@toon-protocol/rig 2.2.0 → 2.4.0

package/dist/cli/rig.js

@@ -17,20 +17,28 @@ import {
   setHeadSymref,
   updateRef,
   writeGitObjects
-} from "../chunk-PS5QOT62.js";
+} from "../chunk-W2SDL2PE.js";
 import {
+  DEFAULT_KEYSTORE_PASSWORD,
   MissingIdentityError,
+  clientConfigPath,
+  clientKeystorePath,
+  linkKeystoreInClientConfig,
+  readClientConfigFile,
   resolveIdentity
-} from "../chunk-CW4HJNMU.js";
+} from "../chunk-XGFBDUQX.js";
 import {
   COMMENT_KIND,
+  authorizedStatusAuthors,
   buildComment,
   buildIssue,
   buildPatch,
+  buildRepoAnnouncement,
   buildStatus,
   fetchRemoteState,
+  parseMaintainers,
   queryRelay
-} from "../chunk-JBB7HBQC.js";
+} from "../chunk-3HRFDH7H.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -42,7 +50,7 @@ import {
 } from "../chunk-X2CZPPDM.js";
 
 // src/cli/rig.ts
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 
 // src/cli/dispatch.ts
 import { createRequire } from "module";
@@ -897,7 +905,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("../standalone-mode-64CKUVU2.js");
+  const mod = await import("../standalone-mode-VH2XPOPK.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -2100,10 +2108,11 @@ function tagValue(tags, name) {
 function tagValues(tags, name) {
   return tags.filter((t) => t[0] === name && t[1]).map((t) => t[1]);
 }
-function deriveStatus(targetEventId, statusEvents) {
+function deriveStatus(targetEventId, statusEvents, authorized) {
   let winner = null;
   for (const event of statusEvents) {
     if (STATUS_BY_KIND[event.kind] === void 0) continue;
+    if (!authorized.has(event.pubkey.toLowerCase())) continue;
     if (!event.tags.some((t) => t[0] === "e" && t[1] === targetEventId))
       continue;
     if (winner === null || event.created_at > winner.created_at || event.created_at === winner.created_at && event.id < winner.id) {
@@ -2184,12 +2193,13 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
   } catch {
   }
   let repoAddr = null;
-  if (needRepoAddr) {
-    const repoId = flags.repoId ?? toonConfig.repoId;
-    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
-    const owner = flags.owner ?? toonConfig.owner;
-    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+  const repoId = flags.repoId ?? toonConfig.repoId;
+  const owner = flags.owner ?? toonConfig.owner;
+  if (repoId && owner) {
     repoAddr = { ownerPubkey: owner, repoId };
+  } else if (needRepoAddr) {
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    throw new UnconfiguredRepoAddressError("repository owner");
   }
   const resolved = await resolveRelays({
     relayFlags: flags.relay,
@@ -2213,6 +2223,34 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
 function repoATag(addr) {
   return `${REPOSITORY_ANNOUNCEMENT_KIND}:${addr.ownerPubkey}:${addr.repoId}`;
 }
+async function fetchAuthorizedAuthors(ctx, ownerPubkey, repoId) {
+  let announceTags = [];
+  try {
+    const events = await queryAll(
+      ctx.relays,
+      [
+        {
+          kinds: [REPOSITORY_ANNOUNCEMENT_KIND],
+          authors: [ownerPubkey],
+          "#d": [repoId]
+        }
+      ],
+      ctx.webSocketFactory
+    );
+    let latest = null;
+    for (const event of events.values()) {
+      if (event.kind !== REPOSITORY_ANNOUNCEMENT_KIND) continue;
+      if (event.pubkey !== ownerPubkey) continue;
+      if (!event.tags.some((t) => t[0] === "d" && t[1] === repoId)) continue;
+      if (latest === null || event.created_at > latest.created_at || event.created_at === latest.created_at && event.id < latest.id) {
+        latest = event;
+      }
+    }
+    if (latest) announceTags = latest.tags;
+  } catch {
+  }
+  return authorizedStatusAuthors(ownerPubkey, announceTags);
+}
 function parseTrackerItem(event, status) {
   const item = {
     eventId: event.id,
@@ -2237,8 +2275,12 @@ function isoDate(createdAt) {
   return new Date(createdAt * 1e3).toISOString().slice(0, 10);
 }
 async function fetchItems(ctx, kind) {
-  const aTag = repoATag(
-    ctx.repoAddr
+  const addr = ctx.repoAddr;
+  const aTag = repoATag(addr);
+  const authorizedPromise = fetchAuthorizedAuthors(
+    ctx,
+    addr.ownerPubkey,
+    addr.repoId
   );
   const [itemEvents, aStatusEvents] = await Promise.all([
     queryAll(
@@ -2265,8 +2307,9 @@ async function fetchItems(ctx, kind) {
     for (const [id, event] of byE)
       if (!statuses.has(id)) statuses.set(id, event);
   }
+  const authorized = await authorizedPromise;
   return items.map(
-    (event) => parseTrackerItem(event, deriveStatus(event.id, statuses.values()))
+    (event) => parseTrackerItem(event, deriveStatus(event.id, statuses.values(), authorized))
   ).sort((a, b) => b.createdAt - a.createdAt);
 }
 async function fetchItem(ctx, eventId, expectedKind) {
@@ -2305,12 +2348,27 @@ async function fetchItem(ctx, eventId, expectedKind) {
     createdAt: e.created_at,
     content: e.content
   }));
+  const repoATag2 = tagValue(event.tags, "a") ?? null;
+  const parsedAddr = parseRepoATag(repoATag2) ?? ctx.repoAddr;
+  const authorized = parsedAddr ? await fetchAuthorizedAuthors(ctx, parsedAddr.ownerPubkey, parsedAddr.repoId) : /* @__PURE__ */ new Set();
   return {
-    item: parseTrackerItem(event, deriveStatus(eventId, statusEvents.values())),
+    item: parseTrackerItem(
+      event,
+      deriveStatus(eventId, statusEvents.values(), authorized)
+    ),
     comments,
-    repoATag: tagValue(event.tags, "a") ?? null
+    repoATag: repoATag2
   };
 }
+function parseRepoATag(aTag) {
+  if (!aTag) return null;
+  const [kind, ownerPubkey, ...repoIdParts] = aTag.split(":");
+  const repoId = repoIdParts.join(":");
+  if (kind !== String(REPOSITORY_ANNOUNCEMENT_KIND) || !ownerPubkey || !repoId) {
+    return null;
+  }
+  return { ownerPubkey, repoId };
+}
 async function runList(args, deps, spec) {
   const { io: io2 } = deps;
   let flags;
@@ -2663,6 +2721,9 @@ async function runEvent(opts) {
     const addr = { ownerPubkey: owner, repoId };
     const event = await opts.buildEvent(addr);
     const action = `kind:${event.kind} ${actionLabel}`;
+    if (opts.preConfirm) {
+      await opts.preConfirm({ identity, addr, relayUrl: relaysUsed[0] });
+    }
     if (!flags.json) {
       for (const line of renderEventPlan({
         action,
@@ -3109,9 +3170,41 @@ async function runPrStatus(args, deps) {
       ]);
       return event;
     },
+    // Authority warning (#287): a status event only moves an issue/PR's
+    // resolved state for repo-authority-honoring clients if its author is the
+    // owner or a declared maintainer. Warn clearly when the active identity is
+    // neither — the publish still happens (permissionless relay; the caller
+    // may be acting on their own repo/fork), but the futility is made obvious.
+    preConfirm: (args2) => warnIfNotMaintainer(deps, args2),
     sendDaemon: (client, addr) => client.gitStatus({ repoAddr: addr, targetEventId, status })
   });
 }
+async function warnIfNotMaintainer(deps, args) {
+  const { io: io2 } = deps;
+  const { identity, addr, relayUrl } = args;
+  if (identity.pubkey.toLowerCase() === addr.ownerPubkey.toLowerCase()) return;
+  if (relayUrl === void 0) return;
+  try {
+    const remote = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: addr.ownerPubkey,
+      repoId: addr.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    const authorized = authorizedStatusAuthors(
+      addr.ownerPubkey,
+      remote.announceEvent?.tags ?? []
+    );
+    if (authorized.has(identity.pubkey.toLowerCase())) return;
+    io2.err(
+      `warning: you (${identity.pubkey.slice(0, 8)}\u2026) are not a maintainer of 30617:${addr.ownerPubkey.slice(0, 8)}\u2026:${addr.repoId} \u2014 clients honoring repo authority (rig, rig-web) will IGNORE this status when resolving the issue/PR's state. Publishing anyway (the relay is permissionless); ask the owner to \`rig maintainers add\` you if this should stick.`
+    );
+  } catch {
+    io2.err(
+      "warning: could not read the repo announcement to verify your maintainer status \u2014 if you are not the owner or a declared maintainer, authority-honoring clients will ignore this status."
+    );
+  }
+}
 
 // src/cli/fetch.ts
 import { parseArgs as parseArgs8 } from "util";
@@ -3344,10 +3437,11 @@ var FUND_USAGE = `Usage: rig fund [options]
 Drip devnet test funds to the active identity's wallet \u2014 free (the faucet
 pays). The identity comes from RIG_MNEMONIC (env or a project .env) or the
 ~/.toon-client keystore/config; the faucet from TOON_CLIENT_FAUCET_URL, the
-faucetUrl config field, or the deployed devnet faucet when the configured
-network is devnet. The faucet drips a FIXED amount per chain (there is no
---amount). On a network without a faucet, prints the wallet address(es) to
-fund externally instead.
+faucetUrl config field, or the deployed devnet faucet when the network is
+devnet \u2014 including when a configured *.devnet.toonprotocol.dev origin infers
+it. The faucet drips a FIXED amount per chain (there is no --amount). On a
+network without a faucet, prints the wallet address(es) to fund externally
+instead.
 
 Options:
   --chain <chain>      evm | solana | mina (default: TOON_CLIENT_CHAIN, the
@@ -3440,7 +3534,10 @@ async function runFund(args, deps) {
       );
     }
     const network = env["TOON_CLIENT_NETWORK"] ?? file.network;
-    const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (network === "devnet" ? DEVNET_FAUCET_URL : void 0);
+    const devnetOrigin = sharedDevnetOrigin(env, file);
+    const inferredDevnet = devnetOrigin !== void 0 && (network === void 0 || network === "custom");
+    const effectiveNetwork = inferredDevnet ? "devnet" : network;
+    const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (effectiveNetwork === "devnet" ? DEVNET_FAUCET_URL : void 0);
     const resolved = await resolveIdentity({
       env,
       cwd: deps.cwd,
@@ -3462,7 +3559,7 @@ async function runFund(args, deps) {
       mina: derived.mina.publicKey || null
     };
     if (!faucetUrl) {
-      const guidance = noFaucetGuidance(network, sharedDevnetOrigin(env, file));
+      const guidance = noFaucetGuidance(network, devnetOrigin);
       if (json) {
         io2.emitJson({
           command: "fund",
@@ -3491,6 +3588,11 @@ async function runFund(args, deps) {
     }
     const timeoutEnv = env["TOON_CLIENT_FAUCET_TIMEOUT_MS"];
     const timeout = timeoutEnv && Number.isFinite(Number(timeoutEnv)) ? Number(timeoutEnv) : file.faucetTimeoutMs ?? (chain === "mina" ? 13e4 : 9e4);
+    if (!json && inferredDevnet) {
+      io2.out(
+        `Inferred network 'devnet' from the configured origin ${devnetOrigin} (network was ${JSON.stringify(network ?? "custom")}). Set TOON_CLIENT_NETWORK explicitly to override.`
+      );
+    }
     if (!json) {
       io2.out(
         `Requesting ${chain} drip from ${faucetUrl} for ${address} \u2026` + (chain === "mina" ? " (mina settles slowly; this can take ~2 minutes)" : "")
@@ -3505,11 +3607,12 @@ async function runFund(args, deps) {
         command: "fund",
         identity,
         funded: true,
-        network: network ?? null,
+        network: effectiveNetwork ?? null,
         chain,
         address,
         faucetUrl,
-        response
+        response,
+        ...inferredDevnet ? { inferredDevnetFrom: devnetOrigin } : {}
       });
       return 0;
     }
@@ -3570,9 +3673,396 @@ var runGitPassthrough = (argv2, options = {}) => {
   });
 };
 
+// src/cli/identity-cmd.ts
+import { existsSync, mkdirSync } from "fs";
+import { dirname as dirname2 } from "path";
+import { createInterface } from "readline/promises";
+import { parseArgs as parseArgs10 } from "util";
+async function loadKeyOps() {
+  return await import("@toon-protocol/client");
+}
+var IdentityExistsError = class extends Error {
+  constructor(pubkey, sourceLabel) {
+    super(
+      `an identity already resolves (${pubkey}, from ${sourceLabel}) \u2014 rig will not overwrite it. Inspect it with \`rig identity show\`, or pass \`--force\` to replace the keystore with a brand-new identity (the old phrase becomes unrecoverable unless you backed it up).`
+    );
+    this.pubkey = pubkey;
+    this.sourceLabel = sourceLabel;
+    this.name = "IdentityExistsError";
+  }
+  pubkey;
+  sourceLabel;
+};
+var KeystoreFileExistsError = class extends Error {
+  constructor(keystorePath) {
+    super(
+      `a keystore file already exists at ${keystorePath} \u2014 rig will not overwrite it. Link it via the client config, or pass \`--force\` to replace it with a new identity.`
+    );
+    this.keystorePath = keystorePath;
+    this.name = "KeystoreFileExistsError";
+  }
+  keystorePath;
+};
+async function prepareKeystoreTarget(input) {
+  const keyOps = await (input.loadKeyOps ?? loadKeyOps)();
+  const resolveImpl = input.resolveIdentityImpl ?? resolveIdentity;
+  let existing;
+  try {
+    existing = await resolveImpl({
+      env: input.env,
+      cwd: input.cwd,
+      warn: input.warn
+    });
+  } catch (err) {
+    if (!(err instanceof MissingIdentityError)) throw err;
+  }
+  if (existing && !input.force) {
+    throw new IdentityExistsError(existing.pubkey, existing.sourceLabel);
+  }
+  const keystorePath = clientKeystorePath(input.env);
+  if (existsSync(keystorePath) && !input.force) {
+    throw new KeystoreFileExistsError(keystorePath);
+  }
+  const envPassword = input.env["TOON_CLIENT_KEYSTORE_PASSWORD"]?.trim() || void 0;
+  const autoPassword = envPassword === void 0;
+  const password = envPassword ?? DEFAULT_KEYSTORE_PASSWORD;
+  mkdirSync(dirname2(keystorePath), { recursive: true });
+  return { keystorePath, password, autoPassword, existing, keyOps };
+}
+function readAccountIndex(env) {
+  const file = readClientConfigFile(clientConfigPath(env));
+  return typeof file.mnemonicAccountIndex === "number" ? file.mnemonicAccountIndex : 0;
+}
+function finishMint(input, target, mnemonic) {
+  const configPath = linkKeystoreInClientConfig(
+    input.env,
+    target.keystorePath,
+    target.autoPassword
+  );
+  const accountIndex = readAccountIndex(input.env);
+  const { pubkey } = target.keyOps.deriveNostrKeyFromMnemonic(
+    mnemonic,
+    accountIndex
+  );
+  const result = {
+    mnemonic,
+    pubkey,
+    keystorePath: target.keystorePath,
+    configPath,
+    autoPassword: target.autoPassword,
+    accountIndex
+  };
+  if (target.existing && target.existing.pubkey !== pubkey) {
+    result.shadowedBy = {
+      sourceLabel: target.existing.sourceLabel,
+      pubkey: target.existing.pubkey
+    };
+  }
+  return result;
+}
+async function createIdentity(input) {
+  const target = await prepareKeystoreTarget(input);
+  const { mnemonic } = target.keyOps.generateKeystore(
+    target.keystorePath,
+    target.password
+  );
+  return finishMint(input, target, mnemonic);
+}
+async function importIdentity(input) {
+  const target = await prepareKeystoreTarget(input);
+  target.keyOps.importKeystore(
+    target.keystorePath,
+    input.mnemonic,
+    target.password
+  );
+  return finishMint(input, target, input.mnemonic);
+}
+function createdIdentityBanner(result) {
+  return [
+    "",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "  rig: generated a new identity",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    `  Nostr pubkey : ${result.pubkey}`,
+    "",
+    "  Seed phrase \u2014 this phrase CONTROLS YOUR FUNDS. Write it down and",
+    "  store it safely. It is shown ONCE and CANNOT be recovered:",
+    "",
+    `    ${result.mnemonic}`,
+    "",
+    `  Encrypted keystore: ${result.keystorePath}`,
+    result.autoPassword ? "  Encrypted with the default password, so the identity reloads with no\n  env var. To use your own password: set TOON_CLIENT_KEYSTORE_PASSWORD\n  and re-import with `rig identity import`." : "  Encrypted with your TOON_CLIENT_KEYSTORE_PASSWORD.",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    ""
+  ];
+}
+function shadowNote(shadowedBy) {
+  return `note: a higher-precedence identity (${shadowedBy.pubkey}, from ${shadowedBy.sourceLabel}) still shadows the new keystore \u2014 rig keeps using it until you remove that source (unset the env var / edit .env).`;
+}
+var IDENTITY_USAGE = `Usage: rig identity <command> [options]
+
+Manage the BIP-39 signing identity rig uses to sign and pay:
+
+  create   generate a fresh identity into the encrypted keystore under
+           TOON_CLIENT_HOME. The seed phrase is shown ONCE \u2014 back it up.
+           Refuses to overwrite an existing identity without --force.
+  show     report the ACTIVE identity's source + derived pubkey (never the
+           phrase); errors with the resolution remediation when none exists.
+  import   read an EXISTING phrase from stdin (never a CLI argument) and write
+           it to the encrypted keystore.
+
+Options:
+  --force              (create/import) replace an existing identity/keystore
+  --json               machine-readable output. NOTE: \`identity create --json\`
+                       DELIBERATELY emits the seed phrase in a \`mnemonic\`
+                       field \u2014 treat that output as SECRET. \`identity show\`
+                       and \`identity import\` never emit the phrase.
+  -h, --help           show this help
+
+The keystore is encrypted with TOON_CLIENT_KEYSTORE_PASSWORD when that env var
+is set, else a default password so the identity reloads with no configuration.
+rig deliberately does NOT accept the keystore password as a CLI flag \u2014 that
+would leak the value that decrypts your keys to shell history and \`ps\`.`;
+async function runIdentity(args, deps) {
+  const [sub, ...rest] = args;
+  switch (sub) {
+    case "create":
+      return runIdentityCreate(rest, deps);
+    case "show":
+      return runIdentityShow(rest, deps);
+    case "import":
+      return runIdentityImport(rest, deps);
+    case "help":
+    case "--help":
+    case "-h":
+      deps.io.out(IDENTITY_USAGE);
+      return 0;
+    case void 0:
+      deps.io.err("rig identity needs a subcommand: create | show | import");
+      deps.io.err(IDENTITY_USAGE);
+      return 2;
+    default:
+      deps.io.err(`unknown rig identity subcommand: ${sub}`);
+      deps.io.err(IDENTITY_USAGE);
+      return 2;
+  }
+}
+function parseMintArgs(args, verb) {
+  const { values, positionals } = parseArgs10({
+    args,
+    options: {
+      force: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: false
+  });
+  if (positionals.length > 0) {
+    throw new Error(`rig identity ${verb} takes no positional arguments`);
+  }
+  return {
+    force: values.force ?? false,
+    json: values.json ?? false,
+    help: values.help ?? false
+  };
+}
+async function runIdentityCreate(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    flags = parseMintArgs(args, "create");
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const result = await createIdentity({
+      env: deps.env,
+      cwd: deps.cwd,
+      force: flags.force,
+      warn: (line) => io2.err(line),
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {},
+      ...deps.loadKeyOps ? { loadKeyOps: deps.loadKeyOps } : {}
+    });
+    emitCreated(io2, flags.json, "identity create", result);
+    return 0;
+  } catch (err) {
+    return emitMintError(io2, flags.json, "identity create", err);
+  }
+}
+async function runIdentityImport(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    flags = parseMintArgs(args, "import");
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const read = deps.readSecretLine ?? defaultReadSecretLine;
+    const phrase = (await read(
+      "Paste your BIP-39 seed phrase (read from stdin, not the terminal history): ",
+      io2.isInteractive
+    )).trim();
+    if (phrase === "") {
+      throw new Error(
+        "no seed phrase provided on stdin \u2014 pipe it in or type it at the prompt (never pass a phrase as a CLI argument; it leaks to shell history and `ps`)."
+      );
+    }
+    const result = await importIdentity({
+      env: deps.env,
+      cwd: deps.cwd,
+      force: flags.force,
+      mnemonic: phrase,
+      warn: (line) => io2.err(line),
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {},
+      ...deps.loadKeyOps ? { loadKeyOps: deps.loadKeyOps } : {}
+    });
+    if (flags.json) {
+      io2.emitJson({
+        command: "identity import",
+        imported: true,
+        pubkey: result.pubkey,
+        keystorePath: result.keystorePath,
+        autoPassword: result.autoPassword,
+        ...result.shadowedBy ? { shadowedBy: result.shadowedBy } : {}
+      });
+    } else {
+      io2.out(`Imported identity ${result.pubkey}`);
+      io2.out(`  Encrypted keystore: ${result.keystorePath}`);
+    }
+    if (result.shadowedBy) io2.err(shadowNote(result.shadowedBy));
+    return 0;
+  } catch (err) {
+    return emitMintError(io2, flags.json, "identity import", err);
+  }
+}
+async function runIdentityShow(args, deps) {
+  const { io: io2 } = deps;
+  let json = false;
+  let help = false;
+  try {
+    const parsed = parseArgs10({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: false
+    });
+    json = parsed.values.json ?? false;
+    help = parsed.values.help ?? false;
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const identity = await (deps.resolveIdentityImpl ?? resolveIdentity)({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line)
+    });
+    if (json) {
+      io2.emitJson({
+        command: "identity show",
+        source: identity.source,
+        sourceLabel: identity.sourceLabel,
+        pubkey: identity.pubkey,
+        accountIndex: identity.accountIndex
+      });
+    } else {
+      io2.out(renderIdentityLine(identity));
+      io2.out(`  source : ${identity.source} (${identity.sourceLabel})`);
+      io2.out(`  pubkey : ${identity.pubkey}`);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "identity show", err);
+  }
+}
+function emitCreated(io2, json, command, result) {
+  if (json) {
+    io2.emitJson({
+      command,
+      created: true,
+      pubkey: result.pubkey,
+      keystorePath: result.keystorePath,
+      autoPassword: result.autoPassword,
+      // DELIBERATE, documented exception to "never print the phrase": the
+      // scripting/agent path needs the generated phrase to back it up.
+      mnemonic: result.mnemonic,
+      ...result.shadowedBy ? { shadowedBy: result.shadowedBy } : {}
+    });
+    io2.err(
+      "rig: `--json` emitted your seed phrase in the `mnemonic` field \u2014 this output is SECRET; store it safely and do not log or share it."
+    );
+  } else {
+    for (const line of createdIdentityBanner(result)) io2.out(line);
+  }
+  if (result.shadowedBy) io2.err(shadowNote(result.shadowedBy));
+}
+function emitMintError(io2, json, command, err) {
+  if (err instanceof IdentityExistsError) {
+    if (json) {
+      io2.emitJson({
+        command,
+        error: "identity_exists",
+        pubkey: err.pubkey,
+        detail: err.message
+      });
+    }
+    for (const line of err.message.split("\n")) io2.err(line);
+    return 1;
+  }
+  if (err instanceof KeystoreFileExistsError) {
+    if (json) {
+      io2.emitJson({
+        command,
+        error: "keystore_exists",
+        keystorePath: err.keystorePath,
+        detail: err.message
+      });
+    }
+    for (const line of err.message.split("\n")) io2.err(line);
+    return 1;
+  }
+  return emitCliError(io2, json, command, err);
+}
+async function defaultReadSecretLine(prompt, isInteractive) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  if (isInteractive) {
+    process.stderr.write(prompt);
+    rl._writeToOutput = () => {
+    };
+  }
+  try {
+    const answer = await rl.question("");
+    if (isInteractive) process.stderr.write("\n");
+    return answer;
+  } finally {
+    rl.close();
+  }
+}
+
 // src/cli/init.ts
 import { basename as basename2 } from "path";
-import { parseArgs as parseArgs10 } from "util";
+import { parseArgs as parseArgs11 } from "util";
 var INIT_USAGE = `Usage: rig init [options]
 
 Set up the current git repository for rig (one-shot, idempotent, free):
@@ -3586,16 +4076,23 @@ The follow-up step is adding a relay: \`rig remote add origin <relay-url>\`
 \`git config toon.relay\` is migrated to the origin remote automatically
 when no origin exists (the old key stays readable and is removed in v0.3).
 
+When NO identity resolves, init does not dead-end: in a terminal it offers to
+generate one (\`Create a new identity now? [y/N]\`), and \`--generate-identity\`
+does it non-interactively (equivalent to \`rig identity create\` \u2014 the phrase
+is shown once to back up). Nothing is ever auto-generated without your yes.
+
 Options:
-  --repo-id <id>     repository id / NIP-34 d-tag (default: the existing
-                     toon.repoid, then the repo directory basename)
-  --json             machine-readable report
-  -h, --help         show this help`;
+  --repo-id <id>       repository id / NIP-34 d-tag (default: the existing
+                       toon.repoid, then the repo directory basename)
+  --generate-identity  when no identity resolves, mint a fresh one (no prompt)
+  --json               machine-readable report
+  -h, --help           show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs10({
+  const { values, positionals } = parseArgs11({
     args,
     options: {
       "repo-id": { type: "string" },
+      "generate-identity": { type: "boolean", default: false },
       json: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false }
     },
@@ -3605,6 +4102,7 @@ function parseInitArgs(args) {
     throw new Error(`rig init takes no positional arguments`);
   }
   const flags = {
+    generateIdentity: values["generate-identity"] ?? false,
     json: values.json ?? false,
     help: values.help ?? false
   };
@@ -3615,8 +4113,38 @@ function parseInitArgs(args) {
   }
   return flags;
 }
-async function runInit(args, deps) {
+async function resolveOrGenerateIdentity(deps, flags) {
   const { io: io2, env } = deps;
+  const resolve2 = deps.resolveIdentityImpl ?? resolveIdentity;
+  try {
+    return { identity: await resolve2({ env, cwd: deps.cwd, warn: io2.err }) };
+  } catch (err) {
+    if (!(err instanceof MissingIdentityError)) throw err;
+    let generate = flags.generateIdentity;
+    if (!generate && io2.isInteractive && !flags.json) {
+      io2.err("No identity found \u2014 rig needs one to sign and pay.");
+      generate = await io2.confirm("Create a new identity now? [y/N] ");
+    }
+    if (!generate) throw err;
+    const created = await (deps.createIdentityImpl ?? createIdentity)({
+      env,
+      cwd: deps.cwd,
+      force: false,
+      warn: io2.err,
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {}
+    });
+    const identity = {
+      mnemonic: created.mnemonic,
+      accountIndex: created.accountIndex,
+      source: "keystore",
+      sourceLabel: created.keystorePath,
+      pubkey: created.pubkey
+    };
+    return { identity, generated: created };
+  }
+}
+async function runInit(args, deps) {
+  const { io: io2 } = deps;
   let flags;
   try {
     flags = parseInitArgs(args);
@@ -3636,11 +4164,7 @@ async function runInit(args, deps) {
     } catch {
       throw new NotAGitRepositoryError(deps.cwd);
     }
-    const identity = await (deps.resolveIdentityImpl ?? resolveIdentity)({
-      env,
-      cwd: deps.cwd,
-      warn: (line) => io2.err(line)
-    });
+    const { identity, generated } = await resolveOrGenerateIdentity(deps, flags);
     const existing = await readToonConfig(repoRoot);
     const repoId = flags.repoId ?? existing.repoId ?? basename2(repoRoot);
     const changed = {
@@ -3674,11 +4198,29 @@ async function runInit(args, deps) {
         remotes,
         origin: originRelay ?? null,
         migratedToonRelay,
-        changed
+        changed,
+        ...generated ? {
+          generatedIdentity: {
+            mnemonic: generated.mnemonic,
+            pubkey: generated.pubkey,
+            keystorePath: generated.keystorePath,
+            autoPassword: generated.autoPassword
+          }
+        } : {}
       };
       io2.emitJson(output);
+      if (generated) {
+        io2.err(
+          "rig: `--json` emitted your new seed phrase in `generatedIdentity.mnemonic` \u2014 this output is SECRET; store it safely and do not log or share it."
+        );
+        if (generated.shadowedBy) io2.err(shadowNote(generated.shadowedBy));
+      }
       return 0;
     }
+    if (generated) {
+      for (const line of createdIdentityBanner(generated)) io2.out(line);
+      if (generated.shadowedBy) io2.err(shadowNote(generated.shadowedBy));
+    }
     io2.out(`Initialized rig for ${repoRoot}`);
     io2.out(renderIdentityLine(identity));
     io2.out(
@@ -3717,14 +4259,341 @@ async function runInit(args, deps) {
   }
 }
 
+// src/cli/maintainers.ts
+import { parseArgs as parseArgs12 } from "util";
+var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var WS_URL_RE4 = /^wss?:\/\//i;
+var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
+
+Manage a repo's declared maintainers (#287). Status authority is consumer-side:
+rig and rig-web honor an issue/PR status (kind:1630-1633) ONLY when its author
+is the repo owner or a declared maintainer. The owner is always an implicit
+maintainer; this command edits the explicit set on the kind:30617 announcement.
+
+Subcommands:
+  list             show the owner + declared maintainers \u2014 FREE (relay read)
+  add <pubkey>     add a maintainer (npub or 64-char hex) \u2014 PAID: republishes
+                   the kind:30617 (permanent, non-refundable)
+  remove <pubkey>  remove a maintainer \u2014 PAID: republishes the kind:30617
+
+add/remove must run under the repo OWNER's identity (only the owner's
+announcement is authoritative).
+
+Options:
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or hex; default: git config)
+  --remote <name>      publish/read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override (exactly one for add/remove)
+  --yes                skip the fee confirmation (required when not a TTY)
+  --json               machine-readable envelope
+  -h, --help           show this help`;
+var MAINT_OPTIONS = {
+  json: { type: "boolean", default: false },
+  yes: { type: "boolean", default: false },
+  relay: { type: "string", multiple: true },
+  remote: { type: "string" },
+  "repo-id": { type: "string" },
+  owner: { type: "string" },
+  help: { type: "boolean", short: "h", default: false }
+};
+function pickFlags(values) {
+  const flags = {
+    json: values["json"] === true,
+    yes: values["yes"] === true,
+    help: values["help"] === true,
+    relay: Array.isArray(values["relay"]) ? values["relay"] : []
+  };
+  if (typeof values["remote"] === "string") flags.remote = values["remote"];
+  if (typeof values["repo-id"] === "string") flags.repoId = values["repo-id"];
+  if (typeof values["owner"] === "string")
+    flags.owner = ownerToHex(values["owner"]);
+  return flags;
+}
+async function resolveContext(flags, deps) {
+  let repoRoot;
+  let toonConfig = {
+    relays: []
+  };
+  try {
+    repoRoot = await resolveRepoRoot(deps.cwd);
+    toonConfig = await readToonConfig(repoRoot);
+  } catch {
+  }
+  const repoId = flags.repoId ?? toonConfig.repoId;
+  if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+  const owner = flags.owner ?? toonConfig.owner;
+  if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+  const resolved = await resolveRelays({
+    relayFlags: flags.relay,
+    remoteName: flags.remote,
+    repoRoot,
+    toonRelays: toonConfig.relays
+  });
+  if (resolved.nudge !== void 0) deps.io.err(resolved.nudge);
+  return {
+    repoId,
+    owner,
+    relays: resolved.relays,
+    resolved,
+    ...repoRoot !== void 0 ? { repoRoot } : {}
+  };
+}
+async function runMaintainers(args, deps) {
+  const { io: io2 } = deps;
+  const [sub, ...rest] = args;
+  switch (sub) {
+    case "list":
+      return runList2(rest, deps);
+    case "add":
+      return runMutate("add", rest, deps);
+    case "remove":
+      return runMutate("remove", rest, deps);
+    case "--help":
+    case "-h":
+    case "help":
+      io2.out(MAINTAINERS_USAGE);
+      return 0;
+    default:
+      io2.err(
+        sub === void 0 ? "missing subcommand: rig maintainers <list|add|remove>" : `unknown rig maintainers subcommand: ${sub}`
+      );
+      io2.err(MAINTAINERS_USAGE);
+      return 2;
+  }
+}
+async function runList2(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    const { values, positionals } = parseArgs12({
+      args,
+      options: MAINT_OPTIONS,
+      allowPositionals: true
+    });
+    if (positionals.length > 0) {
+      throw new Error("rig maintainers list takes no positional arguments");
+    }
+    flags = pickFlags(values);
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(MAINTAINERS_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(MAINTAINERS_USAGE);
+    return 0;
+  }
+  try {
+    const ctx = await resolveContext(flags, deps);
+    const wsRelays = ctx.relays.filter((url) => WS_URL_RE4.test(url));
+    if (wsRelays.length === 0) {
+      throw new InvalidRelayUrlError(
+        ctx.relays[0] ?? "",
+        "reads need a ws:// or wss:// relay"
+      );
+    }
+    const remote = await fetchRemoteState({
+      relayUrls: wsRelays,
+      ownerPubkey: ctx.owner,
+      repoId: ctx.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    const maintainers = remote.maintainers;
+    if (flags.json) {
+      io2.emitJson({
+        command: "maintainers list",
+        repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+        announced: remote.announced,
+        owner: ctx.owner,
+        maintainers
+      });
+      return 0;
+    }
+    io2.out(`Repo:    30617:${ctx.owner}:${ctx.repoId}`);
+    io2.out(`Owner:   ${ctx.owner}  (implicit maintainer)`);
+    if (!remote.announced) {
+      io2.out("No kind:30617 announcement found \u2014 owner-only authority.");
+      return 0;
+    }
+    if (maintainers.length === 0) {
+      io2.out("Maintainers: (none declared \u2014 owner-only authority)");
+    } else {
+      io2.out(`Maintainers (${maintainers.length}):`);
+      for (const m of maintainers) io2.out(`  ${m}`);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, "maintainers list", err);
+  }
+}
+async function runMutate(op, args, deps) {
+  const { io: io2 } = deps;
+  const command = `maintainers ${op}`;
+  let flags;
+  let pubkey;
+  try {
+    const { values, positionals } = parseArgs12({
+      args,
+      options: MAINT_OPTIONS,
+      allowPositionals: true
+    });
+    flags = pickFlags(values);
+    if (flags.help) {
+      io2.out(MAINTAINERS_USAGE);
+      return 0;
+    }
+    if (positionals.length !== 1) {
+      throw new Error(`expected exactly one <pubkey> to ${op}`);
+    }
+    pubkey = ownerToHex(positionals[0]).toLowerCase();
+    if (!HEX64_RE3.test(pubkey)) {
+      throw new Error(`<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`);
+    }
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(MAINTAINERS_USAGE);
+    return 2;
+  }
+  let standaloneCtx;
+  try {
+    const ctx = await resolveContext(flags, deps);
+    if (ctx.relays.length > 1) {
+      io2.err(singleRelayRefusal(ctx.resolved, "Nothing was published or paid."));
+      return 1;
+    }
+    const relayUrl = ctx.relays[0];
+    if (relayUrl === void 0 || !WS_URL_RE4.test(relayUrl)) {
+      throw new InvalidRelayUrlError(
+        relayUrl ?? "",
+        "a paid publish needs a ws:// or wss:// relay"
+      );
+    }
+    const load = deps.loadStandalone ?? defaultLoadStandalone;
+    standaloneCtx = await load({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line),
+      relayUrl
+    });
+    const identity = identityReport(standaloneCtx);
+    if (identity.pubkey.toLowerCase() !== ctx.owner.toLowerCase()) {
+      io2.err(
+        `rig: only the repo owner (${ctx.owner.slice(0, 8)}\u2026) can change the maintainer set \u2014 the active identity is ${identity.pubkey.slice(0, 8)}\u2026. A non-owner republish would write your own (ignored) announcement. Nothing was published or paid.`
+      );
+      return 1;
+    }
+    const remote = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: ctx.owner,
+      repoId: ctx.repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+    });
+    if (!remote.announced) {
+      io2.err(
+        `rig: 30617:${ctx.owner.slice(0, 8)}\u2026:${ctx.repoId} has no announcement yet \u2014 run \`rig push\` to publish the repo (with its real name/description) before managing maintainers. Nothing was published or paid.`
+      );
+      return 1;
+    }
+    const current = remote.announceEvent ? parseMaintainers(remote.announceEvent.tags) : [];
+    const currentSet = new Set(current);
+    if (op === "add" && currentSet.has(pubkey)) {
+      io2.err(
+        `rig: ${pubkey.slice(0, 8)}\u2026 is already a maintainer \u2014 nothing to do (not published).`
+      );
+      return 0;
+    }
+    if (op === "remove" && !currentSet.has(pubkey)) {
+      io2.err(
+        `rig: ${pubkey.slice(0, 8)}\u2026 is not a declared maintainer \u2014 nothing to do (not published).`
+      );
+      return 0;
+    }
+    const next = op === "add" ? [...current, pubkey] : current.filter((m) => m !== pubkey);
+    const name = remote.name ?? ctx.repoId;
+    const description = remote.description ?? "";
+    const event = buildRepoAnnouncement(ctx.repoId, name, description, next);
+    const fee = (await standaloneCtx.publisher.getFeeRates()).eventFee.toString();
+    const action = `kind:30617 maintainers ${op} ${pubkey.slice(0, 8)}\u2026`;
+    if (!flags.json) {
+      io2.out(`Republish ${action}`);
+      io2.out(`Repo: 30617:${ctx.owner}:${ctx.repoId}`);
+      io2.out(`Maintainers after: ${next.length === 0 ? "(none)" : next.join(", ")}`);
+      io2.out(`Fee: ${feeLabel(fee)}. Writes are permanent and non-refundable.`);
+    }
+    if (!flags.yes) {
+      if (flags.json) {
+        io2.emitJson({
+          command,
+          repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+          identity,
+          executed: false,
+          feeEstimate: fee,
+          maintainers: next,
+          hint: "estimate only \u2014 re-run with --yes to publish (permanent, non-refundable)"
+        });
+        return 0;
+      }
+      if (!io2.isInteractive) {
+        io2.err(
+          "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
+        );
+        return 1;
+      }
+      const proceed = await io2.confirm(
+        `Proceed with paid republish (${feeLabel(fee)})? [y/N] `
+      );
+      if (!proceed) {
+        io2.err("aborted \u2014 nothing was published.");
+        return 1;
+      }
+    }
+    const receipt = await standaloneCtx.publisher.publishEvent(event, [
+      relayUrl
+    ]);
+    const result = serializeEventReceipt(event.kind, receipt);
+    if (flags.json) {
+      io2.emitJson({
+        command,
+        repoAddr: { ownerPubkey: ctx.owner, repoId: ctx.repoId },
+        identity,
+        executed: true,
+        feeEstimate: fee,
+        maintainers: next,
+        result
+      });
+    } else {
+      io2.out(
+        `Published ${action}: ${result.eventId}  paid ${result.feePaid} base units`
+      );
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, flags.json, command, err);
+  } finally {
+    if (standaloneCtx) {
+      try {
+        await standaloneCtx.stop();
+      } catch {
+      }
+    }
+  }
+}
+
 // src/cli/dispatch.ts
 var USAGE = `rig \u2014 git with a TOON remote (pay-to-write Nostr + Arweave)
 
 Usage: rig <command> [options]
 
 Commands rig owns:
-  init                       set up this repo: resolve your identity
-                             (RIG_MNEMONIC) and write the toon.* git config
+  identity create            generate a fresh identity (BIP-39) into the
+                             encrypted keystore \u2014 the phrase is shown ONCE;
+                             back it up. This is your first step on a new box
+  identity show              the active identity's source + derived pubkey
+                             (never the phrase)
+  identity import            write an EXISTING phrase (read from stdin) to the
+                             encrypted keystore
+  init                       set up this repo: resolve your identity (or offer
+                             to generate one) and write the toon.* git config
   remote add <name> <url>    add a relay as a REAL git remote ("origin" is
   remote remove <name>       the default publish target); remove/list manage
   remote list                them \u2014 \`git remote -v\` shows the same data
@@ -3749,6 +4618,10 @@ Commands rig owns:
                              \`git format-patch\` content
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
+  maintainers list           show the repo's declared maintainers (free); add/
+  maintainers add <pubkey>   remove republish the kind:30617 to change who may
+  maintainers remove <pubkey>  author authoritative issue/PR status (owner is
+                             always an implicit maintainer)
   fund                       drip devnet faucet funds to this identity's
                              wallet (free); on other networks prints the
                              address(es) to fund externally
@@ -3797,6 +4670,8 @@ async function dispatch(argv2, deps) {
   switch (command) {
     case "init":
       return runInit(rest, deps);
+    case "identity":
+      return runIdentity(rest, deps);
     case "remote":
       return runRemote(rest, deps);
     // The #278 read path — FREE (relay + Arweave gateway reads, no payment).
@@ -3812,6 +4687,8 @@ async function dispatch(argv2, deps) {
       return runComment(rest, deps);
     case "pr":
       return runPr(rest, deps);
+    case "maintainers":
+      return runMaintainers(rest, deps);
     case "channel":
       return runChannel(rest, deps);
     case "fund":
@@ -3882,6 +4759,7 @@ function makeCliIo(options) {
 }
 var RIG_OWNED_VERBS = /* @__PURE__ */ new Set([
   "init",
+  "identity",
   "remote",
   "clone",
   "fetch",
@@ -3889,6 +4767,7 @@ var RIG_OWNED_VERBS = /* @__PURE__ */ new Set([
   "issue",
   "comment",
   "pr",
+  "maintainers",
   "channel",
   "fund",
   "balance"
@@ -3958,7 +4837,7 @@ function makeIo(jsonMode) {
     },
     isInteractive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     confirm: async (question) => {
-      const rl = createInterface({
+      const rl = createInterface2({
         input: process.stdin,
         output: process.stderr
       });