@toon-protocol/rig 3.6.0 → 4.1.0

package/dist/chunk-CDSFVZDV.js

@@ -0,0 +1,290 @@
+import {
+  DEFAULT_CONTENT_TYPE,
+  contentTypeForPath
+} from "./chunk-YZRR2UO6.js";
+import {
+  MAX_OBJECT_SIZE,
+  uploadChargeFor
+} from "./chunk-GVXBUL3C.js";
+
+// src/standalone/connector-publisher.ts
+import { finalizeEvent } from "nostr-tools/pure";
+var ConnectorPublishError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConnectorPublishError";
+  }
+};
+var ARWEAVE_TX_ID_REGEX = /^[A-Za-z0-9_-]{43}$/;
+function decodeUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function describeRefusal(result) {
+  const by = result.refusedBy ? ` by the ${result.refusedBy}` : "";
+  return `${result.code}${by}: ${result.message}`;
+}
+function extractArweaveTxId(status, body) {
+  const text = decodeUtf8(body);
+  if (status < 200 || status >= 300) {
+    throw new ConnectorPublishError(
+      `the store answered HTTP ${String(status)}${text ? ` - ${text}` : ""}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    if (ARWEAVE_TX_ID_REGEX.test(text.trim())) return text.trim();
+    throw new ConnectorPublishError(
+      `the store's answer was not valid JSON: ${JSON.stringify(text.slice(0, 200))}`
+    );
+  }
+  const answer = parsed ?? {};
+  if (answer.accept === false) {
+    const reason = typeof answer.error === "string" ? `: ${answer.error}` : "";
+    throw new ConnectorPublishError(
+      `upload refused by the store (accept:false)${reason}`
+    );
+  }
+  if (typeof answer.txId === "string" && ARWEAVE_TX_ID_REGEX.test(answer.txId)) {
+    return answer.txId;
+  }
+  const nested = answer.result;
+  if (nested && typeof nested.txId === "string" && ARWEAVE_TX_ID_REGEX.test(nested.txId)) {
+    return nested.txId;
+  }
+  if (typeof answer.data === "string" && answer.data.length > 0) {
+    const decoded = Buffer.from(answer.data, "base64").toString("utf8");
+    if (ARWEAVE_TX_ID_REGEX.test(decoded)) return decoded;
+  }
+  throw new ConnectorPublishError(
+    `the store's answer carried no Arweave tx id: ${JSON.stringify(text.slice(0, 200))}`
+  );
+}
+var ConnectorPublisher = class {
+  publish;
+  store;
+  nostrSecretKey;
+  configuredEventFee;
+  uploadTimeoutMs;
+  warn;
+  rates;
+  constructor(options) {
+    this.publish = options.publish;
+    this.store = options.store;
+    this.nostrSecretKey = options.nostrSecretKey;
+    this.configuredEventFee = options.eventFee ?? 0n;
+    this.uploadTimeoutMs = options.uploadTimeoutMs;
+    this.warn = options.warn ?? (() => void 0);
+  }
+  /** Where events go, and where objects go. */
+  get destinations() {
+    return { publish: this.publish.destination, store: this.store.destination };
+  }
+  /**
+   * The two routes' published terms, read once per publisher. A route the
+   * node does not price is a configuration error and says which knob to fix.
+   */
+  getFeeRates() {
+    this.rates ??= this.readFeeRates();
+    return this.rates;
+  }
+  async readFeeRates() {
+    const [publishTerms, storeTerms] = await Promise.all([
+      this.publish.client.routePrice(this.publish.destination),
+      this.store.client.routePrice(this.store.destination)
+    ]);
+    if (!publishTerms) {
+      throw new ConnectorPublishError(
+        `the connector prices no route for the publish destination ${this.publish.destination} (set publishDestination / TOON_CLIENT_PUBLISH_DESTINATION to one of its GET /ilp routes)`
+      );
+    }
+    if (!storeTerms) {
+      throw new ConnectorPublishError(
+        `the connector prices no route for the store destination ${this.store.destination} (set storeDestination / TOON_CLIENT_STORE_DESTINATION to one of its GET /ilp routes)`
+      );
+    }
+    if (publishTerms.pricePerKib !== void 0 && publishTerms.pricePerKib > 0n) {
+      this.warn(
+        `rig: the publish route ${this.publish.destination} meters by size (${String(publishTerms.pricePerKib)}/KiB); the per-event estimate shows its base price only`
+      );
+    }
+    const eventFee = this.configuredEventFee > publishTerms.price ? this.configuredEventFee : publishTerms.price;
+    return {
+      uploadFee: storeTerms.price,
+      ...storeTerms.pricePerKib !== void 0 && storeTerms.pricePerKib > 0n ? { uploadPerKib: storeTerms.pricePerKib } : {},
+      eventFee
+    };
+  }
+  sign(template) {
+    return finalizeEvent(
+      {
+        kind: template.kind,
+        content: template.content,
+        tags: template.tags,
+        created_at: template.created_at
+      },
+      this.nostrSecretKey
+    );
+  }
+  /** One paid kind:5094 write; returns the tx id and what the claim spent. */
+  async storeWrite(tags, bodyBytes, what) {
+    const rates = await this.getFeeRates();
+    const estimate = uploadChargeFor(rates, bodyBytes);
+    const event = this.sign({
+      kind: 5094,
+      content: "",
+      created_at: nowSeconds(),
+      tags: [...tags, ["bid", estimate.toString(), "usdc"]]
+    });
+    const result = await this.store.client.send(
+      this.store.destination,
+      { body: { event } },
+      {
+        ...this.store.sealTo !== void 0 ? { sealTo: this.store.sealTo } : {},
+        ...this.uploadTimeoutMs !== void 0 ? { timeoutMs: this.uploadTimeoutMs } : {}
+      }
+    );
+    if (!result.fulfilled) {
+      throw new ConnectorPublishError(
+        `${what} rejected \u2014 ${describeRefusal(result)}`
+      );
+    }
+    let txId;
+    try {
+      txId = extractArweaveTxId(result.status, result.body);
+    } catch (err) {
+      throw new ConnectorPublishError(
+        `${what}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return { txId, feePaid: result.claim?.amount ?? estimate };
+  }
+  async uploadGitObject(upload) {
+    if (upload.body.length > MAX_OBJECT_SIZE) {
+      throw new ConnectorPublishError(
+        `git object ${upload.sha} exceeds the ${String(MAX_OBJECT_SIZE)}-byte limit: ${String(upload.body.length)} bytes`
+      );
+    }
+    const contentType = upload.type === "blob" ? contentTypeForPath(upload.path) : DEFAULT_CONTENT_TYPE;
+    return this.storeWrite(
+      [
+        ["i", upload.body.toString("base64"), "blob"],
+        ["output", contentType],
+        ["Git-SHA", upload.sha],
+        ["Git-Type", upload.type],
+        ["Repo", upload.repoId]
+      ],
+      upload.body.length,
+      `git-object upload (${upload.sha})`
+    );
+  }
+  async uploadBlob(upload) {
+    if (upload.body.length > MAX_OBJECT_SIZE) {
+      throw new ConnectorPublishError(
+        `blob exceeds the ${String(MAX_OBJECT_SIZE)}-byte limit: ${String(upload.body.length)} bytes`
+      );
+    }
+    return this.storeWrite(
+      [
+        ["i", upload.body.toString("base64"), "blob"],
+        ["output", upload.contentType],
+        ...upload.repoId ? [["Repo", upload.repoId]] : []
+      ],
+      upload.body.length,
+      "blob upload"
+    );
+  }
+  /**
+   * One NIP-90 job to the store node's DVM, over the paid path. A refusal is
+   * returned, not thrown: `accept: false` and a non-2xx status are the
+   * answer's content, and the payer was charged for the answer (ADR 0020).
+   */
+  async submitStoreJob(request) {
+    const rates = await this.getFeeRates();
+    const fee = rates.uploadFee;
+    const event = this.sign({
+      kind: request.kind,
+      content: "",
+      created_at: nowSeconds(),
+      tags: [
+        ...request.params.map(([key, value]) => ["param", key, value]),
+        ["bid", fee.toString(), "usdc"]
+      ]
+    });
+    const result = await this.store.client.send(
+      this.store.destination,
+      { body: { event } },
+      this.store.sealTo !== void 0 ? { sealTo: this.store.sealTo } : {}
+    );
+    if (!result.fulfilled) {
+      throw new ConnectorPublishError(
+        `kind:${String(request.kind)} job rejected \u2014 ${describeRefusal(result)}`
+      );
+    }
+    const text = decodeUtf8(result.body);
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new ConnectorPublishError(
+        `kind:${String(request.kind)} job answer was not valid JSON (HTTP ${String(result.status)}): ${JSON.stringify(text.slice(0, 200))}`
+      );
+    }
+    return {
+      status: result.status,
+      accept: body.accept === true,
+      ...typeof body.code === "string" ? { code: body.code } : {},
+      ...typeof body.message === "string" ? { message: body.message } : {},
+      ...body.result !== null && typeof body.result === "object" ? { result: body.result } : {},
+      feePaid: result.claim?.amount ?? fee
+    };
+  }
+  /**
+   * Sign the event with the owner's key and pay to publish it. `relayUrls`
+   * is the seam's plural surface: this publisher routes to one configured
+   * destination, so more than one relay is refused rather than half-done.
+   */
+  async publishEvent(event, relayUrls) {
+    if (relayUrls.length > 1) {
+      throw new ConnectorPublishError(
+        `multi-relay publish is not supported (got ${String(relayUrls.length)} relays) \u2014 the connector publisher routes to a single publish destination`
+      );
+    }
+    const rates = await this.getFeeRates();
+    const signed = this.sign(event);
+    const result = await this.publish.client.send(
+      this.publish.destination,
+      { body: { event: signed } },
+      this.publish.sealTo !== void 0 ? { sealTo: this.publish.sealTo } : {}
+    );
+    if (!result.fulfilled) {
+      throw new ConnectorPublishError(
+        `publish rejected (kind ${String(event.kind)}) \u2014 ${describeRefusal(result)}`
+      );
+    }
+    if (result.status < 200 || result.status >= 300) {
+      throw new ConnectorPublishError(
+        `publish (kind ${String(event.kind)}): the relay answered HTTP ${String(result.status)} - ${decodeUtf8(result.body)}`
+      );
+    }
+    let eventId = signed.id;
+    try {
+      const answer = JSON.parse(decodeUtf8(result.body));
+      if (typeof answer.eventId === "string" && answer.eventId)
+        eventId = answer.eventId;
+    } catch {
+    }
+    return { eventId, feePaid: result.claim?.amount ?? rates.eventFee };
+  }
+};
+
+export {
+  ConnectorPublishError,
+  extractArweaveTxId,
+  ConnectorPublisher
+};
+//# sourceMappingURL=chunk-CDSFVZDV.js.map

package/dist/chunk-CDSFVZDV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/standalone/connector-publisher.ts"],"sourcesContent":["/**\n * The paid write path on `@toon-protocol/client` 2.x — a {@link Publisher}\n * that pays a TOON connector per request.\n *\n * Everything a paid command needs comes from one connector URL: the client\n * reads the node's own `GET /ilp` (addresses, prices, settlement chains,\n * sealing key — connector ADR 0050), opens or adopts a payment channel, and\n * pays each request with a signed claim. There is no relay to discover peers\n * on (kind:10032 was removed by ADR 0046) and no topology to negotiate: a\n * destination is a route the node prices, and `send()` pays what the route\n * costs — including the per-kibibyte part of an ADR 0065 schedule, which the\n * client works out from the sealed payload so this publisher never has to.\n *\n * Three request shapes, all ordinary paid POSTs:\n *\n *  1. `publishEvent` — a NIP-34 event signed with the OWNER's Nostr key,\n *     sent as `{ event }` to the publish route; the relay answers\n *     `{ eventId, storedAt, payment? }`.\n *  2. `uploadGitObject` / `uploadBlob` — a kind:5094 store job carrying the\n *     bytes base64 in an `i` tag; the store answers the Arweave tx id.\n *  3. `submitStoreJob` — a kind:5095 / 5096 job with `param` tags; the\n *     DVM's answer comes back as data, refusal included (ADR 0020: an answer\n *     is an answer, and the payer was charged for it).\n *\n * The store route may terminate on a different node than the one addressed\n * (the edge forwards it). Then the payload must be sealed to THAT node's\n * identity — `sealTo` — and, when the store node holds its own channel, paid\n * through its own client. Both are options here; the common single-node case\n * needs neither.\n */\n\nimport { finalizeEvent } from 'nostr-tools/pure';\nimport { MAX_OBJECT_SIZE } from '../objects.js';\nimport { contentTypeForPath, DEFAULT_CONTENT_TYPE } from '../mime.js';\nimport type { UnsignedEvent } from '../nip34-events.js';\nimport {\n  uploadChargeFor,\n  type BlobUpload,\n  type FeeRates,\n  type GitObjectUpload,\n  type PublishReceipt,\n  type Publisher,\n  type StoreJobRequest,\n  type StoreJobResponse,\n  type UploadReceipt,\n} from '../publisher.js';\n\n// ---------------------------------------------------------------------------\n// The slice of ToonClient this publisher drives (structural, so tests mock it)\n// ---------------------------------------------------------------------------\n\n/** A paid request, as `ToonClient.send` takes it. */\nexport interface PaidRequest {\n  method?: string;\n  target?: string;\n  headers?: Record<string, string> | [string, string][];\n  body?: string | Uint8Array | object;\n}\n\nexport interface PaidSendOptions {\n  /** The terminating connector's `GET /ilp` URL or raw key, on a forwarded route. */\n  sealTo?: string | Uint8Array;\n  timeoutMs?: number;\n}\n\nexport interface PaidFulfilled {\n  fulfilled: true;\n  status: number;\n  body: Uint8Array;\n  /** What this request paid; absent on a route priced at zero. */\n  claim?: { amount: bigint };\n}\n\nexport interface PaidRefused {\n  fulfilled: false;\n  code: string;\n  message: string;\n  refusedBy?: string;\n}\n\nexport type PaidSendResult = PaidFulfilled | PaidRefused;\n\n/** The route terms a connector publishes: a base price and an optional slope. */\nexport interface RouteTerms {\n  price: bigint;\n  pricePerKib?: bigint;\n}\n\n/** The slice of `ToonClient` (2.x) this publisher needs. */\nexport interface PaidClientLike {\n  send(\n    destination: string,\n    request: PaidRequest,\n    options?: PaidSendOptions\n  ): Promise<PaidSendResult>;\n  /** The node's terms for a destination, or `null` when it prices no such route. */\n  routePrice(destination: string): Promise<RouteTerms | null>;\n}\n\n/** One leg of the write path: who pays, where to, and whom to seal to. */\nexport interface PaidLeg {\n  client: PaidClientLike;\n  destination: string;\n  sealTo?: string | Uint8Array;\n}\n\nexport interface ConnectorPublisherOptions {\n  /** Pays the publish route and signs nothing — the Nostr key below signs. */\n  publish: PaidLeg;\n  /** Pays the store route (often the same client as `publish`). */\n  store: PaidLeg;\n  /** The owner's Nostr secret key: signs every event this publisher sends. */\n  nostrSecretKey: Uint8Array;\n  /**\n   * A configured per-event fee. Informational floor only: the connector's\n   * published price for the publish route wins when it is higher, and the\n   * client pays that price whatever this says.\n   */\n  eventFee?: bigint;\n  /** Per-packet timeout for uploads (the store's Arweave round trip). */\n  uploadTimeoutMs?: number;\n  warn?(line: string): void;\n}\n\nexport class ConnectorPublishError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ConnectorPublishError';\n  }\n}\n\nconst ARWEAVE_TX_ID_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\nfunction decodeUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n\nfunction nowSeconds(): number {\n  return Math.floor(Date.now() / 1000);\n}\n\nfunction describeRefusal(result: PaidRefused): string {\n  const by = result.refusedBy ? ` by the ${result.refusedBy}` : '';\n  return `${result.code}${by}: ${result.message}`;\n}\n\n/**\n * Read the Arweave tx id out of a store's kind:5094 answer.\n *\n * The store answers one of two ways — `{ txId }` as JSON, or the bare id\n * base64 in `data` — and refuses with `{ accept: false, error }`. A non-2xx\n * status is a refusal too; both are thrown, because an upload without an id\n * is an upload that did not happen (even though the packet was paid for).\n */\nexport function extractArweaveTxId(status: number, body: Uint8Array): string {\n  const text = decodeUtf8(body);\n  if (status < 200 || status >= 300) {\n    throw new ConnectorPublishError(\n      `the store answered HTTP ${String(status)}${text ? ` - ${text}` : ''}`\n    );\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    if (ARWEAVE_TX_ID_REGEX.test(text.trim())) return text.trim();\n    throw new ConnectorPublishError(\n      `the store's answer was not valid JSON: ${JSON.stringify(text.slice(0, 200))}`\n    );\n  }\n  const answer = (parsed ?? {}) as {\n    accept?: unknown;\n    error?: unknown;\n    txId?: unknown;\n    data?: unknown;\n    result?: unknown;\n  };\n  if (answer.accept === false) {\n    const reason = typeof answer.error === 'string' ? `: ${answer.error}` : '';\n    throw new ConnectorPublishError(\n      `upload refused by the store (accept:false)${reason}`\n    );\n  }\n  if (\n    typeof answer.txId === 'string' &&\n    ARWEAVE_TX_ID_REGEX.test(answer.txId)\n  ) {\n    return answer.txId;\n  }\n  const nested = answer.result as { txId?: unknown } | undefined;\n  if (\n    nested &&\n    typeof nested.txId === 'string' &&\n    ARWEAVE_TX_ID_REGEX.test(nested.txId)\n  ) {\n    return nested.txId;\n  }\n  if (typeof answer.data === 'string' && answer.data.length > 0) {\n    const decoded = Buffer.from(answer.data, 'base64').toString('utf8');\n    if (ARWEAVE_TX_ID_REGEX.test(decoded)) return decoded;\n  }\n  throw new ConnectorPublishError(\n    `the store's answer carried no Arweave tx id: ${JSON.stringify(text.slice(0, 200))}`\n  );\n}\n\n// ---------------------------------------------------------------------------\n// The publisher\n// ---------------------------------------------------------------------------\n\nexport class ConnectorPublisher implements Publisher {\n  private readonly publish: PaidLeg;\n  private readonly store: PaidLeg;\n  private readonly nostrSecretKey: Uint8Array;\n  private readonly configuredEventFee: bigint;\n  private readonly uploadTimeoutMs: number | undefined;\n  private readonly warn: (line: string) => void;\n  private rates: Promise<FeeRates> | undefined;\n\n  constructor(options: ConnectorPublisherOptions) {\n    this.publish = options.publish;\n    this.store = options.store;\n    this.nostrSecretKey = options.nostrSecretKey;\n    this.configuredEventFee = options.eventFee ?? 0n;\n    this.uploadTimeoutMs = options.uploadTimeoutMs;\n    this.warn = options.warn ?? (() => undefined);\n  }\n\n  /** Where events go, and where objects go. */\n  get destinations(): { publish: string; store: string } {\n    return { publish: this.publish.destination, store: this.store.destination };\n  }\n\n  /**\n   * The two routes' published terms, read once per publisher. A route the\n   * node does not price is a configuration error and says which knob to fix.\n   */\n  getFeeRates(): Promise<FeeRates> {\n    this.rates ??= this.readFeeRates();\n    return this.rates;\n  }\n\n  private async readFeeRates(): Promise<FeeRates> {\n    const [publishTerms, storeTerms] = await Promise.all([\n      this.publish.client.routePrice(this.publish.destination),\n      this.store.client.routePrice(this.store.destination),\n    ]);\n    if (!publishTerms) {\n      throw new ConnectorPublishError(\n        `the connector prices no route for the publish destination ${this.publish.destination} ` +\n          '(set publishDestination / TOON_CLIENT_PUBLISH_DESTINATION to one of its GET /ilp routes)'\n      );\n    }\n    if (!storeTerms) {\n      throw new ConnectorPublishError(\n        `the connector prices no route for the store destination ${this.store.destination} ` +\n          '(set storeDestination / TOON_CLIENT_STORE_DESTINATION to one of its GET /ilp routes)'\n      );\n    }\n    if (\n      publishTerms.pricePerKib !== undefined &&\n      publishTerms.pricePerKib > 0n\n    ) {\n      this.warn(\n        `rig: the publish route ${this.publish.destination} meters by size ` +\n          `(${String(publishTerms.pricePerKib)}/KiB); the per-event estimate shows its base price only`\n      );\n    }\n    const eventFee =\n      this.configuredEventFee > publishTerms.price\n        ? this.configuredEventFee\n        : publishTerms.price;\n    return {\n      uploadFee: storeTerms.price,\n      ...(storeTerms.pricePerKib !== undefined && storeTerms.pricePerKib > 0n\n        ? { uploadPerKib: storeTerms.pricePerKib }\n        : {}),\n      eventFee,\n    };\n  }\n\n  private sign(template: UnsignedEvent) {\n    return finalizeEvent(\n      {\n        kind: template.kind,\n        content: template.content,\n        tags: template.tags,\n        created_at: template.created_at,\n      },\n      this.nostrSecretKey\n    );\n  }\n\n  /** One paid kind:5094 write; returns the tx id and what the claim spent. */\n  private async storeWrite(\n    tags: string[][],\n    bodyBytes: number,\n    what: string\n  ): Promise<UploadReceipt> {\n    const rates = await this.getFeeRates();\n    const estimate = uploadChargeFor(rates, bodyBytes);\n    const event = this.sign({\n      kind: 5094,\n      content: '',\n      created_at: nowSeconds(),\n      tags: [...tags, ['bid', estimate.toString(), 'usdc']],\n    });\n    const result = await this.store.client.send(\n      this.store.destination,\n      { body: { event } },\n      {\n        ...(this.store.sealTo !== undefined\n          ? { sealTo: this.store.sealTo }\n          : {}),\n        ...(this.uploadTimeoutMs !== undefined\n          ? { timeoutMs: this.uploadTimeoutMs }\n          : {}),\n      }\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `${what} rejected — ${describeRefusal(result)}`\n      );\n    }\n    let txId: string;\n    try {\n      txId = extractArweaveTxId(result.status, result.body);\n    } catch (err) {\n      throw new ConnectorPublishError(\n        `${what}: ${err instanceof Error ? err.message : String(err)}`\n      );\n    }\n    return { txId, feePaid: result.claim?.amount ?? estimate };\n  }\n\n  async uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt> {\n    if (upload.body.length > MAX_OBJECT_SIZE) {\n      throw new ConnectorPublishError(\n        `git object ${upload.sha} exceeds the ${String(MAX_OBJECT_SIZE)}-byte limit: ${String(upload.body.length)} bytes`\n      );\n    }\n    const contentType =\n      upload.type === 'blob'\n        ? contentTypeForPath(upload.path)\n        : DEFAULT_CONTENT_TYPE;\n    return this.storeWrite(\n      [\n        ['i', upload.body.toString('base64'), 'blob'],\n        ['output', contentType],\n        ['Git-SHA', upload.sha],\n        ['Git-Type', upload.type],\n        ['Repo', upload.repoId],\n      ],\n      upload.body.length,\n      `git-object upload (${upload.sha})`\n    );\n  }\n\n  async uploadBlob(upload: BlobUpload): Promise<UploadReceipt> {\n    if (upload.body.length > MAX_OBJECT_SIZE) {\n      throw new ConnectorPublishError(\n        `blob exceeds the ${String(MAX_OBJECT_SIZE)}-byte limit: ${String(upload.body.length)} bytes`\n      );\n    }\n    return this.storeWrite(\n      [\n        ['i', upload.body.toString('base64'), 'blob'],\n        ['output', upload.contentType],\n        ...(upload.repoId ? [['Repo', upload.repoId]] : []),\n      ],\n      upload.body.length,\n      'blob upload'\n    );\n  }\n\n  /**\n   * One NIP-90 job to the store node's DVM, over the paid path. A refusal is\n   * returned, not thrown: `accept: false` and a non-2xx status are the\n   * answer's content, and the payer was charged for the answer (ADR 0020).\n   */\n  async submitStoreJob(request: StoreJobRequest): Promise<StoreJobResponse> {\n    const rates = await this.getFeeRates();\n    const fee = rates.uploadFee;\n    const event = this.sign({\n      kind: request.kind,\n      content: '',\n      created_at: nowSeconds(),\n      tags: [\n        ...request.params.map(([key, value]) => ['param', key, value]),\n        ['bid', fee.toString(), 'usdc'],\n      ],\n    });\n    const result = await this.store.client.send(\n      this.store.destination,\n      { body: { event } },\n      this.store.sealTo !== undefined ? { sealTo: this.store.sealTo } : {}\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `kind:${String(request.kind)} job rejected — ${describeRefusal(result)}`\n      );\n    }\n    const text = decodeUtf8(result.body);\n    let body: {\n      accept?: unknown;\n      code?: unknown;\n      message?: unknown;\n      result?: unknown;\n    };\n    try {\n      body = JSON.parse(text) as typeof body;\n    } catch {\n      throw new ConnectorPublishError(\n        `kind:${String(request.kind)} job answer was not valid JSON ` +\n          `(HTTP ${String(result.status)}): ${JSON.stringify(text.slice(0, 200))}`\n      );\n    }\n    return {\n      status: result.status,\n      accept: body.accept === true,\n      ...(typeof body.code === 'string' ? { code: body.code } : {}),\n      ...(typeof body.message === 'string' ? { message: body.message } : {}),\n      ...(body.result !== null && typeof body.result === 'object'\n        ? { result: body.result as Record<string, unknown> }\n        : {}),\n      feePaid: result.claim?.amount ?? fee,\n    };\n  }\n\n  /**\n   * Sign the event with the owner's key and pay to publish it. `relayUrls`\n   * is the seam's plural surface: this publisher routes to one configured\n   * destination, so more than one relay is refused rather than half-done.\n   */\n  async publishEvent(\n    event: UnsignedEvent,\n    relayUrls: string[]\n  ): Promise<PublishReceipt> {\n    if (relayUrls.length > 1) {\n      throw new ConnectorPublishError(\n        `multi-relay publish is not supported (got ${String(relayUrls.length)} relays) — ` +\n          'the connector publisher routes to a single publish destination'\n      );\n    }\n    const rates = await this.getFeeRates();\n    const signed = this.sign(event);\n    const result = await this.publish.client.send(\n      this.publish.destination,\n      { body: { event: signed } },\n      this.publish.sealTo !== undefined ? { sealTo: this.publish.sealTo } : {}\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `publish rejected (kind ${String(event.kind)}) — ${describeRefusal(result)}`\n      );\n    }\n    if (result.status < 200 || result.status >= 300) {\n      throw new ConnectorPublishError(\n        `publish (kind ${String(event.kind)}): the relay answered HTTP ${String(result.status)} - ${decodeUtf8(result.body)}`\n      );\n    }\n    let eventId = signed.id;\n    try {\n      const answer = JSON.parse(decodeUtf8(result.body)) as {\n        eventId?: unknown;\n      };\n      if (typeof answer.eventId === 'string' && answer.eventId)\n        eventId = answer.eventId;\n    } catch {\n      // A 2xx without a JSON body still stored the event we signed.\n    }\n    return { eventId, feePaid: result.claim?.amount ?? rates.eventFee };\n  }\n}\n"],"mappings":";;;;;;;;;;AA+BA,SAAS,qBAAqB;AA6FvB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,sBAAsB;AAE5B,SAAS,WAAW,OAA2B;AAC7C,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEA,SAAS,aAAqB;AAC5B,SAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrC;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,KAAK,OAAO,YAAY,WAAW,OAAO,SAAS,KAAK;AAC9D,SAAO,GAAG,OAAO,IAAI,GAAG,EAAE,KAAK,OAAO,OAAO;AAC/C;AAUO,SAAS,mBAAmB,QAAgB,MAA0B;AAC3E,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,SAAS,OAAO,UAAU,KAAK;AACjC,UAAM,IAAI;AAAA,MACR,2BAA2B,OAAO,MAAM,CAAC,GAAG,OAAO,MAAM,IAAI,KAAK,EAAE;AAAA,IACtE;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,QAAI,oBAAoB,KAAK,KAAK,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAC5D,UAAM,IAAI;AAAA,MACR,0CAA0C,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,SAAU,UAAU,CAAC;AAO3B,MAAI,OAAO,WAAW,OAAO;AAC3B,UAAM,SAAS,OAAO,OAAO,UAAU,WAAW,KAAK,OAAO,KAAK,KAAK;AACxE,UAAM,IAAI;AAAA,MACR,6CAA6C,MAAM;AAAA,IACrD;AAAA,EACF;AACA,MACE,OAAO,OAAO,SAAS,YACvB,oBAAoB,KAAK,OAAO,IAAI,GACpC;AACA,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO;AACtB,MACE,UACA,OAAO,OAAO,SAAS,YACvB,oBAAoB,KAAK,OAAO,IAAI,GACpC;AACA,WAAO,OAAO;AAAA,EAChB;AACA,MAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,GAAG;AAC7D,UAAM,UAAU,OAAO,KAAK,OAAO,MAAM,QAAQ,EAAE,SAAS,MAAM;AAClE,QAAI,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAAA,EAChD;AACA,QAAM,IAAI;AAAA,IACR,gDAAgD,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EACpF;AACF;AAMO,IAAM,qBAAN,MAA8C;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAoC;AAC9C,SAAK,UAAU,QAAQ;AACvB,SAAK,QAAQ,QAAQ;AACrB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,qBAAqB,QAAQ,YAAY;AAC9C,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,OAAO,QAAQ,SAAS,MAAM;AAAA,EACrC;AAAA;AAAA,EAGA,IAAI,eAAmD;AACrD,WAAO,EAAE,SAAS,KAAK,QAAQ,aAAa,OAAO,KAAK,MAAM,YAAY;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAiC;AAC/B,SAAK,UAAU,KAAK,aAAa;AACjC,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAAkC;AAC9C,UAAM,CAAC,cAAc,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,MACnD,KAAK,QAAQ,OAAO,WAAW,KAAK,QAAQ,WAAW;AAAA,MACvD,KAAK,MAAM,OAAO,WAAW,KAAK,MAAM,WAAW;AAAA,IACrD,CAAC;AACD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR,6DAA6D,KAAK,QAAQ,WAAW;AAAA,MAEvF;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,2DAA2D,KAAK,MAAM,WAAW;AAAA,MAEnF;AAAA,IACF;AACA,QACE,aAAa,gBAAgB,UAC7B,aAAa,cAAc,IAC3B;AACA,WAAK;AAAA,QACH,0BAA0B,KAAK,QAAQ,WAAW,oBAC5C,OAAO,aAAa,WAAW,CAAC;AAAA,MACxC;AAAA,IACF;AACA,UAAM,WACJ,KAAK,qBAAqB,aAAa,QACnC,KAAK,qBACL,aAAa;AACnB,WAAO;AAAA,MACL,WAAW,WAAW;AAAA,MACtB,GAAI,WAAW,gBAAgB,UAAa,WAAW,cAAc,KACjE,EAAE,cAAc,WAAW,YAAY,IACvC,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,KAAK,UAAyB;AACpC,WAAO;AAAA,MACL;AAAA,QACE,MAAM,SAAS;AAAA,QACf,SAAS,SAAS;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,YAAY,SAAS;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,WACZ,MACA,WACA,MACwB;AACxB,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,WAAW,gBAAgB,OAAO,SAAS;AACjD,UAAM,QAAQ,KAAK,KAAK;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY,WAAW;AAAA,MACvB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,SAAS,SAAS,GAAG,MAAM,CAAC;AAAA,IACtD,CAAC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,OAAO;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,MAClB;AAAA,QACE,GAAI,KAAK,MAAM,WAAW,SACtB,EAAE,QAAQ,KAAK,MAAM,OAAO,IAC5B,CAAC;AAAA,QACL,GAAI,KAAK,oBAAoB,SACzB,EAAE,WAAW,KAAK,gBAAgB,IAClC,CAAC;AAAA,MACP;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,oBAAe,gBAAgB,MAAM,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,mBAAmB,OAAO,QAAQ,OAAO,IAAI;AAAA,IACtD,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AACA,WAAO,EAAE,MAAM,SAAS,OAAO,OAAO,UAAU,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,gBAAgB,QAAiD;AACrE,QAAI,OAAO,KAAK,SAAS,iBAAiB;AACxC,YAAM,IAAI;AAAA,QACR,cAAc,OAAO,GAAG,gBAAgB,OAAO,eAAe,CAAC,gBAAgB,OAAO,OAAO,KAAK,MAAM,CAAC;AAAA,MAC3G;AAAA,IACF;AACA,UAAM,cACJ,OAAO,SAAS,SACZ,mBAAmB,OAAO,IAAI,IAC9B;AACN,WAAO,KAAK;AAAA,MACV;AAAA,QACE,CAAC,KAAK,OAAO,KAAK,SAAS,QAAQ,GAAG,MAAM;AAAA,QAC5C,CAAC,UAAU,WAAW;AAAA,QACtB,CAAC,WAAW,OAAO,GAAG;AAAA,QACtB,CAAC,YAAY,OAAO,IAAI;AAAA,QACxB,CAAC,QAAQ,OAAO,MAAM;AAAA,MACxB;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,sBAAsB,OAAO,GAAG;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAA4C;AAC3D,QAAI,OAAO,KAAK,SAAS,iBAAiB;AACxC,YAAM,IAAI;AAAA,QACR,oBAAoB,OAAO,eAAe,CAAC,gBAAgB,OAAO,OAAO,KAAK,MAAM,CAAC;AAAA,MACvF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,MACV;AAAA,QACE,CAAC,KAAK,OAAO,KAAK,SAAS,QAAQ,GAAG,MAAM;AAAA,QAC5C,CAAC,UAAU,OAAO,WAAW;AAAA,QAC7B,GAAI,OAAO,SAAS,CAAC,CAAC,QAAQ,OAAO,MAAM,CAAC,IAAI,CAAC;AAAA,MACnD;AAAA,MACA,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,SAAqD;AACxE,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,MAAM,MAAM;AAClB,UAAM,QAAQ,KAAK,KAAK;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,SAAS;AAAA,MACT,YAAY,WAAW;AAAA,MACvB,MAAM;AAAA,QACJ,GAAG,QAAQ,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA,QAC7D,CAAC,OAAO,IAAI,SAAS,GAAG,MAAM;AAAA,MAChC;AAAA,IACF,CAAC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,OAAO;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,MAClB,KAAK,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,MAAM,OAAO,IAAI,CAAC;AAAA,IACrE;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,QAAQ,IAAI,CAAC,wBAAmB,gBAAgB,MAAM,CAAC;AAAA,MACxE;AAAA,IACF;AACA,UAAM,OAAO,WAAW,OAAO,IAAI;AACnC,QAAI;AAMJ,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,QAAQ,IAAI,CAAC,wCACjB,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,QAAQ,KAAK,WAAW;AAAA,MACxB,GAAI,OAAO,KAAK,SAAS,WAAW,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MAC3D,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,WAAW,QAAQ,OAAO,KAAK,WAAW,WAC/C,EAAE,QAAQ,KAAK,OAAkC,IACjD,CAAC;AAAA,MACL,SAAS,OAAO,OAAO,UAAU;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,WACyB;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,6CAA6C,OAAO,UAAU,MAAM,CAAC;AAAA,MAEvE;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AAAA,MACvC,KAAK,QAAQ;AAAA,MACb,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE;AAAA,MAC1B,KAAK,QAAQ,WAAW,SAAY,EAAE,QAAQ,KAAK,QAAQ,OAAO,IAAI,CAAC;AAAA,IACzE;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,0BAA0B,OAAO,MAAM,IAAI,CAAC,YAAO,gBAAgB,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF;AACA,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,KAAK;AAC/C,YAAM,IAAI;AAAA,QACR,iBAAiB,OAAO,MAAM,IAAI,CAAC,8BAA8B,OAAO,OAAO,MAAM,CAAC,MAAM,WAAW,OAAO,IAAI,CAAC;AAAA,MACrH;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACrB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,WAAW,OAAO,IAAI,CAAC;AAGjD,UAAI,OAAO,OAAO,YAAY,YAAY,OAAO;AAC/C,kBAAU,OAAO;AAAA,IACrB,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,SAAS,SAAS,OAAO,OAAO,UAAU,MAAM,SAAS;AAAA,EACpE;AACF;","names":[]}

package/dist/{chunk-B5ISARMU.js → chunk-GVXBUL3C.js}

@@ -46,6 +46,18 @@ function createGitTag(opts) {
   return hashGitObject("tag", Buffer.from(lines.join("\n"), "utf-8"));
 }
 
+// src/publisher.ts
+var UPLOAD_ENVELOPE_OVERHEAD_BYTES = 704;
+function estimateSealedUploadBytes(bodyBytes) {
+  return Math.ceil(bodyBytes / 3) * 4 + UPLOAD_ENVELOPE_OVERHEAD_BYTES;
+}
+function uploadChargeFor(rates, bodyBytes) {
+  const perKib = rates.uploadPerKib ?? 0n;
+  if (perKib === 0n) return rates.uploadFee;
+  const sealed = estimateSealedUploadBytes(bodyBytes);
+  return rates.uploadFee + perKib * BigInt(Math.floor(sealed / 1024) + 1);
+}
+
 export {
   MAX_OBJECT_SIZE,
   EMPTY_BLOB_SHA,
@@ -53,6 +65,7 @@ export {
   createGitBlob,
   createGitTree,
   createGitCommit,
-  createGitTag
+  createGitTag,
+  uploadChargeFor
 };
-//# sourceMappingURL=chunk-B5ISARMU.js.map
+//# sourceMappingURL=chunk-GVXBUL3C.js.map

package/dist/chunk-GVXBUL3C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/objects.ts","../src/publisher.ts"],"sourcesContent":["/**\n * Pure git object construction and SHA-1 envelope hashing.\n *\n * Promoted from `packages/rig-web/tests/e2e/seed/lib/git-builder.ts` (#223) —\n * the proven seed pipeline builders, now the core of the Git-to-TOON write\n * path. Everything here is pure: no network, no signing, no payments.\n * Upload/publish lives with the Publisher (#226).\n *\n * Git object format: `<type> <size>\\0<content>`. The SHA-1 is computed over\n * the full envelope (header + NUL + content); the `body` (content only) is\n * what gets uploaded to Arweave.\n */\n\nimport { createHash } from 'node:crypto';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** All git object types TOON can carry. */\nexport type GitObjectType = 'blob' | 'tree' | 'commit' | 'tag';\n\nexport interface GitObject {\n  /** SHA-1 hex digest computed over full git envelope */\n  sha: string;\n  /** Full git object (header + null + content) */\n  buffer: Buffer;\n  /** Body only (content after the null byte) — this is what gets uploaded */\n  body: Buffer;\n}\n\n/**\n * Maximum uploadable git object body size: 95KB safety margin under the\n * 100KB free tier (R10-005). Larger objects are a hard error in v1.\n */\nexport const MAX_OBJECT_SIZE = 95 * 1024;\n\n/**\n * Git's universal empty-blob SHA-1: the object for a zero-byte file.\n *\n * It is the ONLY zero-byte object git can produce (trees, commits, and tags\n * are never empty) and it always has this exact constant value. The store\n * rejects a zero-byte kind:5094 blob upload as malformed (F00), so `rig` never\n * uploads this object — it is skipped on push and synthesized locally on\n * clone/fetch (both keyed off an ACTUAL zero-length body, never a heuristic).\n */\nexport const EMPTY_BLOB_SHA = 'e69de29bb2d1d6434b8b29ae775ad8c2e48c5391';\n\n// ---------------------------------------------------------------------------\n// Envelope hashing\n// ---------------------------------------------------------------------------\n\n/**\n * Wrap a raw object body in the git envelope (`<type> <size>\\0`) and compute\n * its SHA-1. This is exactly what `git hash-object -t <type>` does.\n */\nexport function hashGitObject(type: GitObjectType, body: Buffer): GitObject {\n  const header = Buffer.from(`${type} ${body.length}\\0`);\n  const fullObject = Buffer.concat([header, body]);\n  const sha = createHash('sha1').update(fullObject).digest('hex');\n  return { sha, buffer: fullObject, body };\n}\n\n// ---------------------------------------------------------------------------\n// Git object construction\n// ---------------------------------------------------------------------------\n\n/**\n * Construct a git blob object and compute its SHA-1.\n *\n * Format: blob <size>\\0<content>\n * SHA is over the full envelope; body is content only (for upload).\n */\nexport function createGitBlob(content: string): GitObject {\n  return hashGitObject('blob', Buffer.from(content, 'utf-8'));\n}\n\n/**\n * Construct a git tree object from sorted entries.\n *\n * Format: tree <size>\\0<entries>\n * Each entry: <mode> <name>\\0<20-byte-raw-sha1>\n * Entries MUST be sorted by name (byte-wise).\n */\nexport function createGitTree(\n  entries: { mode: string; name: string; sha: string }[]\n): GitObject {\n  // Git sorts tree entries by raw byte order (NOT locale-aware)\n  const sorted = [...entries].sort((a, b) =>\n    a.name < b.name ? -1 : a.name > b.name ? 1 : 0\n  );\n\n  const entryBuffers: Buffer[] = [];\n  for (const entry of sorted) {\n    const modeAndName = Buffer.from(`${entry.mode} ${entry.name}\\0`);\n    // Raw 20-byte SHA-1 (NOT hex)\n    const rawSha = Buffer.from(entry.sha, 'hex');\n    entryBuffers.push(Buffer.concat([modeAndName, rawSha]));\n  }\n\n  return hashGitObject('tree', Buffer.concat(entryBuffers));\n}\n\n/**\n * Construct a git commit object.\n *\n * Format: commit <size>\\0tree <tree-sha>\\n[parent ...]\\nauthor ...\\ncommitter ...\\n\\n<message>\n * Tree/parent SHAs are hex-encoded (40 chars) in commits, unlike tree entries.\n */\nexport function createGitCommit(opts: {\n  treeSha: string;\n  parentSha?: string;\n  authorName: string;\n  authorPubkey: string;\n  message: string;\n  timestamp: number;\n}): GitObject {\n  const lines = [\n    `tree ${opts.treeSha}`,\n    ...(opts.parentSha ? [`parent ${opts.parentSha}`] : []),\n    `author ${opts.authorName} <${opts.authorPubkey}@nostr> ${opts.timestamp} +0000`,\n    `committer ${opts.authorName} <${opts.authorPubkey}@nostr> ${opts.timestamp} +0000`,\n    '',\n    opts.message,\n  ];\n  return hashGitObject('commit', Buffer.from(lines.join('\\n'), 'utf-8'));\n}\n\n/**\n * Construct an annotated git tag object.\n *\n * Format: tag <size>\\0object <sha>\\ntype <type>\\ntag <name>\\ntagger ...\\n\\n<message>\n * The tagged object is usually a commit, but git allows tagging any object\n * type (including another tag).\n */\nexport function createGitTag(opts: {\n  /** SHA-1 of the object being tagged (hex, 40 chars) */\n  objectSha: string;\n  /** Type of the tagged object (usually 'commit') */\n  objectType: GitObjectType;\n  /** Tag name, e.g. 'v1.0.0' */\n  tagName: string;\n  taggerName: string;\n  taggerPubkey: string;\n  message: string;\n  timestamp: number;\n}): GitObject {\n  const lines = [\n    `object ${opts.objectSha}`,\n    `type ${opts.objectType}`,\n    `tag ${opts.tagName}`,\n    `tagger ${opts.taggerName} <${opts.taggerPubkey}@nostr> ${opts.timestamp} +0000`,\n    '',\n    opts.message,\n  ];\n  return hashGitObject('tag', Buffer.from(lines.join('\\n'), 'utf-8'));\n}\n","/**\n * Publisher — the paid-write seam between push planning (this package) and\n * the two transport implementations that follow it in epic #222:\n *\n *   1. daemon (#227): client-mcp ControlClient → toon-clientd loopback\n *      /git/* routes, backed by `ClientRunner.publish`/`uploadBlob` (the\n *      production paid-publish path — apex channel, signBalanceProof, flat\n *      per-event fee).\n *   2. standalone (#228): an embedded ToonClient constructed from a\n *      mnemonic, uploading git objects as kind:5094 store writes with\n *      Git-SHA/Git-Type/Repo tags (the proven seed-pipeline shape) and\n *      publishing NIP-34 events through the relay.\n *\n * The interface is deliberately minimal so both fit:\n *\n *  - `uploadGitObject` takes the raw object body (content only — no git\n *    envelope header; the store re-derives the SHA envelope from the\n *    Git-Type/Git-SHA tags) and returns the Arweave txId plus the fee paid.\n *  - `publishEvent` takes an UNSIGNED event template — signing stays with\n *    the implementation (the daemon-held key never leaves the daemon; the\n *    standalone impl signs with its own keypair). Relay URLs are plural\n *    from day one (forward-compat for parked #84/#92; size 1 today).\n *  - `getFeeRates` exposes what `planPush` needs for the pre-push estimate:\n *    a per-byte upload rate (seed pipeline bids bytes × rate) and a flat\n *    per-event publish fee (the daemon charges `apex.feePerEvent` regardless\n *    of event size).\n *\n * All fees are bigint in the smallest asset unit (matches `@toon-protocol/client`\n * channel math); HTTP transports serialize them as strings and convert at\n * the boundary.\n */\n\nimport type { UnsignedEvent } from './nip34-events.js';\nimport type { GitObjectType } from './objects.js';\n\n/** A git object queued for upload to Arweave via the paid store path. */\nexport interface GitObjectUpload {\n  /** Full 40-hex SHA-1 (over the git envelope — see `hashGitObject`). */\n  sha: string;\n  type: GitObjectType;\n  /** Raw object body (content only, no `<type> <size>\\0` header). */\n  body: Buffer;\n  /** Repository identifier — becomes the `Repo` tag on the store write. */\n  repoId: string;\n  /**\n   * Path the blob was reached by in the tree (#368), if known. Its extension\n   * derives the `Content-Type` sent in the store write's `output` tag so a\n   * gateway serves the blob as its real media type instead of\n   * `application/octet-stream`. Absent (or a non-blob object) → octet-stream.\n   */\n  path?: string;\n}\n\n/**\n * A NON-git blob queued for upload to Arweave with an explicit `Content-Type`\n * (#368): the ar.io path manifest that turns a pushed repo into a permaweb\n * site. Unlike {@link GitObjectUpload} it carries no `Git-SHA`/`Git-Type`\n * tags, so the store stores the raw bytes verbatim (no git-envelope\n * re-derivation) — exactly what a manifest needs.\n */\nexport interface BlobUpload {\n  /** Raw bytes to store. */\n  body: Buffer;\n  /** MIME type sent in the store write's `output` tag. */\n  contentType: string;\n  /** Optional repository identifier for provenance (`Repo` tag). */\n  repoId?: string;\n}\n\n/** Receipt for one uploaded git object. */\nexport interface UploadReceipt {\n  /** Arweave transaction ID the object is retrievable under. */\n  txId: string;\n  /** Fee paid for this upload, in the smallest asset unit. */\n  feePaid: bigint;\n}\n\n/** Receipt for one published Nostr event. */\nexport interface PublishReceipt {\n  /** Event ID as accepted by the relay(s). */\n  eventId: string;\n  /** Fee paid for this publish, in the smallest asset unit. */\n  feePaid: bigint;\n}\n\n/**\n * One NIP-90 job for a store node's DVM, carried on the PAID path (#101).\n *\n * The store sits behind the connector's payment termination, so there is no\n * public HTTP endpoint to POST these to — a reachable one would be an\n * anonymous free gateway to a paid handler, which is the failure ADR 0020\n * exists to close. The job therefore travels exactly as a kind:5094 store\n * write does: inside a paid ILP packet, with `/store` as the envelope target\n * BENEATH the route's handler path rather than as a URL path.\n */\nexport interface StoreJobRequest {\n  /** NIP-90 job kind — 5095 brokered ArNS buy, 5096 gas station. */\n  kind: number;\n  /** Job arguments, sent as `[\"param\", key, value]` tags. */\n  params: [string, string][];\n}\n\n/**\n * A store DVM's answer, opened from the sealed FULFILL.\n *\n * ⚠️ A refusal is a RESULT, not an error. Under ADR 0020 an HTTP status is\n * envelope content and never a packet outcome, so `accept: false` arrives on a\n * FULFILL and the payer was charged for it either way. Implementations must\n * return it rather than throw: the zero-ARIO rehearsal (submit a buy with no\n * `processId` and watch the handler refuse by name before it quotes or touches\n * the registry) is the cheapest proof the whole paid path works, and it only\n * works if the refusal comes back as data.\n */\nexport interface StoreJobResponse {\n  /** HTTP status the app answered with, inside the envelope. */\n  status: number;\n  /** The DVM's own accept flag. `false` is a refusal, not a transport fault. */\n  accept: boolean;\n  /** Machine-readable refusal reason, when the DVM sent one. */\n  code?: string;\n  /** Human-readable detail, when the DVM sent one. */\n  message?: string;\n  /** The job's output, shape depending on `kind`. */\n  result?: Record<string, unknown>;\n  /** Fee paid to carry this job, in the smallest asset unit. */\n  feePaid: bigint;\n}\n\n/**\n * Fee rates used by `planPush` for the pre-push estimate.\n *\n * Both figures are FLAT per packet. ADR 0020 (toon-client#452) removed\n * byte-proportional pricing from the protocol: one handler, one price, and an\n * app that wants to charge differently exposes more handlers. A 100-byte and\n * a 100 KB upload to the same store route now cost the same, and the\n * connector charges accordingly regardless of what a client computes — so\n * there is no `uploadFeePerByte` to multiply and no floor to apply, because\n * the route's price is the whole fee rather than a lower bound on one.\n */\nexport interface FeeRates {\n  /**\n   * Flat cost per git-object/blob upload (smallest asset unit): the store\n   * destination's route price, as reported by the terminating connector's\n   * `GET /ilp/routes/price`. The connector gates every paid packet at that\n   * price, so an estimate built from it is exactly what a push pays.\n   */\n  uploadFee: bigint;\n  /**\n   * The store route's per-kibibyte rate, when it meters by size (ADR 0065: a\n   * price is a schedule `{base, per_kib}`; a flat route has no slope). Absent\n   * or zero means every upload costs exactly `uploadFee`.\n   */\n  uploadPerKib?: bigint;\n  /**\n   * Flat cost per published event (smallest asset unit). Implementations\n   * already fold any per-packet route-price floor into this flat value, so\n   * estimates using it match the claims actually signed.\n   */\n  eventFee: bigint;\n}\n\n/**\n * Paid transport for `executePush` — implemented by the daemon route\n * handlers (#227) and the standalone embedded client (#228).\n *\n * Implementations must be safe to call sequentially (uploads are issued one\n * at a time in dependency-safe order) and should throw on any failure —\n * `executePush` does not retry; a crashed push is resumed by re-planning\n * (content-addressed uploads make the retry idempotent).\n */\nexport interface Publisher {\n  /** Current fee rates for estimation (may be queried before every plan). */\n  getFeeRates(): Promise<FeeRates>;\n  /** Upload one git object body to Arweave; paid. */\n  uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt>;\n  /**\n   * Upload one raw blob (no git envelope) with an explicit `Content-Type`;\n   * paid. Used by `rig site` (#368) for the ar.io path manifest. Optional so\n   * transports that only move git objects (and pre-#368 test fakes) need not\n   * implement it — `rig site` requires it and errors clearly when absent.\n   */\n  uploadBlob?(upload: BlobUpload): Promise<UploadReceipt>;\n  /**\n   * Submit one NIP-90 job to the store node's DVM over the paid path and\n   * return its answer; paid. Used by `rig name buy/set --via` (#101) for the\n   * brokered kind:5095 buy and the kind:5096 gas station.\n   *\n   * Optional for the same reason as {@link uploadBlob}: transports that only\n   * move git objects (and pre-#101 test fakes) need not implement it, and\n   * `rig name --via` errors clearly when it is absent.\n   */\n  submitStoreJob?(request: StoreJobRequest): Promise<StoreJobResponse>;\n  /**\n   * Sign (implementation-held key) and pay-to-publish one event to the\n   * given relay(s).\n   */\n  publishEvent(\n    event: UnsignedEvent,\n    relayUrls: string[]\n  ): Promise<PublishReceipt>;\n}\n\n// ---------------------------------------------------------------------------\n// Per-upload charge on a metered route\n// ---------------------------------------------------------------------------\n\n/**\n * Bytes the connector meters that are not the caller's object: the kind:5094\n * event around it (id, pubkey, sig, kind, created_at, tag names), the `{event}`\n * body wrapper, the request envelope and the gift wrap. Measured against the\n * live edge and rounded up; a KiB boundary crossed by this margin costs one\n * `uploadPerKib` more than the store will actually charge, never less.\n */\nexport const UPLOAD_ENVELOPE_OVERHEAD_BYTES = 704;\n\n/**\n * The bytes a connector meters for an upload of `bodyBytes`: the object is\n * base64 in an `i` tag (4/3 expansion), plus {@link UPLOAD_ENVELOPE_OVERHEAD_BYTES}.\n */\nexport function estimateSealedUploadBytes(bodyBytes: number): number {\n  return Math.ceil(bodyBytes / 3) * 4 + UPLOAD_ENVELOPE_OVERHEAD_BYTES;\n}\n\n/**\n * What one upload of `bodyBytes` costs under `rates`: the flat `uploadFee`,\n * plus — on a metered route — `uploadPerKib` per started kibibyte of the\n * sealed payload, counted from one (the connector's own rule:\n * `price + pricePerKib × (⌊bytes / 1024⌋ + 1)`).\n */\nexport function uploadChargeFor(rates: FeeRates, bodyBytes: number): bigint {\n  const perKib = rates.uploadPerKib ?? 0n;\n  if (perKib === 0n) return rates.uploadFee;\n  const sealed = estimateSealedUploadBytes(bodyBytes);\n  return rates.uploadFee + perKib * BigInt(Math.floor(sealed / 1024) + 1);\n}\n"],"mappings":";AAaA,SAAS,kBAAkB;AAsBpB,IAAM,kBAAkB,KAAK;AAW7B,IAAM,iBAAiB;AAUvB,SAAS,cAAc,MAAqB,MAAyB;AAC1E,QAAM,SAAS,OAAO,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,IAAI;AACrD,QAAM,aAAa,OAAO,OAAO,CAAC,QAAQ,IAAI,CAAC;AAC/C,QAAM,MAAM,WAAW,MAAM,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC9D,SAAO,EAAE,KAAK,QAAQ,YAAY,KAAK;AACzC;AAYO,SAAS,cAAc,SAA4B;AACxD,SAAO,cAAc,QAAQ,OAAO,KAAK,SAAS,OAAO,CAAC;AAC5D;AASO,SAAS,cACd,SACW;AAEX,QAAM,SAAS,CAAC,GAAG,OAAO,EAAE;AAAA,IAAK,CAAC,GAAG,MACnC,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI;AAAA,EAC/C;AAEA,QAAM,eAAyB,CAAC;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,cAAc,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI,IAAI;AAE/D,UAAM,SAAS,OAAO,KAAK,MAAM,KAAK,KAAK;AAC3C,iBAAa,KAAK,OAAO,OAAO,CAAC,aAAa,MAAM,CAAC,CAAC;AAAA,EACxD;AAEA,SAAO,cAAc,QAAQ,OAAO,OAAO,YAAY,CAAC;AAC1D;AAQO,SAAS,gBAAgB,MAOlB;AACZ,QAAM,QAAQ;AAAA,IACZ,QAAQ,KAAK,OAAO;AAAA,IACpB,GAAI,KAAK,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,IAAI,CAAC;AAAA,IACrD,UAAU,KAAK,UAAU,KAAK,KAAK,YAAY,WAAW,KAAK,SAAS;AAAA,IACxE,aAAa,KAAK,UAAU,KAAK,KAAK,YAAY,WAAW,KAAK,SAAS;AAAA,IAC3E;AAAA,IACA,KAAK;AAAA,EACP;AACA,SAAO,cAAc,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACvE;AASO,SAAS,aAAa,MAWf;AACZ,QAAM,QAAQ;AAAA,IACZ,UAAU,KAAK,SAAS;AAAA,IACxB,QAAQ,KAAK,UAAU;AAAA,IACvB,OAAO,KAAK,OAAO;AAAA,IACnB,UAAU,KAAK,UAAU,KAAK,KAAK,YAAY,WAAW,KAAK,SAAS;AAAA,IACxE;AAAA,IACA,KAAK;AAAA,EACP;AACA,SAAO,cAAc,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;AACpE;;;ACyDO,IAAM,iCAAiC;AAMvC,SAAS,0BAA0B,WAA2B;AACnE,SAAO,KAAK,KAAK,YAAY,CAAC,IAAI,IAAI;AACxC;AAQO,SAAS,gBAAgB,OAAiB,WAA2B;AAC1E,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,WAAW,GAAI,QAAO,MAAM;AAChC,QAAM,SAAS,0BAA0B,SAAS;AAClD,SAAO,MAAM,YAAY,SAAS,OAAO,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC;AACxE;","names":[]}

package/dist/chunk-LTFMPOHU.js

@@ -0,0 +1,194 @@
+import {
+  deriveNostrKeyFromMnemonic
+} from "./chunk-YZRR2UO6.js";
+
+// src/cli/identity.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var MissingIdentityError = class extends Error {
+  constructor(configPath) {
+    super(
+      `no identity found \u2014 rig needs a BIP-39 seed phrase to sign and pay.
+Generate one now (no BIP-39 tooling needed):
+  \u2022 \`rig identity create\` \u2014 mint a fresh identity into the encrypted keystore (shows the phrase once to back up)
+Or point rig at an existing phrase (highest precedence first):
+  \u2022 RIG_MNEMONIC environment variable
+  \u2022 RIG_MNEMONIC=<phrase> in a project-local .env file (gitignore it!)
+  \u2022 the shared client config at ${configPath} (mnemonic or keystorePath + TOON_CLIENT_KEYSTORE_PASSWORD)`
+    );
+    this.name = "MissingIdentityError";
+  }
+};
+var DEFAULT_KEYSTORE_PASSWORD = "toon-client-default";
+function clientStateDir(env) {
+  return env["TOON_CLIENT_HOME"] ?? join(homedir(), ".toon-client");
+}
+function clientConfigPath(env) {
+  return join(clientStateDir(env), "config.json");
+}
+function clientKeystorePath(env) {
+  return join(clientStateDir(env), "keystore.json");
+}
+function readClientConfigFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new Error(
+      `failed to read client config at ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function linkKeystoreInClientConfig(env, keystorePath, autoPassword) {
+  const configPath = clientConfigPath(env);
+  mkdirSync(dirname(configPath), { recursive: true });
+  const existing = readClientConfigFile(configPath);
+  const merged = {
+    ...existing,
+    keystorePath,
+    ...autoPassword ? { keystoreAutoPassword: true } : (
+      // A user-set password: drop any stale auto flag so decryption
+      // requires TOON_CLIENT_KEYSTORE_PASSWORD.
+      { keystoreAutoPassword: false }
+    )
+  };
+  writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 384
+  });
+  return configPath;
+}
+var DOTENV_LINE_RE = /^\s*(?:export\s+)?RIG_MNEMONIC\s*=\s*(.*)\s*$/;
+function parseDotenvMnemonic(content) {
+  let found;
+  for (const line of content.split(/\r?\n/)) {
+    const match = DOTENV_LINE_RE.exec(line);
+    if (!match) continue;
+    let value = (match[1] ?? "").trim();
+    const quote = value[0];
+    if ((quote === '"' || quote === "'") && value.length >= 2 && value.endsWith(quote)) {
+      value = value.slice(1, -1);
+    } else {
+      const hash = value.search(/\s#/);
+      if (hash !== -1) value = value.slice(0, hash);
+      value = value.trim();
+    }
+    if (value !== "") found = value;
+  }
+  return found;
+}
+function findDotenvMnemonic(startDir, stopDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const candidate = join(dir, ".env");
+    if (existsSync(candidate)) {
+      try {
+        const mnemonic = parseDotenvMnemonic(readFileSync(candidate, "utf8"));
+        if (mnemonic !== void 0) return { path: candidate, mnemonic };
+      } catch {
+      }
+    }
+    if (stopDir !== void 0 && dir === stopDir) return void 0;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+var HOME_INDEPENDENT_SOURCES = /* @__PURE__ */ new Set([
+  "env",
+  "env-alias",
+  "dotenv"
+]);
+function resolveAccountIndex(env, source, file) {
+  const raw = env["RIG_ACCOUNT_INDEX"]?.trim();
+  if (raw) {
+    const parsed = Number(raw);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+      throw new Error(
+        `RIG_ACCOUNT_INDEX must be a non-negative integer, got ${JSON.stringify(raw)}`
+      );
+    }
+    return parsed;
+  }
+  if (HOME_INDEPENDENT_SOURCES.has(source)) return 0;
+  return typeof file.mnemonicAccountIndex === "number" ? file.mnemonicAccountIndex : 0;
+}
+function resolveMnemonicSource(options, file, configPath) {
+  const { env } = options;
+  const rigEnv = env["RIG_MNEMONIC"]?.trim();
+  if (rigEnv) {
+    return { mnemonic: rigEnv, source: "env", sourceLabel: "RIG_MNEMONIC env" };
+  }
+  const aliasEnv = env["TOON_CLIENT_MNEMONIC"]?.trim();
+  if (aliasEnv) {
+    options.warn(
+      "rig: TOON_CLIENT_MNEMONIC is deprecated \u2014 rename the variable to RIG_MNEMONIC"
+    );
+    return {
+      mnemonic: aliasEnv,
+      source: "env-alias",
+      sourceLabel: "TOON_CLIENT_MNEMONIC env (deprecated alias)"
+    };
+  }
+  const dotenv = findDotenvMnemonic(options.cwd, options.dotenvStopDir);
+  if (dotenv) {
+    return {
+      mnemonic: dotenv.mnemonic,
+      source: "dotenv",
+      sourceLabel: dotenv.path
+    };
+  }
+  if (typeof file.keystorePath === "string" && file.keystorePath !== "") {
+    return { keystorePath: file.keystorePath };
+  }
+  if (typeof file.mnemonic === "string" && file.mnemonic.trim() !== "") {
+    return {
+      mnemonic: file.mnemonic.trim(),
+      source: "config",
+      sourceLabel: configPath
+    };
+  }
+  throw new MissingIdentityError(configPath);
+}
+async function loadClientKeys() {
+  const { loadKeystore } = await import("@toon-protocol/client");
+  return { loadKeystore, deriveNostrKeyFromMnemonic };
+}
+async function resolveIdentity(options) {
+  const configPath = clientConfigPath(options.env);
+  const file = readClientConfigFile(configPath);
+  const picked = resolveMnemonicSource(options, file, configPath);
+  const keys = await loadClientKeys();
+  let source;
+  if ("keystorePath" in picked) {
+    const password = options.env["TOON_CLIENT_KEYSTORE_PASSWORD"] ?? (file.keystoreAutoPassword === true ? DEFAULT_KEYSTORE_PASSWORD : void 0);
+    if (!password) {
+      throw new Error(
+        `keystorePath is set in ${configPath} but TOON_CLIENT_KEYSTORE_PASSWORD is not provided`
+      );
+    }
+    source = {
+      mnemonic: keys.loadKeystore(picked.keystorePath, password),
+      source: "keystore",
+      sourceLabel: picked.keystorePath
+    };
+  } else {
+    source = picked;
+  }
+  const accountIndex = resolveAccountIndex(options.env, source.source, file);
+  const { pubkey } = keys.deriveNostrKeyFromMnemonic(source.mnemonic, accountIndex);
+  return { ...source, accountIndex, pubkey };
+}
+
+export {
+  MissingIdentityError,
+  DEFAULT_KEYSTORE_PASSWORD,
+  clientConfigPath,
+  clientKeystorePath,
+  readClientConfigFile,
+  linkKeystoreInClientConfig,
+  resolveAccountIndex,
+  resolveIdentity
+};
+//# sourceMappingURL=chunk-LTFMPOHU.js.map

package/dist/chunk-LTFMPOHU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/identity.ts"],"sourcesContent":["/**\n * Identity resolution for the standalone-only `rig` CLI (#248).\n *\n * One precedence chain, used by every command that signs or pays:\n *\n *   1. `RIG_MNEMONIC` environment variable\n *   2. `TOON_CLIENT_MNEMONIC` environment variable — DEPRECATED alias of the\n *      env tier (a one-line stderr warning fires when it is the source)\n *   3. project-local `.env` — walked up from the working directory (through\n *      the repo root to the filesystem root); ONLY the `RIG_MNEMONIC` line is\n *      parsed out of it (never loaded into the process env, never required\n *      to exist)\n *   4. the shared `~/.toon-client` state dir (`TOON_CLIENT_HOME` override):\n *      encrypted keystore (`keystorePath` + `TOON_CLIENT_KEYSTORE_PASSWORD`,\n *      auto-password fallback for daemon-provisioned keystores), then the\n *      plain `mnemonic` config field — the pre-#248 standalone-context logic\n *\n * The BIP-44 account index follows the same env-over-config precedence:\n *\n *   1. `RIG_ACCOUNT_INDEX` environment variable (applies to every source)\n *   2. `mnemonicAccountIndex` from the shared config file — but ONLY when the\n *      phrase itself came from that shared state dir (keystore/config tiers).\n *      An env- or `.env`-sourced phrase derives at index 0 unless\n *      `RIG_ACCOUNT_INDEX` says otherwise, so an explicit `RIG_MNEMONIC`\n *      pins the same identity no matter which `TOON_CLIENT_HOME` is active\n *      (#384 — a per-home config must never silently shift an explicitly\n *      provided identity).\n *   3. account 0\n *\n * The phrase itself is never written anywhere by rig (not to git config, not\n * to any repo file) and never printed — callers report only the SOURCE and\n * the derived pubkey.\n *\n * Key derivation and keystore decryption live in the `@toon-protocol/client`\n * dependency, loaded via dynamic import so this module can be statically\n * imported by every command without dragging the client into runs that fail\n * earlier (usage errors, missing git repo, …).\n */\n\nimport { deriveNostrKeyFromMnemonic } from '../standalone/nostr-identity.js';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\n\n/** Where the mnemonic came from (reported in output; the phrase never is). */\nexport type IdentitySourceKind =\n  /** `RIG_MNEMONIC` environment variable. */\n  | 'env'\n  /** `TOON_CLIENT_MNEMONIC` environment variable (deprecated alias). */\n  | 'env-alias'\n  /** `RIG_MNEMONIC` parsed out of a project-local `.env` file. */\n  | 'dotenv'\n  /** Encrypted keystore referenced by the shared client config. */\n  | 'keystore'\n  /** Plain `mnemonic` field of the shared client config file. */\n  | 'config';\n\n/** A resolved signing identity: source + derived pubkey (never the phrase). */\nexport interface ResolvedIdentity {\n  /** The BIP-39 phrase. Handle with care; never log or persist it. */\n  mnemonic: string;\n  /** BIP-44 account index used for derivation — `RIG_ACCOUNT_INDEX` env,\n   * else `mnemonicAccountIndex` from the shared config (home-sourced phrases\n   * only), else 0. */\n  accountIndex: number;\n  source: IdentitySourceKind;\n  /** Human-facing source label, e.g. `RIG_MNEMONIC env` or a file path. */\n  sourceLabel: string;\n  /** Derived Nostr pubkey (hex) — the repo owner / `toon.owner` value. */\n  pubkey: string;\n}\n\n/** No mnemonic could be resolved anywhere on the chain. */\nexport class MissingIdentityError extends Error {\n  constructor(configPath: string) {\n    super(\n      'no identity found — rig needs a BIP-39 seed phrase to sign and pay.\\n' +\n        'Generate one now (no BIP-39 tooling needed):\\n' +\n        '  • `rig identity create` — mint a fresh identity into the encrypted ' +\n        'keystore (shows the phrase once to back up)\\n' +\n        'Or point rig at an existing phrase (highest precedence first):\\n' +\n        '  • RIG_MNEMONIC environment variable\\n' +\n        '  • RIG_MNEMONIC=<phrase> in a project-local .env file (gitignore it!)\\n' +\n        `  • the shared client config at ${configPath} (mnemonic or ` +\n        'keystorePath + TOON_CLIENT_KEYSTORE_PASSWORD)'\n    );\n    this.name = 'MissingIdentityError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Shared client config conventions (duplicated from client-mcp — the same\n// note as standalone/nonce-guard.ts: no @toon-protocol/client-mcp import)\n// ---------------------------------------------------------------------------\n\n/**\n * Duplicated daemon convention (client-mcp `daemon/config.ts`): the password\n * used to encrypt a keystore rig auto-provisions (`rig identity create`\n * with no `TOON_CLIENT_KEYSTORE_PASSWORD` set) so the identity reloads across\n * runs with no env var. At-rest obfuscation only.\n */\nexport const DEFAULT_KEYSTORE_PASSWORD = 'toon-client-default';\n\n/** Shared client state dir: `TOON_CLIENT_HOME`, else `~/.toon-client`. */\nexport function clientStateDir(env: NodeJS.ProcessEnv): string {\n  return env['TOON_CLIENT_HOME'] ?? join(homedir(), '.toon-client');\n}\n\n/** Shared client config file path (`<state-dir>/config.json`). */\nexport function clientConfigPath(env: NodeJS.ProcessEnv): string {\n  return join(clientStateDir(env), 'config.json');\n}\n\n/** Default encrypted-keystore path (`<state-dir>/keystore.json`) — the same\n * convention the daemon's first-run provisioning uses. */\nexport function clientKeystorePath(env: NodeJS.ProcessEnv): string {\n  return join(clientStateDir(env), 'keystore.json');\n}\n\n/** The subset of the shared client config file identity resolution reads. */\nexport interface ClientConfigIdentityFields {\n  mnemonic?: unknown;\n  mnemonicAccountIndex?: unknown;\n  keystorePath?: unknown;\n  keystoreAutoPassword?: unknown;\n}\n\nexport function readClientConfigFile(path: string): ClientConfigIdentityFields {\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as ClientConfigIdentityFields;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return {};\n    throw new Error(\n      `failed to read client config at ${path}: ${err instanceof Error ? err.message : String(err)}`\n    );\n  }\n}\n\n/**\n * Link a freshly written keystore into the shared client config so the\n * keystore tier of {@link resolveIdentity} (and the daemon) picks it up on the\n * next run — merging into any existing config, preserving every other field,\n * and writing owner-only (mode 0o600). `keystoreAutoPassword` records whether\n * rig chose the default password (so a user-set password still requires the\n * env var to decrypt, exactly like the daemon's first-run convention).\n */\nexport function linkKeystoreInClientConfig(\n  env: NodeJS.ProcessEnv,\n  keystorePath: string,\n  autoPassword: boolean\n): string {\n  const configPath = clientConfigPath(env);\n  mkdirSync(dirname(configPath), { recursive: true });\n  const existing = readClientConfigFile(configPath) as Record<string, unknown>;\n  const merged: Record<string, unknown> = {\n    ...existing,\n    keystorePath,\n    ...(autoPassword\n      ? { keystoreAutoPassword: true }\n      : // A user-set password: drop any stale auto flag so decryption\n        // requires TOON_CLIENT_KEYSTORE_PASSWORD.\n        { keystoreAutoPassword: false }),\n  };\n  writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\\n', {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return configPath;\n}\n\n// ---------------------------------------------------------------------------\n// .env parsing (RIG_MNEMONIC only — never arbitrary env loading)\n// ---------------------------------------------------------------------------\n\nconst DOTENV_LINE_RE = /^\\s*(?:export\\s+)?RIG_MNEMONIC\\s*=\\s*(.*)\\s*$/;\n\n/**\n * Extract ONLY the `RIG_MNEMONIC` value from `.env` file content. Supports\n * `export ` prefixes, single/double quotes, full-line `#` comments, and\n * inline ` #` comments on unquoted values. Multiple assignments: the last\n * one wins (shell-sourcing semantics). An empty value counts as unset.\n * Nothing is ever loaded into `process.env`.\n */\nexport function parseDotenvMnemonic(content: string): string | undefined {\n  let found: string | undefined;\n  for (const line of content.split(/\\r?\\n/)) {\n    const match = DOTENV_LINE_RE.exec(line);\n    if (!match) continue;\n    let value = (match[1] ?? '').trim();\n    const quote = value[0];\n    if ((quote === '\"' || quote === \"'\") && value.length >= 2 && value.endsWith(quote)) {\n      value = value.slice(1, -1);\n    } else {\n      // Unquoted: an inline comment starts at the first whitespace-preceded #.\n      const hash = value.search(/\\s#/);\n      if (hash !== -1) value = value.slice(0, hash);\n      value = value.trim();\n    }\n    if (value !== '') found = value;\n  }\n  return found;\n}\n\n/**\n * Walk up from `startDir` (the working directory — the walk passes through\n * the repo root) to the filesystem root, returning the first `.env` file\n * that defines `RIG_MNEMONIC`. `stopDir` bounds the walk (tests).\n */\nexport function findDotenvMnemonic(\n  startDir: string,\n  stopDir?: string\n): { path: string; mnemonic: string } | undefined {\n  let dir = startDir;\n  for (;;) {\n    const candidate = join(dir, '.env');\n    if (existsSync(candidate)) {\n      try {\n        const mnemonic = parseDotenvMnemonic(readFileSync(candidate, 'utf8'));\n        if (mnemonic !== undefined) return { path: candidate, mnemonic };\n      } catch {\n        // Unreadable .env → keep walking; the file is never required.\n      }\n    }\n    if (stopDir !== undefined && dir === stopDir) return undefined;\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Account index (env > per-home config for home-sourced phrases > 0)\n// ---------------------------------------------------------------------------\n\n/** Sources whose phrase lives OUTSIDE the shared state dir. For these the\n * per-home `mnemonicAccountIndex` must not apply — an explicit\n * `RIG_MNEMONIC` derives the same identity across every\n * `TOON_CLIENT_HOME` (#384). */\nconst HOME_INDEPENDENT_SOURCES: ReadonlySet<IdentitySourceKind> = new Set([\n  'env',\n  'env-alias',\n  'dotenv',\n]);\n\n/**\n * Resolve the BIP-44 account index for a phrase from `source`:\n * `RIG_ACCOUNT_INDEX` env always wins; the shared config's\n * `mnemonicAccountIndex` applies only when the phrase itself came from the\n * shared state dir (keystore/config tiers); default 0. Throws on a\n * malformed `RIG_ACCOUNT_INDEX` — silently deriving a different identity\n * is exactly the surprise this precedence exists to prevent.\n */\nexport function resolveAccountIndex(\n  env: NodeJS.ProcessEnv,\n  source: IdentitySourceKind,\n  file: ClientConfigIdentityFields\n): number {\n  const raw = env['RIG_ACCOUNT_INDEX']?.trim();\n  if (raw) {\n    const parsed = Number(raw);\n    if (!Number.isInteger(parsed) || parsed < 0) {\n      throw new Error(\n        `RIG_ACCOUNT_INDEX must be a non-negative integer, got ${JSON.stringify(raw)}`\n      );\n    }\n    return parsed;\n  }\n  if (HOME_INDEPENDENT_SOURCES.has(source)) return 0;\n  return typeof file.mnemonicAccountIndex === 'number' ? file.mnemonicAccountIndex : 0;\n}\n\n// ---------------------------------------------------------------------------\n// Resolution\n// ---------------------------------------------------------------------------\n\nexport interface ResolveIdentityOptions {\n  env: NodeJS.ProcessEnv;\n  /** Working directory the `.env` walk starts from. */\n  cwd: string;\n  /** Stderr line sink for the deprecated-alias warning. */\n  warn(line: string): void;\n  /** Bound the `.env` walk-up (tests only). */\n  dotenvStopDir?: string;\n}\n\n/** The resolved source before any derivation (dependency-free). */\ninterface MnemonicSource {\n  mnemonic: string;\n  source: IdentitySourceKind;\n  sourceLabel: string;\n}\n\nfunction resolveMnemonicSource(\n  options: ResolveIdentityOptions,\n  file: ClientConfigIdentityFields,\n  configPath: string\n): MnemonicSource | { keystorePath: string } {\n  const { env } = options;\n\n  const rigEnv = env['RIG_MNEMONIC']?.trim();\n  if (rigEnv) {\n    return { mnemonic: rigEnv, source: 'env', sourceLabel: 'RIG_MNEMONIC env' };\n  }\n\n  const aliasEnv = env['TOON_CLIENT_MNEMONIC']?.trim();\n  if (aliasEnv) {\n    options.warn(\n      'rig: TOON_CLIENT_MNEMONIC is deprecated — rename the variable to RIG_MNEMONIC'\n    );\n    return {\n      mnemonic: aliasEnv,\n      source: 'env-alias',\n      sourceLabel: 'TOON_CLIENT_MNEMONIC env (deprecated alias)',\n    };\n  }\n\n  const dotenv = findDotenvMnemonic(options.cwd, options.dotenvStopDir);\n  if (dotenv) {\n    return {\n      mnemonic: dotenv.mnemonic,\n      source: 'dotenv',\n      sourceLabel: dotenv.path,\n    };\n  }\n\n  if (typeof file.keystorePath === 'string' && file.keystorePath !== '') {\n    return { keystorePath: file.keystorePath };\n  }\n  if (typeof file.mnemonic === 'string' && file.mnemonic.trim() !== '') {\n    return {\n      mnemonic: file.mnemonic.trim(),\n      source: 'config',\n      sourceLabel: configPath,\n    };\n  }\n  throw new MissingIdentityError(configPath);\n}\n\n/**\n * Load the client key helpers. `@toon-protocol/client` is a regular runtime\n * dependency (#259); the import stays dynamic purely so commands that fail\n * earlier never pay its startup cost.\n */\nasync function loadClientKeys(): Promise<{\n  loadKeystore(path: string, password: string): string;\n  deriveNostrKeyFromMnemonic(\n    mnemonic: string,\n    accountIndex?: number\n  ): { secretKey: Uint8Array; pubkey: string };\n}> {\n  const { loadKeystore } = await import('@toon-protocol/client');\n  return { loadKeystore, deriveNostrKeyFromMnemonic };\n}\n\n/**\n * Resolve the CLI signing identity along the precedence chain and derive its\n * Nostr pubkey. Throws {@link MissingIdentityError} (with the full\n * three-option remediation) when nothing on the chain yields a phrase.\n */\nexport async function resolveIdentity(\n  options: ResolveIdentityOptions\n): Promise<ResolvedIdentity> {\n  const configPath = clientConfigPath(options.env);\n  const file = readClientConfigFile(configPath);\n  const picked = resolveMnemonicSource(options, file, configPath);\n\n  const keys = await loadClientKeys();\n  let source: MnemonicSource;\n  if ('keystorePath' in picked) {\n    const password =\n      options.env['TOON_CLIENT_KEYSTORE_PASSWORD'] ??\n      (file.keystoreAutoPassword === true ? DEFAULT_KEYSTORE_PASSWORD : undefined);\n    if (!password) {\n      throw new Error(\n        `keystorePath is set in ${configPath} but TOON_CLIENT_KEYSTORE_PASSWORD is not provided`\n      );\n    }\n    source = {\n      mnemonic: keys.loadKeystore(picked.keystorePath, password),\n      source: 'keystore',\n      sourceLabel: picked.keystorePath,\n    };\n  } else {\n    source = picked;\n  }\n\n  const accountIndex = resolveAccountIndex(options.env, source.source, file);\n  const { pubkey } = keys.deriveNostrKeyFromMnemonic(source.mnemonic, accountIndex);\n  return { ...source, accountIndex, pubkey };\n}\n"],"mappings":";;;;;AAwCA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AA+BvB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,YAAoB;AAC9B;AAAA,MACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uCAOqC,UAAU;AAAA,IAEjD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAaO,IAAM,4BAA4B;AAGlC,SAAS,eAAe,KAAgC;AAC7D,SAAO,IAAI,kBAAkB,KAAK,KAAK,QAAQ,GAAG,cAAc;AAClE;AAGO,SAAS,iBAAiB,KAAgC;AAC/D,SAAO,KAAK,eAAe,GAAG,GAAG,aAAa;AAChD;AAIO,SAAS,mBAAmB,KAAgC;AACjE,SAAO,KAAK,eAAe,GAAG,GAAG,eAAe;AAClD;AAUO,SAAS,qBAAqB,MAA0C;AAC7E,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM,IAAI;AAAA,MACR,mCAAmC,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;AAUO,SAAS,2BACd,KACA,cACA,cACQ;AACR,QAAM,aAAa,iBAAiB,GAAG;AACvC,YAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,QAAM,WAAW,qBAAqB,UAAU;AAChD,QAAM,SAAkC;AAAA,IACtC,GAAG;AAAA,IACH;AAAA,IACA,GAAI,eACA,EAAE,sBAAsB,KAAK;AAAA;AAAA;AAAA,MAG7B,EAAE,sBAAsB,MAAM;AAAA;AAAA,EACpC;AACA,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM;AAAA,IAChE,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,SAAO;AACT;AAMA,IAAM,iBAAiB;AAShB,SAAS,oBAAoB,SAAqC;AACvE,MAAI;AACJ,aAAW,QAAQ,QAAQ,MAAM,OAAO,GAAG;AACzC,UAAM,QAAQ,eAAe,KAAK,IAAI;AACtC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS,MAAM,CAAC,KAAK,IAAI,KAAK;AAClC,UAAM,QAAQ,MAAM,CAAC;AACrB,SAAK,UAAU,OAAO,UAAU,QAAQ,MAAM,UAAU,KAAK,MAAM,SAAS,KAAK,GAAG;AAClF,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B,OAAO;AAEL,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,SAAS,GAAI,SAAQ,MAAM,MAAM,GAAG,IAAI;AAC5C,cAAQ,MAAM,KAAK;AAAA,IACrB;AACA,QAAI,UAAU,GAAI,SAAQ;AAAA,EAC5B;AACA,SAAO;AACT;AAOO,SAAS,mBACd,UACA,SACgD;AAChD,MAAI,MAAM;AACV,aAAS;AACP,UAAM,YAAY,KAAK,KAAK,MAAM;AAClC,QAAI,WAAW,SAAS,GAAG;AACzB,UAAI;AACF,cAAM,WAAW,oBAAoB,aAAa,WAAW,MAAM,CAAC;AACpE,YAAI,aAAa,OAAW,QAAO,EAAE,MAAM,WAAW,SAAS;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,YAAY,UAAa,QAAQ,QAAS,QAAO;AACrD,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAUA,IAAM,2BAA4D,oBAAI,IAAI;AAAA,EACxE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,SAAS,oBACd,KACA,QACA,MACQ;AACR,QAAM,MAAM,IAAI,mBAAmB,GAAG,KAAK;AAC3C,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,GAAG;AAC3C,YAAM,IAAI;AAAA,QACR,yDAAyD,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,IAAI,MAAM,EAAG,QAAO;AACjD,SAAO,OAAO,KAAK,yBAAyB,WAAW,KAAK,uBAAuB;AACrF;AAuBA,SAAS,sBACP,SACA,MACA,YAC2C;AAC3C,QAAM,EAAE,IAAI,IAAI;AAEhB,QAAM,SAAS,IAAI,cAAc,GAAG,KAAK;AACzC,MAAI,QAAQ;AACV,WAAO,EAAE,UAAU,QAAQ,QAAQ,OAAO,aAAa,mBAAmB;AAAA,EAC5E;AAEA,QAAM,WAAW,IAAI,sBAAsB,GAAG,KAAK;AACnD,MAAI,UAAU;AACZ,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AAEA,QAAM,SAAS,mBAAmB,QAAQ,KAAK,QAAQ,aAAa;AACpE,MAAI,QAAQ;AACV,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,IAAI;AACrE,WAAO,EAAE,cAAc,KAAK,aAAa;AAAA,EAC3C;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,MAAM,IAAI;AACpE,WAAO;AAAA,MACL,UAAU,KAAK,SAAS,KAAK;AAAA,MAC7B,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AACA,QAAM,IAAI,qBAAqB,UAAU;AAC3C;AAOA,eAAe,iBAMZ;AACD,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAC7D,SAAO,EAAE,cAAc,2BAA2B;AACpD;AAOA,eAAsB,gBACpB,SAC2B;AAC3B,QAAM,aAAa,iBAAiB,QAAQ,GAAG;AAC/C,QAAM,OAAO,qBAAqB,UAAU;AAC5C,QAAM,SAAS,sBAAsB,SAAS,MAAM,UAAU;AAE9D,QAAM,OAAO,MAAM,eAAe;AAClC,MAAI;AACJ,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,WACJ,QAAQ,IAAI,+BAA+B,MAC1C,KAAK,yBAAyB,OAAO,4BAA4B;AACpE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,0BAA0B,UAAU;AAAA,MACtC;AAAA,IACF;AACA,aAAS;AAAA,MACP,UAAU,KAAK,aAAa,OAAO,cAAc,QAAQ;AAAA,MACzD,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,OAAO;AACL,aAAS;AAAA,EACX;AAEA,QAAM,eAAe,oBAAoB,QAAQ,KAAK,OAAO,QAAQ,IAAI;AACzE,QAAM,EAAE,OAAO,IAAI,KAAK,2BAA2B,OAAO,UAAU,YAAY;AAChF,SAAO,EAAE,GAAG,QAAQ,cAAc,OAAO;AAC3C;","names":[]}