@toon-protocol/rig 2.3.0 → 2.4.0

package/dist/{standalone-mode-JLGAUMRF.js → standalone-mode-VH2XPOPK.js}

@@ -1,6 +1,6 @@
 import {
   resolveIdentity
-} from "./chunk-CW4HJNMU.js";
+} from "./chunk-XGFBDUQX.js";
 import {
   fetchRemoteState,
   queryRelay
@@ -862,4 +862,4 @@ export {
   createStandaloneContext,
   resolveNetworkTopology
 };
-//# sourceMappingURL=standalone-mode-JLGAUMRF.js.map
+//# sourceMappingURL=standalone-mode-VH2XPOPK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toon-protocol/rig",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Git-to-TOON write path core — build git objects and NIP-34 events for the Rig control plane",
   "license": "MIT",
   "author": "Jonathan Green",

package/dist/chunk-CW4HJNMU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/cli/identity.ts"],"sourcesContent":["/**\n * Identity resolution for the standalone-only `rig` CLI (#248).\n *\n * One precedence chain, used by every command that signs or pays:\n *\n *   1. `RIG_MNEMONIC` environment variable\n *   2. `TOON_CLIENT_MNEMONIC` environment variable — DEPRECATED alias of the\n *      env tier (a one-line stderr warning fires when it is the source)\n *   3. project-local `.env` — walked up from the working directory (through\n *      the repo root to the filesystem root); ONLY the `RIG_MNEMONIC` line is\n *      parsed out of it (never loaded into the process env, never required\n *      to exist)\n *   4. the shared `~/.toon-client` state dir (`TOON_CLIENT_HOME` override):\n *      encrypted keystore (`keystorePath` + `TOON_CLIENT_KEYSTORE_PASSWORD`,\n *      auto-password fallback for daemon-provisioned keystores), then the\n *      plain `mnemonic` config field — the pre-#248 standalone-context logic\n *\n * The BIP-44 `mnemonicAccountIndex` from the shared config file applies to\n * every source (same convention as the daemon), so the derived pubkey never\n * depends on WHERE the phrase came from.\n *\n * The phrase itself is never written anywhere by rig (not to git config, not\n * to any repo file) and never printed — callers report only the SOURCE and\n * the derived pubkey.\n *\n * Key derivation and keystore decryption live in the `@toon-protocol/client`\n * dependency, loaded via dynamic import so this module can be statically\n * imported by every command without dragging the client into runs that fail\n * earlier (usage errors, missing git repo, …).\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\n\n/** Where the mnemonic came from (reported in output; the phrase never is). */\nexport type IdentitySourceKind =\n  /** `RIG_MNEMONIC` environment variable. */\n  | 'env'\n  /** `TOON_CLIENT_MNEMONIC` environment variable (deprecated alias). */\n  | 'env-alias'\n  /** `RIG_MNEMONIC` parsed out of a project-local `.env` file. */\n  | 'dotenv'\n  /** Encrypted keystore referenced by the shared client config. */\n  | 'keystore'\n  /** Plain `mnemonic` field of the shared client config file. */\n  | 'config';\n\n/** A resolved signing identity: source + derived pubkey (never the phrase). */\nexport interface ResolvedIdentity {\n  /** The BIP-39 phrase. Handle with care; never log or persist it. */\n  mnemonic: string;\n  /** BIP-44 account index used for derivation (shared config, default 0). */\n  accountIndex: number;\n  source: IdentitySourceKind;\n  /** Human-facing source label, e.g. `RIG_MNEMONIC env` or a file path. */\n  sourceLabel: string;\n  /** Derived Nostr pubkey (hex) — the repo owner / `toon.owner` value. */\n  pubkey: string;\n}\n\n/** No mnemonic could be resolved anywhere on the chain. */\nexport class MissingIdentityError extends Error {\n  constructor(configPath: string) {\n    super(\n      'no identity found — rig needs a BIP-39 seed phrase to sign and pay. ' +\n        'Provide one of (highest precedence first):\\n' +\n        '  • RIG_MNEMONIC environment variable\\n' +\n        '  • RIG_MNEMONIC=<phrase> in a project-local .env file (gitignore it!)\\n' +\n        `  • the shared client config at ${configPath} (mnemonic or ` +\n        'keystorePath + TOON_CLIENT_KEYSTORE_PASSWORD)'\n    );\n    this.name = 'MissingIdentityError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Shared client config conventions (duplicated from client-mcp — the same\n// note as standalone/nonce-guard.ts: no @toon-protocol/client-mcp import)\n// ---------------------------------------------------------------------------\n\n/** Duplicated daemon convention: auto-keystore password. */\nconst DEFAULT_KEYSTORE_PASSWORD = 'toon-client-default';\n\n/** Shared client state dir: `TOON_CLIENT_HOME`, else `~/.toon-client`. */\nexport function clientConfigPath(env: NodeJS.ProcessEnv): string {\n  const dir = env['TOON_CLIENT_HOME'] ?? join(homedir(), '.toon-client');\n  return join(dir, 'config.json');\n}\n\n/** The subset of the shared client config file identity resolution reads. */\ninterface ClientConfigIdentityFields {\n  mnemonic?: unknown;\n  mnemonicAccountIndex?: unknown;\n  keystorePath?: unknown;\n  keystoreAutoPassword?: unknown;\n}\n\nfunction readClientConfigFile(path: string): ClientConfigIdentityFields {\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as ClientConfigIdentityFields;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return {};\n    throw new Error(\n      `failed to read client config at ${path}: ${err instanceof Error ? err.message : String(err)}`\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// .env parsing (RIG_MNEMONIC only — never arbitrary env loading)\n// ---------------------------------------------------------------------------\n\nconst DOTENV_LINE_RE = /^\\s*(?:export\\s+)?RIG_MNEMONIC\\s*=\\s*(.*)\\s*$/;\n\n/**\n * Extract ONLY the `RIG_MNEMONIC` value from `.env` file content. Supports\n * `export ` prefixes, single/double quotes, full-line `#` comments, and\n * inline ` #` comments on unquoted values. Multiple assignments: the last\n * one wins (shell-sourcing semantics). An empty value counts as unset.\n * Nothing is ever loaded into `process.env`.\n */\nexport function parseDotenvMnemonic(content: string): string | undefined {\n  let found: string | undefined;\n  for (const line of content.split(/\\r?\\n/)) {\n    const match = DOTENV_LINE_RE.exec(line);\n    if (!match) continue;\n    let value = (match[1] ?? '').trim();\n    const quote = value[0];\n    if ((quote === '\"' || quote === \"'\") && value.length >= 2 && value.endsWith(quote)) {\n      value = value.slice(1, -1);\n    } else {\n      // Unquoted: an inline comment starts at the first whitespace-preceded #.\n      const hash = value.search(/\\s#/);\n      if (hash !== -1) value = value.slice(0, hash);\n      value = value.trim();\n    }\n    if (value !== '') found = value;\n  }\n  return found;\n}\n\n/**\n * Walk up from `startDir` (the working directory — the walk passes through\n * the repo root) to the filesystem root, returning the first `.env` file\n * that defines `RIG_MNEMONIC`. `stopDir` bounds the walk (tests).\n */\nexport function findDotenvMnemonic(\n  startDir: string,\n  stopDir?: string\n): { path: string; mnemonic: string } | undefined {\n  let dir = startDir;\n  for (;;) {\n    const candidate = join(dir, '.env');\n    if (existsSync(candidate)) {\n      try {\n        const mnemonic = parseDotenvMnemonic(readFileSync(candidate, 'utf8'));\n        if (mnemonic !== undefined) return { path: candidate, mnemonic };\n      } catch {\n        // Unreadable .env → keep walking; the file is never required.\n      }\n    }\n    if (stopDir !== undefined && dir === stopDir) return undefined;\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Resolution\n// ---------------------------------------------------------------------------\n\nexport interface ResolveIdentityOptions {\n  env: NodeJS.ProcessEnv;\n  /** Working directory the `.env` walk starts from. */\n  cwd: string;\n  /** Stderr line sink for the deprecated-alias warning. */\n  warn(line: string): void;\n  /** Bound the `.env` walk-up (tests only). */\n  dotenvStopDir?: string;\n}\n\n/** The resolved source before any derivation (dependency-free). */\ninterface MnemonicSource {\n  mnemonic: string;\n  source: IdentitySourceKind;\n  sourceLabel: string;\n}\n\nfunction resolveMnemonicSource(\n  options: ResolveIdentityOptions,\n  file: ClientConfigIdentityFields,\n  configPath: string\n): MnemonicSource | { keystorePath: string } {\n  const { env } = options;\n\n  const rigEnv = env['RIG_MNEMONIC']?.trim();\n  if (rigEnv) {\n    return { mnemonic: rigEnv, source: 'env', sourceLabel: 'RIG_MNEMONIC env' };\n  }\n\n  const aliasEnv = env['TOON_CLIENT_MNEMONIC']?.trim();\n  if (aliasEnv) {\n    options.warn(\n      'rig: TOON_CLIENT_MNEMONIC is deprecated — rename the variable to RIG_MNEMONIC'\n    );\n    return {\n      mnemonic: aliasEnv,\n      source: 'env-alias',\n      sourceLabel: 'TOON_CLIENT_MNEMONIC env (deprecated alias)',\n    };\n  }\n\n  const dotenv = findDotenvMnemonic(options.cwd, options.dotenvStopDir);\n  if (dotenv) {\n    return {\n      mnemonic: dotenv.mnemonic,\n      source: 'dotenv',\n      sourceLabel: dotenv.path,\n    };\n  }\n\n  if (typeof file.keystorePath === 'string' && file.keystorePath !== '') {\n    return { keystorePath: file.keystorePath };\n  }\n  if (typeof file.mnemonic === 'string' && file.mnemonic.trim() !== '') {\n    return {\n      mnemonic: file.mnemonic.trim(),\n      source: 'config',\n      sourceLabel: configPath,\n    };\n  }\n  throw new MissingIdentityError(configPath);\n}\n\n/**\n * Load the client key helpers. `@toon-protocol/client` is a regular runtime\n * dependency (#259); the import stays dynamic purely so commands that fail\n * earlier never pay its startup cost.\n */\nasync function loadClientKeys(): Promise<{\n  loadKeystore(path: string, password: string): string;\n  deriveNostrKeyFromMnemonic(\n    mnemonic: string,\n    accountIndex?: number\n  ): { secretKey: Uint8Array; pubkey: string };\n}> {\n  return await import('@toon-protocol/client');\n}\n\n/**\n * Resolve the CLI signing identity along the precedence chain and derive its\n * Nostr pubkey. Throws {@link MissingIdentityError} (with the full\n * three-option remediation) when nothing on the chain yields a phrase.\n */\nexport async function resolveIdentity(\n  options: ResolveIdentityOptions\n): Promise<ResolvedIdentity> {\n  const configPath = clientConfigPath(options.env);\n  const file = readClientConfigFile(configPath);\n  const picked = resolveMnemonicSource(options, file, configPath);\n\n  const keys = await loadClientKeys();\n  let source: MnemonicSource;\n  if ('keystorePath' in picked) {\n    const password =\n      options.env['TOON_CLIENT_KEYSTORE_PASSWORD'] ??\n      (file.keystoreAutoPassword === true ? DEFAULT_KEYSTORE_PASSWORD : undefined);\n    if (!password) {\n      throw new Error(\n        `keystorePath is set in ${configPath} but TOON_CLIENT_KEYSTORE_PASSWORD is not provided`\n      );\n    }\n    source = {\n      mnemonic: keys.loadKeystore(picked.keystorePath, password),\n      source: 'keystore',\n      sourceLabel: picked.keystorePath,\n    };\n  } else {\n    source = picked;\n  }\n\n  const accountIndex =\n    typeof file.mnemonicAccountIndex === 'number' ? file.mnemonicAccountIndex : 0;\n  const { pubkey } = keys.deriveNostrKeyFromMnemonic(source.mnemonic, accountIndex);\n  return { ...source, accountIndex, pubkey };\n}\n"],"mappings":";AA+BA,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AA6BvB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,YAAoB;AAC9B;AAAA,MACE;AAAA;AAAA;AAAA,uCAIqC,UAAU;AAAA,IAEjD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAQA,IAAM,4BAA4B;AAG3B,SAAS,iBAAiB,KAAgC;AAC/D,QAAM,MAAM,IAAI,kBAAkB,KAAK,KAAK,QAAQ,GAAG,cAAc;AACrE,SAAO,KAAK,KAAK,aAAa;AAChC;AAUA,SAAS,qBAAqB,MAA0C;AACtE,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM,IAAI;AAAA,MACR,mCAAmC,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;AAMA,IAAM,iBAAiB;AAShB,SAAS,oBAAoB,SAAqC;AACvE,MAAI;AACJ,aAAW,QAAQ,QAAQ,MAAM,OAAO,GAAG;AACzC,UAAM,QAAQ,eAAe,KAAK,IAAI;AACtC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS,MAAM,CAAC,KAAK,IAAI,KAAK;AAClC,UAAM,QAAQ,MAAM,CAAC;AACrB,SAAK,UAAU,OAAO,UAAU,QAAQ,MAAM,UAAU,KAAK,MAAM,SAAS,KAAK,GAAG;AAClF,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B,OAAO;AAEL,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,SAAS,GAAI,SAAQ,MAAM,MAAM,GAAG,IAAI;AAC5C,cAAQ,MAAM,KAAK;AAAA,IACrB;AACA,QAAI,UAAU,GAAI,SAAQ;AAAA,EAC5B;AACA,SAAO;AACT;AAOO,SAAS,mBACd,UACA,SACgD;AAChD,MAAI,MAAM;AACV,aAAS;AACP,UAAM,YAAY,KAAK,KAAK,MAAM;AAClC,QAAI,WAAW,SAAS,GAAG;AACzB,UAAI;AACF,cAAM,WAAW,oBAAoB,aAAa,WAAW,MAAM,CAAC;AACpE,YAAI,aAAa,OAAW,QAAO,EAAE,MAAM,WAAW,SAAS;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,YAAY,UAAa,QAAQ,QAAS,QAAO;AACrD,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAuBA,SAAS,sBACP,SACA,MACA,YAC2C;AAC3C,QAAM,EAAE,IAAI,IAAI;AAEhB,QAAM,SAAS,IAAI,cAAc,GAAG,KAAK;AACzC,MAAI,QAAQ;AACV,WAAO,EAAE,UAAU,QAAQ,QAAQ,OAAO,aAAa,mBAAmB;AAAA,EAC5E;AAEA,QAAM,WAAW,IAAI,sBAAsB,GAAG,KAAK;AACnD,MAAI,UAAU;AACZ,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AAEA,QAAM,SAAS,mBAAmB,QAAQ,KAAK,QAAQ,aAAa;AACpE,MAAI,QAAQ;AACV,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,IAAI;AACrE,WAAO,EAAE,cAAc,KAAK,aAAa;AAAA,EAC3C;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,MAAM,IAAI;AACpE,WAAO;AAAA,MACL,UAAU,KAAK,SAAS,KAAK;AAAA,MAC7B,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AACA,QAAM,IAAI,qBAAqB,UAAU;AAC3C;AAOA,eAAe,iBAMZ;AACD,SAAO,MAAM,OAAO,uBAAuB;AAC7C;AAOA,eAAsB,gBACpB,SAC2B;AAC3B,QAAM,aAAa,iBAAiB,QAAQ,GAAG;AAC/C,QAAM,OAAO,qBAAqB,UAAU;AAC5C,QAAM,SAAS,sBAAsB,SAAS,MAAM,UAAU;AAE9D,QAAM,OAAO,MAAM,eAAe;AAClC,MAAI;AACJ,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,WACJ,QAAQ,IAAI,+BAA+B,MAC1C,KAAK,yBAAyB,OAAO,4BAA4B;AACpE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,0BAA0B,UAAU;AAAA,MACtC;AAAA,IACF;AACA,aAAS;AAAA,MACP,UAAU,KAAK,aAAa,OAAO,cAAc,QAAQ;AAAA,MACzD,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,OAAO;AACL,aAAS;AAAA,EACX;AAEA,QAAM,eACJ,OAAO,KAAK,yBAAyB,WAAW,KAAK,uBAAuB;AAC9E,QAAM,EAAE,OAAO,IAAI,KAAK,2BAA2B,OAAO,UAAU,YAAY;AAChF,SAAO,EAAE,GAAG,QAAQ,cAAc,OAAO;AAC3C;","names":[]}