@toon-protocol/rig 2.0.1 → 2.2.0

package/dist/cli/rig.js

@@ -4,22 +4,39 @@ import {
   GitRepoReader,
   NonFastForwardError,
   OversizeObjectsError,
+  collectRepoObjects,
   executePush,
+  isSafeRefname,
+  missingObjectsMessage,
+  ownerToHex,
   planPush,
+  runGit,
   serializeEventReceipt,
   serializePushPlan,
-  serializePushResult
-} from "../chunk-LFGDLD6J.js";
+  serializePushResult,
+  setHeadSymref,
+  updateRef,
+  writeGitObjects
+} from "../chunk-PS5QOT62.js";
 import {
   MissingIdentityError,
   resolveIdentity
 } from "../chunk-CW4HJNMU.js";
 import {
+  COMMENT_KIND,
   buildComment,
   buildIssue,
   buildPatch,
-  buildStatus
-} from "../chunk-HPSOQP7Q.js";
+  buildStatus,
+  fetchRemoteState,
+  queryRelay
+} from "../chunk-JBB7HBQC.js";
+import {
+  ChannelMapStore,
+  channelStatus,
+  defaultDaemonPort,
+  resolveChannelPaths
+} from "../chunk-SW7ZHMGS.js";
 import {
   MAX_OBJECT_SIZE
 } from "../chunk-X2CZPPDM.js";
@@ -30,16 +47,157 @@ import { createInterface } from "readline/promises";
 // src/cli/dispatch.ts
 import { createRequire } from "module";
 
-// src/cli/events.ts
-import { readFile } from "fs/promises";
+// src/cli/balance.ts
 import { parseArgs as parseArgs3 } from "util";
-import {
-  REPOSITORY_ANNOUNCEMENT_KIND,
-  STATUS_APPLIED_KIND,
-  STATUS_CLOSED_KIND,
-  STATUS_DRAFT_KIND,
-  STATUS_OPEN_KIND
-} from "@toon-protocol/core/nip34";
+
+// src/cli/daemon-session.ts
+function daemonBaseUrl(env) {
+  const raw = env["TOON_CLIENT_HTTP_PORT"];
+  const parsed = raw ? Number(raw) : NaN;
+  const port = Number.isFinite(parsed) && parsed > 0 ? parsed : defaultDaemonPort();
+  return `http://127.0.0.1:${port}`;
+}
+async function probeDaemon(env, fetchImpl, timeoutMs = 1500) {
+  const baseUrl = daemonBaseUrl(env);
+  try {
+    const res = await fetchImpl(`${baseUrl}/status`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return { baseUrl, reachable: false };
+    const body = await res.json();
+    const probe = { baseUrl, reachable: true };
+    const pubkey = body?.identity?.nostrPubkey;
+    if (typeof pubkey === "string" && pubkey !== "") probe.identity = pubkey;
+    if (typeof body?.ready === "boolean") probe.ready = body.ready;
+    if (typeof body?.relay?.url === "string" && body.relay.url !== "") {
+      probe.relayUrl = body.relay.url;
+    }
+    if (typeof body?.feePerEvent === "string" && body.feePerEvent !== "") {
+      probe.feePerEvent = body.feePerEvent;
+    }
+    return probe;
+  } catch {
+    return { baseUrl, reachable: false };
+  }
+}
+var DaemonRouteError = class extends Error {
+  constructor(status, envelope) {
+    super(envelope.detail ?? envelope.error);
+    this.status = status;
+    this.envelope = envelope;
+    this.name = "DaemonRouteError";
+  }
+  status;
+  envelope;
+};
+var DaemonUnreachableError = class extends Error {
+  constructor(baseUrl, cause) {
+    super(
+      `toon-clientd stopped answering at ${baseUrl} after the identity probe \u2014 nothing was paid. Re-run: rig falls back to standalone automatically when no daemon responds` + (cause instanceof Error ? ` (${cause.message})` : "")
+    );
+    this.baseUrl = baseUrl;
+    this.name = "DaemonUnreachableError";
+  }
+  baseUrl;
+};
+var DaemonGitClient = class {
+  constructor(baseUrl, fetchImpl) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+  }
+  baseUrl;
+  fetchImpl;
+  gitEstimate(req) {
+    return this.post("/git/estimate", req);
+  }
+  gitPush(req) {
+    return this.post("/git/push", req);
+  }
+  gitIssue(req) {
+    return this.post("/git/issue", req);
+  }
+  gitComment(req) {
+    return this.post("/git/comment", req);
+  }
+  gitPatch(req) {
+    return this.post("/git/patch", req);
+  }
+  gitStatus(req) {
+    return this.post("/git/status", req);
+  }
+  async post(path, body) {
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      throw new DaemonUnreachableError(this.baseUrl, err);
+    }
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text === "" ? {} : JSON.parse(text);
+    } catch {
+      throw new DaemonRouteError(res.status, {
+        error: "invalid_response",
+        detail: `daemon returned non-JSON (HTTP ${res.status}): ${text.slice(0, 200)}`
+      });
+    }
+    if (!res.ok) {
+      const envelope = parsed && typeof parsed === "object" && "error" in parsed ? parsed : { error: "http_error", detail: `HTTP ${res.status}` };
+      throw new DaemonRouteError(res.status, envelope);
+    }
+    return parsed;
+  }
+};
+async function resolvePaidSession(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const probe = await (options.probeDaemon ?? probeDaemon)(
+    options.env,
+    fetchImpl
+  );
+  if (probe.reachable && probe.identity !== void 0) {
+    const identity = await resolveIdentity({
+      env: options.env,
+      cwd: options.cwd,
+      warn: options.warn
+    });
+    if (identity.pubkey === probe.identity) {
+      options.warn(
+        `rig: paid path: daemon \u2014 toon-clientd at ${probe.baseUrl} holds this identity (${identity.pubkey.slice(0, 8)}\u2026), delegating`
+      );
+      return {
+        path: "daemon",
+        client: new DaemonGitClient(probe.baseUrl, fetchImpl),
+        baseUrl: probe.baseUrl,
+        identity: {
+          pubkey: identity.pubkey,
+          source: identity.source,
+          sourceLabel: identity.sourceLabel
+        },
+        ...probe.feePerEvent !== void 0 ? { feePerEvent: probe.feePerEvent } : {},
+        ...probe.relayUrl !== void 0 ? { daemonRelayUrl: probe.relayUrl } : {}
+      };
+    }
+    options.warn(
+      `rig: paid path: standalone \u2014 the toon-clientd at ${probe.baseUrl} runs a different identity (${probe.identity.slice(0, 8)}\u2026), no shared channel state`
+    );
+  } else {
+    options.warn(
+      `rig: paid path: standalone (no toon-clientd at ${probe.baseUrl})`
+    );
+  }
+  const ctx = await options.loadStandalone({
+    env: options.env,
+    cwd: options.cwd,
+    warn: options.warn,
+    ...options.relayUrl !== void 0 ? { relayUrl: options.relayUrl } : {}
+  });
+  return { path: "standalone", ctx };
+}
 
 // src/cli/errors.ts
 var UnconfiguredRepoAddressError = class extends Error {
@@ -202,6 +360,39 @@ function describeError(err, command = "push") {
       json: { error: "git_error", detail: err.message }
     };
   }
+  if (err instanceof DaemonRouteError) {
+    const envelope = err.envelope;
+    if (envelope.error === "non_fast_forward" && Array.isArray(envelope["refs"])) {
+      return {
+        code: "non_fast_forward",
+        lines: nonFastForwardLines(envelope["refs"]),
+        json: { ...envelope }
+      };
+    }
+    if (envelope.error === "oversize_objects" && Array.isArray(envelope["objects"])) {
+      return {
+        code: "oversize_objects",
+        lines: oversizeLines(envelope["objects"]),
+        json: { ...envelope }
+      };
+    }
+    const retryHint = envelope.retryable === true ? ["The daemon reports this as retryable \u2014 re-run shortly."] : [];
+    return {
+      code: envelope.error,
+      lines: [
+        `daemon rejected the operation (HTTP ${err.status}): ` + (envelope.detail ?? envelope.error),
+        ...retryHint
+      ],
+      json: { ...envelope }
+    };
+  }
+  if (err instanceof DaemonUnreachableError) {
+    return {
+      code: "daemon_unreachable",
+      lines: err.message.split("\n"),
+      json: { error: "daemon_unreachable", detail: err.message }
+    };
+  }
   const name = err instanceof Error ? err.name : "";
   const message = err instanceof Error ? err.message : String(err);
   if (name === "DaemonIdentityConflictError") {
@@ -209,7 +400,7 @@ function describeError(err, command = "push") {
       code: "daemon_identity_conflict",
       lines: [
         message,
-        "Stop the toon-clientd daemon (or publish through its toon_git_* MCP tools) and re-run."
+        "Paid writes delegate to a same-identity daemon automatically; seeing this means the daemon appeared mid-run or this operation has no daemon route \u2014 stop the daemon and re-run."
       ],
       json: { error: "daemon_identity_conflict", detail: message }
     };
@@ -221,12 +412,153 @@ function describeError(err, command = "push") {
       json: { error: "missing_uplink", detail: message }
     };
   }
+  if (name === "ChannelMapCorruptError") {
+    return {
+      code: "channel_map_corrupt",
+      lines: [message],
+      json: { error: "channel_map_corrupt", detail: message }
+    };
+  }
+  if (name === "SettleTooEarlyError") {
+    const settleableAt = err.settleableAt;
+    return {
+      code: "settle_too_early",
+      lines: [
+        message,
+        "The settlement challenge window is still open \u2014 nothing was spent. Re-run `rig channel settle` after the settleable time."
+      ],
+      json: {
+        error: "settle_too_early",
+        detail: message,
+        ...typeof settleableAt === "string" ? { settleableAt } : {}
+      }
+    };
+  }
+  if (name === "RepoNotFoundError") {
+    return {
+      code: "repo_not_found",
+      lines: message.split("\n"),
+      json: { error: "repo_not_found", detail: message }
+    };
+  }
+  if (name === "MissingRemoteObjectsError") {
+    const missing = err.missing;
+    return {
+      code: "missing_remote_objects",
+      lines: message.split("\n"),
+      json: {
+        error: "missing_remote_objects",
+        detail: message,
+        ...Array.isArray(missing) ? { missing } : {}
+      }
+    };
+  }
+  if (name === "ObjectIntegrityError" || name === "ObjectWriteMismatchError") {
+    return {
+      code: "object_integrity",
+      lines: message.split("\n"),
+      json: { error: "object_integrity", detail: message }
+    };
+  }
   return {
     code: "error",
     lines: [`rig ${command} failed: ${message}`],
     json: { error: "error", detail: message }
   };
 }
+function emitCliError(io2, json, command, err) {
+  const described = describeError(err, command);
+  if (json) io2.emitJson({ command, ...described.json });
+  for (const line of described.lines) io2.err(line);
+  return 1;
+}
+
+// src/cli/push.ts
+import { parseArgs as parseArgs2 } from "util";
+
+// src/cli/render.ts
+function formatNumber(value) {
+  return String(value).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+}
+function shortSha(sha) {
+  return sha ? sha.slice(0, 7) : "(none)";
+}
+function refLine(update) {
+  const arrow = `${shortSha(update.remoteSha)} \u2192 ${shortSha(update.localSha)}`;
+  return `  ${update.refname}  ${arrow}  (${update.kind})`;
+}
+function renderIdentityLine(identity) {
+  return `Identity: ${identity.pubkey} (from ${identity.sourceLabel})`;
+}
+function renderPlan(plan) {
+  const lines = [];
+  lines.push(
+    `Push plan for repo "${plan.repoId}"` + (plan.announceNeeded ? " \u2014 first push, will announce (kind:30617)" : "")
+  );
+  lines.push("Refs:");
+  for (const update of plan.refUpdates) lines.push(refLine(update));
+  const est = plan.estimate;
+  const skipped = Object.keys(plan.knownShaToTxId).length;
+  lines.push(
+    `Objects: ${est.objectCount} to upload (${formatNumber(est.totalObjectBytes)} bytes)` + (skipped > 0 ? `; ${skipped} already on Arweave (free)` : "")
+  );
+  lines.push("Fees (base units):");
+  lines.push(
+    `  upload   ${est.objectCount} object(s), ${formatNumber(est.totalObjectBytes)} bytes   ${formatNumber(est.uploadFee)}`
+  );
+  lines.push(`  events   ${est.eventCount} event(s)   ${formatNumber(est.eventFees)}`);
+  lines.push(`  total    ${formatNumber(est.totalFee)}`);
+  lines.push("Writes are permanent and non-refundable.");
+  return lines;
+}
+function feeLabel(fee) {
+  return fee !== void 0 ? `${formatNumber(fee)} base units` : "the publisher's configured per-event fee";
+}
+function renderEventPlan(opts) {
+  return [
+    `Publish ${opts.action}`,
+    `Repo: 30617:${opts.addr.ownerPubkey}:${opts.addr.repoId}`,
+    renderIdentityLine(opts.identity),
+    `Fee: ${feeLabel(opts.fee)}. Writes are permanent and non-refundable.`
+  ];
+}
+function renderEventReceipt(action, result) {
+  const lines = [
+    `Published ${action}: ${result.eventId}  paid ${formatNumber(result.feePaid)} base units`
+  ];
+  if (result.channelBalanceAfter !== void 0) {
+    lines.push(
+      `Channel balance after: ${formatNumber(result.channelBalanceAfter)} base units`
+    );
+  }
+  return lines;
+}
+function renderResult(result) {
+  const lines = [];
+  lines.push(`Pushed "${result.repoId}":`);
+  const paid = result.uploads.filter((u) => !u.skipped);
+  const skipped = result.uploads.filter((u) => u.skipped);
+  for (const upload of result.uploads) {
+    lines.push(
+      `  object ${upload.sha.slice(0, 12)}  ${upload.skipped ? "skipped (already stored)" : `paid ${formatNumber(upload.feePaid)}`}  ar:${upload.txId}`
+    );
+  }
+  lines.push(
+    `Uploads: ${paid.length} paid, ${skipped.length} skipped (content-addressed).`
+  );
+  if (result.announceReceipt) {
+    lines.push(
+      `Announcement (kind:30617): ${result.announceReceipt.eventId}  paid ${formatNumber(result.announceReceipt.feePaid)}`
+    );
+  }
+  lines.push(
+    `Refs event (kind:30618): ${result.refsReceipt.eventId}  paid ${formatNumber(result.refsReceipt.feePaid)}`
+  );
+  lines.push(
+    `Total paid: ${formatNumber(result.totalFeePaid)} base units (estimate was ${formatNumber(result.estimate.totalFee)})`
+  );
+  return lines;
+}
 
 // src/cli/git-config.ts
 import { execFile } from "child_process";
@@ -320,141 +652,54 @@ async function writeToonConfig(repoPath, config) {
   }
 }
 
-// src/cli/push.ts
-import { parseArgs as parseArgs2 } from "util";
-
-// src/cli/render.ts
-function formatNumber(value) {
-  return String(value).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+// src/cli/remote.ts
+import { parseArgs } from "util";
+var RELAY_PROTOCOLS = /* @__PURE__ */ new Set(["ws:", "wss:", "http:", "https:"]);
+function isRelayUrl(url) {
+  try {
+    return RELAY_PROTOCOLS.has(new URL(url).protocol);
+  } catch {
+    return false;
+  }
 }
-function shortSha(sha) {
-  return sha ? sha.slice(0, 7) : "(none)";
+function assertRelayUrl(url, context) {
+  if (!isRelayUrl(url)) throw new InvalidRelayUrlError(url, context);
 }
-function refLine(update) {
-  const arrow = `${shortSha(update.remoteSha)} \u2192 ${shortSha(update.localSha)}`;
-  return `  ${update.refname}  ${arrow}  (${update.kind})`;
+async function resolveRelays(opts) {
+  if (opts.relayFlags.length > 0) {
+    return { relays: opts.relayFlags, source: "relay-flag" };
+  }
+  if (opts.remoteName !== void 0) {
+    const urls = opts.repoRoot !== void 0 ? await getGitRemoteUrls(opts.repoRoot, opts.remoteName) : [];
+    if (urls.length === 0) throw new UnknownRemoteError(opts.remoteName);
+    if (urls.length > 1) throw new MultiUrlRemoteError(opts.remoteName, urls);
+    const url = urls[0];
+    assertRelayUrl(url, `remote ${JSON.stringify(opts.remoteName)}`);
+    return { relays: urls, source: "remote", remoteName: opts.remoteName };
+  }
+  let nonRelayOriginUrl;
+  if (opts.repoRoot !== void 0) {
+    const urls = await getGitRemoteUrls(opts.repoRoot, "origin");
+    if (urls.length === 1 && isRelayUrl(urls[0])) {
+      return { relays: urls, source: "remote", remoteName: "origin" };
+    }
+    if (urls.length > 1 && urls.some(isRelayUrl)) {
+      throw new MultiUrlRemoteError("origin", urls);
+    }
+    if (urls.length > 0) nonRelayOriginUrl = urls[0];
+  }
+  if (opts.toonRelays.length > 0) {
+    return {
+      relays: opts.toonRelays,
+      source: "toon.relay",
+      nudge: `note: git config toon.relay is deprecated (removed in v0.3) \u2014 migrate: rig remote add origin ${opts.toonRelays[0]}`
+    };
+  }
+  throw new NoOriginConfiguredError(nonRelayOriginUrl);
 }
-function renderIdentityLine(identity) {
-  return `Identity: ${identity.pubkey} (from ${identity.sourceLabel})`;
-}
-function renderPlan(plan) {
-  const lines = [];
-  lines.push(
-    `Push plan for repo "${plan.repoId}"` + (plan.announceNeeded ? " \u2014 first push, will announce (kind:30617)" : "")
-  );
-  lines.push("Refs:");
-  for (const update of plan.refUpdates) lines.push(refLine(update));
-  const est = plan.estimate;
-  const skipped = Object.keys(plan.knownShaToTxId).length;
-  lines.push(
-    `Objects: ${est.objectCount} to upload (${formatNumber(est.totalObjectBytes)} bytes)` + (skipped > 0 ? `; ${skipped} already on Arweave (free)` : "")
-  );
-  lines.push("Fees (base units):");
-  lines.push(
-    `  upload   ${est.objectCount} object(s), ${formatNumber(est.totalObjectBytes)} bytes   ${formatNumber(est.uploadFee)}`
-  );
-  lines.push(`  events   ${est.eventCount} event(s)   ${formatNumber(est.eventFees)}`);
-  lines.push(`  total    ${formatNumber(est.totalFee)}`);
-  lines.push("Writes are permanent and non-refundable.");
-  return lines;
-}
-function feeLabel(fee) {
-  return fee !== void 0 ? `${formatNumber(fee)} base units` : "the publisher's configured per-event fee";
-}
-function renderEventPlan(opts) {
-  return [
-    `Publish ${opts.action}`,
-    `Repo: 30617:${opts.addr.ownerPubkey}:${opts.addr.repoId}`,
-    renderIdentityLine(opts.identity),
-    `Fee: ${feeLabel(opts.fee)}. Writes are permanent and non-refundable.`
-  ];
-}
-function renderEventReceipt(action, result) {
-  const lines = [
-    `Published ${action}: ${result.eventId}  paid ${formatNumber(result.feePaid)} base units`
-  ];
-  if (result.channelBalanceAfter !== void 0) {
-    lines.push(
-      `Channel balance after: ${formatNumber(result.channelBalanceAfter)} base units`
-    );
-  }
-  return lines;
-}
-function renderResult(result) {
-  const lines = [];
-  lines.push(`Pushed "${result.repoId}":`);
-  const paid = result.uploads.filter((u) => !u.skipped);
-  const skipped = result.uploads.filter((u) => u.skipped);
-  for (const upload of result.uploads) {
-    lines.push(
-      `  object ${upload.sha.slice(0, 12)}  ${upload.skipped ? "skipped (already stored)" : `paid ${formatNumber(upload.feePaid)}`}  ar:${upload.txId}`
-    );
-  }
-  lines.push(
-    `Uploads: ${paid.length} paid, ${skipped.length} skipped (content-addressed).`
-  );
-  if (result.announceReceipt) {
-    lines.push(
-      `Announcement (kind:30617): ${result.announceReceipt.eventId}  paid ${formatNumber(result.announceReceipt.feePaid)}`
-    );
-  }
-  lines.push(
-    `Refs event (kind:30618): ${result.refsReceipt.eventId}  paid ${formatNumber(result.refsReceipt.feePaid)}`
-  );
-  lines.push(
-    `Total paid: ${formatNumber(result.totalFeePaid)} base units (estimate was ${formatNumber(result.estimate.totalFee)})`
-  );
-  return lines;
-}
-
-// src/cli/remote.ts
-import { parseArgs } from "util";
-var RELAY_PROTOCOLS = /* @__PURE__ */ new Set(["ws:", "wss:", "http:", "https:"]);
-function isRelayUrl(url) {
-  try {
-    return RELAY_PROTOCOLS.has(new URL(url).protocol);
-  } catch {
-    return false;
-  }
-}
-function assertRelayUrl(url, context) {
-  if (!isRelayUrl(url)) throw new InvalidRelayUrlError(url, context);
-}
-async function resolveRelays(opts) {
-  if (opts.relayFlags.length > 0) {
-    return { relays: opts.relayFlags, source: "relay-flag" };
-  }
-  if (opts.remoteName !== void 0) {
-    const urls = opts.repoRoot !== void 0 ? await getGitRemoteUrls(opts.repoRoot, opts.remoteName) : [];
-    if (urls.length === 0) throw new UnknownRemoteError(opts.remoteName);
-    if (urls.length > 1) throw new MultiUrlRemoteError(opts.remoteName, urls);
-    const url = urls[0];
-    assertRelayUrl(url, `remote ${JSON.stringify(opts.remoteName)}`);
-    return { relays: urls, source: "remote", remoteName: opts.remoteName };
-  }
-  let nonRelayOriginUrl;
-  if (opts.repoRoot !== void 0) {
-    const urls = await getGitRemoteUrls(opts.repoRoot, "origin");
-    if (urls.length === 1 && isRelayUrl(urls[0])) {
-      return { relays: urls, source: "remote", remoteName: "origin" };
-    }
-    if (urls.length > 1 && urls.some(isRelayUrl)) {
-      throw new MultiUrlRemoteError("origin", urls);
-    }
-    if (urls.length > 0) nonRelayOriginUrl = urls[0];
-  }
-  if (opts.toonRelays.length > 0) {
-    return {
-      relays: opts.toonRelays,
-      source: "toon.relay",
-      nudge: `note: git config toon.relay is deprecated (removed in v0.3) \u2014 migrate: rig remote add origin ${opts.toonRelays[0]}`
-    };
-  }
-  throw new NoOriginConfiguredError(nonRelayOriginUrl);
-}
-function singleRelayRefusal(resolved, nothingHappened) {
-  const fix = resolved.source === "relay-flag" ? "pass exactly one --relay <url>" : "trim git config toon.relay to one URL (better: migrate \u2014 `rig remote add origin <relay-url>`)";
-  return `rig publishes to a single relay, but ${resolved.relays.length} are configured (${resolved.relays.join(", ")}) \u2014 ${fix}. ${nothingHappened}`;
+function singleRelayRefusal(resolved, nothingHappened) {
+  const fix = resolved.source === "relay-flag" ? "pass exactly one --relay <url>" : "trim git config toon.relay to one URL (better: migrate \u2014 `rig remote add origin <relay-url>`)";
+  return `rig publishes to a single relay, but ${resolved.relays.length} are configured (${resolved.relays.join(", ")}) \u2014 ${fix}. ${nothingHappened}`;
 }
 var REMOTE_USAGE = `Usage: rig remote <add|remove|list> [args] [options]
 
@@ -471,10 +716,10 @@ Commands:
   list                     list remote names + URLs (the default subcommand)
 
 Options:
-  --json                   machine-readable output (list)
+  --json                   machine-readable envelope (all subcommands)
   -h, --help               show this help`;
 async function runRemote(args, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   let sub;
   let rest;
   let json;
@@ -488,34 +733,34 @@ async function runRemote(args, deps) {
       allowPositionals: true
     });
     if (values.help) {
-      io.out(REMOTE_USAGE);
+      io2.out(REMOTE_USAGE);
       return 0;
     }
     json = values.json ?? false;
     [sub, ...rest] = positionals;
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(REMOTE_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(REMOTE_USAGE);
     return 2;
   }
   switch (sub) {
     case void 0:
     case "list":
       if (rest.length > 0) {
-        io.err(`rig remote list takes no arguments (got ${rest.join(" ")})`);
-        io.err(REMOTE_USAGE);
+        io2.err(`rig remote list takes no arguments (got ${rest.join(" ")})`);
+        io2.err(REMOTE_USAGE);
         return 2;
       }
       break;
     case "add": {
       if (rest.length !== 2) {
-        io.err("usage: rig remote add <name> <relay-url>");
-        io.err(REMOTE_USAGE);
+        io2.err("usage: rig remote add <name> <relay-url>");
+        io2.err(REMOTE_USAGE);
         return 2;
       }
       const url = rest[1];
       if (!isRelayUrl(url)) {
-        io.err(
+        io2.err(
           `cannot add remote: ${JSON.stringify(url)} is not a relay URL \u2014 relays are ws://, wss://, http://, or https://`
         );
         return 2;
@@ -524,14 +769,14 @@ async function runRemote(args, deps) {
     }
     case "remove":
       if (rest.length !== 1) {
-        io.err("usage: rig remote remove <name>");
-        io.err(REMOTE_USAGE);
+        io2.err("usage: rig remote remove <name>");
+        io2.err(REMOTE_USAGE);
         return 2;
       }
       break;
     default:
-      io.err(`unknown rig remote subcommand: ${sub}`);
-      io.err(REMOTE_USAGE);
+      io2.err(`unknown rig remote subcommand: ${sub}`);
+      io2.err(REMOTE_USAGE);
       return 2;
   }
   try {
@@ -546,23 +791,23 @@ async function runRemote(args, deps) {
       case "list": {
         const remotes = await listGitRemotes(repoRoot);
         if (json) {
-          io.out(JSON.stringify({ command: "remote", remotes }, null, 2));
+          io2.emitJson({ command: "remote", remotes });
           return 0;
         }
         if (remotes.length === 0) {
-          io.out(
+          io2.out(
             "no remotes configured \u2014 add one: rig remote add origin <relay-url>"
           );
           return 0;
         }
         for (const remote of remotes) {
           for (const url of remote.urls) {
-            io.out(
+            io2.out(
               `${remote.name}	${url}` + (isRelayUrl(url) ? "" : "	(not a relay URL \u2014 ignored by rig)")
             );
           }
           if (remote.urls.length > 1) {
-            io.err(
+            io2.err(
               `warning: remote "${remote.name}" has ${remote.urls.length} URLs \u2014 rig supports one relay URL per remote (fix with \`git remote set-url ${remote.name} <relay-url>\`)`
             );
           }
@@ -573,37 +818,61 @@ async function runRemote(args, deps) {
         const [name, url] = rest;
         const existing = await getGitRemoteUrls(repoRoot, name);
         if (existing.length > 0) {
-          io.err(
-            `remote ${JSON.stringify(name)} already exists (${existing.join(", ")}) \u2014 nothing changed. Point it somewhere else with \`git remote set-url ${name} <relay-url>\`, or \`rig remote remove ${name}\` first.`
-          );
+          const detail = `remote ${JSON.stringify(name)} already exists (${existing.join(", ")}) \u2014 nothing changed. Point it somewhere else with \`git remote set-url ${name} <relay-url>\`, or \`rig remote remove ${name}\` first.`;
+          if (json) {
+            io2.emitJson({
+              command: "remote",
+              error: "remote_exists",
+              detail,
+              remote: name,
+              urls: existing
+            });
+          }
+          io2.err(detail);
           return 1;
         }
         await addGitRemote(repoRoot, name, url);
-        io.out(`Added remote ${name} \u2192 ${url}`);
+        if (!json) io2.out(`Added remote ${name} \u2192 ${url}`);
         if (name === "origin") {
-          io.out(
-            "`rig push` and the event commands now publish here by default."
-          );
+          if (!json) {
+            io2.out(
+              "`rig push` and the event commands now publish here by default."
+            );
+          }
           const toonConfig = await readToonConfig(repoRoot);
           if (toonConfig.relays.length > 0) {
-            io.err(
+            io2.err(
               `note: git config toon.relay (${toonConfig.relays.join(", ")}) is deprecated and now shadowed by the origin remote \u2014 drop it with \`git config --unset-all toon.relay\` (the key is removed in v0.3).`
             );
           }
         }
+        if (json) {
+          io2.emitJson({ command: "remote", action: "add", name, url });
+        }
         return 0;
       }
       case "remove": {
         const name = rest[0];
         const existing = await getGitRemoteUrls(repoRoot, name);
         if (existing.length === 0) {
-          io.err(
-            `no remote named ${JSON.stringify(name)} \u2014 \`rig remote list\` shows configured remotes.`
-          );
+          const detail = `no remote named ${JSON.stringify(name)} \u2014 \`rig remote list\` shows configured remotes.`;
+          if (json) {
+            io2.emitJson({
+              command: "remote",
+              error: "unknown_remote",
+              detail,
+              remote: name
+            });
+          }
+          io2.err(detail);
           return 1;
         }
         await removeGitRemote(repoRoot, name);
-        io.out(`Removed remote ${name}`);
+        if (json) {
+          io2.emitJson({ command: "remote", action: "remove", name });
+        } else {
+          io2.out(`Removed remote ${name}`);
+        }
         return 0;
       }
       /* v8 ignore next 2 -- unreachable: validated above */
@@ -611,19 +880,24 @@ async function runRemote(args, deps) {
         return 2;
     }
   } catch (err) {
-    const described = describeError(err, "remote");
-    if (json) {
-      io.out(JSON.stringify({ command: "remote", ...described.json }, null, 2));
-    } else {
-      for (const line of described.lines) io.err(line);
-    }
-    return 1;
+    return emitCliError(io2, json, "remote", err);
   }
 }
 
 // src/cli/push.ts
+function loadPaidSession(deps, relayUrl) {
+  return resolvePaidSession({
+    env: deps.env,
+    cwd: deps.cwd,
+    warn: (line) => deps.io.err(line),
+    loadStandalone: deps.loadStandalone ?? defaultLoadStandalone,
+    ...relayUrl !== void 0 ? { relayUrl } : {},
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+    ...deps.probeDaemon ? { probeDaemon: deps.probeDaemon } : {}
+  });
+}
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("../standalone-mode-Q3FFZUXE.js");
+  const mod = await import("../standalone-mode-64CKUVU2.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -734,17 +1008,17 @@ function parsePushArgs(args) {
   return flags;
 }
 async function runPush(args, deps) {
-  const { io, env } = deps;
+  const { io: io2 } = deps;
   let flags;
   try {
     flags = parsePushArgs(args);
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(PUSH_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(PUSH_USAGE);
     return 2;
   }
   if (flags.help) {
-    io.out(PUSH_USAGE);
+    io2.out(PUSH_USAGE);
     return 0;
   }
   let standaloneCtx;
@@ -786,106 +1060,140 @@ async function runPush(args, deps) {
       repoRoot,
       toonRelays: toonConfig.relays
     });
-    if (resolved.nudge !== void 0) io.err(resolved.nudge);
+    if (resolved.nudge !== void 0) io2.err(resolved.nudge);
     const relaysUsed = resolved.relays;
     if (relaysUsed.length > 1) {
-      io.err(singleRelayRefusal(resolved, "Nothing was uploaded or paid."));
+      io2.err(singleRelayRefusal(resolved, "Nothing was uploaded or paid."));
       return 1;
     }
-    standaloneCtx = await (deps.loadStandalone ?? defaultLoadStandalone)({
-      env,
-      cwd: deps.cwd,
-      warn: (line) => io.err(line)
-    });
-    const identity = identityReport(standaloneCtx);
+    const session = await loadPaidSession(deps, relaysUsed[0]);
+    const path = session.path;
+    let identity;
+    if (session.path === "standalone") {
+      standaloneCtx = session.ctx;
+      identity = identityReport(standaloneCtx);
+    } else {
+      identity = session.identity;
+    }
     if (toonConfig.owner && toonConfig.owner !== identity.pubkey) {
-      io.err(
+      io2.err(
         `warning: git config toon.owner (${toonConfig.owner.slice(0, 8)}\u2026) differs from the active identity (${identity.pubkey.slice(0, 8)}\u2026) \u2014 this push publishes under the ACTIVE identity's repo namespace, not the configured owner's. Re-run \`rig init\` to adopt the active identity.`
       );
     }
-    const remoteState = await standaloneCtx.fetchRemote({
-      ownerPubkey: standaloneCtx.ownerPubkey,
-      repoId,
-      relayUrls: relaysUsed
-    });
-    const feeRates = await standaloneCtx.publisher.getFeeRates();
-    const pushPlan = await planPush({
-      repoReader: reader,
-      remoteState,
-      feeRates,
-      repoId,
-      refs: refspecs,
-      force: flags.force
-    });
-    const plan = serializePushPlan(pushPlan);
+    let plan;
+    let execute;
+    if (session.path === "standalone") {
+      const ctx = session.ctx;
+      const remoteState = await ctx.fetchRemote({
+        ownerPubkey: ctx.ownerPubkey,
+        repoId,
+        relayUrls: relaysUsed
+      });
+      const feeRates = await ctx.publisher.getFeeRates();
+      const pushPlan = await planPush({
+        repoReader: reader,
+        remoteState,
+        feeRates,
+        repoId,
+        refs: refspecs,
+        force: flags.force
+      });
+      plan = serializePushPlan(pushPlan);
+      execute = async () => serializePushResult(
+        pushPlan,
+        await executePush({
+          plan: pushPlan,
+          publisher: ctx.publisher,
+          remoteState,
+          repoReader: reader,
+          relayUrls: relaysUsed
+        })
+      );
+    } else {
+      const client = session.client;
+      plan = await client.gitEstimate({
+        repoPath: repoRoot,
+        repoId,
+        refspecs,
+        force: flags.force,
+        relayUrls: relaysUsed
+      });
+      execute = () => client.gitPush({
+        repoPath: repoRoot,
+        repoId,
+        refspecs,
+        force: flags.force,
+        relayUrls: relaysUsed,
+        confirm: true
+      });
+    }
     const upToDate = plan.refUpdates.every((u) => u.kind === "up-to-date");
     if (upToDate) {
       if (flags.json) {
-        io.out(
-          jsonOut({ command: "push", repoId, identity, executed: false, upToDate: true, plan })
-        );
+        io2.emitJson({
+          command: "push",
+          repoId,
+          path,
+          identity,
+          executed: false,
+          upToDate: true,
+          plan
+        });
       } else {
-        io.out("Everything up-to-date \u2014 nothing to push (and nothing paid).");
+        io2.out("Everything up-to-date \u2014 nothing to push (and nothing paid).");
       }
       return 0;
     }
     if (!flags.json) {
-      for (const line of renderPlan(plan)) io.out(line);
-      io.out(renderIdentityLine(identity));
+      for (const line of renderPlan(plan)) io2.out(line);
+      io2.out(renderIdentityLine(identity));
     }
     if (!flags.yes) {
       if (flags.json) {
-        io.out(
-          jsonOut({
-            command: "push",
-            repoId,
-            identity,
-            executed: false,
-            upToDate: false,
-            plan,
-            hint: "estimate only \u2014 re-run with --yes to upload and publish (permanent, non-refundable)"
-          })
-        );
+        io2.emitJson({
+          command: "push",
+          repoId,
+          path,
+          identity,
+          executed: false,
+          upToDate: false,
+          plan,
+          hint: "estimate only \u2014 re-run with --yes to upload and publish (permanent, non-refundable)"
+        });
         return 0;
       }
-      if (!io.isInteractive) {
-        io.err(
+      if (!io2.isInteractive) {
+        io2.err(
           "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
         );
         return 1;
       }
-      const proceed = await io.confirm(
+      const proceed = await io2.confirm(
         `Proceed with paid push (total ${plan.estimate.totalFee} base units)? [y/N] `
       );
       if (!proceed) {
-        io.err("aborted \u2014 nothing was uploaded or published.");
+        io2.err("aborted \u2014 nothing was uploaded or published.");
         return 1;
       }
     }
-    const pushResult = await executePush({
-      plan: pushPlan,
-      publisher: standaloneCtx.publisher,
-      remoteState,
-      repoReader: reader,
-      relayUrls: relaysUsed
-    });
-    const result = serializePushResult(pushPlan, pushResult);
+    const result = await execute();
     if (flags.json) {
-      io.out(
-        jsonOut({ command: "push", repoId, identity, executed: true, upToDate: false, plan, result })
-      );
+      io2.emitJson({
+        command: "push",
+        repoId,
+        path,
+        identity,
+        executed: true,
+        upToDate: false,
+        plan,
+        result
+      });
     } else {
-      for (const line of renderResult(result)) io.out(line);
+      for (const line of renderResult(result)) io2.out(line);
     }
     return 0;
   } catch (err) {
-    const described = describeError(err);
-    if (flags.json) {
-      io.out(JSON.stringify({ command: "push", ...described.json }, null, 2));
-    } else {
-      for (const line of described.lines) io.err(line);
-    }
-    return 1;
+    return emitCliError(io2, flags.json, "push", err);
   } finally {
     if (standaloneCtx) {
       try {
@@ -895,8 +1203,1289 @@ async function runPush(args, deps) {
     }
   }
 }
-function jsonOut(output) {
-  return JSON.stringify(output, null, 2);
+
+// src/cli/balance.ts
+var BALANCE_USAGE = `Usage: rig balance [--json]
+
+Show the active identity's money: on-chain wallet balances (per configured
+chain, read from the settlement chain the payment channels actually use) and
+recorded payment-channel holdings (deposited / claimed / available). Free \u2014
+reads chain RPCs and local state only; nothing is signed or paid.
+
+Options:
+  --json      machine-readable envelope (base units as strings)
+  -h, --help  show this help`;
+async function runBalance(args, deps) {
+  const { io: io2, env } = deps;
+  let json = false;
+  try {
+    const { values } = parseArgs3({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      }
+    });
+    if (values.help) {
+      io2.out(BALANCE_USAGE);
+      return 0;
+    }
+    json = values.json ?? false;
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(BALANCE_USAGE);
+    return 2;
+  }
+  let ctx;
+  try {
+    ctx = await (deps.loadStandalone ?? defaultLoadStandalone)({
+      env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line),
+      // Free read: works without a proxy/BTP write uplink.
+      requireUplink: false
+    });
+    const identity = identityReport(ctx);
+    const wallet = ctx.money ? await ctx.money.walletBalances() : [];
+    const store = new ChannelMapStore(resolveChannelPaths(env));
+    const channels = store.list().filter((record) => record.identity === identity.pubkey).map((record) => {
+      const watermark = store.readWatermark(record.channelId);
+      const deposited = record.depositTotal;
+      const claimed = watermark?.cumulativeAmount;
+      let available = null;
+      if (deposited !== void 0 && claimed !== void 0) {
+        const remaining = BigInt(deposited) - BigInt(claimed);
+        available = (remaining > 0n ? remaining : 0n).toString();
+      }
+      return {
+        channelId: record.channelId,
+        destination: record.destination,
+        peerId: record.peerId,
+        chain: record.chain,
+        status: channelStatus(watermark),
+        depositTotal: deposited ?? null,
+        cumulativeClaimed: claimed ?? null,
+        nonce: watermark?.nonce ?? null,
+        available
+      };
+    });
+    if (json) {
+      io2.emitJson({
+        command: "balance",
+        identity,
+        wallet,
+        channels
+      });
+      return 0;
+    }
+    io2.out(renderIdentityLine(identity));
+    io2.out("");
+    io2.out("Wallet (on-chain):");
+    if (wallet.length === 0) {
+      io2.out(
+        "  (no balance readable \u2014 no chain configured, the RPC is unreachable, or the chain's keys derive only during a client start)"
+      );
+    }
+    for (const balance of wallet) {
+      io2.out(
+        `  ${balance.chain.padEnd(7)} ${balance.address}  ${balance.amount}` + (balance.asset ? ` ${balance.asset}` : " base units") + (balance.assetScale !== void 0 ? ` (scale ${balance.assetScale})` : "")
+      );
+    }
+    io2.out("");
+    io2.out("Channels (recorded):");
+    if (channels.length === 0) {
+      io2.out(
+        "  none \u2014 paid commands record their channel on first use; `rig channel open` records one explicitly."
+      );
+    }
+    for (const c of channels) {
+      io2.out(
+        `  ${c.channelId} [${c.status}]  deposited ${c.depositTotal ?? "?"}  claimed ${c.cumulativeClaimed ?? "?"}  available ${c.available ?? "?"}  (${c.chain} \u2192 ${c.destination})`
+      );
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "balance", err);
+  } finally {
+    if (ctx) {
+      try {
+        await ctx.stop();
+      } catch {
+      }
+    }
+  }
+}
+
+// src/cli/channel.ts
+import { parseArgs as parseArgs4 } from "util";
+var CHANNEL_USAGE = `Usage: rig channel <subcommand>
+
+Manage the payment channels paid rig commands hold with relay/store peers.
+Paid commands open a channel lazily on first use and record it under
+TOON_CLIENT_HOME (default ~/.toon-client, rig-channels.json), so later
+invocations resume the same channel instead of opening a new one per run.
+
+Subcommands:
+  list [--json]    show recorded channels \u2014 peer, chain, channel id, deposit,
+                   cumulative claimed, status. Free: reads local state only.
+
+  open [--peer <ilp-destination>] [--deposit <base-units>]
+                   explicitly open the payment channel for a peer \u2014 the SAME
+                   path paid commands use lazily: resumes the recorded live
+                   channel if one exists (no on-chain spend), else opens and
+                   records a fresh one (locks the peer-negotiated initial
+                   deposit on-chain). --peer is the ILP destination to anchor
+                   to (default: the configured destination, e.g. the devnet
+                   apex); --deposit adds that much extra collateral after the
+                   open/resume. On-chain: asks for confirmation (--yes skips).
+
+  close <channelId>
+                   close a recorded channel \u2014 an on-chain tx that starts the
+                   settlement challenge window (the peer's settlementTimeout).
+                   The channel stops paying immediately; the remaining
+                   collateral stays locked until \`rig channel settle\` after
+                   the window elapses. Asks for confirmation (--yes skips).
+
+  settle <channelId>
+                   settle a closed channel once its challenge window elapsed \u2014
+                   an on-chain tx that releases the remaining collateral back
+                   to your wallet. Refused (without spending gas) while the
+                   window is still open. Asks for confirmation (--yes skips).
+
+Common options: --json (machine-readable envelopes; without --yes lifecycle
+commands emit a pure plan and execute nothing), --yes, -h/--help.`;
+async function runChannel(args, deps) {
+  const { io: io2 } = deps;
+  const [sub, ...rest] = args;
+  switch (sub) {
+    case "list":
+      return runChannelList(rest, deps);
+    case "open":
+      return runChannelOpen(rest, deps);
+    case "close":
+      return runChannelWithdrawStep(rest, deps, "close");
+    case "settle":
+      return runChannelWithdrawStep(rest, deps, "settle");
+    case "help":
+    case "--help":
+    case "-h":
+      io2.out(CHANNEL_USAGE);
+      return 0;
+    case void 0:
+      io2.err(CHANNEL_USAGE);
+      return 2;
+    default:
+      io2.err(`rig channel: unknown subcommand ${JSON.stringify(sub)}`);
+      io2.err(CHANNEL_USAGE);
+      return 2;
+  }
+}
+function runChannelList(args, deps) {
+  const { io: io2, env } = deps;
+  let json = false;
+  try {
+    const { values } = parseArgs4({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      }
+    });
+    if (values.help) {
+      io2.out(CHANNEL_USAGE);
+      return 0;
+    }
+    json = values.json ?? false;
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(CHANNEL_USAGE);
+    return 2;
+  }
+  try {
+    const paths = resolveChannelPaths(env);
+    const store = new ChannelMapStore(paths);
+    const records = store.list();
+    const rows = records.map((record) => describeChannel(record, store));
+    if (json) {
+      io2.emitJson({ command: "channel list", channels: rows });
+      return 0;
+    }
+    if (rows.length === 0) {
+      io2.out(
+        "No payment channels recorded \u2014 paid rig commands (push, issue, comment, pr) record the channel they open on first use, and `rig channel open` records an explicit one."
+      );
+      return 0;
+    }
+    io2.out(
+      `${rows.length} payment channel${rows.length === 1 ? "" : "s"} recorded in ${paths.mapPath}:`
+    );
+    for (const row of rows) {
+      io2.out("");
+      for (const line of renderChannel(row)) io2.out(line);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "channel list", err);
+  }
+}
+function describeChannel(record, store) {
+  const watermark = store.readWatermark(
+    record.channelId
+  );
+  return {
+    channelId: record.channelId,
+    peerId: record.peerId,
+    identity: record.identity,
+    destination: record.destination,
+    chain: record.chain,
+    tokenNetwork: record.tokenNetwork,
+    depositTotal: record.depositTotal ?? null,
+    cumulativeClaimed: watermark?.cumulativeAmount ?? null,
+    nonce: watermark?.nonce ?? null,
+    status: channelStatus(watermark),
+    openedAt: record.openedAt,
+    lastUsedAt: record.lastUsedAt
+  };
+}
+function renderChannel(row) {
+  const claimed = row.cumulativeClaimed === null ? "unknown (no local claim state)" : `${row.cumulativeClaimed} base units (nonce ${row.nonce})`;
+  return [
+    `channel ${row.channelId} [${row.status}]`,
+    `  peer        ${row.destination} (${row.peerId})`,
+    `  identity    ${row.identity.slice(0, 8)}\u2026`,
+    `  chain       ${row.chain}` + (row.tokenNetwork ? `  token-network ${row.tokenNetwork}` : ""),
+    `  deposited   ${row.depositTotal ?? "unrecorded"}` + (row.depositTotal ? " base units" : ""),
+    `  claimed     ${claimed}`,
+    `  opened      ${row.openedAt}  (last used ${row.lastUsedAt})`
+  ];
+}
+async function loadMoneyContext(deps, options) {
+  const ctx = await (deps.loadStandalone ?? defaultLoadStandalone)({
+    env: deps.env,
+    cwd: deps.cwd,
+    warn: (line) => deps.io.err(line),
+    ...options?.channelDestination ? { channelDestination: options.channelDestination } : {}
+  });
+  const money = ctx.money;
+  if (!money) {
+    await ctx.stop().catch(() => void 0);
+    throw new Error(
+      "this standalone loader does not expose money operations \u2014 channel open/close/settle need a loader with the money lifecycle"
+    );
+  }
+  return { ctx, money };
+}
+async function confirmOnChain(io2, flags, question) {
+  if (flags.yes) return "proceed";
+  if (flags.json) return "json-plan";
+  if (!io2.isInteractive) {
+    io2.err(
+      "refusing to move on-chain funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for a plan)"
+    );
+    return 1;
+  }
+  const proceed = await io2.confirm(question);
+  if (proceed) return "proceed";
+  io2.err("aborted \u2014 no on-chain transaction was sent.");
+  return 1;
+}
+function formatUnixSeconds(value) {
+  const ms = Number(value) * 1e3;
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : `t=${value}s`;
+}
+function secondsUntil(value, nowSec) {
+  return Number(value) - nowSec;
+}
+async function runChannelOpen(args, deps) {
+  const { io: io2 } = deps;
+  let peer;
+  let deposit;
+  let yes = false;
+  let json = false;
+  try {
+    const { values } = parseArgs4({
+      args,
+      options: {
+        peer: { type: "string" },
+        deposit: { type: "string" },
+        yes: { type: "boolean", default: false },
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      }
+    });
+    if (values.help) {
+      io2.out(CHANNEL_USAGE);
+      return 0;
+    }
+    peer = values.peer;
+    yes = values.yes ?? false;
+    json = values.json ?? false;
+    if (values.deposit !== void 0) {
+      if (!/^\d+$/.test(values.deposit) || BigInt(values.deposit) <= 0n) {
+        throw new Error(
+          `--deposit must be a positive base-unit integer, got ${JSON.stringify(values.deposit)}`
+        );
+      }
+      deposit = BigInt(values.deposit);
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(CHANNEL_USAGE);
+    return 2;
+  }
+  let ctx;
+  try {
+    const loaded = await loadMoneyContext(deps, {
+      ...peer ? { channelDestination: peer } : {}
+    });
+    ctx = loaded.ctx;
+    const identity = identityReport(ctx);
+    const plan = {
+      destination: peer ?? null,
+      deposit: deposit?.toString() ?? null
+    };
+    if (!json) {
+      io2.out("Channel open plan:");
+      io2.out(`  peer (ILP)  ${peer ?? "(configured default destination)"}`);
+      io2.out(
+        `  deposit     ${deposit !== void 0 ? `+${deposit} base units of extra collateral after the open/resume` : "none beyond the peer-negotiated initial deposit"}`
+      );
+      io2.out(renderIdentityLine(identity));
+      io2.out(
+        "If a live channel is already recorded for this peer it is RESUMED (no on-chain spend); otherwise an on-chain channel open locks the peer-negotiated initial deposit from your wallet (plus gas)."
+      );
+    }
+    const gate = await confirmOnChain(
+      io2,
+      { yes, json },
+      "Proceed with on-chain channel open? [y/N] "
+    );
+    if (gate === "json-plan") {
+      io2.emitJson({
+        command: "channel open",
+        identity,
+        executed: false,
+        plan,
+        hint: "plan only \u2014 re-run with --yes to open (on-chain: locks collateral and spends gas)"
+      });
+      return 0;
+    }
+    if (gate !== "proceed") return gate;
+    const outcome = await loaded.money.openChannel(
+      deposit !== void 0 ? { deposit } : void 0
+    );
+    if (json) {
+      io2.emitJson({
+        command: "channel open",
+        identity,
+        executed: true,
+        plan,
+        result: {
+          channelId: outcome.channelId,
+          resumed: outcome.resumed,
+          destination: outcome.destination,
+          chain: outcome.chain ?? null,
+          peerId: outcome.peerId ?? null,
+          depositTotal: outcome.depositTotal ?? null,
+          depositAdded: outcome.depositAdded ?? null,
+          depositTxHash: outcome.depositTxHash ?? null
+        }
+      });
+      return 0;
+    }
+    io2.out(
+      outcome.resumed ? `Resumed recorded channel ${outcome.channelId} \u2014 no on-chain open was needed.` : `Opened channel ${outcome.channelId}${outcome.chain ? ` on ${outcome.chain}` : ""} and recorded it for reuse.`
+    );
+    io2.out(`  peer        ${outcome.destination}${outcome.peerId ? ` (${outcome.peerId})` : ""}`);
+    if (outcome.depositAdded) {
+      io2.out(
+        `  deposited   +${outcome.depositAdded} base units` + (outcome.depositTxHash ? `  (tx ${outcome.depositTxHash})` : "")
+      );
+    }
+    if (outcome.depositTotal) {
+      io2.out(`  collateral  ${outcome.depositTotal} base units total on-chain`);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "channel open", err);
+  } finally {
+    await stopQuietly(ctx);
+  }
+}
+function withdrawPrecheck(step, channelId, watermark, nowSec) {
+  const status = channelStatus(watermark, nowSec);
+  if (status === "settled") {
+    return `channel ${channelId} is already settled \u2014 nothing left to ${step}.`;
+  }
+  if (step === "close") {
+    if (status === "closing" || status === "settleable") {
+      const at = watermark?.settleableAt;
+      return `channel ${channelId} is already closing \u2014 ` + (status === "settleable" ? "its challenge window has elapsed; run `rig channel settle` to release the collateral." : `settleable at ${at ? formatUnixSeconds(at) : "the end of its challenge window"} (run \`rig channel settle\` then).`);
+    }
+    return void 0;
+  }
+  if (status === "open") {
+    return `channel ${channelId} is not closed \u2014 run \`rig channel close ${channelId}\` first (settle only releases collateral after the challenge window of a closed channel).`;
+  }
+  if (status === "closing" && watermark?.settleableAt !== void 0) {
+    const remain = secondsUntil(watermark.settleableAt, nowSec);
+    return `channel ${channelId} is not settleable yet \u2014 the challenge window is still open (${remain}s remain, settleable at ${formatUnixSeconds(watermark.settleableAt)}). Nothing was spent; re-run after that time.`;
+  }
+  return void 0;
+}
+async function runChannelWithdrawStep(args, deps, step) {
+  const { io: io2, env } = deps;
+  const command = `channel ${step}`;
+  let channelId;
+  let yes = false;
+  let json = false;
+  try {
+    const { values, positionals } = parseArgs4({
+      args,
+      options: {
+        yes: { type: "boolean", default: false },
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: true
+    });
+    if (values.help) {
+      io2.out(CHANNEL_USAGE);
+      return 0;
+    }
+    yes = values.yes ?? false;
+    json = values.json ?? false;
+    if (positionals.length !== 1) {
+      throw new Error(
+        `rig channel ${step} takes exactly one <channelId> (got ${positionals.length}) \u2014 \`rig channel list\` shows recorded channels`
+      );
+    }
+    channelId = positionals[0];
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(CHANNEL_USAGE);
+    return 2;
+  }
+  let ctx;
+  try {
+    const store = new ChannelMapStore(resolveChannelPaths(env));
+    const record = store.list().find((r) => r.channelId === channelId);
+    if (!record) {
+      throw new Error(
+        `no recorded channel ${JSON.stringify(channelId)} \u2014 \`rig channel list\` shows the channels this identity holds`
+      );
+    }
+    const watermark = store.readWatermark(channelId);
+    const nowSec = Math.floor(Date.now() / 1e3);
+    const refusal = withdrawPrecheck(step, channelId, watermark, nowSec);
+    if (refusal) throw new Error(refusal);
+    const loaded = await loadMoneyContext(deps);
+    ctx = loaded.ctx;
+    const identity = identityReport(ctx);
+    if (record.identity !== identity.pubkey) {
+      throw new Error(
+        `channel ${channelId} was opened by identity ${record.identity.slice(0, 8)}\u2026 but the active identity is ${identity.pubkey.slice(0, 8)}\u2026 (from ${identity.sourceLabel}) \u2014 on-chain ${step} must be signed by the opener's wallet key. Switch RIG_MNEMONIC (or the keystore) to that identity.`
+      );
+    }
+    if (!json) {
+      const claimed = watermark?.cumulativeAmount;
+      io2.out(`Channel ${step} plan:`);
+      io2.out(`  channel     ${channelId} [${channelStatus(watermark, nowSec)}]`);
+      io2.out(`  peer        ${record.destination} (${record.peerId})`);
+      io2.out(`  chain       ${record.chain}`);
+      io2.out(
+        `  deposited   ${record.depositTotal ?? "unrecorded"}` + (claimed !== void 0 ? `   claimed ${claimed} base units` : "")
+      );
+      io2.out(renderIdentityLine(identity));
+      if (step === "close") {
+        io2.out(
+          "Closing is an ON-CHAIN transaction (gas) that starts the settlement challenge window: the channel stops paying immediately, and the remaining collateral stays locked until `rig channel settle` succeeds after the window elapses."
+        );
+      } else {
+        io2.out(
+          "Settling is an ON-CHAIN transaction (gas) that releases the remaining collateral back to your wallet. The chain's challenge window is authoritative \u2014 a too-early settle is refused before any gas is spent."
+        );
+      }
+    }
+    const gate = await confirmOnChain(
+      io2,
+      { yes, json },
+      `Proceed with on-chain channel ${step}? [y/N] `
+    );
+    if (gate === "json-plan") {
+      io2.emitJson({
+        command,
+        identity,
+        executed: false,
+        channelId,
+        hint: `plan only \u2014 re-run with --yes to ${step} (on-chain transaction)`
+      });
+      return 0;
+    }
+    if (gate !== "proceed") return gate;
+    if (step === "close") {
+      const result2 = await loaded.money.closeChannel(record);
+      if (json) {
+        io2.emitJson({
+          command,
+          identity,
+          executed: true,
+          channelId,
+          result: {
+            txHash: result2.txHash ?? null,
+            closedAt: result2.closedAt,
+            settleableAt: result2.settleableAt
+          }
+        });
+        return 0;
+      }
+      io2.out(
+        `Channel ${channelId} is closing` + (result2.txHash ? ` (tx ${result2.txHash})` : "") + "."
+      );
+      io2.out(
+        `  challenge window: settleable at ${formatUnixSeconds(result2.settleableAt)} (~${Math.max(0, secondsUntil(result2.settleableAt, nowSec))}s from now)`
+      );
+      io2.out(
+        `  run \`rig channel settle ${channelId}\` after that time to release the collateral.`
+      );
+      return 0;
+    }
+    const result = await loaded.money.settleChannel(record);
+    if (json) {
+      io2.emitJson({
+        command,
+        identity,
+        executed: true,
+        channelId,
+        result: { txHash: result.txHash ?? null }
+      });
+      return 0;
+    }
+    io2.out(
+      `Channel ${channelId} settled` + (result.txHash ? ` (tx ${result.txHash})` : "") + " \u2014 the remaining collateral was released to your wallet."
+    );
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, command, err);
+  } finally {
+    await stopQuietly(ctx);
+  }
+}
+async function stopQuietly(ctx) {
+  if (!ctx) return;
+  try {
+    await ctx.stop();
+  } catch {
+  }
+}
+
+// src/cli/clone.ts
+import { mkdtemp, mkdir, readdir, rename, rm, rmdir } from "fs/promises";
+import { basename, dirname, join, resolve } from "path";
+import { parseArgs as parseArgs5 } from "util";
+var CLONE_USAGE = `Usage: rig clone <relay-url> <owner>/<repo-id> [dir] [options]
+
+Clone a TOON repository \u2014 FREE (relay reads + Arweave gateway downloads; no
+payments, no channel, no identity needed). <relay-url> is a ws:// or wss://
+NIP-01 relay; <owner> is the repo owner's pubkey as npub1\u2026 or 64-char hex;
+[dir] defaults to <repo-id>.
+
+Fetches the kind:30617/30618 repository state, downloads every git object
+the refs need from Arweave gateways (SHA-1 verified \u2014 corrupt content is
+rejected), and materializes a real git repository: objects via git plumbing,
+refs, HEAD, checked-out worktree, toon.* config, and the relay preconfigured
+as the "origin" remote \u2014 so \`rig fetch\`, \`rig push\`, and the issue/pr
+commands work immediately.
+
+Note: recently pushed objects can take 10-20 minutes to become fetchable
+from Arweave gateways. A clone right after a push may report missing
+objects \u2014 retry after propagation.
+
+Options:
+  --concurrency <n>    parallel gateway downloads (default 8)
+  --json               machine-readable result envelope
+  -h, --help           show this help`;
+var RepoNotFoundError = class extends Error {
+  constructor(relay, owner, repoId) {
+    super(
+      `repository 30617:${owner}:${repoId} not found on ${relay} \u2014 no kind:30617 announcement or kind:30618 state event exists there. Check the relay URL, the owner pubkey (npub or hex), and the repo id.`
+    );
+    this.name = "RepoNotFoundError";
+  }
+};
+var MissingRemoteObjectsError = class extends Error {
+  constructor(missing, context) {
+    super(missingObjectsMessage(missing, context));
+    this.missing = missing;
+    this.name = "MissingRemoteObjectsError";
+  }
+  missing;
+};
+var WS_URL_RE = /^wss?:\/\//i;
+function parseCloneArgs(args) {
+  const { values, positionals } = parseArgs5({
+    args,
+    options: {
+      json: { type: "boolean", default: false },
+      concurrency: { type: "string" },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: true
+  });
+  if (values.help) return { help: true };
+  if (positionals.length < 2 || positionals.length > 3) {
+    throw new Error("expected: rig clone <relay-url> <owner>/<repo-id> [dir]");
+  }
+  const [relayUrl, addr, dir] = positionals;
+  if (!WS_URL_RE.test(relayUrl)) {
+    throw new Error(
+      `<relay-url> must be ws:// or wss:// (got ${JSON.stringify(relayUrl)})`
+    );
+  }
+  const slash = addr.indexOf("/");
+  if (slash <= 0 || slash === addr.length - 1) {
+    throw new Error(
+      `expected <owner>/<repo-id> (npub or 64-char hex owner), got ${JSON.stringify(addr)}`
+    );
+  }
+  const owner = ownerToHex(addr.slice(0, slash));
+  const repoId = addr.slice(slash + 1);
+  let concurrency;
+  if (values.concurrency !== void 0) {
+    concurrency = Number.parseInt(values.concurrency, 10);
+    if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
+      throw new Error(`--concurrency must be a positive integer`);
+    }
+  }
+  return {
+    relayUrl,
+    owner,
+    repoId,
+    dir,
+    concurrency,
+    json: values.json === true
+  };
+}
+async function isUsableDestination(dir) {
+  try {
+    const entries = await readdir(dir);
+    return entries.length === 0;
+  } catch (err) {
+    return err.code === "ENOENT";
+  }
+}
+function initialBranch(headSymref) {
+  if (headSymref?.startsWith("refs/heads/")) {
+    const name = headSymref.slice("refs/heads/".length);
+    if (name && isSafeRefname(headSymref)) return name;
+  }
+  return "main";
+}
+async function runClone(args, deps) {
+  const { io: io2 } = deps;
+  let parsed;
+  try {
+    const result = parseCloneArgs(args);
+    if ("help" in result) {
+      io2.out(CLONE_USAGE);
+      return 0;
+    }
+    parsed = result;
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(CLONE_USAGE);
+    return 2;
+  }
+  const { relayUrl, owner, repoId, json } = parsed;
+  const dest = resolve(deps.cwd, parsed.dir ?? repoId);
+  let tempDir;
+  try {
+    if (!await isUsableDestination(dest)) {
+      throw new Error(
+        `destination path ${JSON.stringify(dest)} already exists and is not an empty directory`
+      );
+    }
+    if (!json) io2.out(`Cloning into '${basename(dest)}'...`);
+    const remoteState = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: owner,
+      repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
+      ...deps.resolveSha ? { resolveSha: deps.resolveSha } : {}
+    });
+    if (!remoteState.announced && remoteState.refsEvent === null) {
+      throw new RepoNotFoundError(relayUrl, owner, repoId);
+    }
+    const refs = /* @__PURE__ */ new Map();
+    for (const [refname, sha] of remoteState.refs) {
+      if (!isSafeRefname(refname)) {
+        io2.err(
+          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
+        );
+        continue;
+      }
+      refs.set(refname, sha);
+    }
+    if (refs.size === 0) {
+      io2.err(
+        "warning: the repository has no refs yet (announced but never pushed) \u2014 cloning an empty repository"
+      );
+    }
+    const tips = [...new Set(refs.values())];
+    const collected = await collectRepoObjects({
+      tips,
+      shaToTxId: remoteState.shaToTxId,
+      resolveMissing: (shas) => remoteState.resolveMissing(shas),
+      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
+      ...parsed.concurrency !== void 0 ? { concurrency: parsed.concurrency } : {}
+    });
+    if (collected.missing.length > 0) {
+      throw new MissingRemoteObjectsError(
+        collected.missing,
+        `cannot clone ${owner.slice(0, 8)}\u2026/${repoId}`
+      );
+    }
+    for (const { sha, txId } of collected.skippedUnavailable) {
+      io2.err(
+        `warning: unreachable object ${sha} (tx ${txId}) could not be downloaded \u2014 not needed by any ref, continuing`
+      );
+    }
+    const parent = dirname(dest);
+    await mkdir(parent, { recursive: true });
+    tempDir = await mkdtemp(join(parent, `.${basename(dest)}.rig-clone-`));
+    await runGit(tempDir, [
+      "init",
+      "--quiet",
+      `--initial-branch=${initialBranch(remoteState.headSymref)}`
+    ]);
+    const written = await writeGitObjects(tempDir, collected.objects.values());
+    for (const [refname, sha] of refs) {
+      await updateRef(tempDir, refname, sha);
+      if (refname.startsWith("refs/heads/")) {
+        const branch = refname.slice("refs/heads/".length);
+        await updateRef(tempDir, `refs/remotes/origin/${branch}`, sha);
+      }
+    }
+    const head = remoteState.headSymref !== null && isSafeRefname(remoteState.headSymref) && refs.has(remoteState.headSymref) ? remoteState.headSymref : [...refs.keys()].find((r) => r.startsWith("refs/heads/")) ?? null;
+    if (head !== null) {
+      await setHeadSymref(tempDir, head);
+      await runGit(tempDir, ["reset", "--hard", "--quiet"]);
+    }
+    await runGit(tempDir, ["config", "toon.repoid", repoId]);
+    await runGit(tempDir, ["config", "toon.owner", owner]);
+    await runGit(tempDir, ["remote", "add", "origin", relayUrl]);
+    if (head !== null) {
+      const branch = head.slice("refs/heads/".length);
+      await runGit(tempDir, ["config", `branch.${branch}.remote`, "origin"]);
+      await runGit(tempDir, ["config", `branch.${branch}.merge`, head]);
+    }
+    try {
+      await rmdir(dest);
+    } catch {
+    }
+    await rename(tempDir, dest);
+    tempDir = void 0;
+    if (json) {
+      io2.emitJson({
+        command: "clone",
+        repoAddr: { ownerPubkey: owner, repoId },
+        relay: relayUrl,
+        directory: dest,
+        head,
+        refs: Object.fromEntries(refs),
+        name: remoteState.name,
+        objectsDownloaded: written,
+        executed: true
+      });
+    } else {
+      io2.out(`Downloaded ${written} object(s) from Arweave (SHA-1 verified).`);
+      for (const [refname, sha] of refs) {
+        io2.out(`  ${sha.slice(0, 7)}  ${refname}`);
+      }
+      if (head !== null) io2.out(`HEAD is now at ${head}`);
+      io2.out(
+        `Configured toon.repoid=${repoId}, toon.owner=${owner.slice(0, 8)}\u2026, origin \u2192 ${relayUrl}`
+      );
+      io2.out("Done.");
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "clone", err);
+  } finally {
+    if (tempDir !== void 0) {
+      await rm(tempDir, { recursive: true, force: true }).catch(
+        () => void 0
+      );
+    }
+  }
+}
+
+// src/cli/events.ts
+import { readFile } from "fs/promises";
+import { parseArgs as parseArgs7 } from "util";
+import {
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2,
+  STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
+  STATUS_OPEN_KIND as STATUS_OPEN_KIND2
+} from "@toon-protocol/core/nip34";
+
+// src/cli/tracker.ts
+import { parseArgs as parseArgs6 } from "util";
+import {
+  ISSUE_KIND,
+  PATCH_KIND,
+  REPOSITORY_ANNOUNCEMENT_KIND,
+  STATUS_APPLIED_KIND,
+  STATUS_CLOSED_KIND,
+  STATUS_DRAFT_KIND,
+  STATUS_OPEN_KIND
+} from "@toon-protocol/core/nip34";
+var READ_COMMON_FLAGS = `  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
+  --remote <name>      read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override; repeatable \u2014 reads are merged
+  --json               machine-readable envelope
+  -h, --help           show this help`;
+var ISSUE_LIST_USAGE = `Usage: rig issue list [--state open|closed|all] [options]
+
+List the repo's issues (kind:1621) with their derived state \u2014 FREE (relay
+reads only). State comes from kind:1630-1633 status events: the latest status
+wins; an issue with no status events is open.
+
+Options:
+  --state <state>      open | closed | all (default: all)
+${READ_COMMON_FLAGS}`;
+var ISSUE_SHOW_USAGE = `Usage: rig issue show <event-id> [options]
+
+Show one issue (kind:1621): metadata, derived state, body, and its
+kind:1622 comments \u2014 FREE (relay reads only). <event-id> is the 64-char hex
+id \`rig issue create\` printed (also visible in \`rig issue list\`).
+
+Options:
+${READ_COMMON_FLAGS}`;
+var PR_LIST_USAGE = `Usage: rig pr list [--state open|applied|closed|draft|all] [options]
+
+List the repo's patches/PRs (kind:1617) with their derived state \u2014 FREE
+(relay reads only). State comes from kind:1630-1633 status events: the
+latest status wins; a patch with no status events is open.
+
+Options:
+  --state <state>      open | applied | closed | draft | all (default: all)
+${READ_COMMON_FLAGS}`;
+var PR_SHOW_USAGE = `Usage: rig pr show <event-id> [options]
+
+Show one patch/PR (kind:1617): metadata, derived state, the FULL patch text
+(real \`git format-patch\` output \u2014 pipe it to \`git am\` to apply), and its
+kind:1622 comments \u2014 FREE (relay reads only).
+
+Options:
+${READ_COMMON_FLAGS}`;
+var STATUS_BY_KIND = {
+  [STATUS_OPEN_KIND]: "open",
+  [STATUS_APPLIED_KIND]: "applied",
+  [STATUS_CLOSED_KIND]: "closed",
+  [STATUS_DRAFT_KIND]: "draft"
+};
+var STATUS_KINDS = [
+  STATUS_OPEN_KIND,
+  STATUS_APPLIED_KIND,
+  STATUS_CLOSED_KIND,
+  STATUS_DRAFT_KIND
+];
+function tagValue(tags, name) {
+  return tags.find((t) => t[0] === name)?.[1];
+}
+function tagValues(tags, name) {
+  return tags.filter((t) => t[0] === name && t[1]).map((t) => t[1]);
+}
+function deriveStatus(targetEventId, statusEvents) {
+  let winner = null;
+  for (const event of statusEvents) {
+    if (STATUS_BY_KIND[event.kind] === void 0) continue;
+    if (!event.tags.some((t) => t[0] === "e" && t[1] === targetEventId))
+      continue;
+    if (winner === null || event.created_at > winner.created_at || event.created_at === winner.created_at && event.id < winner.id) {
+      winner = event;
+    }
+  }
+  return winner === null ? "open" : STATUS_BY_KIND[winner.kind];
+}
+var RELAY_TIMEOUT_MS = 1e4;
+var HEX64_RE = /^[0-9a-f]{64}$/;
+var WS_URL_RE2 = /^wss?:\/\//i;
+function defaultWebSocketFactory(url) {
+  const ctor = globalThis.WebSocket;
+  if (!ctor) {
+    throw new Error(
+      "No global WebSocket constructor (Node >= 22 required) \u2014 pass webSocketFactory"
+    );
+  }
+  return new ctor(url);
+}
+async function queryAll(relays, filters, webSocketFactory) {
+  const jobs = relays.flatMap(
+    (relay) => filters.map(
+      (filter) => queryRelay(relay, filter, RELAY_TIMEOUT_MS, webSocketFactory)
+    )
+  );
+  const results = await Promise.allSettled(jobs);
+  const byId = /* @__PURE__ */ new Map();
+  let failures = 0;
+  let firstError;
+  for (const result of results) {
+    if (result.status === "rejected") {
+      failures += 1;
+      firstError ??= result.reason;
+      continue;
+    }
+    for (const event of result.value) {
+      if (typeof event.id === "string" && !byId.has(event.id)) {
+        byId.set(event.id, event);
+      }
+    }
+  }
+  if (failures === results.length && results.length > 0) {
+    throw firstError instanceof Error ? firstError : new Error(String(firstError));
+  }
+  return byId;
+}
+var TRACKER_OPTIONS = {
+  json: { type: "boolean", default: false },
+  state: { type: "string" },
+  relay: { type: "string", multiple: true },
+  remote: { type: "string" },
+  "repo-id": { type: "string" },
+  owner: { type: "string" },
+  help: { type: "boolean", short: "h", default: false }
+};
+function pickTrackerFlags(values) {
+  const flags = {
+    json: values["json"] === true,
+    help: values["help"] === true,
+    relay: Array.isArray(values["relay"]) ? values["relay"] : []
+  };
+  if (typeof values["state"] === "string") flags.state = values["state"];
+  if (typeof values["remote"] === "string") flags.remote = values["remote"];
+  if (typeof values["repo-id"] === "string") flags.repoId = values["repo-id"];
+  if (typeof values["owner"] === "string")
+    flags.owner = ownerToHex(values["owner"]);
+  return flags;
+}
+async function resolveTrackerContext(flags, deps, needRepoAddr) {
+  let repoRoot;
+  let toonConfig = {
+    relays: []
+  };
+  try {
+    repoRoot = await resolveRepoRoot(deps.cwd);
+    toonConfig = await readToonConfig(repoRoot);
+  } catch {
+  }
+  let repoAddr = null;
+  if (needRepoAddr) {
+    const repoId = flags.repoId ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const owner = flags.owner ?? toonConfig.owner;
+    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+    repoAddr = { ownerPubkey: owner, repoId };
+  }
+  const resolved = await resolveRelays({
+    relayFlags: flags.relay,
+    remoteName: flags.remote,
+    repoRoot,
+    toonRelays: toonConfig.relays
+  });
+  const wsRelays = resolved.relays.filter((url) => WS_URL_RE2.test(url));
+  if (wsRelays.length === 0) {
+    throw new InvalidRelayUrlError(
+      resolved.relays[0] ?? "",
+      "reads need a ws:// or wss:// relay"
+    );
+  }
+  return {
+    relays: wsRelays,
+    repoAddr,
+    webSocketFactory: deps.webSocketFactory ?? defaultWebSocketFactory
+  };
+}
+function repoATag(addr) {
+  return `${REPOSITORY_ANNOUNCEMENT_KIND}:${addr.ownerPubkey}:${addr.repoId}`;
+}
+function parseTrackerItem(event, status) {
+  const item = {
+    eventId: event.id,
+    kind: event.kind,
+    title: tagValue(event.tags, "subject") ?? (event.content.split("\n")[0] ?? "").slice(0, 120),
+    status,
+    authorPubkey: event.pubkey,
+    createdAt: event.created_at,
+    labels: tagValues(event.tags, "t"),
+    content: event.content
+  };
+  if (event.kind === PATCH_KIND) {
+    item.commitShas = tagValues(event.tags, "commit");
+    const branch = tagValue(event.tags, "branch");
+    if (branch !== void 0) item.branch = branch;
+    const description = tagValue(event.tags, "description");
+    if (description !== void 0) item.description = description;
+  }
+  return item;
+}
+function isoDate(createdAt) {
+  return new Date(createdAt * 1e3).toISOString().slice(0, 10);
+}
+async function fetchItems(ctx, kind) {
+  const aTag = repoATag(
+    ctx.repoAddr
+  );
+  const [itemEvents, aStatusEvents] = await Promise.all([
+    queryAll(
+      ctx.relays,
+      [{ kinds: [kind], "#a": [aTag] }],
+      ctx.webSocketFactory
+    ),
+    queryAll(
+      ctx.relays,
+      [{ kinds: STATUS_KINDS, "#a": [aTag] }],
+      ctx.webSocketFactory
+    )
+  ]);
+  const items = [...itemEvents.values()].filter(
+    (e) => e.kind === kind && e.tags.some((t) => t[0] === "a" && t[1] === aTag)
+  );
+  const statuses = new Map(aStatusEvents);
+  if (items.length > 0) {
+    const byE = await queryAll(
+      ctx.relays,
+      [{ kinds: STATUS_KINDS, "#e": items.map((i) => i.id) }],
+      ctx.webSocketFactory
+    );
+    for (const [id, event] of byE)
+      if (!statuses.has(id)) statuses.set(id, event);
+  }
+  return items.map(
+    (event) => parseTrackerItem(event, deriveStatus(event.id, statuses.values()))
+  ).sort((a, b) => b.createdAt - a.createdAt);
+}
+async function fetchItem(ctx, eventId, expectedKind) {
+  const found = await queryAll(
+    ctx.relays,
+    [{ ids: [eventId] }],
+    ctx.webSocketFactory
+  );
+  const event = found.get(eventId);
+  if (!event) {
+    throw new Error(`event ${eventId} not found on ${ctx.relays.join(", ")}`);
+  }
+  if (event.kind !== expectedKind) {
+    const hint = event.kind === PATCH_KIND ? " (it is a kind:1617 patch \u2014 use `rig pr show`)" : event.kind === ISSUE_KIND ? " (it is a kind:1621 issue \u2014 use `rig issue show`)" : "";
+    throw new Error(
+      `event ${eventId} has kind ${event.kind}, expected ${expectedKind}${hint}`
+    );
+  }
+  const [statusEvents, commentEvents] = await Promise.all([
+    queryAll(
+      ctx.relays,
+      [{ kinds: STATUS_KINDS, "#e": [eventId] }],
+      ctx.webSocketFactory
+    ),
+    queryAll(
+      ctx.relays,
+      [{ kinds: [COMMENT_KIND], "#e": [eventId] }],
+      ctx.webSocketFactory
+    )
+  ]);
+  const comments = [...commentEvents.values()].filter(
+    (e) => e.kind === COMMENT_KIND && e.tags.some((t) => t[0] === "e" && t[1] === eventId)
+  ).sort((a, b) => a.created_at - b.created_at).map((e) => ({
+    eventId: e.id,
+    authorPubkey: e.pubkey,
+    createdAt: e.created_at,
+    content: e.content
+  }));
+  return {
+    item: parseTrackerItem(event, deriveStatus(eventId, statusEvents.values())),
+    comments,
+    repoATag: tagValue(event.tags, "a") ?? null
+  };
+}
+async function runList(args, deps, spec) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    const { values, positionals } = parseArgs6({
+      args,
+      options: TRACKER_OPTIONS,
+      allowPositionals: true
+    });
+    if (positionals.length > 0) {
+      throw new Error(`rig ${spec.command} takes no positional arguments`);
+    }
+    flags = pickTrackerFlags(values);
+    if (flags.state !== void 0 && flags.state !== "all" && !spec.states.includes(flags.state)) {
+      throw new Error(
+        `--state must be one of ${[...spec.states, "all"].join(" | ")} (got ${JSON.stringify(flags.state)})`
+      );
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(spec.usage);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(spec.usage);
+    return 0;
+  }
+  try {
+    const ctx = await resolveTrackerContext(flags, deps, true);
+    const all = await fetchItems(ctx, spec.kind);
+    const state = flags.state ?? "all";
+    const items = state === "all" ? all : all.filter((i) => i.status === state);
+    if (flags.json) {
+      io2.emitJson({
+        command: spec.command,
+        repoAddr: ctx.repoAddr,
+        relays: ctx.relays,
+        state,
+        count: items.length,
+        [spec.jsonKey]: items
+      });
+      return 0;
+    }
+    if (items.length === 0) {
+      io2.out(
+        `no ${state === "all" ? "" : `${state} `}${spec.jsonKey} found for ${repoATag(ctx.repoAddr)}`
+      );
+      return 0;
+    }
+    for (const item of items) {
+      const labels = item.labels.length > 0 ? `  [${item.labels.join(", ")}]` : "";
+      io2.out(
+        `${item.status.padEnd(7)}  ${item.eventId.slice(0, 8)}  ${item.title}  (${item.authorPubkey.slice(0, 8)}, ${isoDate(item.createdAt)})${labels}`
+      );
+    }
+    io2.out(
+      `${items.length} ${spec.jsonKey}${state === "all" ? "" : ` (${state})`}`
+    );
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, spec.command, err);
+  }
+}
+async function runShow(args, deps, spec) {
+  const { io: io2 } = deps;
+  let flags;
+  let eventId;
+  try {
+    const { values, positionals } = parseArgs6({
+      args,
+      options: TRACKER_OPTIONS,
+      allowPositionals: true
+    });
+    flags = pickTrackerFlags(values);
+    if (flags.help) {
+      io2.out(spec.usage);
+      return 0;
+    }
+    if (positionals.length !== 1) {
+      throw new Error("expected exactly one <event-id>");
+    }
+    eventId = positionals[0];
+    if (!HEX64_RE.test(eventId)) {
+      throw new Error(
+        `<event-id> must be a 64-char lowercase hex id (got ${JSON.stringify(eventId)})`
+      );
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(spec.usage);
+    return 2;
+  }
+  try {
+    const ctx = await resolveTrackerContext(flags, deps, false);
+    const shown = await fetchItem(ctx, eventId, spec.kind);
+    if (flags.json) {
+      io2.emitJson({
+        command: spec.command,
+        relays: ctx.relays,
+        repoATag: shown.repoATag,
+        [spec.jsonKey]: shown.item,
+        comments: shown.comments
+      });
+      return 0;
+    }
+    const { item } = shown;
+    io2.out(`${spec.jsonKey} ${item.eventId}`);
+    io2.out(`Title:   ${item.title}`);
+    io2.out(`Status:  ${item.status}`);
+    io2.out(`Author:  ${item.authorPubkey}`);
+    io2.out(`Date:    ${isoDate(item.createdAt)}`);
+    if (item.labels.length > 0) io2.out(`Labels:  ${item.labels.join(", ")}`);
+    if (item.branch !== void 0) io2.out(`Branch:  ${item.branch}`);
+    if (item.commitShas && item.commitShas.length > 0) {
+      io2.out(`Commits: ${item.commitShas.join(", ")}`);
+    }
+    if (shown.repoATag !== null) io2.out(`Repo:    ${shown.repoATag}`);
+    if (item.description !== void 0) {
+      io2.out("");
+      io2.out("Body:");
+      for (const line of item.description.split("\n")) io2.out(line);
+    }
+    io2.out("");
+    io2.out(`${spec.bodyLabel}:`);
+    for (const line of item.content.split("\n")) io2.out(line);
+    io2.out("");
+    io2.out(`Comments (${shown.comments.length}):`);
+    for (const comment of shown.comments) {
+      io2.out(
+        `--- ${comment.eventId.slice(0, 8)} by ${comment.authorPubkey.slice(0, 8)} on ${isoDate(comment.createdAt)}`
+      );
+      for (const line of comment.content.split("\n")) io2.out(line);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, spec.command, err);
+  }
+}
+var ISSUE_STATES = ["open", "closed", "applied", "draft"];
+var PR_STATES = ["open", "applied", "closed", "draft"];
+function runIssueList(args, deps) {
+  return runList(args, deps, {
+    command: "issue list",
+    kind: ISSUE_KIND,
+    usage: ISSUE_LIST_USAGE,
+    states: ISSUE_STATES,
+    jsonKey: "issues"
+  });
+}
+function runIssueShow(args, deps) {
+  return runShow(args, deps, {
+    command: "issue show",
+    kind: ISSUE_KIND,
+    usage: ISSUE_SHOW_USAGE,
+    jsonKey: "issue",
+    bodyLabel: "Body"
+  });
+}
+function runPrList(args, deps) {
+  return runList(args, deps, {
+    command: "pr list",
+    kind: PATCH_KIND,
+    usage: PR_LIST_USAGE,
+    states: PR_STATES,
+    jsonKey: "prs"
+  });
+}
+function runPrShow(args, deps) {
+  return runShow(args, deps, {
+    command: "pr show",
+    kind: PATCH_KIND,
+    usage: PR_SHOW_USAGE,
+    jsonKey: "pr",
+    bodyLabel: "Patch"
+  });
 }
 
 // src/cli/events.ts
@@ -932,7 +2521,11 @@ Options:
   --body <text>        issue body (Markdown)
   --body-file <path>   read the issue body from a file
   --label <label>      label (t tag); repeatable
-${COMMON_FLAGS_USAGE}`;
+${COMMON_FLAGS_USAGE}
+
+Related (FREE reads \u2014 no payment):
+  rig issue list [--state open|closed|all]   list the repo's issues
+  rig issue show <event-id>                  one issue + its comments`;
 var COMMENT_USAGE = `Usage: rig comment <root-event-id> --body <text> [options]
 
 Comment (kind:1622) on an issue or patch \u2014 a paid publish; writes are
@@ -956,11 +2549,17 @@ verbatim. A multi-commit range publishes ONE kind:1617 event carrying the
 full series text \u2014 cover-letter threading (one event per commit) is out of
 scope in v1.
 
+The PR body (--body/--body-file) is carried in a dedicated \`description\`
+tag, not in the event content \u2014 the content stays pure format-patch output so
+\`rig pr show \u2026 | git am\` keeps working.
+
 Options:
   --title <title>      patch/PR title (subject tag) [required]
   --range <range>      revision range for format-patch: <rev>, <rev>..<rev>,
                        or <rev>...<rev> (mutually exclusive with --patch-file)
   --patch-file <path>  literal patch text to publish
+  --body <text>        PR description (Markdown; description tag)
+  --body-file <path>   read the PR description from a file
   --branch <name>      branch name (t tag)
 ${COMMON_FLAGS_USAGE}`;
 var PR_STATUS_USAGE = `Usage: rig pr status <target-event-id> <open|applied|closed|draft> [options]
@@ -976,10 +2575,14 @@ Options:
 ${COMMON_FLAGS_USAGE}`;
 var PR_USAGE = `${PR_CREATE_USAGE}
 
-${PR_STATUS_USAGE}`;
-var HEX64_RE = /^[0-9a-f]{64}$/;
+${PR_STATUS_USAGE}
+
+${PR_LIST_USAGE}
+
+${PR_SHOW_USAGE}`;
+var HEX64_RE2 = /^[0-9a-f]{64}$/;
 function assertHex64(value, what) {
-  if (!HEX64_RE.test(value)) {
+  if (!HEX64_RE2.test(value)) {
     throw new Error(
       `${what} must be a 64-char lowercase hex id (got ${JSON.stringify(value)})`
     );
@@ -1014,7 +2617,7 @@ function pickCommon(values) {
 }
 async function runEvent(opts) {
   const { command, flags, deps, actionLabel } = opts;
-  const { io, env } = deps;
+  const { io: io2 } = deps;
   let standaloneCtx;
   try {
     let repoRoot;
@@ -1032,83 +2635,99 @@ async function runEvent(opts) {
       repoRoot,
       toonRelays: toonConfig.relays
     });
-    if (resolved.nudge !== void 0) io.err(resolved.nudge);
+    if (resolved.nudge !== void 0) io2.err(resolved.nudge);
     const relaysUsed = resolved.relays;
     if (relaysUsed.length > 1) {
-      io.err(singleRelayRefusal(resolved, "Nothing was published or paid."));
+      io2.err(singleRelayRefusal(resolved, "Nothing was published or paid."));
       return 1;
     }
-    standaloneCtx = await (deps.loadStandalone ?? defaultLoadStandalone)({
-      env,
-      cwd: deps.cwd,
-      warn: (line) => io.err(line)
-    });
-    const identity = identityReport(standaloneCtx);
-    const fee = (await standaloneCtx.publisher.getFeeRates()).eventFee.toString();
+    const session = await loadPaidSession(deps, relaysUsed[0]);
+    const path = session.path;
+    let identity;
+    let fee;
+    if (session.path === "standalone") {
+      standaloneCtx = session.ctx;
+      identity = identityReport(standaloneCtx);
+      fee = (await standaloneCtx.publisher.getFeeRates()).eventFee.toString();
+    } else {
+      identity = session.identity;
+      fee = session.feePerEvent;
+      const resolvedRelay = relaysUsed[0];
+      if (resolvedRelay !== void 0 && session.daemonRelayUrl !== void 0 && session.daemonRelayUrl !== resolvedRelay) {
+        io2.err(
+          `rig: the daemon publishes via its configured relay (${session.daemonRelayUrl}), not the resolved relay (${resolvedRelay}) \u2014 stop the daemon to force the standalone path if that matters`
+        );
+      }
+    }
     const owner = flags.owner ?? toonConfig.owner ?? identity.pubkey;
     const addr = { ownerPubkey: owner, repoId };
     const event = await opts.buildEvent(addr);
     const action = `kind:${event.kind} ${actionLabel}`;
     if (!flags.json) {
-      for (const line of renderEventPlan({ action, addr, identity, fee })) {
-        io.out(line);
+      for (const line of renderEventPlan({
+        action,
+        addr,
+        identity,
+        ...fee !== void 0 ? { fee } : {}
+      })) {
+        io2.out(line);
       }
     }
     if (!flags.yes) {
       if (flags.json) {
-        io.out(
-          jsonOut2({
-            command,
-            repoAddr: addr,
-            identity,
-            kind: event.kind,
-            executed: false,
-            feeEstimate: fee,
-            hint: "estimate only \u2014 re-run with --yes to publish (permanent, non-refundable)"
-          })
-        );
+        io2.emitJson({
+          command,
+          repoAddr: addr,
+          path,
+          identity,
+          kind: event.kind,
+          executed: false,
+          feeEstimate: fee ?? null,
+          hint: "estimate only \u2014 re-run with --yes to publish (permanent, non-refundable)"
+        });
         return 0;
       }
-      if (!io.isInteractive) {
-        io.err(
+      if (!io2.isInteractive) {
+        io2.err(
           "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
         );
         return 1;
       }
-      const proceed = await io.confirm(
+      const proceed = await io2.confirm(
         `Proceed with paid publish (${feeLabel(fee)})? [y/N] `
       );
       if (!proceed) {
-        io.err("aborted \u2014 nothing was published.");
+        io2.err("aborted \u2014 nothing was published.");
         return 1;
       }
     }
-    const receipt = await standaloneCtx.publisher.publishEvent(event, relaysUsed);
-    const result = serializeEventReceipt(event.kind, receipt);
-    if (flags.json) {
-      io.out(
-        jsonOut2({
-          command,
-          repoAddr: addr,
-          identity,
-          kind: result.kind,
-          executed: true,
-          feeEstimate: fee,
-          result
-        })
+    let result;
+    if (session.path === "standalone") {
+      const receipt = await session.ctx.publisher.publishEvent(
+        event,
+        relaysUsed
       );
+      result = serializeEventReceipt(event.kind, receipt);
     } else {
-      for (const line of renderEventReceipt(action, result)) io.out(line);
+      result = await opts.sendDaemon(session.client, addr);
     }
-    return 0;
-  } catch (err) {
-    const described = describeError(err, command);
     if (flags.json) {
-      io.out(JSON.stringify({ command, ...described.json }, null, 2));
+      io2.emitJson({
+        command,
+        repoAddr: addr,
+        path,
+        identity,
+        kind: result.kind,
+        executed: true,
+        feeEstimate: fee ?? null,
+        result
+      });
     } else {
-      for (const line of described.lines) io.err(line);
+      for (const line of renderEventReceipt(action, result)) io2.out(line);
     }
-    return 1;
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, command, err);
   } finally {
     if (standaloneCtx) {
       try {
@@ -1118,21 +2737,24 @@ async function runEvent(opts) {
     }
   }
 }
-function jsonOut2(output) {
-  return JSON.stringify(output, null, 2);
-}
 async function runIssue(args, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   const [sub, ...rest] = args;
   if (sub === "--help" || sub === "-h" || sub === "help") {
-    io.out(ISSUE_USAGE);
+    io2.out(ISSUE_USAGE);
+    io2.out("");
+    io2.out(ISSUE_LIST_USAGE);
+    io2.out("");
+    io2.out(ISSUE_SHOW_USAGE);
     return 0;
   }
+  if (sub === "list") return runIssueList(rest, deps);
+  if (sub === "show") return runIssueShow(rest, deps);
   if (sub !== "create") {
-    io.err(
-      sub === void 0 ? "missing subcommand: rig issue create" : `unknown rig issue subcommand: ${sub}`
+    io2.err(
+      sub === void 0 ? "missing subcommand: rig issue <create|list|show>" : `unknown rig issue subcommand: ${sub}`
     );
-    io.err(ISSUE_USAGE);
+    io2.err(ISSUE_USAGE);
     return 2;
   }
   let flags;
@@ -1141,7 +2763,7 @@ async function runIssue(args, deps) {
   let bodyFile;
   let labels;
   try {
-    const { values } = parseArgs3({
+    const { values } = parseArgs7({
       args: rest,
       options: {
         ...COMMON_OPTIONS,
@@ -1164,12 +2786,12 @@ async function runIssue(args, deps) {
     bodyFile = values["body-file"];
     labels = values.label ?? [];
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(ISSUE_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(ISSUE_USAGE);
     return 2;
   }
   if (flags.help) {
-    io.out(ISSUE_USAGE);
+    io2.out(ISSUE_USAGE);
     return 0;
   }
   let body;
@@ -1179,20 +2801,20 @@ async function runIssue(args, deps) {
     try {
       body = await readFile(bodyFile, "utf-8");
     } catch (err) {
-      io.err(
+      io2.err(
         `cannot read --body-file ${bodyFile}: ${err instanceof Error ? err.message : String(err)}`
       );
       return 2;
     }
-  } else if (!io.isInteractive) {
+  } else if (!io2.isInteractive) {
     body = await (deps.readStdin ?? defaultReadStdin)();
   } else {
-    io.err("an issue body is required: pass --body/--body-file or pipe stdin");
-    io.err(ISSUE_USAGE);
+    io2.err("an issue body is required: pass --body/--body-file or pipe stdin");
+    io2.err(ISSUE_USAGE);
     return 2;
   }
   if (body.trim() === "") {
-    io.err("the issue body is empty \u2014 nothing to publish");
+    io2.err("the issue body is empty \u2014 nothing to publish");
     return 2;
   }
   return runEvent({
@@ -1200,18 +2822,24 @@ async function runIssue(args, deps) {
     flags,
     deps,
     actionLabel: `issue ${JSON.stringify(title)}`,
-    buildEvent: async (addr) => buildIssue(addr.ownerPubkey, addr.repoId, title, body, labels)
+    buildEvent: async (addr) => buildIssue(addr.ownerPubkey, addr.repoId, title, body, labels),
+    sendDaemon: (client, addr) => client.gitIssue({
+      repoAddr: addr,
+      title,
+      body,
+      ...labels.length > 0 ? { labels } : {}
+    })
   });
 }
 async function runComment(args, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   let flags;
   let rootEventId;
   let body;
   let parentAuthor;
   let marker;
   try {
-    const { values, positionals } = parseArgs3({
+    const { values, positionals } = parseArgs7({
       args,
       options: {
         ...COMMON_OPTIONS,
@@ -1223,7 +2851,7 @@ async function runComment(args, deps) {
     });
     flags = pickCommon(values);
     if (flags.help) {
-      io.out(COMMENT_USAGE);
+      io2.out(COMMENT_USAGE);
       return 0;
     }
     if (positionals.length !== 1) {
@@ -1245,8 +2873,8 @@ async function runComment(args, deps) {
     }
     marker = rawMarker;
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(COMMENT_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(COMMENT_USAGE);
     return 2;
   }
   return runEvent({
@@ -1261,7 +2889,14 @@ async function runComment(args, deps) {
       parentAuthor ?? addr.ownerPubkey,
       body,
       marker
-    )
+    ),
+    sendDaemon: (client, addr) => client.gitComment({
+      repoAddr: addr,
+      rootEventId,
+      body,
+      ...parentAuthor !== void 0 ? { parentAuthorPubkey: parentAuthor } : {},
+      marker
+    })
   });
 }
 var PATCH_FROM_RE = /^From ([0-9a-f]{40}) /gm;
@@ -1269,48 +2904,57 @@ function extractPatchShas(patchText) {
   return [...patchText.matchAll(PATCH_FROM_RE)].map((m) => m[1]);
 }
 async function runPr(args, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   const [sub, ...rest] = args;
   switch (sub) {
     case "create":
       return runPrCreate(rest, deps);
     case "status":
       return runPrStatus(rest, deps);
+    // FREE read subcommands (#278): relay queries only, no payment path.
+    case "list":
+      return runPrList(rest, deps);
+    case "show":
+      return runPrShow(rest, deps);
     case "--help":
     case "-h":
     case "help":
-      io.out(PR_USAGE);
+      io2.out(PR_USAGE);
       return 0;
     default:
-      io.err(
-        sub === void 0 ? "missing subcommand: rig pr <create|status>" : `unknown rig pr subcommand: ${sub}`
+      io2.err(
+        sub === void 0 ? "missing subcommand: rig pr <create|status|list|show>" : `unknown rig pr subcommand: ${sub}`
       );
-      io.err(PR_USAGE);
+      io2.err(PR_USAGE);
       return 2;
   }
 }
 async function runPrCreate(rest, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   let flags;
   let title;
   let range;
   let patchFile;
   let branch;
+  let bodyFlag;
+  let bodyFile;
   try {
-    const { values } = parseArgs3({
+    const { values } = parseArgs7({
       args: rest,
       options: {
         ...COMMON_OPTIONS,
         title: { type: "string" },
         range: { type: "string" },
         "patch-file": { type: "string" },
+        body: { type: "string" },
+        "body-file": { type: "string" },
         branch: { type: "string" }
       },
       allowPositionals: false
     });
     flags = pickCommon(values);
     if (flags.help) {
-      io.out(PR_CREATE_USAGE);
+      io2.out(PR_CREATE_USAGE);
       return 0;
     }
     if (values.title === void 0 || values.title === "") {
@@ -1319,15 +2963,39 @@ async function runPrCreate(rest, deps) {
     if (values.range === void 0 === (values["patch-file"] === void 0)) {
       throw new Error("exactly one of --range or --patch-file is required");
     }
+    if (values.body !== void 0 && values["body-file"] !== void 0) {
+      throw new Error("--body and --body-file are mutually exclusive");
+    }
     title = values.title;
     range = values.range;
     patchFile = values["patch-file"];
     branch = values.branch;
+    bodyFlag = values.body;
+    bodyFile = values["body-file"];
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(PR_CREATE_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(PR_CREATE_USAGE);
+    return 2;
+  }
+  let body;
+  if (bodyFlag !== void 0) {
+    body = bodyFlag;
+  } else if (bodyFile !== void 0) {
+    try {
+      body = await readFile(bodyFile, "utf-8");
+    } catch (err) {
+      io2.err(
+        `cannot read --body-file ${bodyFile}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return 2;
+    }
+  }
+  if (body !== void 0 && body.trim() === "") {
+    io2.err("the PR body is empty \u2014 drop --body/--body-file or pass text");
     return 2;
   }
+  let builtPatchText;
+  let builtCommits = [];
   return runEvent({
     command: "pr",
     flags,
@@ -1357,40 +3025,56 @@ async function runPrCreate(rest, deps) {
         }
         commits = [];
       }
+      builtPatchText = patchText;
+      builtCommits = commits;
       return buildPatch(
         addr.ownerPubkey,
         addr.repoId,
         title,
         commits,
         branch,
-        patchText
+        patchText,
+        body
       );
+    },
+    sendDaemon: (client, addr) => {
+      if (builtPatchText === void 0) {
+        throw new Error("internal: patch text not built before delegation");
+      }
+      return client.gitPatch({
+        repoAddr: addr,
+        title,
+        patchText: builtPatchText,
+        ...body !== void 0 ? { description: body } : {},
+        ...builtCommits.length > 0 ? { commits: builtCommits } : {},
+        ...branch !== void 0 ? { branch } : {}
+      });
     }
   });
 }
 var STATUS_KIND_BY_VALUE = {
-  open: STATUS_OPEN_KIND,
-  applied: STATUS_APPLIED_KIND,
-  closed: STATUS_CLOSED_KIND,
-  draft: STATUS_DRAFT_KIND
+  open: STATUS_OPEN_KIND2,
+  applied: STATUS_APPLIED_KIND2,
+  closed: STATUS_CLOSED_KIND2,
+  draft: STATUS_DRAFT_KIND2
 };
 function isStatusValue(value) {
   return Object.hasOwn(STATUS_KIND_BY_VALUE, value);
 }
 async function runPrStatus(args, deps) {
-  const { io } = deps;
+  const { io: io2 } = deps;
   let flags;
   let targetEventId;
   let status;
   try {
-    const { values, positionals } = parseArgs3({
+    const { values, positionals } = parseArgs7({
       args,
       options: COMMON_OPTIONS,
       allowPositionals: true
     });
     flags = pickCommon(values);
     if (flags.help) {
-      io.out(PR_STATUS_USAGE);
+      io2.out(PR_STATUS_USAGE);
       return 0;
     }
     if (positionals.length !== 2) {
@@ -1408,8 +3092,8 @@ async function runPrStatus(args, deps) {
     }
     status = rawStatus;
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(PR_STATUS_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(PR_STATUS_USAGE);
     return 2;
   }
   return runEvent({
@@ -1421,13 +3105,423 @@ async function runPrStatus(args, deps) {
       const event = buildStatus(targetEventId, STATUS_KIND_BY_VALUE[status]);
       event.tags.push([
         "a",
-        `${REPOSITORY_ANNOUNCEMENT_KIND}:${addr.ownerPubkey}:${addr.repoId}`
+        `${REPOSITORY_ANNOUNCEMENT_KIND2}:${addr.ownerPubkey}:${addr.repoId}`
       ]);
       return event;
-    }
+    },
+    sendDaemon: (client, addr) => client.gitStatus({ repoAddr: addr, targetEventId, status })
   });
 }
 
+// src/cli/fetch.ts
+import { parseArgs as parseArgs8 } from "util";
+var FETCH_USAGE = `Usage: rig fetch [remote] [options]
+
+Fetch from a TOON remote \u2014 FREE (relay reads + Arweave gateway downloads; no
+payments, no identity needed). Reads the kind:30618 repository state from the
+remote's relay, downloads only the git objects this repository is missing
+(SHA-1 verified), and updates the remote-tracking refs
+(refs/remotes/<remote>/*; tags land at refs/tags/*), reporting what moved.
+
+No merge happens: integrate with the git passthrough, e.g.
+\`rig merge origin/main\`. \`rig fetch\` is the TOON transport and shadows
+\`git fetch\` \u2014 plain-git fetches remain available via \`git fetch\` directly.
+
+The repo address (toon.repoid/toon.owner) comes from the config \`rig init\`
+or \`rig clone\` writes; --repo-id/--owner override.
+
+Options:
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
+  --relay <url>        ad-hoc relay override \u2014 bypasses the remote's URL
+  --concurrency <n>    parallel gateway downloads (default 8)
+  --json               machine-readable result envelope
+  -h, --help           show this help`;
+var WS_URL_RE3 = /^wss?:\/\//i;
+function localRefFor(refname, remote) {
+  if (refname.startsWith("refs/heads/")) {
+    return `refs/remotes/${remote}/${refname.slice("refs/heads/".length)}`;
+  }
+  if (refname.startsWith("refs/tags/")) return refname;
+  return null;
+}
+async function resolveLocalRef(repoRoot, refname) {
+  try {
+    const out = await runGit(repoRoot, [
+      "rev-parse",
+      "--verify",
+      "--quiet",
+      refname
+    ]);
+    const sha = out.trim();
+    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+async function runFetch(args, deps) {
+  const { io: io2 } = deps;
+  let json = false;
+  let remote = "origin";
+  let relayFlag;
+  let repoIdFlag;
+  let ownerFlag;
+  let concurrency;
+  try {
+    const { values, positionals } = parseArgs8({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        relay: { type: "string" },
+        "repo-id": { type: "string" },
+        owner: { type: "string" },
+        concurrency: { type: "string" },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: true
+    });
+    if (values.help) {
+      io2.out(FETCH_USAGE);
+      return 0;
+    }
+    json = values.json === true;
+    if (positionals.length > 1) {
+      throw new Error(
+        `expected at most one [remote] argument, got ${positionals.length}`
+      );
+    }
+    if (positionals[0] !== void 0) remote = positionals[0];
+    relayFlag = values.relay;
+    repoIdFlag = values["repo-id"];
+    ownerFlag = values.owner !== void 0 ? ownerToHex(values.owner) : void 0;
+    if (values.concurrency !== void 0) {
+      concurrency = Number.parseInt(values.concurrency, 10);
+      if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
+        throw new Error("--concurrency must be a positive integer");
+      }
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(FETCH_USAGE);
+    return 2;
+  }
+  try {
+    const repoRoot = await resolveRepoRoot(deps.cwd);
+    const toonConfig = await readToonConfig(repoRoot);
+    const repoId = repoIdFlag ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const owner = ownerFlag ?? toonConfig.owner;
+    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+    let relayUrl;
+    if (relayFlag !== void 0) {
+      relayUrl = relayFlag;
+    } else {
+      const urls = await getGitRemoteUrls(repoRoot, remote);
+      if (urls.length === 0) throw new UnknownRemoteError(remote);
+      if (urls.length > 1) throw new MultiUrlRemoteError(remote, urls);
+      relayUrl = urls[0];
+    }
+    if (!WS_URL_RE3.test(relayUrl)) {
+      throw new InvalidRelayUrlError(
+        relayUrl,
+        `remote ${JSON.stringify(remote)}`
+      );
+    }
+    const remoteState = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: owner,
+      repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
+      ...deps.resolveSha ? { resolveSha: deps.resolveSha } : {}
+    });
+    const planned = [];
+    for (const [refname, sha] of remoteState.refs) {
+      if (!isSafeRefname(refname)) {
+        io2.err(
+          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
+        );
+        continue;
+      }
+      const localRef = localRefFor(refname, remote);
+      if (localRef === null) {
+        io2.err(
+          `warning: skipping ref outside refs/heads and refs/tags: ${refname}`
+        );
+        continue;
+      }
+      planned.push({ refname, localRef, newSha: sha });
+    }
+    const reader = new GitRepoReader(repoRoot);
+    const tips = [...new Set(planned.map((p) => p.newSha))];
+    const candidates = [.../* @__PURE__ */ new Set([...remoteState.shaToTxId.keys(), ...tips])];
+    const { missing: absent } = await reader.statObjects(candidates);
+    const absentSet = new Set(absent);
+    const presentLocally = new Set(
+      candidates.filter((sha) => !absentSet.has(sha))
+    );
+    const collected = await collectRepoObjects({
+      tips,
+      shaToTxId: remoteState.shaToTxId,
+      resolveMissing: (shas) => remoteState.resolveMissing(shas),
+      presentLocally,
+      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
+      ...concurrency !== void 0 ? { concurrency } : {}
+    });
+    if (collected.missing.length > 0) {
+      throw new MissingRemoteObjectsError(
+        collected.missing,
+        `cannot fetch from ${relayUrl}`
+      );
+    }
+    const written = await writeGitObjects(repoRoot, collected.objects.values());
+    const updates = [];
+    for (const { refname, localRef, newSha } of planned) {
+      const oldSha = await resolveLocalRef(repoRoot, localRef);
+      if (oldSha === newSha) {
+        updates.push({ refname, localRef, oldSha, newSha, kind: "up-to-date" });
+        continue;
+      }
+      let kind;
+      if (oldSha === null) {
+        kind = "new";
+      } else {
+        kind = await reader.isAncestor(oldSha, newSha) ? "fast-forward" : "forced";
+      }
+      await updateRef(repoRoot, localRef, newSha);
+      updates.push({ refname, localRef, oldSha, newSha, kind });
+    }
+    const moved = updates.filter((u) => u.kind !== "up-to-date");
+    if (json) {
+      io2.emitJson({
+        command: "fetch",
+        repoAddr: { ownerPubkey: owner, repoId },
+        remote,
+        relay: relayUrl,
+        objectsDownloaded: written,
+        updates,
+        executed: true
+      });
+      return 0;
+    }
+    if (moved.length === 0) {
+      io2.out("Already up to date.");
+      return 0;
+    }
+    io2.out(`From ${relayUrl}`);
+    for (const u of moved) {
+      const short = (refname) => refname.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/remotes\//, "");
+      const src = short(u.refname);
+      const dst = short(u.localRef);
+      if (u.kind === "new") {
+        const label = u.refname.startsWith("refs/tags/") ? "[new tag]" : "[new branch]";
+        io2.out(` * ${label.padEnd(17)} ${src.padEnd(14)} -> ${dst}`);
+      } else if (u.kind === "forced") {
+        io2.out(
+          ` + ${u.oldSha.slice(0, 7)}...${u.newSha.slice(0, 7)} ${src.padEnd(14)} -> ${dst}  (forced update)`
+        );
+      } else {
+        io2.out(
+          `   ${u.oldSha.slice(0, 7)}..${u.newSha.slice(0, 7)}  ${src.padEnd(14)} -> ${dst}`
+        );
+      }
+    }
+    io2.out(`Downloaded ${written} object(s) (SHA-1 verified).`);
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "fetch", err);
+  }
+}
+
+// src/cli/fund.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+import { parseArgs as parseArgs9 } from "util";
+var DEVNET_FAUCET_URL = "https://faucet.devnet.toonprotocol.dev";
+var CHAINS = ["evm", "solana", "mina"];
+var FUND_USAGE = `Usage: rig fund [options]
+
+Drip devnet test funds to the active identity's wallet \u2014 free (the faucet
+pays). The identity comes from RIG_MNEMONIC (env or a project .env) or the
+~/.toon-client keystore/config; the faucet from TOON_CLIENT_FAUCET_URL, the
+faucetUrl config field, or the deployed devnet faucet when the configured
+network is devnet. The faucet drips a FIXED amount per chain (there is no
+--amount). On a network without a faucet, prints the wallet address(es) to
+fund externally instead.
+
+Options:
+  --chain <chain>      evm | solana | mina (default: TOON_CLIENT_CHAIN, the
+                       \`chain\` config field, else evm)
+  --address <address>  fund this address instead of the identity's own
+  --json               machine-readable envelope
+  -h, --help           show this help`;
+var SHARED_DEVNET_SUFFIX = ".devnet.toonprotocol.dev";
+function sharedDevnetOrigin(env, file) {
+  const candidates = [
+    env["TOON_CLIENT_RELAY_URL"] ?? file.relayUrl,
+    env["TOON_CLIENT_PROXY_URL"] ?? file.proxyUrl,
+    env["TOON_CLIENT_BTP_URL"] ?? file.btpUrl
+  ];
+  for (const url of candidates) {
+    if (!url) continue;
+    try {
+      const { hostname } = new URL(url);
+      if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1)) {
+        return url;
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+function noFaucetGuidance(network, devnetOrigin) {
+  const head = `no faucet is configured for network ${JSON.stringify(network ?? "custom")}`;
+  const external = "To fund the wallet externally instead, send the settlement token plus native gas to the address below for the chain your channels settle on.";
+  if (devnetOrigin !== void 0) {
+    return `${head} \u2014 but your configured origin (${devnetOrigin}) looks like the shared devnet. Set TOON_CLIENT_NETWORK=devnet (or "network": "devnet" in the client config) and re-run \`rig fund\` \u2014 no faucet URL is needed there. ${external}`;
+  }
+  return `${head}. If you meant the shared devnet, set TOON_CLIENT_NETWORK=devnet and re-run \`rig fund\` \u2014 no faucet URL is needed there. If this is a self-hosted network with its own faucet, set TOON_CLIENT_FAUCET_URL (or the faucetUrl config field). ${external}`;
+}
+function readFundConfig(env) {
+  const dir = env["TOON_CLIENT_HOME"] ?? join2(homedir(), ".toon-client");
+  const configPath = join2(dir, "config.json");
+  try {
+    return {
+      file: JSON.parse(readFileSync(configPath, "utf8")),
+      configPath
+    };
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { file: {}, configPath };
+    }
+    throw new Error(
+      `failed to read client config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function runFund(args, deps) {
+  const { io: io2, env } = deps;
+  let chainFlag;
+  let addressFlag;
+  let json = false;
+  try {
+    const { values } = parseArgs9({
+      args,
+      options: {
+        chain: { type: "string" },
+        address: { type: "string" },
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      }
+    });
+    if (values.help) {
+      io2.out(FUND_USAGE);
+      return 0;
+    }
+    chainFlag = values.chain;
+    addressFlag = values.address;
+    json = values.json ?? false;
+    if (chainFlag !== void 0 && !CHAINS.includes(chainFlag)) {
+      throw new Error(
+        `--chain must be one of ${CHAINS.join(" | ")}, got ${JSON.stringify(chainFlag)}`
+      );
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(FUND_USAGE);
+    return 2;
+  }
+  try {
+    const { file } = readFundConfig(env);
+    const chain = chainFlag ?? env["TOON_CLIENT_CHAIN"] ?? file.chain ?? "evm";
+    if (!CHAINS.includes(chain)) {
+      throw new Error(
+        `configured settlement chain ${JSON.stringify(chain)} has no faucet \u2014 pass --chain ${CHAINS.join(" | ")}`
+      );
+    }
+    const network = env["TOON_CLIENT_NETWORK"] ?? file.network;
+    const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (network === "devnet" ? DEVNET_FAUCET_URL : void 0);
+    const resolved = await resolveIdentity({
+      env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line)
+    });
+    const identity = {
+      pubkey: resolved.pubkey,
+      source: resolved.source,
+      sourceLabel: resolved.sourceLabel
+    };
+    const client = await import("@toon-protocol/client");
+    const derived = await client.deriveFullIdentity(
+      resolved.mnemonic,
+      resolved.accountIndex
+    );
+    const addresses = {
+      evm: derived.evm.address || null,
+      solana: derived.solana.publicKey || null,
+      mina: derived.mina.publicKey || null
+    };
+    if (!faucetUrl) {
+      const guidance = noFaucetGuidance(network, sharedDevnetOrigin(env, file));
+      if (json) {
+        io2.emitJson({
+          command: "fund",
+          identity,
+          funded: false,
+          network: network ?? null,
+          chain,
+          addresses,
+          guidance
+        });
+        return 0;
+      }
+      io2.out(renderIdentityLine(identity));
+      io2.out(guidance);
+      io2.out("Wallet addresses:");
+      io2.out(`  evm     ${addresses.evm ?? "(no key derived)"}`);
+      io2.out(`  solana  ${addresses.solana ?? "(no key derived)"}`);
+      io2.out(`  mina    ${addresses.mina ?? "(no key derived \u2014 optional mina-signer dependency missing)"}`);
+      return 0;
+    }
+    const address = addressFlag ?? addresses[chain];
+    if (!address) {
+      throw new Error(
+        `no ${chain} address could be derived for this identity \u2014 pass an explicit --address (for mina, install the optional mina-signer dependency)`
+      );
+    }
+    const timeoutEnv = env["TOON_CLIENT_FAUCET_TIMEOUT_MS"];
+    const timeout = timeoutEnv && Number.isFinite(Number(timeoutEnv)) ? Number(timeoutEnv) : file.faucetTimeoutMs ?? (chain === "mina" ? 13e4 : 9e4);
+    if (!json) {
+      io2.out(
+        `Requesting ${chain} drip from ${faucetUrl} for ${address} \u2026` + (chain === "mina" ? " (mina settles slowly; this can take ~2 minutes)" : "")
+      );
+    }
+    const { response } = await client.fundWallet(faucetUrl, address, chain, {
+      timeout,
+      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+    });
+    if (json) {
+      io2.emitJson({
+        command: "fund",
+        identity,
+        funded: true,
+        network: network ?? null,
+        chain,
+        address,
+        faucetUrl,
+        response
+      });
+      return 0;
+    }
+    io2.out(`Faucet drip succeeded: ${chain} \u2192 ${address}`);
+    io2.out(renderIdentityLine(identity));
+    io2.out("Re-check with `rig balance` (a drip can take a few blocks to land).");
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "fund", err);
+  }
+}
+
 // src/cli/git-passthrough.ts
 import { spawn } from "child_process";
 import { constants as osConstants } from "os";
@@ -1437,11 +3531,11 @@ function signalExitCode(signal) {
   const num = osConstants.signals[signal];
   return num === void 0 ? 1 : 128 + num;
 }
-var runGitPassthrough = (argv, options = {}) => {
+var runGitPassthrough = (argv2, options = {}) => {
   const err = options.err ?? ((line) => process.stderr.write(`${line}
 `));
-  return new Promise((resolve) => {
-    const child = spawn("git", argv, {
+  return new Promise((resolve2) => {
+    const child = spawn("git", argv2, {
       stdio: "inherit",
       ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
       env: options.env ?? process.env
@@ -1461,24 +3555,24 @@ var runGitPassthrough = (argv, options = {}) => {
       restoreSignals();
       if (spawnErr.code === "ENOENT") {
         err(
-          `rig: git not found \u2014 \`rig ${argv[0] ?? ""}\` is not a rig command, so it is passed through to the system \`git\`, which is not on your PATH. Install git (https://git-scm.com) or fix your PATH.`
+          `rig: git not found \u2014 \`rig ${argv2[0] ?? ""}\` is not a rig command, so it is passed through to the system \`git\`, which is not on your PATH. Install git (https://git-scm.com) or fix your PATH.`
         );
-        resolve(GIT_NOT_FOUND_EXIT);
+        resolve2(GIT_NOT_FOUND_EXIT);
         return;
       }
       err(`rig: failed to run git: ${spawnErr.message}`);
-      resolve(1);
+      resolve2(1);
     });
     child.on("close", (code, signal) => {
       restoreSignals();
-      resolve(signal !== null ? signalExitCode(signal) : code ?? 1);
+      resolve2(signal !== null ? signalExitCode(signal) : code ?? 1);
     });
   });
 };
 
 // src/cli/init.ts
-import { basename } from "path";
-import { parseArgs as parseArgs4 } from "util";
+import { basename as basename2 } from "path";
+import { parseArgs as parseArgs10 } from "util";
 var INIT_USAGE = `Usage: rig init [options]
 
 Set up the current git repository for rig (one-shot, idempotent, free):
@@ -1498,7 +3592,7 @@ Options:
   --json             machine-readable report
   -h, --help         show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs4({
+  const { values, positionals } = parseArgs10({
     args,
     options: {
       "repo-id": { type: "string" },
@@ -1522,17 +3616,17 @@ function parseInitArgs(args) {
   return flags;
 }
 async function runInit(args, deps) {
-  const { io, env } = deps;
+  const { io: io2, env } = deps;
   let flags;
   try {
     flags = parseInitArgs(args);
   } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(INIT_USAGE);
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(INIT_USAGE);
     return 2;
   }
   if (flags.help) {
-    io.out(INIT_USAGE);
+    io2.out(INIT_USAGE);
     return 0;
   }
   try {
@@ -1545,10 +3639,10 @@ async function runInit(args, deps) {
     const identity = await (deps.resolveIdentityImpl ?? resolveIdentity)({
       env,
       cwd: deps.cwd,
-      warn: (line) => io.err(line)
+      warn: (line) => io2.err(line)
     });
     const existing = await readToonConfig(repoRoot);
-    const repoId = flags.repoId ?? existing.repoId ?? basename(repoRoot);
+    const repoId = flags.repoId ?? existing.repoId ?? basename2(repoRoot);
     const changed = {
       repoId: existing.repoId !== repoId,
       owner: existing.owner !== identity.pubkey
@@ -1582,50 +3676,44 @@ async function runInit(args, deps) {
         migratedToonRelay,
         changed
       };
-      io.out(JSON.stringify(output, null, 2));
+      io2.emitJson(output);
       return 0;
     }
-    io.out(`Initialized rig for ${repoRoot}`);
-    io.out(renderIdentityLine(identity));
-    io.out(
+    io2.out(`Initialized rig for ${repoRoot}`);
+    io2.out(renderIdentityLine(identity));
+    io2.out(
       `  toon.repoid = ${repoId}` + (changed.repoId ? "" : " (unchanged)") + (existing.repoId && changed.repoId ? ` (was ${existing.repoId})` : "")
     );
-    io.out(
+    io2.out(
       `  toon.owner  = ${identity.pubkey}` + (changed.owner ? "" : " (unchanged)") + (existing.owner && changed.owner ? ` (was ${existing.owner})` : "")
     );
     if (originRelay !== void 0) {
-      io.out(
+      io2.out(
         `  origin      = ${originRelay}` + (migratedToonRelay ? " (migrated from git config toon.relay)" : "")
       );
       if (migratedToonRelay) {
-        io.out(
+        io2.out(
           "note: toon.relay is deprecated \u2014 it stays readable as a fallback and is removed in v0.3; drop it now with `git config --unset-all toon.relay`."
         );
       }
-      io.out('Ready: `rig push` publishes this repo via remote "origin".');
+      io2.out('Ready: `rig push` publishes this repo via remote "origin".');
     } else if (existing.relays.length > 0) {
-      io.out(`  toon.relay  = ${existing.relays.join(", ")} (deprecated)`);
-      io.out(
+      io2.out(`  toon.relay  = ${existing.relays.join(", ")} (deprecated)`);
+      io2.out(
         origin !== void 0 ? `The "origin" remote (${origin.urls.join(", ")}) is not a single relay URL, so toon.relay stays the fallback \u2014 add the relay under another name (\`rig remote add toon <relay-url>\`) and push with \`rig push toon\`.` : existing.relays.length > 1 ? `toon.relay has ${existing.relays.length} values and rig publishes to one relay \u2014 migrate the right one: \`rig remote add origin <relay-url>\`.` : "This value is not a relay URL (ws://, wss://, http://, or https://) \u2014 set a real one: `rig remote add origin <relay-url>`."
       );
     } else if (origin !== void 0) {
-      io.out(
+      io2.out(
         `No relay configured yet \u2014 "origin" (${origin.urls.join(", ")}) is not a relay URL, so add the relay under another name: \`rig remote add toon <relay-url>\`, then \`rig push toon\`.`
       );
     } else {
-      io.out(
+      io2.out(
         "No relay configured yet \u2014 add one as the follow-up step: `rig remote add origin <relay-url>` (a real git remote; `git remote -v` shows it). One-off pushes can pass --relay <url>."
       );
     }
     return 0;
   } catch (err) {
-    const described = describeError(err, "init");
-    if (flags.json) {
-      io.out(JSON.stringify({ command: "init", ...described.json }, null, 2));
-    } else {
-      for (const line of described.lines) io.err(line);
-    }
-    return 1;
+    return emitCliError(io2, flags.json, "init", err);
   }
 }
 
@@ -1640,26 +3728,58 @@ Commands rig owns:
   remote add <name> <url>    add a relay as a REAL git remote ("origin" is
   remote remove <name>       the default publish target); remove/list manage
   remote list                them \u2014 \`git remote -v\` shows the same data
+  clone <relay-url> <owner>/<repo-id> [dir]
+                             clone a TOON repo (free): relay state + Arweave
+                             objects (SHA-1 verified) \u2192 a real git repository,
+                             push/pull-capable out of the box
+  fetch [remote]             fetch remote refs + missing objects (free) and
+                             update refs/remotes/<remote>/*; no merge. Shadows
+                             git fetch (plain \`git fetch\` stays available)
   push [remote] [refspecs...]  plan, price, confirm, and execute a paid push
                              to TOON (defaults to the "origin" remote). rig
                              push is the TOON transport and shadows git push;
                              plain-git pushes remain available by running
                              \`git push\` directly
   issue create               file an issue (kind:1621) against a repo
+  issue list | show <id>     read the repo's issues + comments (free)
+  pr list | show <id>        read the repo's patches; show prints the full
+                             patch text (free)
   comment <root-event-id>    comment (kind:1622) on an issue or patch
   pr create                  publish a patch (kind:1617) with real
                              \`git format-patch\` content
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
+  fund                       drip devnet faucet funds to this identity's
+                             wallet (free); on other networks prints the
+                             address(es) to fund externally
+  balance                    wallet balances + payment-channel holdings
+                             (free \u2014 chain reads and local state only)
+  channel list               show the payment channels paid commands hold
+                             (free \u2014 reads local state)
+  channel open               explicitly open (or resume) the channel for a
+                             peer; --deposit adds collateral (on-chain)
+  channel close <channelId>  start the settlement challenge window (on-chain)
+  channel settle <channelId> release collateral after the window (on-chain)
 
 Any other command is passed through to git verbatim: \`rig status\` runs
 \`git status\`, and \`rig add -p\`, \`rig commit\`, \`rig log --oneline\`,
 \`rig rebase -i\`, \u2026 behave exactly like git (same output, same exit code).
 
-Run \`rig <command> --help\` for a rig command's flags. \`rig init\` and
-\`rig remote\` are free; the other rig commands are paid writes \u2014 permanent
-and non-refundable; each quotes its fee and asks for confirmation before
-spending (--yes skips, --json emits machine output).`;
+Run \`rig <command> --help\` for a rig command's flags. \`rig init\`,
+\`rig remote\`, \`rig clone\`, \`rig fetch\`, \`rig issue list/show\`,
+\`rig pr list/show\`, \`rig fund\`, \`rig balance\`, and \`rig channel list\`
+are free; push/issue create/comment/pr create/pr status are paid writes \u2014
+permanent and non-refundable \u2014
+and channel open/close/settle are on-chain wallet transactions; each states
+what it will spend and asks for confirmation before doing so (--yes skips,
+--json emits machine output).
+
+With --json, stdout carries exactly ONE JSON document (everything human-facing
+goes to stderr), so \`rig <command> --json | jq\` always parses. --json is a
+per-subcommand flag on the commands rig owns, NOT a global rig flag: it does
+not apply to the git passthrough (\`rig status --json\` runs
+\`git status --json\`), and flags placed before the subcommand
+(\`rig --json status\`) pass through to git untouched.`;
 function rigVersion() {
   const require2 = createRequire(import.meta.url);
   for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
@@ -1671,14 +3791,19 @@ function rigVersion() {
   }
   return "unknown";
 }
-async function dispatch(argv, deps) {
-  const [command, ...rest] = argv;
-  const { io } = deps;
+async function dispatch(argv2, deps) {
+  const [command, ...rest] = argv2;
+  const { io: io2 } = deps;
   switch (command) {
     case "init":
       return runInit(rest, deps);
     case "remote":
       return runRemote(rest, deps);
+    // The #278 read path — FREE (relay + Arweave gateway reads, no payment).
+    case "clone":
+      return runClone(rest, deps);
+    case "fetch":
+      return runFetch(rest, deps);
     case "push":
       return runPush(rest, deps);
     case "issue":
@@ -1687,35 +3812,150 @@ async function dispatch(argv, deps) {
       return runComment(rest, deps);
     case "pr":
       return runPr(rest, deps);
+    case "channel":
+      return runChannel(rest, deps);
+    case "fund":
+      return runFund(rest, deps);
+    case "balance":
+      return runBalance(rest, deps);
     case "help":
     case "--help":
     case "-h":
-      io.out(USAGE);
-      io.out("");
-      io.out(PUSH_USAGE);
+      io2.out(USAGE);
+      io2.out("");
+      io2.out(PUSH_USAGE);
       return 0;
     case "--version":
-      io.out(`rig ${rigVersion()}`);
+      io2.out(`rig ${rigVersion()}`);
       return 0;
     case void 0:
-      io.err(USAGE);
+      io2.err(USAGE);
       return 2;
     default:
-      return (deps.runGit ?? runGitPassthrough)(argv, {
+      return (deps.runGit ?? runGitPassthrough)(argv2, {
         cwd: deps.cwd,
         env: deps.env,
-        err: (line) => io.err(line)
+        err: (line) => io2.err(line)
       });
   }
 }
 
-// src/cli/rig.ts
-function makeIo() {
+// src/cli/output.ts
+function makeCliIo(options) {
+  const { jsonMode, writeStdout, writeStderr } = options;
+  let emittedJson = false;
+  const humanLines = [];
+  const toStderr = (line) => {
+    if (jsonMode) humanLines.push(line);
+    writeStderr(`${line}
+`);
+  };
+  return {
+    jsonMode,
+    get emittedJson() {
+      return emittedJson;
+    },
+    out: (line) => {
+      if (jsonMode) {
+        toStderr(line);
+      } else {
+        writeStdout(`${line}
+`);
+      }
+    },
+    err: toStderr,
+    emitJson: (payload) => {
+      emittedJson = true;
+      writeStdout(`${JSON.stringify(payload, null, 2)}
+`);
+    },
+    isInteractive: options.isInteractive,
+    confirm: options.confirm,
+    ensureSingleJsonDoc(exitCode) {
+      if (!jsonMode || emittedJson) return;
+      const detail = humanLines.join("\n") || (exitCode === 0 ? "the command produced no machine output" : "the command failed before emitting machine output \u2014 see stderr");
+      this.emitJson(
+        exitCode === 0 ? { error: null, exitCode, detail } : { error: "error", exitCode, detail }
+      );
+    }
+  };
+}
+var RIG_OWNED_VERBS = /* @__PURE__ */ new Set([
+  "init",
+  "remote",
+  "clone",
+  "fetch",
+  "push",
+  "issue",
+  "comment",
+  "pr",
+  "channel",
+  "fund",
+  "balance"
+]);
+function isJsonInvocation(argv2) {
+  const [verb, ...rest] = argv2;
+  if (verb === void 0 || !RIG_OWNED_VERBS.has(verb)) return false;
+  for (const arg of rest) {
+    if (arg === "--") return false;
+    if (arg === "--json") return true;
+  }
+  return false;
+}
+var ANNOUNCE_FAILED_RE = /\[Bootstrap\] Announce failed/;
+var ANNOUNCE_402_RE = /402|payment required/i;
+var ANNOUNCE_402_INFO = "rig: skipped the optional identity self-announce \u2014 the payment peer charges for announces and this identity has not paid for one (expected on a fresh or unfunded identity); harmless, the command continues.\n";
+function calmBootstrapNoise() {
+  const original = process.stderr.write;
+  let reframed = false;
+  const patched = ((chunk, encodingOrCb, cb) => {
+    let text = chunk;
+    if (typeof chunk === "string" && ANNOUNCE_FAILED_RE.test(chunk)) {
+      if (ANNOUNCE_402_RE.test(chunk)) {
+        text = reframed ? "" : ANNOUNCE_402_INFO;
+        reframed = true;
+      }
+    }
+    return typeof encodingOrCb === "function" ? original.call(process.stderr, text, encodingOrCb) : original.call(process.stderr, text, encodingOrCb, cb);
+  });
+  process.stderr.write = patched;
+  return {
+    restore: () => {
+      if (process.stderr.write === patched) process.stderr.write = original;
+    }
+  };
+}
+function redirectStdoutToStderr(realWrite) {
+  const original = process.stdout.write;
+  const real = realWrite ?? original.bind(process.stdout);
+  const patched = ((chunk, encodingOrCb, cb) => typeof encodingOrCb === "function" ? process.stderr.write(chunk, encodingOrCb) : process.stderr.write(
+    chunk,
+    encodingOrCb,
+    cb
+  ));
+  process.stdout.write = patched;
   return {
-    out: (line) => process.stdout.write(`${line}
-`),
-    err: (line) => process.stderr.write(`${line}
-`),
+    write: (text) => {
+      real(text);
+    },
+    restore: () => {
+      if (process.stdout.write === patched) process.stdout.write = original;
+    }
+  };
+}
+
+// src/cli/rig.ts
+function makeIo(jsonMode) {
+  calmBootstrapNoise();
+  const guard = jsonMode ? redirectStdoutToStderr() : void 0;
+  return makeCliIo({
+    jsonMode,
+    writeStdout: guard ? guard.write : (text) => {
+      process.stdout.write(text);
+    },
+    writeStderr: (text) => {
+      process.stderr.write(text);
+    },
     isInteractive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     confirm: async (question) => {
       const rl = createInterface({
@@ -1729,22 +3969,36 @@ function makeIo() {
         rl.close();
       }
     }
+  });
+}
+function exitWhenFlushed(code) {
+  process.exitCode = code;
+  let pending = 2;
+  const done = () => {
+    pending -= 1;
+    if (pending === 0) process.exit(code);
   };
+  process.stdout.write("", done);
+  process.stderr.write("", done);
 }
-dispatch(process.argv.slice(2), {
-  io: makeIo(),
+var argv = process.argv.slice(2);
+var io = makeIo(isJsonInvocation(argv));
+dispatch(argv, {
+  io,
   env: process.env,
   cwd: process.cwd()
 }).then(
   (code) => {
-    process.exitCode = code;
+    io.ensureSingleJsonDoc(code);
+    exitWhenFlushed(code);
   },
   (err) => {
     process.stderr.write(
       `rig: unexpected error: ${err instanceof Error ? err.stack ?? err.message : String(err)}
 `
     );
-    process.exitCode = 1;
+    io.ensureSingleJsonDoc(1);
+    exitWhenFlushed(1);
   }
 );
 //# sourceMappingURL=rig.js.map