@toon-protocol/rig 2.3.0 → 2.4.1

package/dist/cli/rig.js

@@ -19,9 +19,14 @@ import {
   writeGitObjects
 } from "../chunk-W2SDL2PE.js";
 import {
+  DEFAULT_KEYSTORE_PASSWORD,
   MissingIdentityError,
+  clientConfigPath,
+  clientKeystorePath,
+  linkKeystoreInClientConfig,
+  readClientConfigFile,
   resolveIdentity
-} from "../chunk-CW4HJNMU.js";
+} from "../chunk-XGFBDUQX.js";
 import {
   COMMENT_KIND,
   authorizedStatusAuthors,
@@ -45,7 +50,7 @@ import {
 } from "../chunk-X2CZPPDM.js";
 
 // src/cli/rig.ts
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 
 // src/cli/dispatch.ts
 import { createRequire } from "module";
@@ -900,7 +905,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("../standalone-mode-JLGAUMRF.js");
+  const mod = await import("../standalone-mode-VH2XPOPK.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -3434,7 +3439,9 @@ pays). The identity comes from RIG_MNEMONIC (env or a project .env) or the
 ~/.toon-client keystore/config; the faucet from TOON_CLIENT_FAUCET_URL, the
 faucetUrl config field, or the deployed devnet faucet when the network is
 devnet \u2014 including when a configured *.devnet.toonprotocol.dev origin infers
-it. The faucet drips a FIXED amount per chain (there is no --amount). On a
+it (a devnet relay/proxy/btp endpoint, or the git origin remote from
+\`rig remote add origin <devnet relay>\`). The faucet drips a FIXED amount per
+chain (there is no --amount). On a
 network without a faucet, prints the wallet address(es) to fund externally
 instead.
 
@@ -3445,24 +3452,50 @@ Options:
   --json               machine-readable envelope
   -h, --help           show this help`;
 var SHARED_DEVNET_SUFFIX = ".devnet.toonprotocol.dev";
-function sharedDevnetOrigin(env, file) {
+function devnetHost(url) {
+  if (!url) return void 0;
+  try {
+    const { hostname } = new URL(url);
+    if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1)) {
+      return url;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function sharedDevnetOrigin(env, file, originRelays = []) {
   const candidates = [
     env["TOON_CLIENT_RELAY_URL"] ?? file.relayUrl,
     env["TOON_CLIENT_PROXY_URL"] ?? file.proxyUrl,
-    env["TOON_CLIENT_BTP_URL"] ?? file.btpUrl
+    env["TOON_CLIENT_BTP_URL"] ?? file.btpUrl,
+    ...originRelays
   ];
   for (const url of candidates) {
-    if (!url) continue;
-    try {
-      const { hostname } = new URL(url);
-      if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1)) {
-        return url;
-      }
-    } catch {
-    }
+    const hit = devnetHost(url);
+    if (hit) return hit;
   }
   return void 0;
 }
+async function resolveOriginRelays(cwd) {
+  let repoRoot;
+  try {
+    repoRoot = await resolveRepoRoot(cwd);
+  } catch {
+    return [];
+  }
+  try {
+    const toonConfig = await readToonConfig(repoRoot);
+    const resolved = await resolveRelays({
+      relayFlags: [],
+      remoteName: void 0,
+      repoRoot,
+      toonRelays: toonConfig.relays
+    });
+    return resolved.relays;
+  } catch {
+    return [];
+  }
+}
 function noFaucetGuidance(network, devnetOrigin) {
   const head = `no faucet is configured for network ${JSON.stringify(network ?? "custom")}`;
   const external = "To fund the wallet externally instead, send the settlement token plus native gas to the address below for the chain your channels settle on.";
@@ -3529,7 +3562,9 @@ async function runFund(args, deps) {
       );
     }
     const network = env["TOON_CLIENT_NETWORK"] ?? file.network;
-    const devnetOrigin = sharedDevnetOrigin(env, file);
+    const canInfer = network === void 0 || network === "custom";
+    const originRelays = canInfer ? await resolveOriginRelays(deps.cwd) : [];
+    const devnetOrigin = sharedDevnetOrigin(env, file, originRelays);
     const inferredDevnet = devnetOrigin !== void 0 && (network === void 0 || network === "custom");
     const effectiveNetwork = inferredDevnet ? "devnet" : network;
     const faucetUrl = env["TOON_CLIENT_FAUCET_URL"] ?? file.faucetUrl ?? (effectiveNetwork === "devnet" ? DEVNET_FAUCET_URL : void 0);
@@ -3668,9 +3703,396 @@ var runGitPassthrough = (argv2, options = {}) => {
   });
 };
 
+// src/cli/identity-cmd.ts
+import { existsSync, mkdirSync } from "fs";
+import { dirname as dirname2 } from "path";
+import { createInterface } from "readline/promises";
+import { parseArgs as parseArgs10 } from "util";
+async function loadKeyOps() {
+  return await import("@toon-protocol/client");
+}
+var IdentityExistsError = class extends Error {
+  constructor(pubkey, sourceLabel) {
+    super(
+      `an identity already resolves (${pubkey}, from ${sourceLabel}) \u2014 rig will not overwrite it. Inspect it with \`rig identity show\`, or pass \`--force\` to replace the keystore with a brand-new identity (the old phrase becomes unrecoverable unless you backed it up).`
+    );
+    this.pubkey = pubkey;
+    this.sourceLabel = sourceLabel;
+    this.name = "IdentityExistsError";
+  }
+  pubkey;
+  sourceLabel;
+};
+var KeystoreFileExistsError = class extends Error {
+  constructor(keystorePath) {
+    super(
+      `a keystore file already exists at ${keystorePath} \u2014 rig will not overwrite it. Link it via the client config, or pass \`--force\` to replace it with a new identity.`
+    );
+    this.keystorePath = keystorePath;
+    this.name = "KeystoreFileExistsError";
+  }
+  keystorePath;
+};
+async function prepareKeystoreTarget(input) {
+  const keyOps = await (input.loadKeyOps ?? loadKeyOps)();
+  const resolveImpl = input.resolveIdentityImpl ?? resolveIdentity;
+  let existing;
+  try {
+    existing = await resolveImpl({
+      env: input.env,
+      cwd: input.cwd,
+      warn: input.warn
+    });
+  } catch (err) {
+    if (!(err instanceof MissingIdentityError)) throw err;
+  }
+  if (existing && !input.force) {
+    throw new IdentityExistsError(existing.pubkey, existing.sourceLabel);
+  }
+  const keystorePath = clientKeystorePath(input.env);
+  if (existsSync(keystorePath) && !input.force) {
+    throw new KeystoreFileExistsError(keystorePath);
+  }
+  const envPassword = input.env["TOON_CLIENT_KEYSTORE_PASSWORD"]?.trim() || void 0;
+  const autoPassword = envPassword === void 0;
+  const password = envPassword ?? DEFAULT_KEYSTORE_PASSWORD;
+  mkdirSync(dirname2(keystorePath), { recursive: true });
+  return { keystorePath, password, autoPassword, existing, keyOps };
+}
+function readAccountIndex(env) {
+  const file = readClientConfigFile(clientConfigPath(env));
+  return typeof file.mnemonicAccountIndex === "number" ? file.mnemonicAccountIndex : 0;
+}
+function finishMint(input, target, mnemonic) {
+  const configPath = linkKeystoreInClientConfig(
+    input.env,
+    target.keystorePath,
+    target.autoPassword
+  );
+  const accountIndex = readAccountIndex(input.env);
+  const { pubkey } = target.keyOps.deriveNostrKeyFromMnemonic(
+    mnemonic,
+    accountIndex
+  );
+  const result = {
+    mnemonic,
+    pubkey,
+    keystorePath: target.keystorePath,
+    configPath,
+    autoPassword: target.autoPassword,
+    accountIndex
+  };
+  if (target.existing && target.existing.pubkey !== pubkey) {
+    result.shadowedBy = {
+      sourceLabel: target.existing.sourceLabel,
+      pubkey: target.existing.pubkey
+    };
+  }
+  return result;
+}
+async function createIdentity(input) {
+  const target = await prepareKeystoreTarget(input);
+  const { mnemonic } = target.keyOps.generateKeystore(
+    target.keystorePath,
+    target.password
+  );
+  return finishMint(input, target, mnemonic);
+}
+async function importIdentity(input) {
+  const target = await prepareKeystoreTarget(input);
+  target.keyOps.importKeystore(
+    target.keystorePath,
+    input.mnemonic,
+    target.password
+  );
+  return finishMint(input, target, input.mnemonic);
+}
+function createdIdentityBanner(result) {
+  return [
+    "",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "  rig: generated a new identity",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    `  Nostr pubkey : ${result.pubkey}`,
+    "",
+    "  Seed phrase \u2014 this phrase CONTROLS YOUR FUNDS. Write it down and",
+    "  store it safely. It is shown ONCE and CANNOT be recovered:",
+    "",
+    `    ${result.mnemonic}`,
+    "",
+    `  Encrypted keystore: ${result.keystorePath}`,
+    result.autoPassword ? "  Encrypted with the default password, so the identity reloads with no\n  env var. To use your own password: set TOON_CLIENT_KEYSTORE_PASSWORD\n  and re-import with `rig identity import`." : "  Encrypted with your TOON_CLIENT_KEYSTORE_PASSWORD.",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    ""
+  ];
+}
+function shadowNote(shadowedBy) {
+  return `note: a higher-precedence identity (${shadowedBy.pubkey}, from ${shadowedBy.sourceLabel}) still shadows the new keystore \u2014 rig keeps using it until you remove that source (unset the env var / edit .env).`;
+}
+var IDENTITY_USAGE = `Usage: rig identity <command> [options]
+
+Manage the BIP-39 signing identity rig uses to sign and pay:
+
+  create   generate a fresh identity into the encrypted keystore under
+           TOON_CLIENT_HOME. The seed phrase is shown ONCE \u2014 back it up.
+           Refuses to overwrite an existing identity without --force.
+  show     report the ACTIVE identity's source + derived pubkey (never the
+           phrase); errors with the resolution remediation when none exists.
+  import   read an EXISTING phrase from stdin (never a CLI argument) and write
+           it to the encrypted keystore.
+
+Options:
+  --force              (create/import) replace an existing identity/keystore
+  --json               machine-readable output. NOTE: \`identity create --json\`
+                       DELIBERATELY emits the seed phrase in a \`mnemonic\`
+                       field \u2014 treat that output as SECRET. \`identity show\`
+                       and \`identity import\` never emit the phrase.
+  -h, --help           show this help
+
+The keystore is encrypted with TOON_CLIENT_KEYSTORE_PASSWORD when that env var
+is set, else a default password so the identity reloads with no configuration.
+rig deliberately does NOT accept the keystore password as a CLI flag \u2014 that
+would leak the value that decrypts your keys to shell history and \`ps\`.`;
+async function runIdentity(args, deps) {
+  const [sub, ...rest] = args;
+  switch (sub) {
+    case "create":
+      return runIdentityCreate(rest, deps);
+    case "show":
+      return runIdentityShow(rest, deps);
+    case "import":
+      return runIdentityImport(rest, deps);
+    case "help":
+    case "--help":
+    case "-h":
+      deps.io.out(IDENTITY_USAGE);
+      return 0;
+    case void 0:
+      deps.io.err("rig identity needs a subcommand: create | show | import");
+      deps.io.err(IDENTITY_USAGE);
+      return 2;
+    default:
+      deps.io.err(`unknown rig identity subcommand: ${sub}`);
+      deps.io.err(IDENTITY_USAGE);
+      return 2;
+  }
+}
+function parseMintArgs(args, verb) {
+  const { values, positionals } = parseArgs10({
+    args,
+    options: {
+      force: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: false
+  });
+  if (positionals.length > 0) {
+    throw new Error(`rig identity ${verb} takes no positional arguments`);
+  }
+  return {
+    force: values.force ?? false,
+    json: values.json ?? false,
+    help: values.help ?? false
+  };
+}
+async function runIdentityCreate(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    flags = parseMintArgs(args, "create");
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const result = await createIdentity({
+      env: deps.env,
+      cwd: deps.cwd,
+      force: flags.force,
+      warn: (line) => io2.err(line),
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {},
+      ...deps.loadKeyOps ? { loadKeyOps: deps.loadKeyOps } : {}
+    });
+    emitCreated(io2, flags.json, "identity create", result);
+    return 0;
+  } catch (err) {
+    return emitMintError(io2, flags.json, "identity create", err);
+  }
+}
+async function runIdentityImport(args, deps) {
+  const { io: io2 } = deps;
+  let flags;
+  try {
+    flags = parseMintArgs(args, "import");
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (flags.help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const read = deps.readSecretLine ?? defaultReadSecretLine;
+    const phrase = (await read(
+      "Paste your BIP-39 seed phrase (read from stdin, not the terminal history): ",
+      io2.isInteractive
+    )).trim();
+    if (phrase === "") {
+      throw new Error(
+        "no seed phrase provided on stdin \u2014 pipe it in or type it at the prompt (never pass a phrase as a CLI argument; it leaks to shell history and `ps`)."
+      );
+    }
+    const result = await importIdentity({
+      env: deps.env,
+      cwd: deps.cwd,
+      force: flags.force,
+      mnemonic: phrase,
+      warn: (line) => io2.err(line),
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {},
+      ...deps.loadKeyOps ? { loadKeyOps: deps.loadKeyOps } : {}
+    });
+    if (flags.json) {
+      io2.emitJson({
+        command: "identity import",
+        imported: true,
+        pubkey: result.pubkey,
+        keystorePath: result.keystorePath,
+        autoPassword: result.autoPassword,
+        ...result.shadowedBy ? { shadowedBy: result.shadowedBy } : {}
+      });
+    } else {
+      io2.out(`Imported identity ${result.pubkey}`);
+      io2.out(`  Encrypted keystore: ${result.keystorePath}`);
+    }
+    if (result.shadowedBy) io2.err(shadowNote(result.shadowedBy));
+    return 0;
+  } catch (err) {
+    return emitMintError(io2, flags.json, "identity import", err);
+  }
+}
+async function runIdentityShow(args, deps) {
+  const { io: io2 } = deps;
+  let json = false;
+  let help = false;
+  try {
+    const parsed = parseArgs10({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: false
+    });
+    json = parsed.values.json ?? false;
+    help = parsed.values.help ?? false;
+  } catch (err) {
+    io2.err(err instanceof Error ? err.message : String(err));
+    io2.err(IDENTITY_USAGE);
+    return 2;
+  }
+  if (help) {
+    io2.out(IDENTITY_USAGE);
+    return 0;
+  }
+  try {
+    const identity = await (deps.resolveIdentityImpl ?? resolveIdentity)({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io2.err(line)
+    });
+    if (json) {
+      io2.emitJson({
+        command: "identity show",
+        source: identity.source,
+        sourceLabel: identity.sourceLabel,
+        pubkey: identity.pubkey,
+        accountIndex: identity.accountIndex
+      });
+    } else {
+      io2.out(renderIdentityLine(identity));
+      io2.out(`  source : ${identity.source} (${identity.sourceLabel})`);
+      io2.out(`  pubkey : ${identity.pubkey}`);
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io2, json, "identity show", err);
+  }
+}
+function emitCreated(io2, json, command, result) {
+  if (json) {
+    io2.emitJson({
+      command,
+      created: true,
+      pubkey: result.pubkey,
+      keystorePath: result.keystorePath,
+      autoPassword: result.autoPassword,
+      // DELIBERATE, documented exception to "never print the phrase": the
+      // scripting/agent path needs the generated phrase to back it up.
+      mnemonic: result.mnemonic,
+      ...result.shadowedBy ? { shadowedBy: result.shadowedBy } : {}
+    });
+    io2.err(
+      "rig: `--json` emitted your seed phrase in the `mnemonic` field \u2014 this output is SECRET; store it safely and do not log or share it."
+    );
+  } else {
+    for (const line of createdIdentityBanner(result)) io2.out(line);
+  }
+  if (result.shadowedBy) io2.err(shadowNote(result.shadowedBy));
+}
+function emitMintError(io2, json, command, err) {
+  if (err instanceof IdentityExistsError) {
+    if (json) {
+      io2.emitJson({
+        command,
+        error: "identity_exists",
+        pubkey: err.pubkey,
+        detail: err.message
+      });
+    }
+    for (const line of err.message.split("\n")) io2.err(line);
+    return 1;
+  }
+  if (err instanceof KeystoreFileExistsError) {
+    if (json) {
+      io2.emitJson({
+        command,
+        error: "keystore_exists",
+        keystorePath: err.keystorePath,
+        detail: err.message
+      });
+    }
+    for (const line of err.message.split("\n")) io2.err(line);
+    return 1;
+  }
+  return emitCliError(io2, json, command, err);
+}
+async function defaultReadSecretLine(prompt, isInteractive) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  if (isInteractive) {
+    process.stderr.write(prompt);
+    rl._writeToOutput = () => {
+    };
+  }
+  try {
+    const answer = await rl.question("");
+    if (isInteractive) process.stderr.write("\n");
+    return answer;
+  } finally {
+    rl.close();
+  }
+}
+
 // src/cli/init.ts
 import { basename as basename2 } from "path";
-import { parseArgs as parseArgs10 } from "util";
+import { parseArgs as parseArgs11 } from "util";
 var INIT_USAGE = `Usage: rig init [options]
 
 Set up the current git repository for rig (one-shot, idempotent, free):
@@ -3684,16 +4106,23 @@ The follow-up step is adding a relay: \`rig remote add origin <relay-url>\`
 \`git config toon.relay\` is migrated to the origin remote automatically
 when no origin exists (the old key stays readable and is removed in v0.3).
 
+When NO identity resolves, init does not dead-end: in a terminal it offers to
+generate one (\`Create a new identity now? [y/N]\`), and \`--generate-identity\`
+does it non-interactively (equivalent to \`rig identity create\` \u2014 the phrase
+is shown once to back up). Nothing is ever auto-generated without your yes.
+
 Options:
-  --repo-id <id>     repository id / NIP-34 d-tag (default: the existing
-                     toon.repoid, then the repo directory basename)
-  --json             machine-readable report
-  -h, --help         show this help`;
+  --repo-id <id>       repository id / NIP-34 d-tag (default: the existing
+                       toon.repoid, then the repo directory basename)
+  --generate-identity  when no identity resolves, mint a fresh one (no prompt)
+  --json               machine-readable report
+  -h, --help           show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs10({
+  const { values, positionals } = parseArgs11({
     args,
     options: {
       "repo-id": { type: "string" },
+      "generate-identity": { type: "boolean", default: false },
       json: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false }
     },
@@ -3703,6 +4132,7 @@ function parseInitArgs(args) {
     throw new Error(`rig init takes no positional arguments`);
   }
   const flags = {
+    generateIdentity: values["generate-identity"] ?? false,
     json: values.json ?? false,
     help: values.help ?? false
   };
@@ -3713,8 +4143,38 @@ function parseInitArgs(args) {
   }
   return flags;
 }
-async function runInit(args, deps) {
+async function resolveOrGenerateIdentity(deps, flags) {
   const { io: io2, env } = deps;
+  const resolve2 = deps.resolveIdentityImpl ?? resolveIdentity;
+  try {
+    return { identity: await resolve2({ env, cwd: deps.cwd, warn: io2.err }) };
+  } catch (err) {
+    if (!(err instanceof MissingIdentityError)) throw err;
+    let generate = flags.generateIdentity;
+    if (!generate && io2.isInteractive && !flags.json) {
+      io2.err("No identity found \u2014 rig needs one to sign and pay.");
+      generate = await io2.confirm("Create a new identity now? [y/N] ");
+    }
+    if (!generate) throw err;
+    const created = await (deps.createIdentityImpl ?? createIdentity)({
+      env,
+      cwd: deps.cwd,
+      force: false,
+      warn: io2.err,
+      ...deps.resolveIdentityImpl ? { resolveIdentityImpl: deps.resolveIdentityImpl } : {}
+    });
+    const identity = {
+      mnemonic: created.mnemonic,
+      accountIndex: created.accountIndex,
+      source: "keystore",
+      sourceLabel: created.keystorePath,
+      pubkey: created.pubkey
+    };
+    return { identity, generated: created };
+  }
+}
+async function runInit(args, deps) {
+  const { io: io2 } = deps;
   let flags;
   try {
     flags = parseInitArgs(args);
@@ -3734,11 +4194,7 @@ async function runInit(args, deps) {
     } catch {
       throw new NotAGitRepositoryError(deps.cwd);
     }
-    const identity = await (deps.resolveIdentityImpl ?? resolveIdentity)({
-      env,
-      cwd: deps.cwd,
-      warn: (line) => io2.err(line)
-    });
+    const { identity, generated } = await resolveOrGenerateIdentity(deps, flags);
     const existing = await readToonConfig(repoRoot);
     const repoId = flags.repoId ?? existing.repoId ?? basename2(repoRoot);
     const changed = {
@@ -3772,11 +4228,29 @@ async function runInit(args, deps) {
         remotes,
         origin: originRelay ?? null,
         migratedToonRelay,
-        changed
+        changed,
+        ...generated ? {
+          generatedIdentity: {
+            mnemonic: generated.mnemonic,
+            pubkey: generated.pubkey,
+            keystorePath: generated.keystorePath,
+            autoPassword: generated.autoPassword
+          }
+        } : {}
       };
       io2.emitJson(output);
+      if (generated) {
+        io2.err(
+          "rig: `--json` emitted your new seed phrase in `generatedIdentity.mnemonic` \u2014 this output is SECRET; store it safely and do not log or share it."
+        );
+        if (generated.shadowedBy) io2.err(shadowNote(generated.shadowedBy));
+      }
       return 0;
     }
+    if (generated) {
+      for (const line of createdIdentityBanner(generated)) io2.out(line);
+      if (generated.shadowedBy) io2.err(shadowNote(generated.shadowedBy));
+    }
     io2.out(`Initialized rig for ${repoRoot}`);
     io2.out(renderIdentityLine(identity));
     io2.out(
@@ -3816,7 +4290,7 @@ async function runInit(args, deps) {
 }
 
 // src/cli/maintainers.ts
-import { parseArgs as parseArgs11 } from "util";
+import { parseArgs as parseArgs12 } from "util";
 var HEX64_RE3 = /^[0-9a-f]{64}$/;
 var WS_URL_RE4 = /^wss?:\/\//i;
 var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
@@ -3921,7 +4395,7 @@ async function runList2(args, deps) {
   const { io: io2 } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs11({
+    const { values, positionals } = parseArgs12({
       args,
       options: MAINT_OPTIONS,
       allowPositionals: true
@@ -3988,7 +4462,7 @@ async function runMutate(op, args, deps) {
   let flags;
   let pubkey;
   try {
-    const { values, positionals } = parseArgs11({
+    const { values, positionals } = parseArgs12({
       args,
       options: MAINT_OPTIONS,
       allowPositionals: true
@@ -4141,8 +4615,15 @@ var USAGE = `rig \u2014 git with a TOON remote (pay-to-write Nostr + Arweave)
 Usage: rig <command> [options]
 
 Commands rig owns:
-  init                       set up this repo: resolve your identity
-                             (RIG_MNEMONIC) and write the toon.* git config
+  identity create            generate a fresh identity (BIP-39) into the
+                             encrypted keystore \u2014 the phrase is shown ONCE;
+                             back it up. This is your first step on a new box
+  identity show              the active identity's source + derived pubkey
+                             (never the phrase)
+  identity import            write an EXISTING phrase (read from stdin) to the
+                             encrypted keystore
+  init                       set up this repo: resolve your identity (or offer
+                             to generate one) and write the toon.* git config
   remote add <name> <url>    add a relay as a REAL git remote ("origin" is
   remote remove <name>       the default publish target); remove/list manage
   remote list                them \u2014 \`git remote -v\` shows the same data
@@ -4219,6 +4700,8 @@ async function dispatch(argv2, deps) {
   switch (command) {
     case "init":
       return runInit(rest, deps);
+    case "identity":
+      return runIdentity(rest, deps);
     case "remote":
       return runRemote(rest, deps);
     // The #278 read path — FREE (relay + Arweave gateway reads, no payment).
@@ -4306,6 +4789,7 @@ function makeCliIo(options) {
 }
 var RIG_OWNED_VERBS = /* @__PURE__ */ new Set([
   "init",
+  "identity",
   "remote",
   "clone",
   "fetch",
@@ -4383,7 +4867,7 @@ function makeIo(jsonMode) {
     },
     isInteractive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     confirm: async (question) => {
-      const rl = createInterface({
+      const rl = createInterface2({
         input: process.stdin,
         output: process.stderr
       });