@toon-protocol/rig 2.2.0 → 2.3.0

package/dist/cli/rig.js

@@ -17,20 +17,23 @@ import {
   setHeadSymref,
   updateRef,
   writeGitObjects
-} from "../chunk-PS5QOT62.js";
+} from "../chunk-W2SDL2PE.js";
 import {
   MissingIdentityError,
   resolveIdentity
 } from "../chunk-CW4HJNMU.js";
 import {
   COMMENT_KIND,
+  authorizedStatusAuthors,
   buildComment,
   buildIssue,
   buildPatch,
+  buildRepoAnnouncement,
   buildStatus,
   fetchRemoteState,
+  parseMaintainers,
   queryRelay
-} from "../chunk-JBB7HBQC.js";
+} from "../chunk-3HRFDH7H.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -897,7 +900,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("../standalone-mode-64CKUVU2.js");
+  const mod = await import("../standalone-mode-JLGAUMRF.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -2100,10 +2103,11 @@ function tagValue(tags, name) {
 function tagValues(tags, name) {
   return tags.filter((t) => t[0] === name && t[1]).map((t) => t[1]);
 }
-function deriveStatus(targetEventId, statusEvents) {
+function deriveStatus(targetEventId, statusEvents, authorized) {
   let winner = null;
   for (const event of statusEvents) {
     if (STATUS_BY_KIND[event.kind] === void 0) continue;
+    if (!authorized.has(event.pubkey.toLowerCase())) continue;
     if (!event.tags.some((t) => t[0] === "e" && t[1] === targetEventId))
       continue;
     if (winner === null || event.created_at > winner.created_at || event.created_at === winner.created_at && event.id < winner.id) {
@@ -2184,12 +2188,13 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
   } catch {
   }
   let repoAddr = null;
-  if (needRepoAddr) {
-    const repoId = flags.repoId ?? toonConfig.repoId;
-    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
-    const owner = flags.owner ?? toonConfig.owner;
-    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+  const repoId = flags.repoId ?? toonConfig.repoId;
+  const owner = flags.owner ?? toonConfig.owner;
+  if (repoId && owner) {
     repoAddr = { ownerPubkey: owner, repoId };
+  } else if (needRepoAddr) {
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    throw new UnconfiguredRepoAddressError("repository owner");
   }
   const resolved = await resolveRelays({
     relayFlags: flags.relay,
@@ -2213,6 +2218,34 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
 function repoATag(addr) {
   return `${REPOSITORY_ANNOUNCEMENT_KIND}:${addr.ownerPubkey}:${addr.repoId}`;
 }
+async function fetchAuthorizedAuthors(ctx, ownerPubkey, repoId) {
+  let announceTags = [];
+  try {
+    const events = await queryAll(
+      ctx.relays,
+      [
+        {
+          kinds: [REPOSITORY_ANNOUNCEMENT_KIND],
+          authors: [ownerPubkey],
+          "#d": [repoId]
+        }
+      ],
+      ctx.webSocketFactory
+    );
+    let latest = null;
+    for (const event of events.values()) {
+      if (event.kind !== REPOSITORY_ANNOUNCEMENT_KIND) continue;
+      if (event.pubkey !== ownerPubkey) continue;
+      if (!event.tags.some((t) => t[0] === "d" && t[1] === repoId)) continue;
+      if (latest === null || event.created_at > latest.created_at || event.created_at === latest.created_at && event.id < latest.id) {
+        latest = event;
+      }
+    }
+    if (latest) announceTags = latest.tags;
+  } catch {
+  }
+  return authorizedStatusAuthors(ownerPubkey, announceTags);
+}
 function parseTrackerItem(event, status) {
   const item = {
     eventId: event.id,
@@ -2237,8 +2270,12 @@ function isoDate(createdAt) {
   return new Date(createdAt * 1e3).toISOString().slice(0, 10);
 }
 async function fetchItems(ctx, kind) {
-  const aTag = repoATag(
-    ctx.repoAddr
+  const addr = ctx.repoAddr;
+  const aTag = repoATag(addr);
+  const authorizedPromise = fetchAuthorizedAuthors(
+    ctx,
+    addr.ownerPubkey,
+    addr.repoId
   );
   const [itemEvents, aStatusEvents] = await Promise.all([
     queryAll(
@@ -2265,8 +2302,9 @@ async function fetchItems(ctx, kind) {
     for (const [id, event] of byE)
       if (!statuses.has(id)) statuses.set(id, event);
   }
+  const authorized = await authorizedPromise;
   return items.map(
-    (event) => parseTrackerItem(event, deriveStatus(event.id, statuses.values()))
+    (event) => parseTrackerItem(event, deriveStatus(event.id, statuses.values(), authorized))
   ).sort((a, b) => b.createdAt - a.createdAt);
 }
 async function fetchItem(ctx, eventId, expectedKind) {
@@ -2305,12 +2343,27 @@ async function fetchItem(ctx, eventId, expectedKind) {
     createdAt: e.created_at,
     content: e.content
   }));
+  const repoATag2 = tagValue(event.tags, "a") ?? null;
+  const parsedAddr = parseRepoATag(repoATag2) ?? ctx.repoAddr;
+  const authorized = parsedAddr ? await fetchAuthorizedAuthors(ctx, parsedAddr.ownerPubkey, parsedAddr.repoId) : /* @__PURE__ */ new Set();
   return {
-    item: parseTrackerItem(event, deriveStatus(eventId, statusEvents.values())),
+    item: parseTrackerItem(
+      event,
+      deriveStatus(eventId, statusEvents.values(), authorized)
+    ),
     comments,
-    repoATag: tagValue(event.tags, "a") ?? null
+    repoATag: repoATag2
   };
 }
+function parseRepoATag(aTag) {
+  if (!aTag) return null;
+  const [kind, ownerPubkey, ...repoIdParts] = aTag.split(":");
+  const repoId = repoIdParts.join(":");
+  if (kind !== String(REPOSITORY_ANNOUNCEMENT_KIND) || !ownerPubkey || !repoId) {
+    return null;
+  }
+  return { ownerPubkey, repoId };
+}
 async function runList(args, deps, spec) {
   const { io: io2 } = deps;
   let flags;
@@ -2663,6 +2716,9 @@ async function runEvent(opts) {
     const addr = { ownerPubkey: owner, repoId };
     const event = await opts.buildEvent(addr);
     const action = `kind:${event.kind} ${actionLabel}`;
+    if (opts.preConfirm) {
+      await opts.preConfirm({ identity, addr, relayUrl: relaysUsed[0] });
+    }
     if (!flags.json) {
       for (const line of renderEventPlan({
         action,
@@ -3109,9 +3165,41 @@ async function runPrStatus(args, deps) {
       ]);
       return event;
     },
+    // Authority warning (#287): a status event only moves an issue/PR's
+    // resolved state for repo-authority-honoring clients if its author is the
+    // owner or a declared maintainer. Warn clearly when the active identity is
+    // neither — the publish still happens (permissionless relay; the caller
+    // may be acting on their own repo/fork), but the futility is made obvious.
+    preConfirm: (args2) => warnIfNotMaintainer(deps, args2),
     sendDaemon: (client, addr) => client.gitStatus({ repoAddr: addr, targetEventId, status })
   });
 }
+async function warnIfNotMaintainer(deps, args) {
+  const { io: io2 } = deps;
+  const { identity, addr, relayUrl } = args;
+  if (identity.pubkey.toLowerCase() === addr.ownerPubkey.toLowerCase()) return;
+  if (relayUrl === void 0) return;
+  try {
+    const remote = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: addr.ownerPubkey,
+      repoId: addr.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    const authorized = authorizedStatusAuthors(
+      addr.ownerPubkey,
+      remote.announceEvent?.tags ?? []
+    );
+    if (authorized.has(identity.pubkey.toLowerCase())) return;
+    io2.err(
+      `warning: you (${identity.pubkey.slice(0, 8)}\u2026) are not a maintainer of 30617:${addr.ownerPubkey.slice(0, 8)}\u2026:${addr.repoId} \u2014 clients honoring repo authority (rig, rig-web) will IGNORE this status when resolving the issue/PR's state. Publishing anyway (the relay is permissionless); ask the owner to \`rig maintainers add\` you if this should stick.`
+    );
+  } catch {
+    io2.err(
+      "warning: could not read the repo announcement to verify your maintainer status \u2014 if you are not the owner or a declared maintainer, authority-honoring clients will ignore this status."
+    );
+  }
+}
 
 // src/cli/fetch.ts
 import { parseArgs as parseArgs8 } from "util";
@@ -3344,10 +3432,11 @@ var FUND_USAGE = `Usage: rig fund [options]
 Drip devnet test funds to the active identity's wallet \u2014 free (the faucet
 pays). The identity comes from RIG_MNEMONIC (env or a project .env) or the
 ~/.toon-client keystore/config; the faucet from TOON_CLIENT_FAUCET_URL, the
-faucetUrl config field, or the deployed devnet faucet when the configured
-network is devnet. The faucet drips a FIXED amount per chain (there is no
---amount). On a network without a faucet, prints the wallet address(es) to
-fund externally instead.
+faucetUrl config field, or the deployed devnet faucet when the network is
+devnet \u2014 including when a configured *.devnet.toonprotocol.dev origin infers
+it. The faucet drips a FIXED amount per chain (there is no --amount). On a
+network without a faucet, prints the wallet address(es) to fund externally
+instead.
 
 Options:
   --chain <chain>      evm | solana | mina (default: TOON_CLIENT_CHAIN, the
@@ -3440,7 +3529,10 @@ async function runFund(args, deps) {
       );
     }
     const network = env["TOON_CLIENT_NETWORK"] ?? file.network;
-    const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (network === "devnet" ? DEVNET_FAUCET_URL : void 0);
+    const devnetOrigin = sharedDevnetOrigin(env, file);
+    const inferredDevnet = devnetOrigin !== void 0 && (network === void 0 || network === "custom");
+    const effectiveNetwork = inferredDevnet ? "devnet" : network;
+    const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (effectiveNetwork === "devnet" ? DEVNET_FAUCET_URL : void 0);
     const resolved = await resolveIdentity({
       env,
       cwd: deps.cwd,
@@ -3462,7 +3554,7 @@ async function runFund(args, deps) {
       mina: derived.mina.publicKey || null
     };
     if (!faucetUrl) {
-      const guidance = noFaucetGuidance(network, sharedDevnetOrigin(env, file));
+      const guidance = noFaucetGuidance(network, devnetOrigin);
       if (json) {
         io2.emitJson({
           command: "fund",
@@ -3491,6 +3583,11 @@ async function runFund(args, deps) {
     }
     const timeoutEnv = env["TOON_CLIENT_FAUCET_TIMEOUT_MS"];
     const timeout = timeoutEnv && Number.isFinite(Number(timeoutEnv)) ? Number(timeoutEnv) : file.faucetTimeoutMs ?? (chain === "mina" ? 13e4 : 9e4);
+    if (!json && inferredDevnet) {
+      io2.out(
+        `Inferred network 'devnet' from the configured origin ${devnetOrigin} (network was ${JSON.stringify(network ?? "custom")}). Set TOON_CLIENT_NETWORK explicitly to override.`
+      );
+    }
     if (!json) {
       io2.out(
         `Requesting ${chain} drip from ${faucetUrl} for ${address} \u2026` + (chain === "mina" ? " (mina settles slowly; this can take ~2 minutes)" : "")
@@ -3505,11 +3602,12 @@ async function runFund(args, deps) {
         command: "fund",
         identity,
         funded: true,
-        network: network ?? null,
+        network: effectiveNetwork ?? null,
         chain,
         address,
         faucetUrl,
-        response
+        response,
+        ...inferredDevnet ? { inferredDevnetFrom: devnetOrigin } : {}
       });
       return 0;
     }
@@ -3717,6 +3815,326 @@ async function runInit(args, deps) {
   }
 }
 
+// src/cli/maintainers.ts
+import { parseArgs as parseArgs11 } from "util";
+var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var WS_URL_RE4 = /^wss?:\/\//i;
+var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
+
+Manage a repo's declared maintainers (#287). Status authority is consumer-side:
+rig and rig-web honor an issue/PR status (kind:1630-1633) ONLY when its author
+is the repo owner or a declared maintainer. The owner is always an implicit
+maintainer; this command edits the explicit set on the kind:30617 announcement.
+
+Subcommands:
+  list             show the owner + declared maintainers \u2014 FREE (relay read)
+  add <pubkey>     add a maintainer (npub or 64-char hex) \u2014 PAID: republishes
+                   the kind:30617 (permanent, non-refundable)
+  remove <pubkey>  remove a maintainer \u2014 PAID: republishes the kind:30617
+
+add/remove must run under the repo OWNER's identity (only the owner's
+announcement is authoritative).
+
+Options:
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or hex; default: git config)
+  --remote <name>      publish/read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override (exactly one for add/remove)
+  --yes                skip the fee confirmation (required when not a TTY)
+  --json               machine-readable envelope
+  -h, --help           show this help`;
+var MAINT_OPTIONS = {
+  json: { type: "boolean", default: false },
+  yes: { type: "boolean", default: false },
+  relay: { type: "string", multiple: true },
+  remote: { type: "string" },
+  "repo-id": { type: "string" },
+  owner: { type: "string" },
+  help: { type: "boolean", short: "h", default: false }
+};
+function pickFlags(values) {
+  const flags = {
+    json: values["json"] === true,
+    yes: values["yes"] === true,
+    help: values["help"] === true,
+    relay: Array.isArray(values["relay"]) ? values["relay"] : []
+  };
+  if (typeof values["remote"] === "string") flags.remote = values["remote"];
+  if (typeof values["repo-id"] === "string") flags.repoId = values["repo-id"];
+  if (typeof values["owner"] === "string")
+    flags.owner = ownerToHex(values["owner"]);
+  return flags;
+}
+async function resolveContext(flags, deps) {
+  let repoRoot;
+  let toonConfig = {
+    relays: []
+  };
+  try {
+    repoRoot = await resolveRepoRoot(deps.cwd);
+    toonConfig = await readToonConfig(repoRoot);
+  } catch {
+  }
+  const repoId = flags.repoId ?? toonConfig.repoId;
+  if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+  const owner = flags.owner ?? toonConfig.owner;
+  if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+  const resolved = await resolveRelays({
+    relayFlags: flags.relay,
+    remoteName: flags.remote,
+    repoRoot,
+    toonRelays: toonConfig.relays
+  });
+  if (resolved.nudge !== void 0) deps.io.err(resolved.nudge);
+  return {
+    repoId,
+    owner,
+    relays: resolved.relays,
+    resolved,
+    ...repoRoot !== void 0 ? { repoRoot } : {}
+  };
+}
+async function runMaintainers(args, deps) {
+  const { io: io2 } = deps;
+  const [sub, ...rest] = args;
+  switch (sub) {
+    case "list":
+      return runList2(rest, deps);
+    case "add":
+      return runMutate("add", rest, deps);
+    case "remove":
+      return runMutate("remove", rest, deps);
+    case "--help":
+    case "-h":
+    case "help":
+      io2.out(MAINTAINERS_USAGE);
+      return 0;
+    default:
+      io2.err(
+        sub === void 0 ? "missing subcommand: rig maintainers <list|add|remove>" : `unknown rig maintainers subcommand: ${sub}`
+      );
+      io2.err(MAINTAINERS_USAGE);
+      return 2;
+  }
+}
+async function runList2(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    const { values, positionals } = parseArgs11({
+      args,
+      options: MAINT_OPTIONS,
+      allowPositionals: true
+    });
+    if (positionals.length > 0) {
+      throw new Error("rig maintainers list takes no positional arguments");
+    }
+    flags = pickFlags(values);
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(MAINTAINERS_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(MAINTAINERS_USAGE);
+    return 0;
+  }
+  try {
+    const ctx = await resolveContext(flags, deps);
+    const wsRelays = ctx.relays.filter((url) => WS_URL_RE4.test(url));
+    if (wsRelays.length === 0) {
+      throw new InvalidRelayUrlError(
+        ctx.relays[0] ?? "",
+        "reads need a ws:// or wss:// relay"
+      );
+    }
+    const remote = await fetchRemoteState({
+      relayUrls: wsRelays,
+      ownerPubkey: ctx.owner,
+      repoId: ctx.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    const maintainers = remote.maintainers;
+    if (flags.json) {
+      io2.emitJson({
+        command: "maintainers list",
+        repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+        announced: remote.announced,
+        owner: ctx.owner,
+        maintainers
+      });
+      return 0;
+    }
+    io2.out(`Repo:    30617:${ctx.owner}:${ctx.repoId}`);
+    io2.out(`Owner:   ${ctx.owner}  (implicit maintainer)`);
+    if (!remote.announced) {
+      io2.out("No kind:30617 announcement found \u2014 owner-only authority.");
+      return 0;
+    }
+    if (maintainers.length === 0) {
+      io2.out("Maintainers: (none declared \u2014 owner-only authority)");
+    } else {
+      io2.out(`Maintainers (${maintainers.length}):`);
+      for (const m of maintainers) io2.out(`  ${m}`);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, "maintainers list", err);
+  }
+}
+async function runMutate(op, args, deps) {
+  const { io: io2 } = deps;
+  const command = `maintainers ${op}`;
+  let flags;
+  let pubkey;
+  try {
+    const { values, positionals } = parseArgs11({
+      args,
+      options: MAINT_OPTIONS,
+      allowPositionals: true
+    });
+    flags = pickFlags(values);
+    if (flags.help) {
+      io2.out(MAINTAINERS_USAGE);
+      return 0;
+    }
+    if (positionals.length !== 1) {
+      throw new Error(`expected exactly one <pubkey> to ${op}`);
+    }
+    pubkey = ownerToHex(positionals[0]).toLowerCase();
+    if (!HEX64_RE3.test(pubkey)) {
+      throw new Error(`<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`);
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(MAINTAINERS_USAGE);
+    return 2;
+  }
+  let standaloneCtx;
+  try {
+    const ctx = await resolveContext(flags, deps);
+    if (ctx.relays.length > 1) {
+      io2.err(singleRelayRefusal(ctx.resolved, "Nothing was published or paid."));
+      return 1;
+    }
+    const relayUrl = ctx.relays[0];
+    if (relayUrl === void 0 || !WS_URL_RE4.test(relayUrl)) {
+      throw new InvalidRelayUrlError(
+        relayUrl ?? "",
+        "a paid publish needs a ws:// or wss:// relay"
+      );
+    }
+    const load = deps.loadStandalone ?? defaultLoadStandalone;
+    standaloneCtx = await load({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line),
+      relayUrl
+    });
+    const identity = identityReport(standaloneCtx);
+    if (identity.pubkey.toLowerCase() !== ctx.owner.toLowerCase()) {
+      io2.err(
+        `rig: only the repo owner (${ctx.owner.slice(0, 8)}\u2026) can change the maintainer set \u2014 the active identity is ${identity.pubkey.slice(0, 8)}\u2026. A non-owner republish would write your own (ignored) announcement. Nothing was published or paid.`
+      );
+      return 1;
+    }
+    const remote = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: ctx.owner,
+      repoId: ctx.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    if (!remote.announced) {
+      io2.err(
+        `rig: 30617:${ctx.owner.slice(0, 8)}\u2026:${ctx.repoId} has no announcement yet \u2014 run \`rig push\` to publish the repo (with its real name/description) before managing maintainers. Nothing was published or paid.`
+      );
+      return 1;
+    }
+    const current = remote.announceEvent ? parseMaintainers(remote.announceEvent.tags) : [];
+    const currentSet = new Set(current);
+    if (op === "add" && currentSet.has(pubkey)) {
+      io2.err(
+        `rig: ${pubkey.slice(0, 8)}\u2026 is already a maintainer \u2014 nothing to do (not published).`
+      );
+      return 0;
+    }
+    if (op === "remove" && !currentSet.has(pubkey)) {
+      io2.err(
+        `rig: ${pubkey.slice(0, 8)}\u2026 is not a declared maintainer \u2014 nothing to do (not published).`
+      );
+      return 0;
+    }
+    const next = op === "add" ? [...current, pubkey] : current.filter((m) => m !== pubkey);
+    const name = remote.name ?? ctx.repoId;
+    const description = remote.description ?? "";
+    const event = buildRepoAnnouncement(ctx.repoId, name, description, next);
+    const fee = (await standaloneCtx.publisher.getFeeRates()).eventFee.toString();
+    const action = `kind:30617 maintainers ${op} ${pubkey.slice(0, 8)}\u2026`;
+    if (!flags.json) {
+      io2.out(`Republish ${action}`);
+      io2.out(`Repo: 30617:${ctx.owner}:${ctx.repoId}`);
+      io2.out(`Maintainers after: ${next.length === 0 ? "(none)" : next.join(", ")}`);
+      io2.out(`Fee: ${feeLabel(fee)}. Writes are permanent and non-refundable.`);
+    }
+    if (!flags.yes) {
+      if (flags.json) {
+        io2.emitJson({
+          command,
+          repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+          identity,
+          executed: false,
+          feeEstimate: fee,
+          maintainers: next,
+          hint: "estimate only \u2014 re-run with --yes to publish (permanent, non-refundable)"
+        });
+        return 0;
+      }
+      if (!io2.isInteractive) {
+        io2.err(
+          "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
+        );
+        return 1;
+      }
+      const proceed = await io2.confirm(
+        `Proceed with paid republish (${feeLabel(fee)})? [y/N] `
+      );
+      if (!proceed) {
+        io2.err("aborted \u2014 nothing was published.");
+        return 1;
+      }
+    }
+    const receipt = await standaloneCtx.publisher.publishEvent(event, [
+      relayUrl
+    ]);
+    const result = serializeEventReceipt(event.kind, receipt);
+    if (flags.json) {
+      io2.emitJson({
+        command,
+        repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+        identity,
+        executed: true,
+        feeEstimate: fee,
+        maintainers: next,
+        result
+      });
+    } else {
+      io2.out(
+        `Published ${action}: ${result.eventId}  paid ${result.feePaid} base units`
+      );
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, command, err);
+  } finally {
+    if (standaloneCtx) {
+      try {
+        await standaloneCtx.stop();
+      } catch {
+      }
+    }
+  }
+}
+
 // src/cli/dispatch.ts
 var USAGE = `rig \u2014 git with a TOON remote (pay-to-write Nostr + Arweave)
 
@@ -3749,6 +4167,10 @@ Commands rig owns:
                              \`git format-patch\` content
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
+  maintainers list           show the repo's declared maintainers (free); add/
+  maintainers add <pubkey>   remove republish the kind:30617 to change who may
+  maintainers remove <pubkey>  author authoritative issue/PR status (owner is
+                             always an implicit maintainer)
   fund                       drip devnet faucet funds to this identity's
                              wallet (free); on other networks prints the
                              address(es) to fund externally
@@ -3812,6 +4234,8 @@ async function dispatch(argv2, deps) {
       return runComment(rest, deps);
     case "pr":
       return runPr(rest, deps);
+    case "maintainers":
+      return runMaintainers(rest, deps);
     case "channel":
       return runChannel(rest, deps);
     case "fund":
@@ -3889,6 +4313,7 @@ var RIG_OWNED_VERBS = /* @__PURE__ */ new Set([
   "issue",
   "comment",
   "pr",
+  "maintainers",
   "channel",
   "fund",
   "balance"