@toon-protocol/rig 4.1.0 → 4.3.0

package/dist/chunk-3RWM7PBM.js

@@ -0,0 +1,3705 @@
+import {
+  ARWEAVE_FETCH_TIMEOUT_MS,
+  ARWEAVE_GATEWAYS,
+  MissingIdentityError,
+  authorizedStatusAuthors,
+  buildRepoAnnouncement,
+  buildRepoRefs,
+  defaultWebSocketFactory,
+  isValidArweaveTxId,
+  queryRelay,
+  resolveIdentity
+} from "./chunk-GWA3CSUR.js";
+import {
+  defaultDaemonPort,
+  standaloneForced,
+  uploadChargeFor
+} from "./chunk-U5A7MHBP.js";
+
+// src/objects.ts
+import { createHash } from "crypto";
+var FREE_TIER_MAX_ITEM_BYTES = 107520;
+var MAX_OBJECT_SIZE = FREE_TIER_MAX_ITEM_BYTES;
+var EMPTY_BLOB_SHA = "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391";
+function hashGitObject(type, body) {
+  const header = Buffer.from(`${type} ${body.length}\0`);
+  const fullObject = Buffer.concat([header, body]);
+  const sha = createHash("sha1").update(fullObject).digest("hex");
+  return { sha, buffer: fullObject, body };
+}
+function createGitBlob(content) {
+  return hashGitObject("blob", Buffer.from(content, "utf-8"));
+}
+function createGitTree(entries) {
+  const sorted = [...entries].sort(
+    (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
+  );
+  const entryBuffers = [];
+  for (const entry of sorted) {
+    const modeAndName = Buffer.from(`${entry.mode} ${entry.name}\0`);
+    const rawSha = Buffer.from(entry.sha, "hex");
+    entryBuffers.push(Buffer.concat([modeAndName, rawSha]));
+  }
+  return hashGitObject("tree", Buffer.concat(entryBuffers));
+}
+function createGitCommit(opts) {
+  const lines = [
+    `tree ${opts.treeSha}`,
+    ...opts.parentSha ? [`parent ${opts.parentSha}`] : [],
+    `author ${opts.authorName} <${opts.authorPubkey}@nostr> ${opts.timestamp} +0000`,
+    `committer ${opts.authorName} <${opts.authorPubkey}@nostr> ${opts.timestamp} +0000`,
+    "",
+    opts.message
+  ];
+  return hashGitObject("commit", Buffer.from(lines.join("\n"), "utf-8"));
+}
+function createGitTag(opts) {
+  const lines = [
+    `object ${opts.objectSha}`,
+    `type ${opts.objectType}`,
+    `tag ${opts.tagName}`,
+    `tagger ${opts.taggerName} <${opts.taggerPubkey}@nostr> ${opts.timestamp} +0000`,
+    "",
+    opts.message
+  ];
+  return hashGitObject("tag", Buffer.from(lines.join("\n"), "utf-8"));
+}
+
+// src/repo-reader.ts
+import { execFile, spawn } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var MAX_BUFFER = 256 * 1024 * 1024;
+var GitError = class extends Error {
+  constructor(message, exitCode, stderr) {
+    super(message);
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.name = "GitError";
+  }
+  exitCode;
+  stderr;
+};
+var FULL_SHA_RE = /^[0-9a-f]{40}$/;
+var REV_TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*(?:[~^][0-9]*)*$/;
+function isValidRevision(rev) {
+  if (rev.length === 0 || rev.length > 1024) return false;
+  if (!REV_TOKEN_RE.test(rev)) return false;
+  if (rev.includes("..")) return false;
+  if (rev.endsWith(".lock") || rev.endsWith("/") || rev.endsWith(".")) return false;
+  return true;
+}
+function assertRevision(rev, what) {
+  if (!isValidRevision(rev)) {
+    throw new Error(
+      `${what} is not a valid git revision (got ${JSON.stringify(rev)}); expected a SHA or simple refname \u2014 options/ranges are rejected`
+    );
+  }
+}
+function assertFullSha(sha, what) {
+  if (!FULL_SHA_RE.test(sha)) {
+    throw new Error(
+      `${what} is not a full 40-hex SHA-1 (got ${JSON.stringify(sha)})`
+    );
+  }
+}
+function assertRange(range, what) {
+  const parts = range.split(/\.{2,3}/);
+  const separators = range.match(/\.{2,3}/g) ?? [];
+  const ok = parts.length <= 2 && separators.length === parts.length - 1 && parts.every((p) => isValidRevision(p));
+  if (!ok) {
+    throw new Error(
+      `${what} is not a valid revision range (got ${JSON.stringify(range)}); expected <rev>, <rev>..<rev>, or <rev>...<rev>`
+    );
+  }
+}
+var OBJECT_TYPES = /* @__PURE__ */ new Set(["blob", "tree", "commit", "tag"]);
+var BatchParser = class {
+  buf = Buffer.alloc(0);
+  pending = null;
+  objects = [];
+  missing = [];
+  push(chunk) {
+    this.buf = this.buf.length === 0 ? chunk : Buffer.concat([this.buf, chunk]);
+    this.drain();
+  }
+  /** True when no partially-parsed record remains. */
+  isComplete() {
+    return this.pending === null && this.buf.length === 0;
+  }
+  drain() {
+    for (; ; ) {
+      if (this.pending) {
+        const needed = this.pending.size + 1;
+        if (this.buf.length < needed) return;
+        const body = Buffer.from(this.buf.subarray(0, this.pending.size));
+        this.objects.push({ sha: this.pending.sha, type: this.pending.type, body });
+        this.buf = this.buf.subarray(needed);
+        this.pending = null;
+        continue;
+      }
+      const nl = this.buf.indexOf(10);
+      if (nl === -1) return;
+      const header = this.buf.subarray(0, nl).toString("utf-8");
+      this.buf = this.buf.subarray(nl + 1);
+      const [name, second, third] = header.split(" ");
+      if (name && second === "missing" && third === void 0) {
+        this.missing.push(name);
+        continue;
+      }
+      if (name && second && third !== void 0 && OBJECT_TYPES.has(second)) {
+        const size = Number.parseInt(third, 10);
+        if (Number.isSafeInteger(size) && size >= 0) {
+          this.pending = { sha: name, type: second, size };
+          continue;
+        }
+      }
+      throw new GitError(
+        `unexpected cat-file --batch header: ${JSON.stringify(header)}`,
+        void 0,
+        ""
+      );
+    }
+  }
+};
+var GitRepoReader = class {
+  constructor(repoPath) {
+    this.repoPath = repoPath;
+  }
+  repoPath;
+  /** Run git with argument-array safety; resolves stdout as UTF-8. */
+  async git(args, opts = {}) {
+    try {
+      const { stdout } = await execFileAsync("git", args, {
+        cwd: this.repoPath,
+        maxBuffer: MAX_BUFFER,
+        encoding: "utf-8"
+      });
+      return { stdout, exitCode: 0 };
+    } catch (err) {
+      const e = err;
+      const exitCode = typeof e.code === "number" ? e.code : void 0;
+      if (exitCode !== void 0 && opts.allowExitCodes?.includes(exitCode)) {
+        return { stdout: e.stdout ?? "", exitCode };
+      }
+      throw new GitError(
+        `git ${args[0]} failed${exitCode !== void 0 ? ` (exit ${exitCode})` : ""}: ${(e.stderr ?? e.message ?? "").trim()}`,
+        exitCode,
+        (e.stderr ?? "").trim()
+      );
+    }
+  }
+  /**
+   * List all branches and tags plus the symbolic HEAD.
+   *
+   * Annotated tags report the tag object's SHA/type with the peeled target
+   * in `peeledSha`. A detached HEAD is tolerated (`head` is `undefined`).
+   */
+  async listRefs() {
+    const format = "%(refname)%00%(objectname)%00%(objecttype)%00%(*objectname)";
+    const [refsRes, headRes] = await Promise.all([
+      this.git(["for-each-ref", `--format=${format}`, "refs/heads", "refs/tags"]),
+      // Exit 1 = detached HEAD (or unborn branch pointer oddities) — tolerated.
+      this.git(["symbolic-ref", "--quiet", "HEAD"], { allowExitCodes: [1] })
+    ]);
+    const refs = [];
+    for (const line of refsRes.stdout.split("\n")) {
+      if (!line) continue;
+      const [refname, sha, objecttype, peeled] = line.split("\0");
+      if (!refname || !sha || !objecttype || !OBJECT_TYPES.has(objecttype)) {
+        throw new GitError(`unexpected for-each-ref line: ${JSON.stringify(line)}`, void 0, "");
+      }
+      refs.push({
+        refname,
+        sha,
+        type: objecttype,
+        ...peeled ? { peeledSha: peeled } : {}
+      });
+    }
+    const head = headRes.exitCode === 0 ? headRes.stdout.trim() || void 0 : void 0;
+    return { head, refs };
+  }
+  /**
+   * SHAs of every object reachable from `want` but not from `have`
+   * (`git rev-list --objects <want…> --not <have…>`), i.e. the push delta.
+   *
+   * Haves that don't exist locally (e.g. remote tips we never fetched) are
+   * filtered out first via one `cat-file --batch-check` pass — rev-list
+   * would otherwise die on them.
+   */
+  async objectsBetween(want, have) {
+    const objects = await this.objectsBetweenWithPaths(want, have);
+    return objects.map((o) => o.sha);
+  }
+  /**
+   * Like {@link objectsBetween} but keeps the path each object was reached
+   * by (`rev-list --objects` emits `<sha> <path>` for blobs and non-root
+   * trees) — used by push planning to report actionable oversize errors.
+   */
+  async objectsBetweenWithPaths(want, have) {
+    for (const w of want) assertRevision(w, "want");
+    for (const h of have) assertRevision(h, "have");
+    if (want.length === 0) return [];
+    const knownHaves = await this.filterExisting(have);
+    const args = ["rev-list", "--objects", ...want];
+    if (knownHaves.length > 0) args.push("--not", ...knownHaves);
+    args.push("--");
+    const { stdout } = await this.git(args);
+    const objects = [];
+    for (const line of stdout.split("\n")) {
+      if (!line) continue;
+      const spaceIdx = line.indexOf(" ");
+      if (spaceIdx === -1) {
+        objects.push({ sha: line });
+      } else {
+        const path = line.slice(spaceIdx + 1);
+        objects.push({
+          sha: line.slice(0, spaceIdx),
+          ...path ? { path } : {}
+        });
+      }
+    }
+    return objects;
+  }
+  /**
+   * List every blob (file) reachable from a ref's root tree, recursively,
+   * with the path it is served at (#368: the ar.io site manifest join key).
+   * Uses `git ls-tree -r -z` — NUL-terminated records so binary/spaced paths
+   * survive verbatim, and no path quoting to undo. Submodule (`commit`)
+   * gitlink entries and directories are excluded; only real file blobs remain.
+   */
+  async listBlobs(rev) {
+    assertRevision(rev, "ref");
+    const { stdout } = await this.git(["ls-tree", "-r", "-z", rev, "--"]);
+    const blobs = [];
+    for (const record of stdout.split("\0")) {
+      if (!record) continue;
+      const tab = record.indexOf("	");
+      if (tab === -1) {
+        throw new GitError(
+          `unexpected ls-tree record: ${JSON.stringify(record)}`,
+          void 0,
+          ""
+        );
+      }
+      const meta = record.slice(0, tab);
+      const path = record.slice(tab + 1);
+      const [, type, sha] = meta.split(" ");
+      if (type !== "blob") continue;
+      if (!sha || !FULL_SHA_RE.test(sha)) {
+        throw new GitError(
+          `unexpected ls-tree object id: ${JSON.stringify(record)}`,
+          void 0,
+          ""
+        );
+      }
+      blobs.push({ path, sha });
+    }
+    return blobs;
+  }
+  /** Run git feeding `input` on stdin; resolves collected stdout bytes. */
+  runWithStdin(args, input) {
+    return new Promise((resolve, reject) => {
+      const child = spawn("git", args, {
+        cwd: this.repoPath,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      const out = [];
+      let stderr = "";
+      child.stdout.on("data", (chunk) => out.push(chunk));
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString("utf-8");
+      });
+      child.on("error", (err) => {
+        reject(new GitError(`failed to spawn git ${args[0]}: ${err.message}`, void 0, ""));
+      });
+      child.on("close", (code) => {
+        if (code !== 0) {
+          return reject(
+            new GitError(`git ${args[0]} failed (exit ${code}): ${stderr.trim()}`, code ?? void 0, stderr.trim())
+          );
+        }
+        resolve(Buffer.concat(out));
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.write(input);
+      child.stdin.end();
+    });
+  }
+  /** Of the given revisions, keep only those resolvable locally. */
+  async filterExisting(revs) {
+    if (revs.length === 0) return [];
+    const { missing } = await this.batchCheck(revs);
+    const missingSet = new Set(missing);
+    return revs.filter((r) => !missingSet.has(r));
+  }
+  /** One `cat-file --batch-check` pass; returns names reported missing. */
+  async batchCheck(names) {
+    const stdout = await this.runWithStdin(
+      ["cat-file", "--batch-check"],
+      names.join("\n") + "\n"
+    );
+    const missing = [];
+    for (const line of stdout.toString("utf-8").split("\n")) {
+      if (line.endsWith(" missing")) missing.push(line.slice(0, -" missing".length));
+    }
+    return { missing };
+  }
+  /**
+   * Object metadata (type + body size) for a batch of SHAs via one
+   * `cat-file --batch-check` pass — no bodies are read. Missing objects are
+   * reported, not thrown.
+   */
+  async statObjects(shas) {
+    for (const sha of shas) assertFullSha(sha, "sha");
+    if (shas.length === 0) return { objects: [], missing: [] };
+    const stdout = await this.runWithStdin(
+      ["cat-file", "--batch-check"],
+      shas.join("\n") + "\n"
+    );
+    const objects = [];
+    const missing = [];
+    for (const line of stdout.toString("utf-8").split("\n")) {
+      if (!line) continue;
+      if (line.endsWith(" missing")) {
+        missing.push(line.slice(0, -" missing".length));
+        continue;
+      }
+      const [sha, type, sizeStr] = line.split(" ");
+      const size = Number.parseInt(sizeStr ?? "", 10);
+      if (!sha || !type || !OBJECT_TYPES.has(type) || !Number.isSafeInteger(size) || size < 0) {
+        throw new GitError(
+          `unexpected cat-file --batch-check line: ${JSON.stringify(line)}`,
+          void 0,
+          ""
+        );
+      }
+      objects.push({ sha, type, size });
+    }
+    return { objects, missing };
+  }
+  /**
+   * Read raw object bodies via a single streaming `git cat-file --batch`
+   * child process. Bodies may be binary and are parsed size-driven across
+   * chunk boundaries. Missing objects are reported, not thrown.
+   */
+  async readObjects(shas) {
+    for (const sha of shas) assertFullSha(sha, "sha");
+    if (shas.length === 0) return { objects: [], missing: [] };
+    const parser = new BatchParser();
+    await new Promise((resolve, reject) => {
+      const child = spawn("git", ["cat-file", "--batch"], {
+        cwd: this.repoPath,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      let stderr = "";
+      let parseError = null;
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString("utf-8");
+      });
+      child.stdout.on("data", (chunk) => {
+        if (parseError) return;
+        try {
+          parser.push(chunk);
+        } catch (err) {
+          parseError = err;
+          child.kill();
+        }
+      });
+      child.on("error", (err) => {
+        reject(new GitError(`failed to spawn git cat-file: ${err.message}`, void 0, ""));
+      });
+      child.on("close", (code) => {
+        if (parseError) return reject(parseError);
+        if (code !== 0) {
+          return reject(
+            new GitError(`git cat-file --batch failed (exit ${code}): ${stderr.trim()}`, code ?? void 0, stderr.trim())
+          );
+        }
+        if (!parser.isComplete()) {
+          return reject(
+            new GitError("git cat-file --batch output ended mid-record", code ?? void 0, stderr.trim())
+          );
+        }
+        resolve();
+      });
+      child.stdin.on("error", () => {
+      });
+      child.stdin.write(shas.join("\n") + "\n");
+      child.stdin.end();
+    });
+    return { objects: parser.objects, missing: parser.missing };
+  }
+  /**
+   * `git merge-base --is-ancestor <a> <b>` — true when `a` is an ancestor
+   * of `b` (fast-forward check / force detection). Exit codes other than
+   * 0/1 (e.g. unknown revisions) throw.
+   */
+  async isAncestor(a, b) {
+    assertRevision(a, "ancestor candidate");
+    assertRevision(b, "descendant candidate");
+    const { exitCode } = await this.git(
+      ["merge-base", "--is-ancestor", a, b],
+      { allowExitCodes: [1] }
+    );
+    return exitCode === 0;
+  }
+  /**
+   * `git format-patch --stdout <range>` — the full mbox-formatted patch
+   * series text (empty string when the range selects no commits).
+   */
+  async formatPatch(range) {
+    assertRange(range, "range");
+    const { stdout } = await this.git(["format-patch", "--stdout", range, "--"]);
+    return stdout;
+  }
+  /**
+   * Parent SHAs for a batch of commit SHAs via one
+   * `git rev-list --no-walk=unsorted --parents` pass. Root commits map to an
+   * empty array. Used to derive the kind:1617 `commit`/`parent-commit` tag
+   * pairs for exactly the commits a format-patch series carries.
+   */
+  async commitParents(shas) {
+    for (const sha of shas) assertFullSha(sha, "sha");
+    if (shas.length === 0) return /* @__PURE__ */ new Map();
+    const { stdout } = await this.git([
+      "rev-list",
+      "--no-walk=unsorted",
+      "--parents",
+      ...shas,
+      "--"
+    ]);
+    const parents = /* @__PURE__ */ new Map();
+    for (const line of stdout.split("\n")) {
+      if (!line) continue;
+      const [sha, ...rest] = line.split(" ");
+      if (!sha || !FULL_SHA_RE.test(sha) || rest.some((p) => !FULL_SHA_RE.test(p))) {
+        throw new GitError(
+          `unexpected rev-list --parents line: ${JSON.stringify(line)}`,
+          void 0,
+          ""
+        );
+      }
+      parents.set(sha, rest);
+    }
+    return parents;
+  }
+  /**
+   * Resolve a ref/revision to a full SHA via `git rev-parse --verify`.
+   * Throws {@link GitError} when the name doesn't resolve.
+   */
+  async resolveRef(name) {
+    assertRevision(name, "ref name");
+    const { stdout } = await this.git(["rev-parse", "--verify", "--quiet", name]);
+    const sha = stdout.trim();
+    if (!FULL_SHA_RE.test(sha)) {
+      throw new GitError(
+        `rev-parse --verify returned unexpected output for ${JSON.stringify(name)}: ${JSON.stringify(sha)}`,
+        void 0,
+        ""
+      );
+    }
+    return sha;
+  }
+};
+
+// src/object-fetch.ts
+var DEFAULT_CONCURRENCY = 8;
+var ObjectIntegrityError = class extends Error {
+  constructor(objects) {
+    super(
+      `${objects.length} downloaded object(s) failed SHA-1 verification \u2014 the gateway content does not match the announced git SHA(s): ` + objects.map((o) => `${o.sha} (tx ${o.txId})`).join(", ") + ". Refusing to write corrupt/tampered objects."
+    );
+    this.objects = objects;
+    this.name = "ObjectIntegrityError";
+  }
+  objects;
+};
+var OBJECT_TYPES2 = [
+  "blob",
+  "tree",
+  "commit",
+  "tag"
+];
+function verifyObjectBody(expectedSha, bytes) {
+  const body = Buffer.from(bytes);
+  for (const type of OBJECT_TYPES2) {
+    if (hashGitObject(type, body).sha === expectedSha) {
+      return { sha: expectedSha, type, body };
+    }
+  }
+  return null;
+}
+async function fetchTxBytes(txId, options = {}) {
+  if (!isValidArweaveTxId(txId)) return null;
+  const gateways = options.gateways ?? ARWEAVE_GATEWAYS;
+  const fetchFn = options.fetchFn ?? fetch;
+  const timeoutMs = options.timeoutMs ?? ARWEAVE_FETCH_TIMEOUT_MS;
+  for (const gateway of gateways) {
+    try {
+      const response = await fetchFn(`${gateway}/${txId}`, {
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!response.ok) continue;
+      return new Uint8Array(await response.arrayBuffer());
+    } catch {
+    }
+  }
+  return null;
+}
+async function downloadGitObjects(entries, options = {}) {
+  const queue = [...entries];
+  const total = queue.length;
+  const concurrency = Math.max(1, options.concurrency ?? DEFAULT_CONCURRENCY);
+  const objects = /* @__PURE__ */ new Map();
+  const unavailable = [];
+  const corrupt = [];
+  let done = 0;
+  const worker = async () => {
+    for (; ; ) {
+      const next = queue.shift();
+      if (!next) return;
+      const [sha, txId] = next;
+      const bytes = await fetchTxBytes(txId, options);
+      if (bytes === null) {
+        unavailable.push({ sha, txId });
+      } else {
+        const verified = verifyObjectBody(sha, bytes);
+        if (verified === null) {
+          corrupt.push({ sha, txId });
+        } else {
+          objects.set(sha, verified);
+        }
+      }
+      done += 1;
+      options.onObject?.(done, total);
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, total) }, () => worker())
+  );
+  if (corrupt.length > 0) throw new ObjectIntegrityError(corrupt);
+  return { objects, unavailable };
+}
+var FULL_SHA_RE2 = /^[0-9a-f]{40}$/;
+var GITLINK_MODE = "160000";
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+function referencedShas(object) {
+  switch (object.type) {
+    case "blob":
+      return [];
+    case "tree": {
+      const refs = [];
+      const data = object.body;
+      let offset = 0;
+      while (offset < data.length) {
+        const spaceIdx = data.indexOf(32, offset);
+        if (spaceIdx === -1) break;
+        const mode = data.subarray(offset, spaceIdx).toString("utf-8");
+        const nulIdx = data.indexOf(0, spaceIdx + 1);
+        if (nulIdx === -1 || nulIdx + 21 > data.length) break;
+        const sha = bytesToHex(data.subarray(nulIdx + 1, nulIdx + 21));
+        if (mode !== GITLINK_MODE) refs.push(sha);
+        offset = nulIdx + 21;
+      }
+      return refs;
+    }
+    case "commit": {
+      const refs = [];
+      const text = object.body.toString("utf-8");
+      const headerEnd = text.indexOf("\n\n");
+      const header = headerEnd === -1 ? text : text.slice(0, headerEnd);
+      for (const line of header.split("\n")) {
+        if (line.startsWith("tree ")) refs.push(line.slice(5).trim());
+        else if (line.startsWith("parent ")) refs.push(line.slice(7).trim());
+      }
+      return refs.filter((sha) => FULL_SHA_RE2.test(sha));
+    }
+    case "tag": {
+      const text = object.body.toString("utf-8");
+      const match = /^object ([0-9a-f]{40})$/m.exec(text);
+      return match?.[1] ? [match[1]] : [];
+    }
+  }
+}
+function walkClosure(tips, objects, presentLocally = /* @__PURE__ */ new Set()) {
+  const reachable = /* @__PURE__ */ new Set();
+  const missing = /* @__PURE__ */ new Set();
+  const stack = [...new Set(tips)];
+  while (stack.length > 0) {
+    const sha = stack.pop();
+    if (reachable.has(sha) || missing.has(sha)) continue;
+    if (presentLocally.has(sha)) continue;
+    const object = objects.get(sha);
+    if (!object) {
+      missing.add(sha);
+      continue;
+    }
+    reachable.add(sha);
+    for (const ref of referencedShas(object)) {
+      if (!reachable.has(ref) && !missing.has(ref)) stack.push(ref);
+    }
+  }
+  return { reachable, missing: [...missing] };
+}
+
+// src/read-pipeline.ts
+var MAX_PASSES = 64;
+async function collectRepoObjects(options) {
+  const { tips, shaToTxId, resolveMissing } = options;
+  const present = options.presentLocally ?? /* @__PURE__ */ new Set();
+  const txIds = new Map(shaToTxId);
+  const resolverAsked = /* @__PURE__ */ new Set();
+  const undownloadable = /* @__PURE__ */ new Map();
+  const objects = /* @__PURE__ */ new Map();
+  const initial = [];
+  for (const [sha, txId] of txIds) {
+    if (!present.has(sha)) initial.push([sha, txId]);
+  }
+  const bulk = await downloadGitObjects(initial, options);
+  for (const [sha, object] of bulk.objects) objects.set(sha, object);
+  for (const { sha, txId } of bulk.unavailable) undownloadable.set(sha, txId);
+  for (let pass = 0; pass < MAX_PASSES; pass++) {
+    const closure = walkClosure(tips, objects, present);
+    const open = closure.missing.filter((sha) => !undownloadable.has(sha));
+    if (open.length === 0) break;
+    const toResolve = open.filter(
+      (sha) => !txIds.has(sha) && !resolverAsked.has(sha)
+    );
+    for (const sha of toResolve) resolverAsked.add(sha);
+    if (toResolve.length > 0) {
+      const resolved = await resolveMissing(toResolve);
+      for (const [sha, txId] of resolved) txIds.set(sha, txId);
+    }
+    const batch = [];
+    for (const sha of open) {
+      const txId = txIds.get(sha);
+      if (txId !== void 0 && !objects.has(sha)) batch.push([sha, txId]);
+    }
+    if (batch.length === 0) break;
+    const result = await downloadGitObjects(batch, options);
+    for (const [sha, object] of result.objects) objects.set(sha, object);
+    for (const { sha, txId } of result.unavailable)
+      undownloadable.set(sha, txId);
+    if (result.objects.size === 0) break;
+  }
+  let finalClosure = walkClosure(tips, objects, present);
+  if (finalClosure.missing.includes(EMPTY_BLOB_SHA) && !present.has(EMPTY_BLOB_SHA)) {
+    objects.set(EMPTY_BLOB_SHA, {
+      sha: EMPTY_BLOB_SHA,
+      type: "blob",
+      body: Buffer.alloc(0)
+    });
+    finalClosure = walkClosure(tips, objects, present);
+  }
+  const missing = finalClosure.missing.map((sha) => ({
+    sha,
+    txId: txIds.get(sha) ?? null
+  }));
+  const reachable = finalClosure.reachable;
+  const skippedUnavailable = [...undownloadable].filter(
+    ([sha]) => !reachable.has(sha) && !finalClosure.missing.includes(sha)
+  ).map(([sha, txId]) => ({ sha, txId }));
+  return { objects, missing, skippedUnavailable };
+}
+function missingObjectsMessage(missing, context) {
+  const listed = missing.slice(0, 20).map(
+    (m) => `  ${m.sha}${m.txId ? `  (tx ${m.txId})` : "  (no Arweave tx found)"}`
+  ).join("\n");
+  const more = missing.length > 20 ? `
+  \u2026 and ${missing.length - 20} more` : "";
+  return `${context}: ${missing.length} required object(s) could not be downloaded:
+${listed}${more}
+Recently pushed objects can take 10-20 minutes to become fetchable from Arweave gateways \u2014 if this repo was just pushed, retry in a few minutes. Nothing was written.`;
+}
+
+// src/materialize.ts
+import { execFile as execFile2, spawn as spawn2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var ObjectWriteMismatchError = class extends Error {
+  constructor(expectedSha, writtenSha) {
+    super(
+      `git hash-object wrote ${writtenSha} where ${expectedSha} was expected \u2014 object content does not round-trip; aborting`
+    );
+    this.expectedSha = expectedSha;
+    this.writtenSha = writtenSha;
+    this.name = "ObjectWriteMismatchError";
+  }
+  expectedSha;
+  writtenSha;
+};
+var FULL_SHA_RE3 = /^[0-9a-f]{40}$/;
+function isSafeRefname(refname) {
+  if (!refname.startsWith("refs/") || refname.length > 1024) return false;
+  if (/[\u0000-\u0020~^:?*[\\\u007f]/.test(refname)) return false;
+  if (refname.includes("..") || refname.includes("@{")) return false;
+  if (refname.endsWith("/") || refname.endsWith(".")) return false;
+  for (const part of refname.split("/")) {
+    if (part === "" || part.startsWith(".") || part.startsWith("-"))
+      return false;
+    if (part.endsWith(".lock")) return false;
+  }
+  return true;
+}
+function assertSafeRefname(refname) {
+  if (!isSafeRefname(refname)) {
+    throw new Error(
+      `unsafe ref name from remote state: ${JSON.stringify(refname)} \u2014 refusing`
+    );
+  }
+}
+function assertFullSha2(sha) {
+  if (!FULL_SHA_RE3.test(sha)) {
+    throw new Error(`not a full 40-hex SHA-1: ${JSON.stringify(sha)}`);
+  }
+}
+async function runGit(repoPath, args) {
+  try {
+    const { stdout } = await execFileAsync2("git", args, {
+      cwd: repoPath,
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+    return stdout;
+  } catch (err) {
+    const e = err;
+    throw new Error(
+      `git ${args[0]} failed${typeof e.code === "number" ? ` (exit ${e.code})` : ""}: ${(e.stderr ?? e.message ?? "").trim()}`
+    );
+  }
+}
+async function writeGitObject(repoPath, object) {
+  assertFullSha2(object.sha);
+  const written = await new Promise((resolve, reject) => {
+    const child = spawn2(
+      "git",
+      ["hash-object", "-w", "--stdin", "-t", object.type],
+      { cwd: repoPath, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (err) => {
+      reject(new Error(`failed to spawn git hash-object: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code !== 0) {
+        return reject(
+          new Error(`git hash-object failed (exit ${code}): ${stderr.trim()}`)
+        );
+      }
+      resolve(stdout.trim());
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.write(object.body);
+    child.stdin.end();
+  });
+  if (written !== object.sha) {
+    throw new ObjectWriteMismatchError(object.sha, written);
+  }
+}
+async function writeGitObjects(repoPath, objects) {
+  let count = 0;
+  for (const object of objects) {
+    await writeGitObject(repoPath, object);
+    count += 1;
+  }
+  return count;
+}
+async function updateRef(repoPath, refname, sha) {
+  assertSafeRefname(refname);
+  assertFullSha2(sha);
+  await runGit(repoPath, ["update-ref", refname, sha]);
+}
+async function setHeadSymref(repoPath, refname) {
+  assertSafeRefname(refname);
+  await runGit(repoPath, ["symbolic-ref", "HEAD", refname]);
+}
+
+// src/npub.ts
+var BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+function bech32Polymod(values2) {
+  const GEN = [996825010, 642813549, 513874426, 1027748829, 705979059];
+  let chk = 1;
+  for (const v of values2) {
+    const b = chk >> 25;
+    chk = (chk & 33554431) << 5 ^ v;
+    for (let i = 0; i < 5; i++) {
+      chk ^= b >> i & 1 ? GEN[i] : 0;
+    }
+  }
+  return chk;
+}
+function bech32HrpExpand(hrp) {
+  const ret = [];
+  for (let i = 0; i < hrp.length; i++) {
+    ret.push(hrp.charCodeAt(i) >> 5);
+  }
+  ret.push(0);
+  for (let i = 0; i < hrp.length; i++) {
+    ret.push(hrp.charCodeAt(i) & 31);
+  }
+  return ret;
+}
+function bech32CreateChecksum(hrp, data) {
+  const values2 = bech32HrpExpand(hrp).concat(data).concat([0, 0, 0, 0, 0, 0]);
+  const polymod = bech32Polymod(values2) ^ 1;
+  const ret = [];
+  for (let i = 0; i < 6; i++) {
+    ret.push(polymod >> 5 * (5 - i) & 31);
+  }
+  return ret;
+}
+function convertBits(data, fromBits, toBits, pad) {
+  let acc = 0;
+  let bits = 0;
+  const ret = [];
+  const maxv = (1 << toBits) - 1;
+  for (const value of data) {
+    acc = acc << fromBits | value;
+    bits += fromBits;
+    while (bits >= toBits) {
+      bits -= toBits;
+      ret.push(acc >> bits & maxv);
+    }
+  }
+  if (pad && bits > 0) {
+    ret.push(acc << toBits - bits & maxv);
+  }
+  return ret;
+}
+function hexToBytes(hex) {
+  const bytes = [];
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes.push(parseInt(hex.slice(i, i + 2), 16));
+  }
+  return bytes;
+}
+function hexToNpub(hexPubkey) {
+  const hrp = "npub";
+  const bytes = hexToBytes(hexPubkey);
+  const words = convertBits(bytes, 8, 5, true);
+  const checksum = bech32CreateChecksum(hrp, words);
+  const combined = words.concat(checksum);
+  return hrp + "1" + combined.map((d) => BECH32_CHARSET[d]).join("");
+}
+function npubToHex(npub) {
+  const lower = npub.toLowerCase();
+  if (lower !== npub && npub.toUpperCase() !== npub) {
+    throw new Error("npub: mixed case");
+  }
+  if (!lower.startsWith("npub1")) {
+    throw new Error("npub: invalid prefix");
+  }
+  if (lower.length !== 63) {
+    throw new Error("npub: invalid length");
+  }
+  const data = [];
+  for (let i = 5; i < lower.length; i++) {
+    const idx = BECH32_CHARSET.indexOf(lower[i]);
+    if (idx === -1) throw new Error("npub: invalid character");
+    data.push(idx);
+  }
+  const hrpExpanded = bech32HrpExpand("npub");
+  if (bech32Polymod(hrpExpanded.concat(data)) !== 1) {
+    throw new Error("npub: invalid checksum");
+  }
+  const words = data.slice(0, -6);
+  const bytes = convertBits(words, 5, 8, false);
+  if (bytes.length !== 32) {
+    throw new Error("npub: invalid data length");
+  }
+  const totalBits = words.length * 5;
+  const trailingBits = totalBits - bytes.length * 8;
+  if (trailingBits > 0) {
+    const lastWord = words[words.length - 1];
+    const mask = (1 << trailingBits) - 1;
+    if ((lastWord & mask) !== 0) {
+      throw new Error("npub: non-zero padding bits");
+    }
+  }
+  return bytes.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var HEX64_RE = /^[0-9a-f]{64}$/;
+function ownerToHex(owner) {
+  if (HEX64_RE.test(owner)) return owner;
+  if (owner.startsWith("npub1")) {
+    try {
+      return npubToHex(owner);
+    } catch (err) {
+      throw new Error(
+        `invalid owner ${JSON.stringify(owner)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  throw new Error(
+    `invalid owner ${JSON.stringify(owner)}: expected a 64-char lowercase hex pubkey or an npub1\u2026 string`
+  );
+}
+
+// src/routes.ts
+function serializeFeeEstimate(plan) {
+  return {
+    objectCount: plan.estimate.objectCount,
+    totalObjectBytes: plan.estimate.totalObjectBytes,
+    uploadFee: plan.estimate.uploadFee.toString(),
+    eventCount: plan.estimate.eventCount,
+    eventFees: plan.estimate.eventFees.toString(),
+    totalFee: plan.estimate.totalFee.toString(),
+    ...plan.estimate.skippedEmptyCount > 0 ? { skippedEmptyCount: plan.estimate.skippedEmptyCount } : {}
+  };
+}
+function serializePushPlan(plan) {
+  return {
+    repoId: plan.repoId,
+    refUpdates: plan.refUpdates,
+    newRefs: plan.newRefs,
+    headSymref: plan.headSymref,
+    objects: plan.objects,
+    knownShaToTxId: Object.fromEntries(plan.knownShaToTxId),
+    announceNeeded: plan.announceNeeded,
+    announcement: plan.announcement,
+    estimate: serializeFeeEstimate(plan)
+  };
+}
+function serializeEventReceipt(kind, receipt) {
+  return {
+    eventId: receipt.eventId,
+    feePaid: receipt.feePaid.toString(),
+    kind
+  };
+}
+function serializePushResult(plan, result) {
+  return {
+    repoId: plan.repoId,
+    refUpdates: plan.refUpdates,
+    uploads: result.uploads.map((u) => ({
+      sha: u.sha,
+      txId: u.txId,
+      feePaid: u.feePaid.toString(),
+      skipped: u.skipped
+    })),
+    announceReceipt: result.announceReceipt ? {
+      eventId: result.announceReceipt.eventId,
+      feePaid: result.announceReceipt.feePaid.toString()
+    } : null,
+    refsReceipt: {
+      eventId: result.refsReceipt.eventId,
+      feePaid: result.refsReceipt.feePaid.toString()
+    },
+    arweaveMap: Object.fromEntries(result.arweaveMap),
+    totalFeePaid: result.totalFeePaid.toString(),
+    estimate: serializeFeeEstimate(plan)
+  };
+}
+
+// src/push.ts
+var NonFastForwardError = class extends Error {
+  constructor(refs) {
+    super(
+      `non-fast-forward update rejected for ${refs.map((r) => r.refname).join(", ")} \u2014 re-run with force to overwrite the remote ref(s)`
+    );
+    this.refs = refs;
+    this.name = "NonFastForwardError";
+  }
+  refs;
+};
+var OversizeObjectsError = class extends Error {
+  constructor(objects) {
+    super(
+      `${objects.length} object(s) exceed the ${MAX_OBJECT_SIZE} byte upload limit: ` + objects.map((o) => `${o.path ?? o.sha} (${o.size} bytes)`).join(", ")
+    );
+    this.objects = objects;
+    this.name = "OversizeObjectsError";
+  }
+  objects;
+};
+async function planPush(options) {
+  const { repoReader, remoteState, feeRates, repoId, force = false } = options;
+  const resolveMissing = options.resolveMissing ?? remoteState.resolveMissing.bind(remoteState);
+  const { head, refs: localRefs } = await repoReader.listRefs();
+  const localByName = new Map(localRefs.map((r) => [r.refname, r]));
+  let selected;
+  if (options.refs !== void 0) {
+    selected = options.refs.map((name) => {
+      const ref = localByName.get(name);
+      if (!ref) {
+        throw new Error(
+          `ref ${JSON.stringify(name)} does not exist locally (ref deletion is out of scope in v1)`
+        );
+      }
+      return ref;
+    });
+  } else {
+    selected = localRefs;
+  }
+  const refUpdates = [];
+  const rejected = [];
+  for (const ref of selected) {
+    const remoteSha = remoteState.refs.get(ref.refname) ?? null;
+    if (remoteSha === null) {
+      refUpdates.push({
+        refname: ref.refname,
+        localSha: ref.sha,
+        remoteSha,
+        kind: "new"
+      });
+      continue;
+    }
+    if (remoteSha === ref.sha) {
+      refUpdates.push({
+        refname: ref.refname,
+        localSha: ref.sha,
+        remoteSha,
+        kind: "up-to-date"
+      });
+      continue;
+    }
+    let fastForward = false;
+    try {
+      fastForward = await repoReader.isAncestor(remoteSha, ref.sha);
+    } catch (err) {
+      if (!(err instanceof GitError)) throw err;
+      fastForward = false;
+    }
+    if (fastForward) {
+      refUpdates.push({
+        refname: ref.refname,
+        localSha: ref.sha,
+        remoteSha,
+        kind: "fast-forward"
+      });
+    } else if (force) {
+      refUpdates.push({
+        refname: ref.refname,
+        localSha: ref.sha,
+        remoteSha,
+        kind: "forced"
+      });
+    } else {
+      rejected.push({ refname: ref.refname, localSha: ref.sha, remoteSha });
+    }
+  }
+  if (rejected.length > 0) throw new NonFastForwardError(rejected);
+  const updates = refUpdates.filter((u) => u.kind !== "up-to-date");
+  const wantTips = [...new Set(updates.map((u) => u.localSha))];
+  const haveTips = [...new Set(remoteState.refs.values())];
+  const delta = wantTips.length > 0 ? await repoReader.objectsBetweenWithPaths(wantTips, haveTips) : [];
+  const knownShaToTxId = new Map(remoteState.shaToTxId);
+  let candidates = delta.filter((o) => !knownShaToTxId.has(o.sha));
+  if (candidates.length > 0) {
+    const resolved = await resolveMissing(candidates.map((o) => o.sha));
+    for (const [sha, txId] of resolved) knownShaToTxId.set(sha, txId);
+    candidates = candidates.filter((o) => !knownShaToTxId.has(o.sha));
+  }
+  const pathBySha = new Map(candidates.map((c) => [c.sha, c.path]));
+  const { objects: stats, missing } = await repoReader.statObjects(
+    candidates.map((c) => c.sha)
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `objects vanished from the local repository during planning: ${missing.join(", ")}`
+    );
+  }
+  const tipShas = new Set(updates.map((u) => u.localSha));
+  const planned = [];
+  const skippedEmptyObjects = [];
+  for (const stat of stats) {
+    const path = pathBySha.get(stat.sha);
+    const object = {
+      ...stat,
+      ...path ? { path } : {},
+      isRefTip: tipShas.has(stat.sha)
+    };
+    if (stat.sha === EMPTY_BLOB_SHA) skippedEmptyObjects.push(object);
+    else planned.push(object);
+  }
+  const objects = [
+    ...planned.filter((o) => !o.isRefTip),
+    ...planned.filter((o) => o.isRefTip)
+  ];
+  const newRefsMap = new Map(remoteState.refs);
+  for (const update of updates) newRefsMap.set(update.refname, update.localSha);
+  const headSymref = head && newRefsMap.has(head) ? head : remoteState.headSymref && newRefsMap.has(remoteState.headSymref) ? remoteState.headSymref : [...newRefsMap.keys()][0] ?? null;
+  const newRefs = {};
+  const headSha = headSymref ? newRefsMap.get(headSymref) : void 0;
+  if (headSymref && headSha) newRefs[headSymref] = headSha;
+  for (const [refname, sha] of newRefsMap) {
+    if (refname !== headSymref) newRefs[refname] = sha;
+  }
+  const announceNeeded = !remoteState.announced;
+  const totalObjectBytes = objects.reduce((sum, o) => sum + o.size, 0);
+  const uploadFee = objects.reduce(
+    (sum, o) => sum + uploadChargeFor(feeRates, o.size),
+    0n
+  );
+  const eventCount = 1 + (announceNeeded ? 1 : 0);
+  const eventFees = BigInt(eventCount) * feeRates.eventFee;
+  return {
+    repoId,
+    refUpdates,
+    newRefs,
+    headSymref,
+    objects,
+    skippedEmptyObjects,
+    knownShaToTxId,
+    announceNeeded,
+    announcement: {
+      name: options.announcement?.name ?? repoId,
+      description: options.announcement?.description ?? ""
+    },
+    estimate: {
+      objectCount: objects.length,
+      totalObjectBytes,
+      uploadFee,
+      eventCount,
+      eventFees,
+      totalFee: uploadFee + eventFees,
+      skippedEmptyCount: skippedEmptyObjects.length
+    }
+  };
+}
+var READ_BATCH_SIZE = 100;
+async function executePush(options) {
+  const { plan, publisher, remoteState, repoReader, relayUrls } = options;
+  const merged = new Map([...remoteState.shaToTxId, ...plan.knownShaToTxId]);
+  const resultBySha = /* @__PURE__ */ new Map();
+  let totalFeePaid = 0n;
+  const pending = [];
+  for (const object of plan.objects) {
+    const knownTxId = merged.get(object.sha);
+    if (knownTxId !== void 0) {
+      resultBySha.set(object.sha, {
+        sha: object.sha,
+        txId: knownTxId,
+        feePaid: 0n,
+        skipped: true
+      });
+    } else {
+      pending.push(object);
+    }
+  }
+  for (let i = 0; i < pending.length; i += READ_BATCH_SIZE) {
+    const batch = pending.slice(i, i + READ_BATCH_SIZE);
+    const { objects: read, missing } = await repoReader.readObjects(
+      batch.map((o) => o.sha)
+    );
+    if (missing.length > 0) {
+      throw new Error(
+        `objects vanished from the local repository during push: ${missing.join(", ")}`
+      );
+    }
+    const bodyBySha = new Map(read.map((r) => [r.sha, r.body]));
+    for (const object of batch) {
+      const body = bodyBySha.get(object.sha);
+      if (!body) {
+        throw new Error(
+          `internal: cat-file returned no body for ${object.sha}`
+        );
+      }
+      const receipt = await publisher.uploadGitObject({
+        sha: object.sha,
+        type: object.type,
+        body,
+        repoId: plan.repoId,
+        // #368: the path the blob was reached by drives its Content-Type; a
+        // non-blob object (no path) uploads as octet-stream.
+        ...object.path ? { path: object.path } : {}
+      });
+      merged.set(object.sha, receipt.txId);
+      totalFeePaid += receipt.feePaid;
+      resultBySha.set(object.sha, {
+        sha: object.sha,
+        txId: receipt.txId,
+        feePaid: receipt.feePaid,
+        skipped: false
+      });
+    }
+  }
+  let announceReceipt = null;
+  if (plan.announceNeeded && !remoteState.announced) {
+    const announceEvent = buildRepoAnnouncement(
+      plan.repoId,
+      plan.announcement.name,
+      plan.announcement.description
+    );
+    announceReceipt = await publisher.publishEvent(announceEvent, relayUrls);
+    totalFeePaid += announceReceipt.feePaid;
+  }
+  const refsEvent = buildRepoRefs(
+    plan.repoId,
+    plan.newRefs,
+    Object.fromEntries(merged)
+  );
+  const refsReceipt = await publisher.publishEvent(refsEvent, relayUrls);
+  totalFeePaid += refsReceipt.feePaid;
+  const uploads = plan.objects.map((o) => {
+    const step = resultBySha.get(o.sha);
+    if (!step) {
+      throw new Error(`internal: no upload result recorded for ${o.sha}`);
+    }
+    return step;
+  });
+  return {
+    uploads,
+    announceReceipt,
+    refsReceipt,
+    arweaveMap: merged,
+    totalFeePaid
+  };
+}
+
+// src/ci/nip-c1-events.ts
+var CI_ADVERTISEMENT_KIND = 19843;
+var CI_SERVICE_REQUEST_KIND = 9843;
+var CI_SERVICE_STOP_KIND = 9844;
+var CI_SECRET_UPDATE_KIND = 29846;
+var CI_MANUAL_TRIGGER_KIND = 9840;
+var CI_JOB_RESULT_KIND = 9841;
+var CI_WORKFLOW_RESULT_KIND = 9842;
+var CI_WORKFLOW_PROGRESS_KIND = 39842;
+var CI_RUNNER_FAMILY = "act";
+var CI_SOFTWARE = "rig";
+var CI_MAX_ADVERTISEMENT_TTL = 30 * 60;
+var CI_MAX_PROGRESS_TTL = 30 * 60;
+var REPO_ANNOUNCEMENT_KIND = 30617;
+var CONCLUSIONS = /* @__PURE__ */ new Set([
+  "success",
+  "failure",
+  "neutral",
+  "cancelled",
+  "skipped",
+  "timed_out",
+  "startup_failure"
+]);
+function isCiConclusion(value) {
+  return CONCLUSIONS.has(value);
+}
+var PROGRESS_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "in_progress",
+  "concluded"
+]);
+var TRIGGER_REASONS = /* @__PURE__ */ new Set([
+  "push",
+  "pull_request",
+  "manual"
+]);
+var ADMISSIONS = /* @__PURE__ */ new Set([
+  "operator-selected",
+  "maintainer-request",
+  "open"
+]);
+var EXECUTIONS = /* @__PURE__ */ new Set([
+  "automatic",
+  "request-required"
+]);
+var BILLINGS = /* @__PURE__ */ new Set([
+  "not-required",
+  "out-of-band"
+]);
+var HEX64 = /^[0-9a-f]{64}$/;
+var GIT_OID = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var REPO_ADDR_RE = /^30617:([0-9a-fA-F]{64}):(.+)$/;
+function repoAddress(ownerPubkey, repoId) {
+  return `${REPO_ANNOUNCEMENT_KIND}:${ownerPubkey.toLowerCase()}:${repoId}`;
+}
+function parseRepoAddress(a) {
+  const m = REPO_ADDR_RE.exec(a);
+  if (!m) return null;
+  return {
+    ownerPubkey: m[1].toLowerCase(),
+    repoId: m[2]
+  };
+}
+var PROVENANCE_MARKERS = /* @__PURE__ */ new Set([
+  "service-request",
+  "manual-trigger"
+]);
+function triggerTags(trigger, opts = {}) {
+  const tags = [["a", trigger.repoAddr]];
+  for (const a of trigger.extraRepoAddrs ?? []) tags.push(["a", a]);
+  tags.push(["c", trigger.commit]);
+  for (const c of trigger.tagObjectIds ?? []) tags.push(["c", c]);
+  tags.push(["w", trigger.workflow.path, trigger.workflow.sha256]);
+  if (!opts.omitReason && trigger.reason !== void 0) {
+    tags.push(["o", trigger.reason]);
+  }
+  if (trigger.pr) {
+    tags.push(["E", trigger.pr.prEventId]);
+    tags.push(["K", String(trigger.pr.prKind)]);
+    tags.push(["P", trigger.pr.prAuthor]);
+    tags.push(["e", trigger.pr.sourceEventId]);
+    tags.push(["k", String(trigger.pr.sourceKind)]);
+    if (!opts.omitPrParentAuthor) tags.push(["p", trigger.pr.sourceAuthor]);
+  } else if (trigger.ref !== void 0) {
+    tags.push(["r", trigger.ref]);
+  }
+  return tags;
+}
+function commonTriggerTags(trigger) {
+  return triggerTags(trigger);
+}
+function values(tags, name) {
+  return tags.filter((t) => t[0] === name);
+}
+function single(tags, name) {
+  const found = values(tags, name);
+  return found.length === 1 ? found[0] : null;
+}
+function optionalSingle(tags, name) {
+  const found = values(tags, name);
+  if (found.length === 0) return void 0;
+  return found.length === 1 ? found[0] : null;
+}
+function parsePrKind(value, allowUpdate) {
+  if (value === "1617") return 1617;
+  if (value === "1618") return 1618;
+  if (allowUpdate && value === "1619") return 1619;
+  return null;
+}
+function parseCiTriggerContext(tags, opts = {}) {
+  const aTags = values(tags, "a");
+  if (aTags.length === 0) return null;
+  const addrs = [];
+  let repoId = null;
+  for (const t of aTags) {
+    const parsed = t[1] === void 0 ? null : parseRepoAddress(t[1]);
+    if (!parsed) return null;
+    if (repoId !== null && parsed.repoId !== repoId) return null;
+    repoId = parsed.repoId;
+    addrs.push(repoAddress(parsed.ownerPubkey, parsed.repoId));
+  }
+  const cTags = values(tags, "c");
+  if (cTags.length === 0) return null;
+  const commits = [];
+  for (const t of cTags) {
+    const c = t[1]?.toLowerCase();
+    if (c === void 0 || !GIT_OID.test(c)) return null;
+    commits.push(c);
+  }
+  const w = single(tags, "w");
+  if (!w || w.length < 3 || !w[1] || !HEX64.test(w[2].toLowerCase()))
+    return null;
+  const o = optionalSingle(tags, "o");
+  if (o === null) return null;
+  let reason;
+  if (o === void 0) {
+    if (opts.defaultReason === void 0) return null;
+    reason = opts.defaultReason;
+  } else {
+    const v = o[1] ?? "";
+    if (!TRIGGER_REASONS.has(v)) return null;
+    reason = v;
+  }
+  const trigger = {
+    repoAddr: addrs[0],
+    commit: commits[0],
+    workflow: { path: w[1], sha256: w[2].toLowerCase() },
+    reason
+  };
+  if (addrs.length > 1) trigger.extraRepoAddrs = addrs.slice(1);
+  if (commits.length > 1) trigger.tagObjectIds = commits.slice(1);
+  const E = optionalSingle(tags, "E");
+  if (E === null) return null;
+  if (E !== void 0) {
+    const K = single(tags, "K");
+    const P = single(tags, "P");
+    const prKind = parsePrKind(K?.[1], false);
+    const prEventId = E[1]?.toLowerCase();
+    const prAuthor = P?.[1]?.toLowerCase();
+    if (prKind === null || prEventId === void 0 || !HEX64.test(prEventId) || prAuthor === void 0 || !HEX64.test(prAuthor)) {
+      return null;
+    }
+    const e = optionalSingle(tags, "e");
+    const k = optionalSingle(tags, "k");
+    const p = optionalSingle(tags, "p");
+    if (e === null || k === null || p === null) return null;
+    let sourceEventId = prEventId;
+    let sourceKind = prKind;
+    if (e !== void 0) {
+      const id = e[1]?.toLowerCase();
+      if (id === void 0 || !HEX64.test(id)) return null;
+      sourceEventId = id;
+      const parsedKind = parsePrKind(k?.[1], true);
+      if (k !== void 0 && parsedKind === null) return null;
+      sourceKind = parsedKind ?? prKind;
+    }
+    let sourceAuthor = prAuthor;
+    if (p !== void 0) {
+      const author = p[1]?.toLowerCase();
+      if (author === void 0 || !HEX64.test(author)) return null;
+      sourceAuthor = author;
+    }
+    trigger.pr = {
+      prEventId,
+      prAuthor,
+      prKind,
+      sourceEventId,
+      sourceAuthor,
+      sourceKind
+    };
+    if (values(tags, "r").some((t) => t[1]?.startsWith("refs/"))) return null;
+  } else {
+    const refs = values(tags, "r").filter((t) => t[1]?.startsWith("refs/"));
+    if (refs.length > 1) return null;
+    if (refs.length === 1) trigger.ref = refs[0][1];
+  }
+  return trigger;
+}
+function provenanceTag(p) {
+  return ["q", p.eventId, p.relayUrl, p.pubkey, p.kind];
+}
+function parseProvenance(tags) {
+  const quotes = values(tags, "q").filter(
+    (t) => t[4] !== void 0 && PROVENANCE_MARKERS.has(t[4])
+  );
+  if (quotes.length === 0) return void 0;
+  if (quotes.length > 1) return null;
+  const q = quotes[0];
+  const eventId = q[1]?.toLowerCase();
+  const pubkey = q[3]?.toLowerCase();
+  if (eventId === void 0 || !HEX64.test(eventId) || pubkey === void 0 || !HEX64.test(pubkey)) {
+    return null;
+  }
+  return {
+    kind: q[4],
+    eventId,
+    relayUrl: q[2] ?? "",
+    pubkey
+  };
+}
+function now() {
+  return Math.floor(Date.now() / 1e3);
+}
+function assertExpiration(createdAt, expiresAt, maxTtl) {
+  if (!Number.isInteger(expiresAt) || expiresAt <= createdAt) {
+    throw new Error("expiration must be later than created_at");
+  }
+  if (expiresAt - createdAt > maxTtl) {
+    throw new Error(
+      `expiration must be no more than ${maxTtl}s after created_at`
+    );
+  }
+}
+function foldUnique(items) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of items) {
+    const v = raw.toLowerCase();
+    if (!seen.has(v)) {
+      seen.add(v);
+      out.push(v);
+    }
+  }
+  return out;
+}
+function buildCiAdvertisement(input, createdAt = now()) {
+  const selectors = foldUnique(input.selectors);
+  if (selectors.length === 0) {
+    throw new Error("an advertisement needs at least one runner selector");
+  }
+  if (input.secretsKey && input.secretsKey.inboxRelays.length === 0) {
+    throw new Error("secrets-key needs at least one secret-inbox relay");
+  }
+  assertExpiration(createdAt, input.expiresAt, CI_MAX_ADVERTISEMENT_TTL);
+  const tags = [
+    ["software", CI_SOFTWARE, input.version],
+    ["W", CI_RUNNER_FAMILY],
+    ...selectors.map((s) => ["R", `${CI_RUNNER_FAMILY}:${s}`]),
+    ["M", input.admission],
+    ["X", input.execution]
+  ];
+  if (input.billing) tags.push(["B", input.billing]);
+  if (input.secretsKey) {
+    tags.push([
+      "secrets-key",
+      "nip44-v2",
+      input.secretsKey.pubkey.toLowerCase(),
+      ...input.secretsKey.inboxRelays
+    ]);
+  }
+  tags.push(["expiration", String(input.expiresAt)]);
+  return {
+    kind: CI_ADVERTISEMENT_KIND,
+    content: "",
+    tags,
+    created_at: createdAt
+  };
+}
+function parseCiAdvertisement(ev) {
+  if (ev.kind !== CI_ADVERTISEMENT_KIND || ev.content !== "") return null;
+  const { tags } = ev;
+  if (values(tags, "d").length > 0) return null;
+  const M = single(tags, "M");
+  const X = single(tags, "X");
+  const exp = single(tags, "expiration");
+  if (!M || !X || !exp) return null;
+  if (!ADMISSIONS.has(M[1] ?? "") || !EXECUTIONS.has(X[1] ?? "")) return null;
+  const B = optionalSingle(tags, "B");
+  if (B === null || B !== void 0 && !BILLINGS.has(B[1] ?? "")) return null;
+  const expiresAt = Number(exp[1]);
+  if (!Number.isInteger(expiresAt) || expiresAt <= ev.created_at) return null;
+  const families = foldUnique(
+    values(tags, "W").map((t) => t[1] ?? "").filter((v) => v !== "")
+  );
+  const selectors = foldUnique(
+    values(tags, "R").map((t) => t[1] ?? "").filter((v) => v !== "")
+  );
+  if (families.length === 0 || selectors.length === 0) return null;
+  const covered = /* @__PURE__ */ new Set();
+  for (const s of selectors) {
+    const family = s.slice(0, s.indexOf(":"));
+    if (!family || !families.includes(family)) return null;
+    covered.add(family);
+  }
+  if (covered.size !== families.length) return null;
+  const software = optionalSingle(tags, "software");
+  if (software === null) return null;
+  const sk = optionalSingle(tags, "secrets-key");
+  if (sk === null) return null;
+  let secretsKey;
+  if (sk !== void 0) {
+    const pubkey = sk[2]?.toLowerCase();
+    const inboxRelays = sk.slice(3).filter((u) => /^wss?:\/\//i.test(u));
+    if (sk[1] !== "nip44-v2" || pubkey === void 0 || !HEX64.test(pubkey) || inboxRelays.length === 0) {
+      return null;
+    }
+    secretsKey = { pubkey, inboxRelays };
+  }
+  const result = {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    version: software?.[2] ?? "",
+    families,
+    selectors,
+    admission: M[1],
+    execution: X[1],
+    expiresAt
+  };
+  if (B !== void 0) result.billing = B[1];
+  if (secretsKey) result.secretsKey = secretsKey;
+  return result;
+}
+function buildServiceControl(kind, repoAddr, coordinatorPubkey, relayHint, createdAt) {
+  const a = relayHint ? ["a", repoAddr, relayHint] : ["a", repoAddr];
+  return {
+    kind,
+    content: "",
+    tags: [a, ["p", coordinatorPubkey.toLowerCase()]],
+    created_at: createdAt
+  };
+}
+function buildCiServiceRequest(repoAddr, coordinatorPubkey, relayHint, createdAt = now()) {
+  return buildServiceControl(
+    CI_SERVICE_REQUEST_KIND,
+    repoAddr,
+    coordinatorPubkey,
+    relayHint,
+    createdAt
+  );
+}
+function buildCiServiceStop(repoAddr, coordinatorPubkey, relayHint, createdAt = now()) {
+  return buildServiceControl(
+    CI_SERVICE_STOP_KIND,
+    repoAddr,
+    coordinatorPubkey,
+    relayHint,
+    createdAt
+  );
+}
+function parseCiServiceControl(ev) {
+  if (ev.kind !== CI_SERVICE_REQUEST_KIND && ev.kind !== CI_SERVICE_STOP_KIND)
+    return null;
+  if (ev.content !== "") return null;
+  const { tags } = ev;
+  if (values(tags, "d").length > 0 || values(tags, "expiration").length > 0)
+    return null;
+  const a = single(tags, "a");
+  const p = single(tags, "p");
+  if (!a || !p) return null;
+  const addr = a[1] === void 0 ? null : parseRepoAddress(a[1]);
+  const coordinator = p[1]?.toLowerCase();
+  if (!addr || coordinator === void 0 || !HEX64.test(coordinator))
+    return null;
+  const control = {
+    kind: ev.kind === CI_SERVICE_REQUEST_KIND ? "request" : "stop",
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    repoAddr: repoAddress(addr.ownerPubkey, addr.repoId),
+    coordinatorPubkey: coordinator
+  };
+  if (a[2]) control.relayHint = a[2];
+  return control;
+}
+function controlOrder(a, b) {
+  if (a.createdAt !== b.createdAt) return a.createdAt - b.createdAt;
+  if (a.eventId === b.eventId) return 0;
+  return a.eventId < b.eventId ? 1 : -1;
+}
+function selectServiceRequests(controls, opts) {
+  const coordinator = opts.coordinatorPubkey.toLowerCase();
+  const authorized = new Set([...opts.authorized].map((p) => p.toLowerCase()));
+  const accepted = /* @__PURE__ */ new Set([
+    ...authorized,
+    ...[...opts.acceptedRequesters ?? []].map((p) => p.toLowerCase())
+  ]);
+  const relevant = controls.filter(
+    (c) => c.coordinatorPubkey.toLowerCase() === coordinator && (opts.repoAddr === void 0 || c.repoAddr === opts.repoAddr)
+  ).sort(controlOrder);
+  let open = [];
+  for (const control of relevant) {
+    const author = control.pubkey.toLowerCase();
+    if (control.kind === "request") {
+      if (accepted.has(author)) open.push(control);
+      continue;
+    }
+    open = authorized.has(author) ? [] : open.filter((r) => r.pubkey.toLowerCase() !== author);
+  }
+  return {
+    active: open.length > 0 ? open[open.length - 1] : null,
+    open
+  };
+}
+function buildCiManualTrigger(coordinatorPubkey, trigger, createdAt = now()) {
+  return {
+    kind: CI_MANUAL_TRIGGER_KIND,
+    content: "",
+    tags: [
+      ["p", coordinatorPubkey.toLowerCase()],
+      ...triggerTags(trigger, { omitReason: true, omitPrParentAuthor: true })
+    ],
+    created_at: createdAt
+  };
+}
+function parseCiManualTrigger(ev, coordinatorPubkey) {
+  if (ev.kind !== CI_MANUAL_TRIGGER_KIND || ev.content !== "") return null;
+  const p = single(ev.tags, "p");
+  const coordinator = p?.[1]?.toLowerCase();
+  if (!p || coordinator === void 0 || !HEX64.test(coordinator)) return null;
+  if (coordinatorPubkey !== void 0 && coordinator !== coordinatorPubkey.toLowerCase())
+    return null;
+  if (values(ev.tags, "o").length > 0) return null;
+  const rest = ev.tags.filter((t) => t[0] !== "p");
+  const parsed = parseCiTriggerContext(rest, { defaultReason: "manual" });
+  if (!parsed) return null;
+  const { reason: _reason, ...trigger } = parsed;
+  return {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    coordinatorPubkey: coordinator,
+    trigger
+  };
+}
+var SECRET_UPDATE_TAGS = ["a", "p", "e", "sender", "recipient", "encryption"];
+function buildCiSecretUpdate(args) {
+  return {
+    kind: CI_SECRET_UPDATE_KIND,
+    content: args.ciphertext,
+    tags: [
+      ["a", args.repoAddr],
+      ["p", args.coordinatorPubkey.toLowerCase()],
+      [
+        "e",
+        args.advertisementId,
+        args.advertisementRelayHint ?? "",
+        "secrets-key"
+      ],
+      ["sender", args.senderPubkey.toLowerCase()],
+      ["recipient", args.recipientPubkey.toLowerCase()],
+      ["encryption", "nip44-v2"]
+    ],
+    created_at: args.createdAt
+  };
+}
+function parseCiSecretUpdate(ev) {
+  if (ev.kind !== CI_SECRET_UPDATE_KIND) return null;
+  if (ev.content === "" || ev.content.length > 100 * 1024) return null;
+  const { tags } = ev;
+  if (tags.length !== SECRET_UPDATE_TAGS.length) return null;
+  for (const name of SECRET_UPDATE_TAGS) {
+    if (values(tags, name).length !== 1) return null;
+  }
+  const a = single(tags, "a");
+  const p = single(tags, "p");
+  const e = single(tags, "e");
+  const sender = single(tags, "sender");
+  const recipient = single(tags, "recipient");
+  const encryption = single(tags, "encryption");
+  const addr = a[1] === void 0 ? null : parseRepoAddress(a[1]);
+  if (!addr || addr.ownerPubkey !== ev.pubkey.toLowerCase()) return null;
+  const coordinator = p[1]?.toLowerCase();
+  const advertisementId = e[1]?.toLowerCase();
+  const senderPubkey = sender[1]?.toLowerCase();
+  const recipientPubkey = recipient[1]?.toLowerCase();
+  if (coordinator === void 0 || !HEX64.test(coordinator) || advertisementId === void 0 || !HEX64.test(advertisementId) || e[3] !== "secrets-key" || senderPubkey === void 0 || !HEX64.test(senderPubkey) || recipientPubkey === void 0 || !HEX64.test(recipientPubkey) || encryption[1] !== "nip44-v2") {
+    return null;
+  }
+  return {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    repoAddr: repoAddress(addr.ownerPubkey, addr.repoId),
+    coordinatorPubkey: coordinator,
+    advertisementId,
+    senderPubkey,
+    recipientPubkey,
+    ciphertext: ev.content
+  };
+}
+var LOG_TAIL_HEADER = /^\[log-tail omitted=(\d+)\]\n?/;
+var PROGRESS_ADDR_RE = /^39842:[0-9a-f]{64}:.+$/i;
+function buildCiJobResult(input, createdAt = now()) {
+  const tags = [
+    ...commonTriggerTags(input.trigger),
+    ["q", input.progressAddress, input.relayUrl],
+    ["job", input.jobId]
+  ];
+  if (input.name !== void 0) tags.push(["name", input.name]);
+  tags.push(["conclusion", input.conclusion]);
+  tags.push(["logs", input.logsUrl]);
+  for (const a of input.artifacts ?? []) {
+    tags.push(["artifact", a.url, a.filename, a.name]);
+  }
+  if (input.queuedAt !== void 0)
+    tags.push(["queued_at", String(input.queuedAt)]);
+  if (input.startedAt !== void 0)
+    tags.push(["started_at", String(input.startedAt)]);
+  if (input.exitCode !== void 0)
+    tags.push(["exit_code", String(input.exitCode)]);
+  if (input.runsOn && input.runsOn.length > 0)
+    tags.push(["runs_on", ...input.runsOn]);
+  if (input.provenance) tags.push(provenanceTag(input.provenance));
+  return {
+    kind: CI_JOB_RESULT_KIND,
+    content: `[log-tail omitted=${input.logOmittedBytes}]
+${input.logTail}`,
+    tags,
+    created_at: createdAt
+  };
+}
+function optionalInt(tags, name) {
+  const t = optionalSingle(tags, name);
+  if (t === null) return null;
+  if (t === void 0) return void 0;
+  const n = Number(t[1]);
+  return Number.isInteger(n) ? n : null;
+}
+function parseCiJobResult(ev) {
+  if (ev.kind !== CI_JOB_RESULT_KIND) return null;
+  const { tags } = ev;
+  const trigger = parseCiTriggerContext(tags);
+  if (!trigger) return null;
+  const progress = values(tags, "q").filter(
+    (t) => t[1] !== void 0 && PROGRESS_ADDR_RE.test(t[1])
+  );
+  if (progress.length !== 1) return null;
+  const job = single(tags, "job");
+  const conclusion = single(tags, "conclusion");
+  if (!job || !job[1] || !conclusion || !isCiConclusion(conclusion[1] ?? ""))
+    return null;
+  const name = optionalSingle(tags, "name");
+  const logs = optionalSingle(tags, "logs");
+  if (name === null || logs === null) return null;
+  const queuedAt = optionalInt(tags, "queued_at");
+  const startedAt = optionalInt(tags, "started_at");
+  const exitCode = optionalInt(tags, "exit_code");
+  if (queuedAt === null || startedAt === null || exitCode === null) return null;
+  const runsOn = optionalSingle(tags, "runs_on");
+  if (runsOn === null) return null;
+  const provenance = parseProvenance(tags);
+  if (provenance === null) return null;
+  const artifacts = [];
+  for (const t of values(tags, "artifact")) {
+    if (!t[1] || t[2] === void 0 || t[3] === void 0) return null;
+    artifacts.push({ url: t[1], filename: t[2], name: t[3] });
+  }
+  const header = LOG_TAIL_HEADER.exec(ev.content);
+  const logOmittedBytes = header ? Number(header[1]) : 0;
+  const logTail = header ? ev.content.slice(header[0].length) : ev.content;
+  const result = {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    trigger,
+    progressAddress: progress[0][1],
+    jobId: job[1],
+    conclusion: conclusion[1],
+    logTail,
+    logOmittedBytes,
+    artifacts,
+    runsOn: runsOn ? runsOn.slice(1) : []
+  };
+  if (name?.[1] !== void 0) result.name = name[1];
+  if (logs?.[1]) result.logsUrl = logs[1];
+  if (queuedAt !== void 0) result.queuedAt = queuedAt;
+  if (startedAt !== void 0) result.startedAt = startedAt;
+  if (exitCode !== void 0) result.exitCode = exitCode;
+  if (provenance) result.provenance = provenance;
+  return result;
+}
+function jobQuoteTag(j) {
+  return ["q", j.eventId, j.relayUrl, j.pubkey, j.jobId];
+}
+function parseJobQuotes(tags) {
+  const jobs = [];
+  for (const t of values(tags, "q")) {
+    const marker = t[4];
+    if (marker === void 0 || PROVENANCE_MARKERS.has(marker)) continue;
+    if (t[1] !== void 0 && PROGRESS_ADDR_RE.test(t[1])) continue;
+    const eventId = t[1]?.toLowerCase();
+    const pubkey = t[3]?.toLowerCase();
+    if (eventId === void 0 || !HEX64.test(eventId) || pubkey === void 0 || !HEX64.test(pubkey) || marker === "") {
+      return null;
+    }
+    jobs.push({ eventId, relayUrl: t[2] ?? "", pubkey, jobId: marker });
+  }
+  return jobs;
+}
+function buildCiWorkflowResult(input, createdAt = now()) {
+  const tags = [
+    ...commonTriggerTags(input.trigger),
+    ["r", input.runId],
+    ["conclusion", input.conclusion]
+  ];
+  if (input.queuedAt !== void 0)
+    tags.push(["queued_at", String(input.queuedAt)]);
+  if (input.startedAt !== void 0)
+    tags.push(["started_at", String(input.startedAt)]);
+  if (input.provenance) tags.push(provenanceTag(input.provenance));
+  for (const j of input.jobs) tags.push(jobQuoteTag(j));
+  return {
+    kind: CI_WORKFLOW_RESULT_KIND,
+    content: "",
+    tags,
+    created_at: createdAt
+  };
+}
+function parseCiWorkflowResult(ev) {
+  if (ev.kind !== CI_WORKFLOW_RESULT_KIND || ev.content !== "") return null;
+  const { tags } = ev;
+  const trigger = parseCiTriggerContext(tags);
+  if (!trigger) return null;
+  const runIds = values(tags, "r").filter(
+    (t) => t[1] && !t[1].startsWith("refs/")
+  );
+  if (runIds.length !== 1) return null;
+  const conclusion = single(tags, "conclusion");
+  if (!conclusion || !isCiConclusion(conclusion[1] ?? "")) return null;
+  const queuedAt = optionalInt(tags, "queued_at");
+  const startedAt = optionalInt(tags, "started_at");
+  if (queuedAt === null || startedAt === null) return null;
+  const provenance = parseProvenance(tags);
+  if (provenance === null) return null;
+  const jobs = parseJobQuotes(tags);
+  if (!jobs) return null;
+  const result = {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    trigger,
+    runId: runIds[0][1],
+    conclusion: conclusion[1],
+    jobs
+  };
+  if (queuedAt !== void 0) result.queuedAt = queuedAt;
+  if (startedAt !== void 0) result.startedAt = startedAt;
+  if (provenance) result.provenance = provenance;
+  return result;
+}
+function buildCiWorkflowProgress(input, createdAt = now()) {
+  if (input.status === "concluded" && input.conclusion === void 0) {
+    throw new Error("a concluded progress event needs a conclusion");
+  }
+  if (input.status !== "concluded" && input.conclusion !== void 0) {
+    throw new Error("only a concluded progress event may carry a conclusion");
+  }
+  assertExpiration(createdAt, input.expiresAt, CI_MAX_PROGRESS_TTL);
+  const tags = [
+    ...commonTriggerTags(input.trigger),
+    ["d", input.runId],
+    ["status", input.status]
+  ];
+  if (input.queue !== void 0) tags.push(["queue", String(input.queue)]);
+  if (input.inProgress && input.inProgress.length > 0) {
+    tags.push(["in-progress", ...input.inProgress]);
+  }
+  if (input.conclusion !== void 0)
+    tags.push(["conclusion", input.conclusion]);
+  if (input.queuedAt !== void 0)
+    tags.push(["queued_at", String(input.queuedAt)]);
+  if (input.startedAt !== void 0)
+    tags.push(["started_at", String(input.startedAt)]);
+  tags.push(["expiration", String(input.expiresAt)]);
+  if (input.provenance && !(input.status === "queued" && input.provenance.kind === "service-request")) {
+    tags.push(provenanceTag(input.provenance));
+  }
+  for (const j of input.jobs) tags.push(jobQuoteTag(j));
+  return {
+    kind: CI_WORKFLOW_PROGRESS_KIND,
+    content: "",
+    tags,
+    created_at: createdAt
+  };
+}
+function parseCiWorkflowProgress(ev) {
+  if (ev.kind !== CI_WORKFLOW_PROGRESS_KIND || ev.content !== "") return null;
+  const { tags } = ev;
+  const trigger = parseCiTriggerContext(tags);
+  if (!trigger) return null;
+  const d = single(tags, "d");
+  const status = single(tags, "status");
+  const exp = single(tags, "expiration");
+  if (!d || !d[1] || !status || !PROGRESS_STATUSES.has(status[1] ?? "") || !exp)
+    return null;
+  const expiresAt = Number(exp[1]);
+  if (!Number.isInteger(expiresAt)) return null;
+  const conclusion = optionalSingle(tags, "conclusion");
+  if (conclusion === null) return null;
+  if (status[1] === "concluded") {
+    if (!conclusion || !isCiConclusion(conclusion[1] ?? "")) return null;
+  } else if (conclusion !== void 0) {
+    return null;
+  }
+  const queue = optionalInt(tags, "queue");
+  const queuedAt = optionalInt(tags, "queued_at");
+  const startedAt = optionalInt(tags, "started_at");
+  if (queue === null || queuedAt === null || startedAt === null) return null;
+  const inProgress = optionalSingle(tags, "in-progress");
+  if (inProgress === null) return null;
+  const provenance = parseProvenance(tags);
+  if (provenance === null) return null;
+  const jobs = parseJobQuotes(tags);
+  if (!jobs) return null;
+  const result = {
+    eventId: ev.id,
+    pubkey: ev.pubkey.toLowerCase(),
+    createdAt: ev.created_at,
+    trigger,
+    runId: d[1],
+    status: status[1],
+    inProgress: inProgress ? inProgress.slice(1) : [],
+    expiresAt,
+    jobs
+  };
+  if (conclusion?.[1] !== void 0)
+    result.conclusion = conclusion[1];
+  if (queue !== void 0) result.queue = queue;
+  if (queuedAt !== void 0) result.queuedAt = queuedAt;
+  if (startedAt !== void 0) result.startedAt = startedAt;
+  if (provenance) result.provenance = provenance;
+  return result;
+}
+
+// src/ci/secrets.ts
+import { v2 as nip44 } from "nostr-tools/nip44";
+import { generateSecretKey, getPublicKey } from "nostr-tools/pure";
+var SECRET_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+var RESERVED_SECRET_NAMES = [
+  "WORKFLOW_SECRETS_DECRYPTION_BUNKER"
+];
+var MAX_SECRET_NAMES = 100;
+var MAX_SECRET_VALUE_BYTES = 16384;
+var MAX_SECRET_PLAINTEXT_BYTES = 65535;
+var MAX_SECRET_CIPHERTEXT_BYTES = 100 * 1024;
+var HEX642 = /^[0-9a-f]{64}$/i;
+function utf8Bytes(s) {
+  return Buffer.byteLength(s, "utf-8");
+}
+function assertName(name) {
+  if (!SECRET_NAME_RE.test(name)) {
+    throw new Error(`invalid secret name ${JSON.stringify(name)}`);
+  }
+  if (RESERVED_SECRET_NAMES.includes(name)) {
+    throw new Error(`secret name ${name} is reserved`);
+  }
+}
+function assertSecretUpdateShape(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("secret update plaintext must be a JSON object");
+  }
+  const keys = Object.keys(value).sort();
+  if (keys.join(",") !== "author,created_at,remove,set") {
+    throw new Error(
+      "secret update plaintext must contain exactly author, created_at, set, and remove"
+    );
+  }
+  const { author, created_at, set, remove } = value;
+  if (typeof author !== "string" || !HEX642.test(author)) {
+    throw new Error("secret update author must be a 64-hex pubkey");
+  }
+  if (typeof created_at !== "number" || !Number.isInteger(created_at)) {
+    throw new Error("secret update created_at must be an integer");
+  }
+  if (set === null || typeof set !== "object" || Array.isArray(set)) {
+    throw new Error("secret update set must be an object");
+  }
+  if (!Array.isArray(remove) || !remove.every((n) => typeof n === "string")) {
+    throw new Error("secret update remove must be an array of names");
+  }
+  const setNames = Object.keys(set);
+  const removeNames = remove;
+  if (setNames.length === 0 && removeNames.length === 0) {
+    throw new Error("secret update needs a non-empty set or remove");
+  }
+  if (setNames.length + removeNames.length > MAX_SECRET_NAMES) {
+    throw new Error(
+      `secret update may name at most ${MAX_SECRET_NAMES} secrets`
+    );
+  }
+  for (const name of [...setNames, ...removeNames]) assertName(name);
+  const removeSet = new Set(removeNames);
+  if (removeSet.size !== removeNames.length) {
+    throw new Error("secret update remove lists a name twice");
+  }
+  for (const name of setNames) {
+    if (removeSet.has(name)) {
+      throw new Error(`secret ${name} appears in both set and remove`);
+    }
+    const v = set[name];
+    if (typeof v !== "string" || v === "") {
+      throw new Error(`secret ${name} value must be a non-empty string`);
+    }
+    if (utf8Bytes(v) > MAX_SECRET_VALUE_BYTES) {
+      throw new Error(
+        `secret ${name} value exceeds ${MAX_SECRET_VALUE_BYTES} bytes`
+      );
+    }
+  }
+  return {
+    author: author.toLowerCase(),
+    created_at,
+    set,
+    remove: removeNames
+  };
+}
+function validateSecretUpdate(plain, outer) {
+  if (plain.author.toLowerCase() !== outer.pubkey.toLowerCase()) {
+    throw new Error("secret update author does not match the signing pubkey");
+  }
+  if (plain.created_at !== outer.created_at) {
+    throw new Error(
+      "secret update created_at does not match the event timestamp"
+    );
+  }
+}
+function encryptSecretUpdate(plain, senderSecretKey, recipientPubkey) {
+  const checked = assertSecretUpdateShape(plain);
+  const json = JSON.stringify(checked);
+  if (utf8Bytes(json) > MAX_SECRET_PLAINTEXT_BYTES) {
+    throw new Error(
+      `secret update plaintext exceeds ${MAX_SECRET_PLAINTEXT_BYTES} bytes`
+    );
+  }
+  const key = nip44.utils.getConversationKey(senderSecretKey, recipientPubkey);
+  return nip44.encrypt(json, key);
+}
+function decryptSecretUpdate(ciphertext, recipientSecretKey, senderPubkey) {
+  if (utf8Bytes(ciphertext) > MAX_SECRET_CIPHERTEXT_BYTES) {
+    throw new Error("secret update ciphertext exceeds 100 KiB");
+  }
+  const key = nip44.utils.getConversationKey(recipientSecretKey, senderPubkey);
+  const json = nip44.decrypt(ciphertext, key);
+  if (utf8Bytes(json) > MAX_SECRET_PLAINTEXT_BYTES) {
+    throw new Error(
+      `secret update plaintext exceeds ${MAX_SECRET_PLAINTEXT_BYTES} bytes`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    throw new Error("secret update plaintext is not JSON");
+  }
+  return assertSecretUpdateShape(parsed);
+}
+function applySecretUpdate(inventory, plain, eventId) {
+  const next = { ...inventory };
+  const position = { createdAt: plain.created_at, eventId };
+  const isLater = (name) => {
+    const existing = next[name];
+    return existing === void 0 || controlOrder(position, existing) > 0;
+  };
+  for (const [name, value] of Object.entries(plain.set)) {
+    if (isLater(name)) {
+      next[name] = { value, ...position, origin: plain.author };
+    }
+  }
+  for (const name of plain.remove) {
+    if (isLater(name)) {
+      next[name] = { value: null, ...position, origin: plain.author };
+    }
+  }
+  return next;
+}
+function effectiveSecrets(inventory) {
+  const out = {};
+  for (const [name, entry] of Object.entries(inventory)) {
+    if (entry.value !== null) out[name] = entry.value;
+  }
+  return out;
+}
+function generateSecretsKey() {
+  const secretKey = generateSecretKey();
+  return { secretKey, pubkey: getPublicKey(secretKey) };
+}
+
+// src/ci/trust.ts
+var CI_TRUST_ORDER = [
+  "maintainer-directed",
+  "operationally-associated",
+  "seen-in-network",
+  "no-known-context"
+];
+function isCiTrustLevel(value) {
+  return CI_TRUST_ORDER.includes(value);
+}
+function deriveTrustLevel(args) {
+  const publisher = args.publisherPubkey.toLowerCase();
+  const authorized = new Set([...args.authorized].map((p) => p.toLowerCase()));
+  const forPublisher = args.controls.filter(
+    (c) => c.coordinatorPubkey.toLowerCase() === publisher
+  );
+  const prov = args.provenance;
+  if (prov && authorized.has(prov.pubkey.toLowerCase())) {
+    if (prov.kind === "manual-trigger") return "maintainer-directed";
+    const quoted = prov.eventId.toLowerCase();
+    if (forPublisher.some(
+      (c) => c.kind === "request" && c.eventId.toLowerCase() === quoted && c.pubkey.toLowerCase() === prov.pubkey.toLowerCase()
+    )) {
+      return "maintainer-directed";
+    }
+  }
+  const standing = selectServiceRequests(
+    forPublisher.filter((c) => c.createdAt <= args.runCreatedAt),
+    { coordinatorPubkey: publisher, authorized }
+  );
+  if (standing.active) return "operationally-associated";
+  if (authorized.has(publisher)) return "seen-in-network";
+  if (forPublisher.some((c) => c.kind === "request")) return "seen-in-network";
+  return "no-known-context";
+}
+function trustAtLeast(level, required) {
+  return CI_TRUST_ORDER.indexOf(level) <= CI_TRUST_ORDER.indexOf(required);
+}
+
+// src/ci/workflows.ts
+import { createHash as createHash2 } from "crypto";
+import { readdir, readFile } from "fs/promises";
+import { join } from "path";
+import { parse as parseYaml } from "yaml";
+var WORKFLOW_DIRS = [
+  ".github/workflows",
+  ".ngit/act/workflows"
+];
+var WORKFLOW_FILE_RE = /\.ya?ml$/i;
+function sha256Hex(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stringList(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) {
+    return value.filter((v) => typeof v === "string");
+  }
+  return void 0;
+}
+function refFilters(value) {
+  if (!isRecord(value)) return {};
+  const out = {};
+  const branches = stringList(value["branches"]);
+  const tags = stringList(value["tags"]);
+  if (branches) out.branches = branches;
+  if (tags) out.tags = tags;
+  return out;
+}
+function parseTriggers(on) {
+  const triggers = {};
+  const enable = (name, options) => {
+    if (name === "push") triggers.push = refFilters(options);
+    else if (name === "pull_request")
+      triggers.pull_request = refFilters(options);
+    else if (name === "workflow_dispatch") triggers.workflow_dispatch = true;
+  };
+  if (typeof on === "string") enable(on, void 0);
+  else if (Array.isArray(on)) for (const name of on) enable(name, void 0);
+  else if (isRecord(on)) {
+    for (const [name, options] of Object.entries(on)) enable(name, options);
+  }
+  return triggers;
+}
+function parseJobs(jobs) {
+  if (!isRecord(jobs)) return [];
+  const out = [];
+  for (const [id, spec] of Object.entries(jobs)) {
+    const job = { id };
+    if (isRecord(spec)) {
+      if (typeof spec["name"] === "string") job.name = spec["name"];
+      const runsOn = stringList(spec["runs-on"]);
+      if (runsOn) job.runsOn = runsOn;
+    }
+    out.push(job);
+  }
+  return out;
+}
+function parseWorkflow(path, content) {
+  const text = typeof content === "string" ? content : Buffer.from(content).toString("utf-8");
+  const base = {
+    path,
+    sha256: sha256Hex(content),
+    triggers: {},
+    jobs: []
+  };
+  let doc;
+  try {
+    doc = parseYaml(text, { strict: false, uniqueKeys: false });
+  } catch (err) {
+    return {
+      ...base,
+      parseError: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (!isRecord(doc)) {
+    return { ...base, parseError: "workflow is not a YAML mapping" };
+  }
+  const on = doc["on"] ?? doc["true"];
+  if (on === void 0 || on === null) {
+    return { ...base, parseError: "workflow has no `on:` trigger clause" };
+  }
+  const out = {
+    ...base,
+    triggers: parseTriggers(on),
+    jobs: parseJobs(doc["jobs"])
+  };
+  if (typeof doc["name"] === "string") out.name = doc["name"];
+  return out;
+}
+async function discoverWorkflows(checkoutDir) {
+  const found = [];
+  for (const dir of WORKFLOW_DIRS) {
+    let names;
+    try {
+      names = await readdir(join(checkoutDir, dir));
+    } catch {
+      continue;
+    }
+    for (const name of names.filter((n) => WORKFLOW_FILE_RE.test(n)).sort()) {
+      const rel = `${dir}/${name}`;
+      const bytes = await readFile(join(checkoutDir, dir, name));
+      found.push(parseWorkflow(rel, bytes));
+    }
+  }
+  return found;
+}
+function patternToRegExp(pattern) {
+  let re = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        re += ".*";
+        i++;
+      } else {
+        re += "[^/]*";
+      }
+    } else if (ch === "?") {
+      re += "[^/]";
+    } else if (ch === "+") {
+      re += "+";
+    } else {
+      re += ch.replace(/[.\\^$|()[\]{}]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function refMatchesPatterns(shortName, patterns) {
+  let included = false;
+  for (const pattern of patterns) {
+    const negated = pattern.startsWith("!");
+    const body = negated ? pattern.slice(1) : pattern;
+    if (patternToRegExp(body).test(shortName)) included = !negated;
+  }
+  return included;
+}
+function matchesPush(wf, ref) {
+  if (wf.parseError !== void 0 || !wf.triggers.push) return false;
+  const { branches, tags } = wf.triggers.push;
+  if (!branches && !tags) return true;
+  if (ref.startsWith("refs/heads/")) {
+    return branches !== void 0 && refMatchesPatterns(ref.slice("refs/heads/".length), branches);
+  }
+  if (ref.startsWith("refs/tags/")) {
+    return tags !== void 0 && refMatchesPatterns(ref.slice("refs/tags/".length), tags);
+  }
+  return false;
+}
+function matchesPullRequest(wf, baseRef) {
+  if (wf.parseError !== void 0 || !wf.triggers.pull_request) return false;
+  const { branches } = wf.triggers.pull_request;
+  if (!branches) return true;
+  if (baseRef === void 0) return false;
+  const short = baseRef.startsWith("refs/heads/") ? baseRef.slice("refs/heads/".length) : baseRef;
+  return refMatchesPatterns(short, branches);
+}
+
+// src/cli/daemon-session.ts
+function daemonSupportsGit(probe) {
+  return Array.isArray(probe.capabilities) && probe.capabilities.includes("git");
+}
+function daemonBaseUrl(env) {
+  const raw = env["TOON_CLIENT_HTTP_PORT"];
+  const parsed = raw ? Number(raw) : NaN;
+  const port = Number.isFinite(parsed) && parsed > 0 ? parsed : defaultDaemonPort();
+  return `http://127.0.0.1:${port}`;
+}
+async function probeDaemon(env, fetchImpl, timeoutMs = 1500) {
+  const baseUrl = daemonBaseUrl(env);
+  try {
+    const res = await fetchImpl(`${baseUrl}/status`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return { baseUrl, reachable: false };
+    const body = await res.json();
+    const probe = { baseUrl, reachable: true };
+    const pubkey = body?.identity?.nostrPubkey;
+    if (typeof pubkey === "string" && pubkey !== "") probe.identity = pubkey;
+    if (typeof body?.ready === "boolean") probe.ready = body.ready;
+    if (typeof body?.relay?.url === "string" && body.relay.url !== "") {
+      probe.relayUrl = body.relay.url;
+    }
+    if (typeof body?.feePerEvent === "string" && body.feePerEvent !== "") {
+      probe.feePerEvent = body.feePerEvent;
+    }
+    if (Array.isArray(body?.capabilities)) {
+      probe.capabilities = body.capabilities.filter(
+        (c) => typeof c === "string"
+      );
+    }
+    return probe;
+  } catch {
+    return { baseUrl, reachable: false };
+  }
+}
+var DaemonRouteError = class extends Error {
+  constructor(status, envelope) {
+    super(envelope.detail ?? envelope.error);
+    this.status = status;
+    this.envelope = envelope;
+    this.name = "DaemonRouteError";
+  }
+  status;
+  envelope;
+};
+var DaemonTooOldForGitError = class extends Error {
+  constructor(baseUrl, pubkey) {
+    const holds = pubkey !== void 0 && pubkey !== "" ? ` holds this identity (${pubkey.slice(0, 8)}\u2026)` : " holds this identity";
+    super(
+      `toon-clientd at ${baseUrl}${holds} but is too old to handle git operations (missing /git routes). Upgrade the daemon (npm i -g @toon-protocol/client-mcp@latest, then restart it) \u2014 or stop it to let rig run standalone.`
+    );
+    this.baseUrl = baseUrl;
+    this.pubkey = pubkey;
+    this.name = "DaemonTooOldForGitError";
+  }
+  baseUrl;
+  pubkey;
+};
+var DaemonUnreachableError = class extends Error {
+  constructor(baseUrl, cause) {
+    super(
+      `toon-clientd stopped answering at ${baseUrl} after the identity probe \u2014 nothing was paid. Re-run: rig falls back to standalone automatically when no daemon responds` + (cause instanceof Error ? ` (${cause.message})` : "")
+    );
+    this.baseUrl = baseUrl;
+    this.name = "DaemonUnreachableError";
+  }
+  baseUrl;
+};
+var DaemonGitClient = class {
+  constructor(baseUrl, fetchImpl, pubkey) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+    this.pubkey = pubkey;
+  }
+  baseUrl;
+  fetchImpl;
+  pubkey;
+  gitEstimate(req) {
+    return this.post("/git/estimate", req);
+  }
+  gitPush(req) {
+    return this.post("/git/push", req);
+  }
+  gitIssue(req) {
+    return this.post("/git/issue", req);
+  }
+  gitComment(req) {
+    return this.post("/git/comment", req);
+  }
+  gitPatch(req) {
+    return this.post("/git/patch", req);
+  }
+  gitStatus(req) {
+    return this.post("/git/status", req);
+  }
+  async post(path, body) {
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      throw new DaemonUnreachableError(this.baseUrl, err);
+    }
+    if (res.status === 404) {
+      throw new DaemonTooOldForGitError(this.baseUrl, this.pubkey);
+    }
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text === "" ? {} : JSON.parse(text);
+    } catch {
+      throw new DaemonRouteError(res.status, {
+        error: "invalid_response",
+        detail: `daemon returned non-JSON (HTTP ${res.status}): ${text.slice(0, 200)}`
+      });
+    }
+    if (!res.ok) {
+      const envelope = parsed && typeof parsed === "object" && "error" in parsed ? parsed : { error: "http_error", detail: `HTTP ${res.status}` };
+      throw new DaemonRouteError(res.status, envelope);
+    }
+    return parsed;
+  }
+};
+async function resolvePaidSession(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  if (standaloneForced(options.env)) {
+    options.warn(
+      "rig: paid path: standalone (RIG_STANDALONE set \u2014 toon-clientd bypassed)"
+    );
+    const ctx2 = await options.loadStandalone({
+      env: options.env,
+      cwd: options.cwd,
+      warn: options.warn,
+      ...options.relayUrl !== void 0 ? { relayUrl: options.relayUrl } : {}
+    });
+    return { path: "standalone", ctx: ctx2 };
+  }
+  const probe = await (options.probeDaemon ?? probeDaemon)(
+    options.env,
+    fetchImpl
+  );
+  if (probe.reachable && probe.identity !== void 0) {
+    const identity = await resolveIdentity({
+      env: options.env,
+      cwd: options.cwd,
+      warn: options.warn
+    });
+    if (identity.pubkey === probe.identity) {
+      if (!daemonSupportsGit(probe)) {
+        throw new DaemonTooOldForGitError(probe.baseUrl, identity.pubkey);
+      }
+      options.warn(
+        `rig: paid path: daemon \u2014 toon-clientd at ${probe.baseUrl} holds this identity (${identity.pubkey.slice(0, 8)}\u2026), delegating`
+      );
+      return {
+        path: "daemon",
+        client: new DaemonGitClient(probe.baseUrl, fetchImpl, identity.pubkey),
+        baseUrl: probe.baseUrl,
+        identity: {
+          pubkey: identity.pubkey,
+          source: identity.source,
+          sourceLabel: identity.sourceLabel
+        },
+        ...probe.feePerEvent !== void 0 ? { feePerEvent: probe.feePerEvent } : {},
+        ...probe.relayUrl !== void 0 ? { daemonRelayUrl: probe.relayUrl } : {}
+      };
+    }
+    options.warn(
+      `rig: paid path: standalone \u2014 the toon-clientd at ${probe.baseUrl} runs a different identity (${probe.identity.slice(0, 8)}\u2026), no shared channel state`
+    );
+  } else {
+    options.warn(
+      `rig: paid path: standalone (no toon-clientd at ${probe.baseUrl})`
+    );
+  }
+  const ctx = await options.loadStandalone({
+    env: options.env,
+    cwd: options.cwd,
+    warn: options.warn,
+    ...options.relayUrl !== void 0 ? { relayUrl: options.relayUrl } : {}
+  });
+  return { path: "standalone", ctx };
+}
+
+// src/cli/errors.ts
+var UnconfiguredRepoAddressError = class extends Error {
+  constructor(missing) {
+    super(
+      `no ${missing} configured \u2014 this command addresses the repo as 30617:<ownerPubkey>:<repoId>. Run \`rig init\` once inside the repo (it writes toon.repoid/toon.owner to the local git config), or pass ${missing === "repository id" ? "--repo-id <id>" : "--owner <pubkey>"} explicitly (use --owner for repos you don't own).`
+    );
+    this.missing = missing;
+    this.name = "UnconfiguredRepoAddressError";
+  }
+  missing;
+};
+var InvalidRelayUrlError = class extends Error {
+  constructor(url, context) {
+    super(
+      `${context}: ${JSON.stringify(url)} is not a relay URL \u2014 relays are ws://, wss://, http://, or https://`
+    );
+    this.url = url;
+    this.name = "InvalidRelayUrlError";
+  }
+  url;
+};
+var UnknownRemoteError = class extends Error {
+  constructor(remote) {
+    super(
+      `no remote named ${JSON.stringify(remote)} is configured \u2014 \`rig remote list\` shows configured remotes; add it with \`rig remote add ${remote} <relay-url>\``
+    );
+    this.remote = remote;
+    this.name = "UnknownRemoteError";
+  }
+  remote;
+};
+var MultiUrlRemoteError = class extends Error {
+  constructor(remote, urls) {
+    super(
+      `remote ${JSON.stringify(remote)} has ${urls.length} URLs (${urls.join(", ")}) \u2014 rig supports one relay URL per remote. Fix it with \`git remote set-url ${remote} <relay-url>\`. Nothing was uploaded, published, or paid.`
+    );
+    this.remote = remote;
+    this.urls = urls;
+    this.name = "MultiUrlRemoteError";
+  }
+  remote;
+  urls;
+};
+var NoOriginConfiguredError = class extends Error {
+  constructor(nonRelayOriginUrl) {
+    super(
+      "no origin configured \u2014 run `rig remote add origin <relay-url>` (or pass --relay <url> for a one-off publish)." + (nonRelayOriginUrl !== void 0 ? `
+The existing "origin" remote (${nonRelayOriginUrl}) is not a relay URL, so rig ignores it \u2014 add the relay under another name (\`rig remote add toon <relay-url>\`) and target it explicitly (\`rig push toon\` / \`--remote toon\`).` : "")
+    );
+    this.name = "NoOriginConfiguredError";
+  }
+};
+var NotAGitRepositoryError = class extends Error {
+  constructor(cwd) {
+    super(
+      `not a git repository: ${cwd}
+rig can create one for you: re-run \`rig init --git-init\` (in a terminal, plain \`rig init\` offers the same via a prompt). Or run \`git init\` yourself first, then re-run.`
+    );
+    this.name = "NotAGitRepositoryError";
+  }
+};
+function nonFastForwardLines(refs) {
+  return [
+    "Push rejected: non-fast-forward update for:",
+    ...refs.map(
+      (r) => `  ${r.refname}  remote ${r.remoteSha.slice(0, 7)} is not an ancestor of local ${r.localSha.slice(0, 7)}`
+    ),
+    "The remote moved since your last push. Re-run with --force to overwrite it",
+    "WARNING: --force rewrites the published ref history for every reader of this repo."
+  ];
+}
+function oversizeLines(objects) {
+  return [
+    `Push rejected: ${objects.length} object(s) exceed the ${MAX_OBJECT_SIZE}-byte (95KB) upload limit:`,
+    ...objects.map((o) => `  ${o.path ?? o.sha}  ${o.type}, ${o.size} bytes`),
+    "Objects over 95KB are a hard error in v1 \u2014 split or remove the file(s) from history to push.",
+    "Large-object support is tracked in toon-client#235."
+  ];
+}
+function describeError(err, command = "push") {
+  if (err instanceof UnconfiguredRepoAddressError) {
+    return {
+      code: "unconfigured_repo_address",
+      lines: err.message.split("\n"),
+      json: { error: "unconfigured_repo_address", detail: err.message }
+    };
+  }
+  if (err instanceof NotAGitRepositoryError) {
+    return {
+      code: "not_a_git_repository",
+      lines: err.message.split("\n"),
+      json: { error: "not_a_git_repository", detail: err.message }
+    };
+  }
+  if (err instanceof InvalidRelayUrlError) {
+    return {
+      code: "invalid_relay_url",
+      lines: err.message.split("\n"),
+      json: { error: "invalid_relay_url", detail: err.message, url: err.url }
+    };
+  }
+  if (err instanceof UnknownRemoteError) {
+    return {
+      code: "unknown_remote",
+      lines: err.message.split("\n"),
+      json: {
+        error: "unknown_remote",
+        detail: err.message,
+        remote: err.remote
+      }
+    };
+  }
+  if (err instanceof MultiUrlRemoteError) {
+    return {
+      code: "multi_url_remote",
+      lines: err.message.split("\n"),
+      json: {
+        error: "multi_url_remote",
+        detail: err.message,
+        remote: err.remote,
+        urls: err.urls
+      }
+    };
+  }
+  if (err instanceof NoOriginConfiguredError) {
+    return {
+      code: "no_origin_configured",
+      lines: err.message.split("\n"),
+      json: { error: "no_origin_configured", detail: err.message }
+    };
+  }
+  if (err instanceof MissingIdentityError) {
+    return {
+      code: "missing_identity",
+      lines: err.message.split("\n"),
+      json: { error: "missing_identity", detail: err.message }
+    };
+  }
+  if (err instanceof NonFastForwardError) {
+    return {
+      code: "non_fast_forward",
+      lines: nonFastForwardLines(err.refs),
+      json: { error: "non_fast_forward", detail: err.message, refs: err.refs }
+    };
+  }
+  if (err instanceof OversizeObjectsError) {
+    return {
+      code: "oversize_objects",
+      lines: oversizeLines(err.objects),
+      json: {
+        error: "oversize_objects",
+        detail: err.message,
+        objects: err.objects
+      }
+    };
+  }
+  if (err instanceof GitError) {
+    return {
+      code: "git_error",
+      lines: [`git failed: ${err.message}`],
+      json: { error: "git_error", detail: err.message }
+    };
+  }
+  if (err instanceof Error && err.name === "ArnsSdkUnavailableError") {
+    return {
+      code: "arns_sdk_unavailable",
+      lines: err.message.split("\n"),
+      json: { error: "arns_sdk_unavailable", detail: err.message }
+    };
+  }
+  if (err instanceof Error && err.name === "ArnsSdkIncompatibleError") {
+    return {
+      code: "arns_sdk_incompatible",
+      lines: err.message.split("\n"),
+      json: { error: "arns_sdk_incompatible", detail: err.message }
+    };
+  }
+  if (err instanceof DaemonRouteError) {
+    const envelope = err.envelope;
+    if (envelope.error === "non_fast_forward" && Array.isArray(envelope["refs"])) {
+      return {
+        code: "non_fast_forward",
+        lines: nonFastForwardLines(envelope["refs"]),
+        json: { ...envelope }
+      };
+    }
+    if (envelope.error === "oversize_objects" && Array.isArray(envelope["objects"])) {
+      return {
+        code: "oversize_objects",
+        lines: oversizeLines(envelope["objects"]),
+        json: { ...envelope }
+      };
+    }
+    const retryHint = envelope.retryable === true ? ["The daemon reports this as retryable \u2014 re-run shortly."] : [];
+    return {
+      code: envelope.error,
+      lines: [
+        `daemon rejected the operation (HTTP ${err.status}): ` + (envelope.detail ?? envelope.error),
+        ...retryHint
+      ],
+      json: { ...envelope }
+    };
+  }
+  if (err instanceof DaemonUnreachableError) {
+    return {
+      code: "daemon_unreachable",
+      lines: err.message.split("\n"),
+      json: { error: "daemon_unreachable", detail: err.message }
+    };
+  }
+  if (err instanceof DaemonTooOldForGitError) {
+    return {
+      code: "daemon_too_old_for_git",
+      lines: err.message.split("\n"),
+      json: {
+        error: "daemon_too_old_for_git",
+        detail: err.message,
+        baseUrl: err.baseUrl,
+        ...err.pubkey !== void 0 ? { pubkey: err.pubkey } : {}
+      }
+    };
+  }
+  const name = err instanceof Error ? err.name : "";
+  const message = err instanceof Error ? err.message : String(err);
+  if (name === "DaemonIdentityConflictError") {
+    return {
+      code: "daemon_identity_conflict",
+      lines: [
+        message,
+        "Paid writes delegate to a same-identity daemon automatically; seeing this means the daemon appeared mid-run or this operation has no daemon route \u2014 stop the daemon and re-run."
+      ],
+      json: { error: "daemon_identity_conflict", detail: message }
+    };
+  }
+  if (name === "MissingUplinkError") {
+    return {
+      code: "missing_uplink",
+      lines: [message],
+      json: { error: "missing_uplink", detail: message }
+    };
+  }
+  if (name === "ChannelMapCorruptError") {
+    return {
+      code: "channel_map_corrupt",
+      lines: [message],
+      json: { error: "channel_map_corrupt", detail: message }
+    };
+  }
+  if (name === "SettleTooEarlyError") {
+    const settleableAt = err.settleableAt;
+    return {
+      code: "settle_too_early",
+      lines: [
+        message,
+        "The settlement challenge window is still open \u2014 nothing was spent. Re-run `rig channel settle` after the settleable time."
+      ],
+      json: {
+        error: "settle_too_early",
+        detail: message,
+        ...typeof settleableAt === "string" ? { settleableAt } : {}
+      }
+    };
+  }
+  if (name === "RepoNotFoundError") {
+    return {
+      code: "repo_not_found",
+      lines: message.split("\n"),
+      json: { error: "repo_not_found", detail: message }
+    };
+  }
+  if (name === "MissingRemoteObjectsError") {
+    const missing = err.missing;
+    return {
+      code: "missing_remote_objects",
+      lines: message.split("\n"),
+      json: {
+        error: "missing_remote_objects",
+        detail: message,
+        ...Array.isArray(missing) ? { missing } : {}
+      }
+    };
+  }
+  if (name === "ObjectIntegrityError" || name === "ObjectWriteMismatchError") {
+    return {
+      code: "object_integrity",
+      lines: message.split("\n"),
+      json: { error: "object_integrity", detail: message }
+    };
+  }
+  return {
+    code: "error",
+    lines: [`rig ${command} failed: ${message}`],
+    json: { error: "error", detail: message }
+  };
+}
+function emitCliError(io, json, command, err) {
+  const described = describeError(err, command);
+  if (json) io.emitJson({ command, ...described.json });
+  for (const line of described.lines) io.err(line);
+  return 1;
+}
+
+// src/cli/ci-status.ts
+import { parseArgs as parseArgs2 } from "util";
+import { REPOSITORY_ANNOUNCEMENT_KIND } from "@toon-protocol/core/nip34";
+
+// src/cli/git-config.ts
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFileAsync3 = promisify3(execFile3);
+async function git(repoPath, args, allowExitCodes = []) {
+  try {
+    const { stdout } = await execFileAsync3("git", args, {
+      cwd: repoPath,
+      encoding: "utf-8"
+    });
+    return { stdout, exitCode: 0 };
+  } catch (err) {
+    const e = err;
+    const exitCode = typeof e.code === "number" ? e.code : void 0;
+    if (exitCode !== void 0 && allowExitCodes.includes(exitCode)) {
+      return { stdout: e.stdout ?? "", exitCode };
+    }
+    throw new Error(
+      `git ${args.join(" ")} failed${exitCode !== void 0 ? ` (exit ${exitCode})` : ""}: ${(e.stderr ?? e.message ?? "").trim()}`
+    );
+  }
+}
+async function resolveRepoRoot(cwd) {
+  try {
+    const { stdout } = await execFileAsync3(
+      "git",
+      ["rev-parse", "--show-toplevel"],
+      { cwd, encoding: "utf-8" }
+    );
+    const root = stdout.trim();
+    if (!root) throw new Error("empty rev-parse output");
+    return root;
+  } catch (err) {
+    const e = err;
+    throw new Error(
+      `not a git repository (run rig inside a repo): ${(e.stderr ?? e.message ?? "").trim()}`
+    );
+  }
+}
+async function initGitRepository(dir) {
+  try {
+    await git(dir, ["init", "--initial-branch=main"]);
+  } catch {
+    await git(dir, ["init"]);
+    await git(dir, ["symbolic-ref", "HEAD", "refs/heads/main"]);
+  }
+}
+async function readToonConfig(repoPath) {
+  const [repoId, owner, relays] = await Promise.all([
+    git(repoPath, ["config", "--get", "toon.repoid"], [1]),
+    git(repoPath, ["config", "--get", "toon.owner"], [1]),
+    git(repoPath, ["config", "--get-all", "toon.relay"], [1])
+  ]);
+  const config = {
+    relays: relays.stdout.split("\n").map((l) => l.trim()).filter(Boolean)
+  };
+  const id = repoId.stdout.trim();
+  if (repoId.exitCode === 0 && id) config.repoId = id;
+  const own = owner.stdout.trim();
+  if (owner.exitCode === 0 && own) config.owner = own;
+  return config;
+}
+async function getGitRemoteUrls(repoPath, name) {
+  const { stdout } = await git(
+    repoPath,
+    ["config", "--get-all", `remote.${name}.url`],
+    [1]
+  );
+  return stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+}
+async function listGitRemotes(repoPath) {
+  const { stdout } = await git(repoPath, ["remote"]);
+  const names = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  const remotes = [];
+  for (const name of names) {
+    remotes.push({ name, urls: await getGitRemoteUrls(repoPath, name) });
+  }
+  return remotes;
+}
+async function setGitAuthor(repoPath, author) {
+  await git(repoPath, ["config", "--local", "user.name", author.name]);
+  await git(repoPath, ["config", "--local", "user.email", author.email]);
+}
+async function addGitRemote(repoPath, name, url) {
+  await git(repoPath, ["remote", "add", name, url]);
+}
+async function removeGitRemote(repoPath, name) {
+  await git(repoPath, ["remote", "remove", name]);
+}
+async function writeToonConfig(repoPath, config) {
+  if (config.repoId !== void 0) {
+    await git(repoPath, ["config", "toon.repoid", config.repoId]);
+  }
+  if (config.owner !== void 0) {
+    await git(repoPath, ["config", "toon.owner", config.owner]);
+  }
+  if (config.relays !== void 0 && config.relays.length > 0) {
+    await git(repoPath, ["config", "--unset-all", "toon.relay"], [5]);
+    for (const relay of config.relays) {
+      await git(repoPath, ["config", "--add", "toon.relay", relay]);
+    }
+  }
+}
+
+// src/cli/remote.ts
+import { parseArgs } from "util";
+var RELAY_PROTOCOLS = /* @__PURE__ */ new Set(["ws:", "wss:", "http:", "https:"]);
+function isRelayUrl(url) {
+  try {
+    return RELAY_PROTOCOLS.has(new URL(url).protocol);
+  } catch {
+    return false;
+  }
+}
+function assertRelayUrl(url, context) {
+  if (!isRelayUrl(url)) throw new InvalidRelayUrlError(url, context);
+}
+async function resolveRelays(opts) {
+  if (opts.relayFlags.length > 0) {
+    return { relays: opts.relayFlags, source: "relay-flag" };
+  }
+  if (opts.remoteName !== void 0) {
+    const urls = opts.repoRoot !== void 0 ? await getGitRemoteUrls(opts.repoRoot, opts.remoteName) : [];
+    if (urls.length === 0) throw new UnknownRemoteError(opts.remoteName);
+    if (urls.length > 1) throw new MultiUrlRemoteError(opts.remoteName, urls);
+    const url = urls[0];
+    assertRelayUrl(url, `remote ${JSON.stringify(opts.remoteName)}`);
+    return { relays: urls, source: "remote", remoteName: opts.remoteName };
+  }
+  let nonRelayOriginUrl;
+  if (opts.repoRoot !== void 0) {
+    const urls = await getGitRemoteUrls(opts.repoRoot, "origin");
+    if (urls.length === 1 && isRelayUrl(urls[0])) {
+      return { relays: urls, source: "remote", remoteName: "origin" };
+    }
+    if (urls.length > 1 && urls.some(isRelayUrl)) {
+      throw new MultiUrlRemoteError("origin", urls);
+    }
+    if (urls.length > 0) nonRelayOriginUrl = urls[0];
+  }
+  if (opts.toonRelays.length > 0) {
+    return {
+      relays: opts.toonRelays,
+      source: "toon.relay",
+      nudge: `note: git config toon.relay is deprecated (removed in v0.3) \u2014 migrate: rig remote add origin ${opts.toonRelays[0]}`
+    };
+  }
+  throw new NoOriginConfiguredError(nonRelayOriginUrl);
+}
+function singleRelayRefusal(resolved, nothingHappened) {
+  const fix = resolved.source === "relay-flag" ? "pass exactly one --relay <url>" : "trim git config toon.relay to one URL (better: migrate \u2014 `rig remote add origin <relay-url>`)";
+  return `rig publishes to a single relay, but ${resolved.relays.length} are configured (${resolved.relays.join(", ")}) \u2014 ${fix}. ${nothingHappened}`;
+}
+var REMOTE_USAGE = `Usage: rig remote <add|remove|list> [args] [options]
+
+Manage the relays this repo publishes to. Remotes are stored as REAL git
+remotes (\`git remote -v\` shows them; plain git tooling round-trips). Paid
+commands publish via the "origin" remote by default; \`rig push <remote>\`
+and \`--remote <name>\` target another one. Free \u2014 nothing is published or
+paid.
+
+Commands:
+  add <name> <relay-url>   add a remote pointing at a relay (the URL must be
+                           ws://, wss://, http://, or https://)
+  remove <name>            remove a remote
+  list                     list remote names + URLs (the default subcommand)
+
+Options:
+  --json                   machine-readable envelope (all subcommands)
+  -h, --help               show this help`;
+async function runRemote(args, deps) {
+  const { io } = deps;
+  let sub;
+  let rest;
+  let json;
+  try {
+    const { values: values2, positionals } = parseArgs({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: true
+    });
+    if (values2.help) {
+      io.out(REMOTE_USAGE);
+      return 0;
+    }
+    json = values2.json ?? false;
+    [sub, ...rest] = positionals;
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(REMOTE_USAGE);
+    return 2;
+  }
+  switch (sub) {
+    case void 0:
+    case "list":
+      if (rest.length > 0) {
+        io.err(`rig remote list takes no arguments (got ${rest.join(" ")})`);
+        io.err(REMOTE_USAGE);
+        return 2;
+      }
+      break;
+    case "add": {
+      if (rest.length !== 2) {
+        io.err("usage: rig remote add <name> <relay-url>");
+        io.err(REMOTE_USAGE);
+        return 2;
+      }
+      const url = rest[1];
+      if (!isRelayUrl(url)) {
+        io.err(
+          `cannot add remote: ${JSON.stringify(url)} is not a relay URL \u2014 relays are ws://, wss://, http://, or https://`
+        );
+        return 2;
+      }
+      break;
+    }
+    case "remove":
+      if (rest.length !== 1) {
+        io.err("usage: rig remote remove <name>");
+        io.err(REMOTE_USAGE);
+        return 2;
+      }
+      break;
+    default:
+      io.err(`unknown rig remote subcommand: ${sub}`);
+      io.err(REMOTE_USAGE);
+      return 2;
+  }
+  try {
+    let repoRoot;
+    try {
+      repoRoot = await resolveRepoRoot(deps.cwd);
+    } catch {
+      throw new NotAGitRepositoryError(deps.cwd);
+    }
+    switch (sub) {
+      case void 0:
+      case "list": {
+        const remotes = await listGitRemotes(repoRoot);
+        if (json) {
+          io.emitJson({ command: "remote", remotes });
+          return 0;
+        }
+        if (remotes.length === 0) {
+          io.out(
+            "no remotes configured \u2014 add one: rig remote add origin <relay-url>"
+          );
+          return 0;
+        }
+        for (const remote of remotes) {
+          for (const url of remote.urls) {
+            io.out(
+              `${remote.name}	${url}` + (isRelayUrl(url) ? "" : "	(not a relay URL \u2014 ignored by rig)")
+            );
+          }
+          if (remote.urls.length > 1) {
+            io.err(
+              `warning: remote "${remote.name}" has ${remote.urls.length} URLs \u2014 rig supports one relay URL per remote (fix with \`git remote set-url ${remote.name} <relay-url>\`)`
+            );
+          }
+        }
+        return 0;
+      }
+      case "add": {
+        const [name, url] = rest;
+        const existing = await getGitRemoteUrls(repoRoot, name);
+        if (existing.length > 0) {
+          const detail = `remote ${JSON.stringify(name)} already exists (${existing.join(", ")}) \u2014 nothing changed. Point it somewhere else with \`git remote set-url ${name} <relay-url>\`, or \`rig remote remove ${name}\` first.`;
+          if (json) {
+            io.emitJson({
+              command: "remote",
+              error: "remote_exists",
+              detail,
+              remote: name,
+              urls: existing
+            });
+          }
+          io.err(detail);
+          return 1;
+        }
+        await addGitRemote(repoRoot, name, url);
+        if (!json) io.out(`Added remote ${name} \u2192 ${url}`);
+        if (name === "origin") {
+          if (!json) {
+            io.out(
+              "`rig push` and the event commands now publish here by default."
+            );
+          }
+          const toonConfig = await readToonConfig(repoRoot);
+          if (toonConfig.relays.length > 0) {
+            io.err(
+              `note: git config toon.relay (${toonConfig.relays.join(", ")}) is deprecated and now shadowed by the origin remote \u2014 drop it with \`git config --unset-all toon.relay\` (the key is removed in v0.3).`
+            );
+          }
+        }
+        if (json) {
+          io.emitJson({ command: "remote", action: "add", name, url });
+        }
+        return 0;
+      }
+      case "remove": {
+        const name = rest[0];
+        const existing = await getGitRemoteUrls(repoRoot, name);
+        if (existing.length === 0) {
+          const detail = `no remote named ${JSON.stringify(name)} \u2014 \`rig remote list\` shows configured remotes.`;
+          if (json) {
+            io.emitJson({
+              command: "remote",
+              error: "unknown_remote",
+              detail,
+              remote: name
+            });
+          }
+          io.err(detail);
+          return 1;
+        }
+        await removeGitRemote(repoRoot, name);
+        if (json) {
+          io.emitJson({ command: "remote", action: "remove", name });
+        } else {
+          io.out(`Removed remote ${name}`);
+        }
+        return 0;
+      }
+      /* v8 ignore next 2 -- unreachable: validated above */
+      default:
+        return 2;
+    }
+  } catch (err) {
+    return emitCliError(io, json, "remote", err);
+  }
+}
+
+// src/cli/ci-status.ts
+var CI_STATUS_USAGE = `Usage: rig ci status <commit> [options]
+
+Show every CI run and job for <commit> \u2014 FREE (relay reads only). <commit>
+is a full 40-hex SHA, or any local revision (HEAD, a branch, a short SHA)
+when run inside the repository. Exit status is the gate: 0 when every
+counted run concluded green (success/neutral/skipped); 1 when any counted
+run failed, timed out, was cancelled, or failed to start, when a run is
+still queued/in progress, or when the commit has no concluded run at all.
+
+A run counts when it is its publisher's latest attempt for its workflow.
+Trust levels (NIP-C1, derived from the repo's maintainers and Service
+Requests): maintainer-directed > operationally-associated > seen-in-network
+> no-known-context. With --require-ci-trust, runs below that level are
+dropped before counting \u2014 so an unknown coordinator's green never gates.
+
+Options:
+  --require-ci-trust <level>   minimum trust level to count a run
+  --workflow <path>            only runs of this workflow file
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
+  --remote <name>      read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override; repeatable \u2014 reads are merged
+  --json               machine-readable envelope (exactly one JSON document)
+  -h, --help           show this help`;
+var GREEN = /* @__PURE__ */ new Set([
+  "success",
+  "neutral",
+  "skipped"
+]);
+var STATUS_OPTIONS = {
+  json: { type: "boolean", default: false },
+  relay: { type: "string", multiple: true },
+  remote: { type: "string" },
+  "repo-id": { type: "string" },
+  owner: { type: "string" },
+  "require-ci-trust": { type: "string" },
+  workflow: { type: "string" },
+  help: { type: "boolean", short: "h", default: false }
+};
+var FULL_SHA_RE4 = /^[0-9a-f]{40}$/;
+var WS_URL_RE = /^wss?:\/\//i;
+var RELAY_TIMEOUT_MS = 1e4;
+async function queryAll(relays, filters, webSocketFactory) {
+  const jobs = relays.flatMap(
+    (relay) => filters.map(
+      (filter) => queryRelay(relay, filter, RELAY_TIMEOUT_MS, webSocketFactory)
+    )
+  );
+  const results = await Promise.allSettled(jobs);
+  const byId = /* @__PURE__ */ new Map();
+  let failures = 0;
+  let firstError;
+  for (const result of results) {
+    if (result.status === "rejected") {
+      failures += 1;
+      firstError ??= result.reason;
+      continue;
+    }
+    for (const event of result.value) {
+      if (typeof event.id === "string" && !byId.has(event.id))
+        byId.set(event.id, event);
+    }
+  }
+  if (failures === results.length && results.length > 0) {
+    throw firstError instanceof Error ? firstError : new Error(String(firstError));
+  }
+  return [...byId.values()];
+}
+function assembleCiStatus(opts) {
+  const repoAddr = repoAddress(opts.ownerPubkey, opts.repoId);
+  const commit = opts.commit.toLowerCase();
+  const controls = [];
+  const results = /* @__PURE__ */ new Map();
+  const progresses = /* @__PURE__ */ new Map();
+  const jobs = [];
+  for (const ev of opts.events) {
+    switch (ev.kind) {
+      case CI_SERVICE_REQUEST_KIND:
+      case CI_SERVICE_STOP_KIND: {
+        const c = parseCiServiceControl(ev);
+        if (c && c.repoAddr === repoAddr) controls.push(c);
+        break;
+      }
+      case CI_WORKFLOW_RESULT_KIND: {
+        const r = parseCiWorkflowResult(ev);
+        if (!r || r.trigger.repoAddr !== repoAddr || r.trigger.commit !== commit)
+          break;
+        const key = `${r.pubkey}:${r.runId}`;
+        const prev = results.get(key);
+        if (!prev || r.createdAt > prev.createdAt || r.createdAt === prev.createdAt && r.eventId < prev.eventId) {
+          results.set(key, r);
+        }
+        break;
+      }
+      case CI_WORKFLOW_PROGRESS_KIND: {
+        const p = parseCiWorkflowProgress(ev);
+        if (!p || p.trigger.repoAddr !== repoAddr || p.trigger.commit !== commit)
+          break;
+        const key = `${p.pubkey}:${p.runId}`;
+        const prev = progresses.get(key);
+        if (!prev || p.createdAt > prev.createdAt || p.createdAt === prev.createdAt && p.eventId < prev.eventId) {
+          progresses.set(key, p);
+        }
+        break;
+      }
+      case CI_JOB_RESULT_KIND: {
+        const j = parseCiJobResult(ev);
+        if (j && j.trigger.repoAddr === repoAddr && j.trigger.commit === commit)
+          jobs.push(j);
+        break;
+      }
+      default:
+        break;
+    }
+  }
+  const runs = [];
+  const keys = /* @__PURE__ */ new Set([...results.keys(), ...progresses.keys()]);
+  for (const key of keys) {
+    const result = results.get(key) ?? null;
+    const progress = progresses.get(key) ?? null;
+    const base = result ?? progress;
+    if (!base) continue;
+    const progressAddress = `${CI_WORKFLOW_PROGRESS_KIND}:${base.pubkey}:${base.runId}`;
+    const runJobs = jobs.filter(
+      (j) => j.progressAddress.toLowerCase() === progressAddress.toLowerCase()
+    ).sort(
+      (a, b) => (a.startedAt ?? a.createdAt) - (b.startedAt ?? b.createdAt)
+    ).map((j) => ({
+      jobId: j.jobId,
+      ...j.name !== void 0 ? { name: j.name } : {},
+      conclusion: j.conclusion,
+      ...j.logsUrl !== void 0 ? { logsUrl: j.logsUrl } : {},
+      artifacts: j.artifacts,
+      ...j.exitCode !== void 0 ? { exitCode: j.exitCode } : {},
+      ...j.startedAt !== void 0 ? { startedAt: j.startedAt } : {},
+      eventId: j.eventId,
+      publisher: j.pubkey
+    }));
+    const provenance = result?.provenance ?? progress?.provenance;
+    const trust = deriveTrustLevel({
+      publisherPubkey: base.pubkey,
+      ...provenance ? { provenance } : {},
+      authorized: opts.authorized,
+      controls,
+      runCreatedAt: base.createdAt
+    });
+    const status = result ? "concluded" : progress.status;
+    const conclusion = result ? result.conclusion : progress?.conclusion;
+    const startedAt = result?.startedAt ?? progress?.startedAt;
+    const queuedAt = result?.queuedAt ?? progress?.queuedAt;
+    runs.push({
+      runId: base.runId,
+      coordinator: base.pubkey,
+      workflow: base.trigger.workflow,
+      reason: base.trigger.reason,
+      status,
+      ...conclusion !== void 0 ? { conclusion } : {},
+      trust,
+      createdAt: base.createdAt,
+      ...startedAt !== void 0 ? { startedAt } : {},
+      ...queuedAt !== void 0 ? { queuedAt } : {},
+      ...provenance ? { provenance } : {},
+      jobs: runJobs,
+      eventId: base.eventId
+    });
+  }
+  runs.sort(
+    (a, b) => b.createdAt - a.createdAt || (a.eventId < b.eventId ? -1 : 1)
+  );
+  const latestByWorkflow = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    const k = `${run.coordinator}:${run.workflow.path}`;
+    if (!latestByWorkflow.has(k)) latestByWorkflow.set(k, run);
+  }
+  const counted = [...latestByWorkflow.values()].filter(
+    (run) => (opts.workflow === void 0 || run.workflow.path === opts.workflow) && (opts.requireTrust === void 0 || trustAtLeast(run.trust, opts.requireTrust))
+  );
+  let green = 0;
+  let red = 0;
+  let pending = 0;
+  for (const run of counted) {
+    if (run.status !== "concluded" || run.conclusion === void 0)
+      pending += 1;
+    else if (GREEN.has(run.conclusion)) green += 1;
+    else red += 1;
+  }
+  const summary = {
+    counted: counted.length,
+    green,
+    red,
+    pending
+  };
+  let reason;
+  if (counted.length === 0) {
+    reason = runs.length === 0 ? "no CI runs found for this commit" : "no run meets the workflow/trust requirement";
+  } else if (red > 0) {
+    reason = `${red} run(s) concluded red`;
+  } else if (pending > 0) {
+    reason = `${pending} run(s) not concluded yet`;
+  }
+  const ok = counted.length > 0 && red === 0 && pending === 0;
+  return { runs, summary, ok, ...reason !== void 0 ? { reason } : {} };
+}
+async function runCiStatus(args, deps) {
+  const { io } = deps;
+  let flags;
+  let commitArg;
+  try {
+    const { values: values2, positionals } = parseArgs2({
+      args,
+      options: STATUS_OPTIONS,
+      allowPositionals: true
+    });
+    flags = {
+      json: values2.json === true,
+      help: values2.help === true,
+      relay: values2.relay ?? []
+    };
+    if (values2.remote !== void 0) flags.remote = values2.remote;
+    if (values2["repo-id"] !== void 0) flags.repoId = values2["repo-id"];
+    if (values2.owner !== void 0) flags.owner = ownerToHex(values2.owner);
+    if (values2.workflow !== void 0)
+      flags.workflow = values2.workflow.replace(/^\.\//, "");
+    if (values2["require-ci-trust"] !== void 0) {
+      const level = values2["require-ci-trust"];
+      if (!isCiTrustLevel(level)) {
+        throw new Error(
+          `--require-ci-trust must be one of ${CI_TRUST_ORDER.join(" | ")} (got ${JSON.stringify(level)})`
+        );
+      }
+      flags.requireTrust = level;
+    }
+    if (flags.help) {
+      io.out(CI_STATUS_USAGE);
+      return 0;
+    }
+    if (positionals.length !== 1) {
+      throw new Error(
+        positionals.length === 0 ? "<commit> is required" : `expected exactly one <commit>, got ${positionals.length}`
+      );
+    }
+    commitArg = positionals[0];
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(CI_STATUS_USAGE);
+    return 2;
+  }
+  try {
+    let repoRoot;
+    let toonConfig = {
+      relays: []
+    };
+    try {
+      repoRoot = await resolveRepoRoot(deps.cwd);
+      toonConfig = await readToonConfig(repoRoot);
+    } catch {
+    }
+    const repoId = flags.repoId ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const owner = flags.owner ?? toonConfig.owner;
+    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+    let commit = commitArg.toLowerCase();
+    if (!FULL_SHA_RE4.test(commit)) {
+      if (repoRoot === void 0) {
+        throw new Error(
+          `<commit> must be a full 40-hex SHA outside a git repository (got ${JSON.stringify(commitArg)})`
+        );
+      }
+      commit = (await runGit(repoRoot, [
+        "rev-parse",
+        "--verify",
+        `${commitArg}^{commit}`
+      ])).trim();
+    }
+    const resolved = await resolveRelays({
+      relayFlags: flags.relay,
+      remoteName: flags.remote,
+      repoRoot,
+      toonRelays: toonConfig.relays
+    });
+    const relays = resolved.relays.filter((url) => WS_URL_RE.test(url));
+    if (relays.length === 0) {
+      throw new InvalidRelayUrlError(
+        resolved.relays[0] ?? "",
+        "reads need a ws:// or wss:// relay"
+      );
+    }
+    const webSocketFactory = deps.webSocketFactory ?? defaultWebSocketFactory;
+    const repoAddr = repoAddress(owner, repoId);
+    const events = await queryAll(
+      relays,
+      [
+        {
+          kinds: [
+            CI_WORKFLOW_RESULT_KIND,
+            CI_WORKFLOW_PROGRESS_KIND,
+            CI_JOB_RESULT_KIND
+          ],
+          "#a": [repoAddr],
+          "#c": [commit]
+        },
+        {
+          kinds: [CI_SERVICE_REQUEST_KIND, CI_SERVICE_STOP_KIND],
+          "#a": [repoAddr]
+        },
+        {
+          kinds: [REPOSITORY_ANNOUNCEMENT_KIND],
+          authors: [owner],
+          "#d": [repoId]
+        }
+      ],
+      webSocketFactory
+    );
+    let announce = null;
+    for (const ev of events) {
+      if (ev.kind !== REPOSITORY_ANNOUNCEMENT_KIND || ev.pubkey.toLowerCase() !== owner)
+        continue;
+      if (!ev.tags.some((t) => t[0] === "d" && t[1] === repoId)) continue;
+      if (announce === null || ev.created_at > announce.created_at || ev.created_at === announce.created_at && ev.id < announce.id) {
+        announce = ev;
+      }
+    }
+    const authorized = authorizedStatusAuthors(owner, announce?.tags ?? []);
+    const assembled = assembleCiStatus({
+      commit,
+      ownerPubkey: owner,
+      repoId,
+      authorized,
+      events,
+      ...flags.requireTrust !== void 0 ? { requireTrust: flags.requireTrust } : {},
+      ...flags.workflow !== void 0 ? { workflow: flags.workflow } : {}
+    });
+    const report = {
+      command: "ci status",
+      commit,
+      repo: { owner, repoId },
+      relays,
+      requiredTrust: flags.requireTrust ?? null,
+      runs: assembled.runs,
+      summary: assembled.summary,
+      ok: assembled.ok,
+      ...assembled.reason !== void 0 ? { reason: assembled.reason } : {}
+    };
+    if (flags.json) {
+      io.emitJson(report);
+    } else {
+      for (const line of renderStatus(report)) io.out(line);
+    }
+    return report.ok ? 0 : 1;
+  } catch (err) {
+    return emitCliError(io, flags.json, "ci status", err);
+  }
+}
+function glyph(run) {
+  if (run.status !== "concluded" || run.conclusion === void 0) return "\u2026";
+  return GREEN.has(run.conclusion) ? "\u2713" : "\u2717";
+}
+function shortNpub(hex) {
+  try {
+    const npub = hexToNpub(hex);
+    return `${npub.slice(0, 12)}\u2026${npub.slice(-4)}`;
+  } catch {
+    return `${hex.slice(0, 12)}\u2026`;
+  }
+}
+function renderStatus(report) {
+  const lines = [];
+  lines.push(
+    `CI for ${report.commit.slice(0, 12)} in 30617:${report.repo.owner}:${report.repo.repoId}`
+  );
+  if (report.runs.length === 0) {
+    lines.push("  (no runs)");
+  }
+  for (const run of report.runs) {
+    const state = run.status === "concluded" ? run.conclusion ?? "concluded" : run.status;
+    lines.push(
+      `${glyph(run)} ${state.padEnd(15)} ${run.workflow.path}  ${run.reason}  coordinator ${shortNpub(run.coordinator)}  trust ${run.trust}`
+    );
+    for (const job of run.jobs) {
+      const extra = job.exitCode !== void 0 ? ` (exit ${job.exitCode})` : "";
+      lines.push(
+        `    ${job.conclusion.padEnd(15)} ${job.name ?? job.jobId}${extra}`
+      );
+    }
+  }
+  const s = report.summary;
+  const verdict = report.ok ? "GREEN" : `NOT GREEN \u2014 ${report.reason ?? "see runs"}`;
+  lines.push(
+    `${verdict} (counted ${s.counted}: ${s.green} green, ${s.red} red, ${s.pending} pending` + (report.requiredTrust ? `; trust \u2265 ${report.requiredTrust}` : "") + ")"
+  );
+  return lines;
+}
+
+export {
+  MAX_OBJECT_SIZE,
+  hashGitObject,
+  createGitBlob,
+  createGitTree,
+  createGitCommit,
+  createGitTag,
+  GitError,
+  GitRepoReader,
+  DEFAULT_CONCURRENCY,
+  ObjectIntegrityError,
+  verifyObjectBody,
+  fetchTxBytes,
+  downloadGitObjects,
+  referencedShas,
+  walkClosure,
+  collectRepoObjects,
+  missingObjectsMessage,
+  ObjectWriteMismatchError,
+  isSafeRefname,
+  runGit,
+  writeGitObject,
+  writeGitObjects,
+  updateRef,
+  setHeadSymref,
+  hexToNpub,
+  npubToHex,
+  ownerToHex,
+  serializeFeeEstimate,
+  serializePushPlan,
+  serializeEventReceipt,
+  serializePushResult,
+  NonFastForwardError,
+  OversizeObjectsError,
+  planPush,
+  executePush,
+  CI_ADVERTISEMENT_KIND,
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
+  CI_SECRET_UPDATE_KIND,
+  CI_MANUAL_TRIGGER_KIND,
+  CI_JOB_RESULT_KIND,
+  CI_WORKFLOW_RESULT_KIND,
+  CI_WORKFLOW_PROGRESS_KIND,
+  CI_RUNNER_FAMILY,
+  CI_SOFTWARE,
+  CI_MAX_ADVERTISEMENT_TTL,
+  CI_MAX_PROGRESS_TTL,
+  isCiConclusion,
+  repoAddress,
+  parseRepoAddress,
+  commonTriggerTags,
+  parseCiTriggerContext,
+  buildCiAdvertisement,
+  parseCiAdvertisement,
+  buildCiServiceRequest,
+  buildCiServiceStop,
+  parseCiServiceControl,
+  controlOrder,
+  selectServiceRequests,
+  buildCiManualTrigger,
+  parseCiManualTrigger,
+  buildCiSecretUpdate,
+  parseCiSecretUpdate,
+  buildCiJobResult,
+  parseCiJobResult,
+  buildCiWorkflowResult,
+  parseCiWorkflowResult,
+  buildCiWorkflowProgress,
+  parseCiWorkflowProgress,
+  SECRET_NAME_RE,
+  RESERVED_SECRET_NAMES,
+  MAX_SECRET_NAMES,
+  MAX_SECRET_VALUE_BYTES,
+  MAX_SECRET_PLAINTEXT_BYTES,
+  MAX_SECRET_CIPHERTEXT_BYTES,
+  assertSecretUpdateShape,
+  validateSecretUpdate,
+  encryptSecretUpdate,
+  decryptSecretUpdate,
+  applySecretUpdate,
+  effectiveSecrets,
+  generateSecretsKey,
+  CI_TRUST_ORDER,
+  isCiTrustLevel,
+  deriveTrustLevel,
+  trustAtLeast,
+  WORKFLOW_DIRS,
+  sha256Hex,
+  parseWorkflow,
+  discoverWorkflows,
+  refMatchesPatterns,
+  matchesPush,
+  matchesPullRequest,
+  resolvePaidSession,
+  UnconfiguredRepoAddressError,
+  InvalidRelayUrlError,
+  UnknownRemoteError,
+  MultiUrlRemoteError,
+  NotAGitRepositoryError,
+  emitCliError,
+  resolveRepoRoot,
+  initGitRepository,
+  readToonConfig,
+  getGitRemoteUrls,
+  listGitRemotes,
+  setGitAuthor,
+  addGitRemote,
+  writeToonConfig,
+  isRelayUrl,
+  resolveRelays,
+  singleRelayRefusal,
+  runRemote,
+  CI_STATUS_USAGE,
+  assembleCiStatus,
+  runCiStatus
+};
+//# sourceMappingURL=chunk-3RWM7PBM.js.map