@toon-protocol/rig 4.2.0 → 4.4.0

package/dist/ci-serve-P4HOLAMP.js

@@ -0,0 +1,2360 @@
+import {
+  PREFERRED_GATEWAY,
+  WS_URL_RE,
+  identityReport,
+  loadPaidSession,
+  renderIdentityLine,
+  rigVersion,
+  withForcedStandalone
+} from "./chunk-CTRP2UAQ.js";
+import {
+  CI_MANUAL_TRIGGER_KIND,
+  CI_SECRET_UPDATE_KIND,
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
+  CI_WORKFLOW_PROGRESS_KIND,
+  applySecretUpdate,
+  buildCiAdvertisement,
+  buildCiJobResult,
+  buildCiWorkflowProgress,
+  buildCiWorkflowResult,
+  collectRepoObjects,
+  decryptSecretUpdate,
+  discoverWorkflows,
+  effectiveSecrets,
+  emitCliError,
+  generateSecretsKey,
+  hexToNpub,
+  matchesPullRequest,
+  matchesPush,
+  missingObjectsMessage,
+  ownerToHex,
+  parseCiManualTrigger,
+  parseCiSecretUpdate,
+  parseCiServiceControl,
+  parseRepoAddress,
+  parseWorkflow,
+  repoAddress,
+  runGit,
+  selectServiceRequests,
+  validateSecretUpdate,
+  writeGitObjects
+} from "./chunk-RL5XUWR4.js";
+import {
+  REPOSITORY_STATE_KIND,
+  authorizedStatusAuthors,
+  defaultWebSocketFactory,
+  fetchRemoteState,
+  queryRelay
+} from "./chunk-GWA3CSUR.js";
+import {
+  ChannelMapStore,
+  channelStatus,
+  contentTypeForPath,
+  resolveChannelPaths
+} from "./chunk-XCLUB2CY.js";
+import {
+  uploadChargeFor
+} from "./chunk-U5A7MHBP.js";
+
+// src/cli/ci-serve.ts
+import { join as join4 } from "path";
+import { parseArgs } from "util";
+
+// src/ci/act-runner.ts
+import { execFile, spawn } from "child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { basename, dirname, join, relative, resolve, sep } from "path";
+import { promisify } from "util";
+import { inflateRawSync } from "zlib";
+import { accessSync, constants } from "fs";
+var RIG_ACT_BIN_ENV = "RIG_ACT_BIN";
+var DEFAULT_ACT_PLATFORMS = {
+  "ubuntu-latest": "catthehacker/ubuntu:act-latest"
+};
+var execFileAsync = promisify(execFile);
+function actContainerNamePrefix(workflowName) {
+  const prefix = `act-${workflowName}-`.replace(/[^a-zA-Z0-9]/g, "-").replaceAll("--", "-");
+  return prefix.length > 63 ? prefix.slice(0, 63) : prefix;
+}
+var CONTAINER_CREATED_SLACK_MS = 5e3;
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function resolveActBinary(env, explicit) {
+  const candidate = explicit ?? env[RIG_ACT_BIN_ENV];
+  if (candidate) return isExecutable(candidate) ? candidate : null;
+  for (const dir of (env["PATH"] ?? "").split(":")) {
+    if (!dir) continue;
+    const p = join(dir, "act");
+    if (isExecutable(p)) return p;
+  }
+  return null;
+}
+var EXITCODE_RE = /^exitcode '(\d+)'/;
+function parseActJsonLine(line) {
+  if (!line.startsWith("{")) return null;
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  const jobId = obj["jobID"];
+  if (typeof jobId !== "string" || jobId === "") return null;
+  const display = typeof obj["job"] === "string" ? obj["job"] : jobId;
+  const slash = display.indexOf("/");
+  const jobName = (slash >= 0 ? display.slice(slash + 1) : display).trim() || jobId;
+  const msg = typeof obj["msg"] === "string" ? obj["msg"] : "";
+  const out = {
+    jobId,
+    jobName,
+    msg,
+    level: typeof obj["level"] === "string" ? obj["level"] : "info",
+    rawOutput: obj["raw_output"] === true,
+    timeMs: typeof obj["time"] === "string" ? Date.parse(obj["time"]) || 0 : 0
+  };
+  if (typeof obj["jobResult"] === "string") out.jobResult = obj["jobResult"];
+  const exit = EXITCODE_RE.exec(msg);
+  if (exit) out.exitCode = Number(exit[1]);
+  return out;
+}
+function mapJobResult(result, outcome) {
+  if (result === "success") return "success";
+  if (result === "skipped") return "skipped";
+  if (outcome.timedOut) return "timed_out";
+  if (outcome.cancelled) return "cancelled";
+  switch (result) {
+    case "failure":
+      return "failure";
+    case "cancelled":
+      return "cancelled";
+    default:
+      return outcome.exitCode === 0 ? "success" : "failure";
+  }
+}
+function summarizeActRun(lines, outcome) {
+  const byJob = /* @__PURE__ */ new Map();
+  for (const l of lines) {
+    const list = byJob.get(l.jobId);
+    if (list) list.push(l);
+    else byJob.set(l.jobId, [l]);
+  }
+  const jobs = [];
+  for (const [jobId, list] of byJob) {
+    const terminal = list.find((l) => l.jobResult !== void 0);
+    const exitLine = list.find((l) => l.exitCode !== void 0);
+    const conclusion2 = mapJobResult(terminal?.jobResult, outcome);
+    const times = list.map((l) => l.timeMs).filter((t) => t > 0);
+    const startedAt = times.length > 0 ? Math.floor(Math.min(...times) / 1e3) : 0;
+    const finishedAt = times.length > 0 ? Math.floor(Math.max(...times) / 1e3) : 0;
+    const log = list.filter((l) => l.exitCode === void 0).map((l) => l.rawOutput || l.msg.endsWith("\n") ? l.msg : `${l.msg}
+`).join("");
+    const job = {
+      jobId,
+      name: list[0]?.jobName ?? jobId,
+      conclusion: conclusion2,
+      log,
+      startedAt,
+      finishedAt
+    };
+    if (exitLine?.exitCode !== void 0) job.exitCode = exitLine.exitCode;
+    else if (conclusion2 === "success") job.exitCode = 0;
+    jobs.push(job);
+  }
+  let conclusion;
+  if (jobs.length === 0) {
+    conclusion = outcome.timedOut ? "timed_out" : outcome.cancelled ? "cancelled" : outcome.exitCode === 0 ? "success" : "startup_failure";
+  } else if (outcome.timedOut && jobs.some((j) => j.conclusion === "timed_out")) {
+    conclusion = "timed_out";
+  } else if (outcome.cancelled && jobs.some((j) => j.conclusion === "cancelled")) {
+    conclusion = "cancelled";
+  } else if (jobs.some((j) => j.conclusion === "failure")) {
+    conclusion = "failure";
+  } else if (jobs.some((j) => j.conclusion === "timed_out")) {
+    conclusion = "timed_out";
+  } else if (jobs.some((j) => j.conclusion === "cancelled")) {
+    conclusion = "cancelled";
+  } else {
+    conclusion = "success";
+  }
+  return { conclusion, jobs };
+}
+function actEventName(trigger, triggers) {
+  if (trigger.reason === "push") return "push";
+  if (trigger.reason === "pull_request") return "pull_request";
+  if (triggers.push) return "push";
+  if (triggers.pull_request) return "pull_request";
+  return "workflow_dispatch";
+}
+function shortBranch(ref) {
+  if (!ref) return "main";
+  return ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
+}
+function buildActEventPayload(trigger) {
+  if (trigger.reason === "pull_request" && trigger.pr) {
+    const base = shortBranch(trigger.ref);
+    return {
+      action: "synchronize",
+      number: 0,
+      ref: `refs/pull/0/merge`,
+      pull_request: {
+        number: 0,
+        head: { sha: trigger.commit, ref: trigger.commit.slice(0, 12) },
+        base: { ref: base }
+      }
+    };
+  }
+  return {
+    ref: trigger.ref ?? "refs/heads/main",
+    before: "0".repeat(40),
+    after: trigger.commit,
+    head_commit: { id: trigger.commit }
+  };
+}
+var EOCD_SIG = 101010256;
+var CDIR_SIG = 33639248;
+var LOCAL_SIG = 67324752;
+function extractZip(zipPath, destDir) {
+  const buf = readFileSync(zipPath);
+  let eocd = -1;
+  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 22 - 65535); i--) {
+    if (buf.readUInt32LE(i) === EOCD_SIG) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new Error(`not a zip file: ${zipPath}`);
+  const entryCount = buf.readUInt16LE(eocd + 10);
+  let offset = buf.readUInt32LE(eocd + 16);
+  if (offset === 4294967295)
+    throw new Error(`zip64 archives are not supported: ${zipPath}`);
+  const root = resolve(destDir);
+  const names = [];
+  for (let n = 0; n < entryCount; n++) {
+    if (buf.readUInt32LE(offset) !== CDIR_SIG)
+      throw new Error(`corrupt central directory: ${zipPath}`);
+    const method = buf.readUInt16LE(offset + 10);
+    const compSize = buf.readUInt32LE(offset + 20);
+    const nameLen = buf.readUInt16LE(offset + 28);
+    const extraLen = buf.readUInt16LE(offset + 30);
+    const commentLen = buf.readUInt16LE(offset + 32);
+    const localOffset = buf.readUInt32LE(offset + 42);
+    const name = buf.toString("utf-8", offset + 46, offset + 46 + nameLen);
+    offset += 46 + nameLen + extraLen + commentLen;
+    if (name.endsWith("/")) continue;
+    const target = resolve(root, name);
+    if (target !== root && !target.startsWith(root + sep)) {
+      throw new Error(
+        `zip entry would escape the destination: ${JSON.stringify(name)}`
+      );
+    }
+    if (buf.readUInt32LE(localOffset) !== LOCAL_SIG)
+      throw new Error(`corrupt local header: ${zipPath}`);
+    const localNameLen = buf.readUInt16LE(localOffset + 26);
+    const localExtraLen = buf.readUInt16LE(localOffset + 28);
+    const dataStart = localOffset + 30 + localNameLen + localExtraLen;
+    const data = buf.subarray(dataStart, dataStart + compSize);
+    let bytes;
+    if (method === 0) bytes = Buffer.from(data);
+    else if (method === 8) bytes = inflateRawSync(data);
+    else
+      throw new Error(
+        `unsupported zip compression method ${method} in ${zipPath}`
+      );
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, bytes);
+    names.push(name);
+  }
+  return names;
+}
+function walkFiles(dir) {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true }).sort(
+    (a, b) => a.name.localeCompare(b.name)
+  )) {
+    const p = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walkFiles(p));
+    else if (entry.isFile()) out.push(p);
+  }
+  return out;
+}
+function collectArtifacts(artifactDir) {
+  if (!existsSync(artifactDir)) return [];
+  const out = [];
+  for (const run of readdirSync(artifactDir, { withFileTypes: true })) {
+    if (!run.isDirectory()) continue;
+    const runDir = join(artifactDir, run.name);
+    for (const art of readdirSync(runDir, { withFileTypes: true }).sort(
+      (a, b) => a.name.localeCompare(b.name)
+    )) {
+      if (!art.isDirectory()) continue;
+      const artDir = join(runDir, art.name);
+      const unpackedDir = join(artDir, "unpacked");
+      for (const file of walkFiles(artDir)) {
+        if (file.startsWith(unpackedDir + sep)) continue;
+        if (file.toLowerCase().endsWith(".zip")) {
+          for (const name of extractZip(file, unpackedDir)) {
+            out.push({
+              path: join(unpackedDir, name),
+              filename: name,
+              name: art.name
+            });
+          }
+        } else {
+          out.push({
+            path: file,
+            filename: relative(artDir, file).split(sep).join("/"),
+            name: art.name
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+var ActRunner = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.platforms = options.platforms ?? { ...DEFAULT_ACT_PLATFORMS };
+    this.selectors = Object.keys(this.platforms);
+  }
+  options;
+  family = "act";
+  selectors;
+  platforms;
+  /** The resolved act binary, or null when none is available. */
+  binary(env = process.env) {
+    return resolveActBinary(env, this.options.actBin);
+  }
+  async run(request) {
+    const startedAt = Math.floor(Date.now() / 1e3);
+    const bin = this.binary();
+    if (bin === null) {
+      return startupFailure(
+        startedAt,
+        "act binary not found (set RIG_ACT_BIN or install act)"
+      );
+    }
+    const workflowText = readFileSync(
+      join(request.checkoutDir, request.workflow.path)
+    );
+    const parsed = parseWorkflow(request.workflow.path, workflowText);
+    if (parsed.parseError !== void 0) {
+      return startupFailure(
+        startedAt,
+        `workflow parse error: ${parsed.parseError}`
+      );
+    }
+    const scratch = await mkdtemp(join(tmpdir(), "rig-act-"));
+    const artifactDir = this.options.artifactDir ?? join(scratch, "artifacts");
+    mkdirSync(artifactDir, { recursive: true });
+    const eventPath = join(scratch, "event.json");
+    writeFileSync(
+      eventPath,
+      JSON.stringify(buildActEventPayload(request.trigger))
+    );
+    const args = [
+      actEventName(request.trigger, parsed.triggers),
+      "-W",
+      request.workflow.path,
+      "-C",
+      request.checkoutDir,
+      "--json",
+      "-e",
+      eventPath,
+      "--artifact-server-path",
+      artifactDir
+    ];
+    if (this.options.pull === false) args.push("--pull=false");
+    for (const [label, image] of Object.entries(this.platforms)) {
+      args.push("-P", `${label}=${image}`);
+    }
+    for (const name of Object.keys(request.secrets)) args.push("-s", name);
+    for (const name of Object.keys(request.env ?? {})) args.push("--env", name);
+    const env = {
+      ...process.env,
+      ...request.env,
+      ...request.secrets
+    };
+    const lines = [];
+    let timedOut = false;
+    let cancelled = false;
+    const startedAtMs = Date.now();
+    const grace = this.options.killGraceMs ?? 1e4;
+    const exitCode = await new Promise((resolveExit) => {
+      const child = spawn(bin, args, {
+        cwd: request.checkoutDir,
+        env,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let killTimer;
+      const kill = () => {
+        child.kill("SIGTERM");
+        killTimer = setTimeout(() => child.kill("SIGKILL"), grace);
+      };
+      const timeout = setTimeout(() => {
+        timedOut = true;
+        kill();
+      }, request.timeoutMs);
+      const onAbort = () => {
+        cancelled = true;
+        kill();
+      };
+      if (request.signal?.aborted) onAbort();
+      else request.signal?.addEventListener("abort", onAbort, { once: true });
+      const consume = (stream) => {
+        let buffered = "";
+        stream.setEncoding("utf-8");
+        stream.on("data", (chunk) => {
+          buffered += chunk;
+          let nl;
+          while ((nl = buffered.indexOf("\n")) >= 0) {
+            const line = buffered.slice(0, nl);
+            buffered = buffered.slice(nl + 1);
+            const parsedLine = parseActJsonLine(line);
+            if (!parsedLine) continue;
+            lines.push(parsedLine);
+            if (request.onLog && parsedLine.exitCode === void 0) {
+              request.onLog(
+                parsedLine.jobId,
+                parsedLine.rawOutput || parsedLine.msg.endsWith("\n") ? parsedLine.msg : `${parsedLine.msg}
+`
+              );
+            }
+          }
+        });
+        stream.on("end", () => {
+          const parsedLine = parseActJsonLine(buffered);
+          if (parsedLine) lines.push(parsedLine);
+        });
+      };
+      consume(child.stdout);
+      consume(child.stderr);
+      child.on("error", () => resolveExit(null));
+      child.on("close", (code) => {
+        clearTimeout(timeout);
+        if (killTimer) clearTimeout(killTimer);
+        request.signal?.removeEventListener("abort", onAbort);
+        resolveExit(code);
+      });
+    });
+    if (timedOut || cancelled) {
+      await this.removeOrphanedContainers(
+        actContainerNamePrefix(parsed.name ?? basename(request.workflow.path)),
+        startedAtMs,
+        (note) => {
+          this.options.warn?.(note);
+          request.onLog?.("runner", `${note}
+`);
+        }
+      );
+    }
+    const summary = summarizeActRun(lines, { exitCode, timedOut, cancelled });
+    const artifacts = collectArtifacts(artifactDir);
+    const finishedAt = Math.floor(Date.now() / 1e3);
+    const jobs = summary.jobs.map((j) => ({
+      jobId: j.jobId,
+      name: j.name,
+      conclusion: j.conclusion,
+      ...j.exitCode !== void 0 ? { exitCode: j.exitCode } : {},
+      startedAt: j.startedAt || startedAt,
+      finishedAt: j.finishedAt || finishedAt,
+      log: j.log,
+      artifacts: []
+    }));
+    for (const artifact of artifacts) {
+      const owner = jobs.find(
+        (j) => j.log.includes(
+          `Artifact ${artifact.name} has been successfully uploaded`
+        )
+      ) ?? jobs[0];
+      owner?.artifacts.push(artifact);
+    }
+    if (this.options.artifactDir !== void 0) {
+      await rm(scratch, { recursive: true, force: true });
+    }
+    return { conclusion: summary.conclusion, jobs, startedAt, finishedAt };
+  }
+  /**
+   * Remove the job containers a killed act left running (see the module
+   * header): every container whose name starts with `prefix` and whose
+   * Docker `Created` stamp is at or after this run's start (minus a little
+   * slack). Never throws — a failed cleanup is reported through `note` and
+   * the run result is still returned.
+   */
+  async removeOrphanedContainers(prefix, startedAtMs, note) {
+    const docker = this.options.dockerBin ?? "docker";
+    const run = async (args) => {
+      const { stdout } = await execFileAsync(docker, args, {
+        encoding: "utf-8",
+        timeout: 3e4
+      });
+      return stdout;
+    };
+    try {
+      const ids = (await run(["ps", "-aq", "--filter", `name=^${prefix}`])).split("\n").map((id) => id.trim()).filter((id) => id !== "");
+      const ours = [];
+      for (const id of ids) {
+        const created = Date.parse(
+          (await run(["inspect", "-f", "{{.Created}}", id])).trim()
+        );
+        if (Number.isNaN(created) || created >= startedAtMs - CONTAINER_CREATED_SLACK_MS) {
+          ours.push(id);
+        }
+      }
+      if (ours.length === 0) return;
+      await run(["rm", "-f", ...ours]);
+      note(
+        `removed ${ours.length} job container(s) act left running after the kill (${prefix}*)`
+      );
+    } catch (err) {
+      note(
+        `could not remove act's leftover job containers (${prefix}*): ${err instanceof Error ? err.message : String(err)} \u2014 remove them by hand`
+      );
+    }
+  }
+};
+function startupFailure(startedAt, reason) {
+  return {
+    conclusion: "startup_failure",
+    startedAt,
+    finishedAt: Math.floor(Date.now() / 1e3),
+    jobs: [
+      {
+        jobId: "startup",
+        conclusion: "startup_failure",
+        startedAt,
+        finishedAt: Math.floor(Date.now() / 1e3),
+        log: `${reason}
+`,
+        artifacts: []
+      }
+    ]
+  };
+}
+
+// src/ci/coordinator.ts
+import { randomUUID } from "crypto";
+import { readFile as readFile2, rm as rm2 } from "fs/promises";
+import { join as join3 } from "path";
+import { REPOSITORY_ANNOUNCEMENT_KIND } from "@toon-protocol/core/nip34";
+
+// src/ci/materialize-commit.ts
+import { spawn as spawn2 } from "child_process";
+import { mkdir } from "fs/promises";
+var FULL_SHA_RE = /^[0-9a-f]{40}$/;
+var MaterializeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MaterializeError";
+  }
+};
+function gitWithStdin(cwd, args, stdin, env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn2("git", args, {
+      cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on(
+      "error",
+      (err) => reject(new Error(`failed to spawn git: ${err.message}`))
+    );
+    child.on("close", (code) => {
+      if (code !== 0) {
+        reject(
+          new Error(`git ${args[0]} failed (exit ${code}): ${stderr.trim()}`)
+        );
+      } else {
+        resolve2(stdout);
+      }
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.write(stdin);
+    child.stdin.end();
+  });
+}
+var materializeCommit = async (opts) => {
+  if (!FULL_SHA_RE.test(opts.commit)) {
+    throw new MaterializeError(
+      `not a full commit sha: ${JSON.stringify(opts.commit)}`
+    );
+  }
+  const remote = await fetchRemoteState({
+    relayUrls: opts.relayUrls,
+    ownerPubkey: opts.ownerPubkey,
+    repoId: opts.repoId,
+    ...opts.webSocketFactory ? { webSocketFactory: opts.webSocketFactory } : {},
+    ...opts.resolveSha ? { resolveSha: opts.resolveSha } : {}
+  });
+  if (!remote.announced && remote.refsEvent === null) {
+    throw new MaterializeError(
+      `repository ${opts.ownerPubkey.slice(0, 8)}\u2026/${opts.repoId} is not on the relay`
+    );
+  }
+  const collected = await collectRepoObjects({
+    tips: [opts.commit, ...opts.extraObjectIds ?? []],
+    shaToTxId: remote.shaToTxId,
+    resolveMissing: (shas) => remote.resolveMissing(shas),
+    ...opts.fetchFn ? { fetchFn: opts.fetchFn } : {},
+    ...opts.gateways ? { gateways: opts.gateways } : {}
+  });
+  const extra = new Set(
+    (opts.extraObjectIds ?? []).map((id) => id.toLowerCase())
+  );
+  const fatal = collected.missing.filter(
+    (m) => !extra.has(m.sha.toLowerCase())
+  );
+  if (fatal.length > 0) {
+    throw new MaterializeError(
+      missingObjectsMessage(
+        fatal,
+        `cannot materialize ${opts.commit.slice(0, 7)}`
+      )
+    );
+  }
+  await mkdir(opts.dir, { recursive: true });
+  await runGit(opts.dir, ["init", "--quiet", "--initial-branch=main"]);
+  const objectsWritten = await writeGitObjects(
+    opts.dir,
+    collected.objects.values()
+  );
+  await runGit(opts.dir, ["checkout", "--quiet", "--detach", opts.commit]);
+  if (opts.patch) {
+    const committer = opts.committer ?? {
+      name: "rig ci",
+      email: "ci@rig.invalid"
+    };
+    const env = {
+      ...process.env,
+      GIT_COMMITTER_NAME: committer.name,
+      GIT_COMMITTER_EMAIL: committer.email
+    };
+    try {
+      await gitWithStdin(opts.dir, ["am", "--quiet"], opts.patch.content, env);
+    } catch (err) {
+      throw new MaterializeError(
+        `patch does not apply on ${opts.commit.slice(0, 7)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const head = (await runGit(opts.dir, ["rev-parse", "HEAD"])).trim();
+  return { dir: opts.dir, commit: head, objectsWritten };
+};
+
+// src/ci/relay-subscription.ts
+import { decode as decodeToon } from "@toon-format/toon";
+var realScheduler = {
+  setTimeout: (fn, ms) => setTimeout(fn, ms),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+var WS_OPEN = 1;
+function decodeRelayEvent(payload) {
+  if (payload !== null && typeof payload === "object")
+    return payload;
+  if (typeof payload !== "string") return null;
+  try {
+    const parsed = JSON.parse(payload);
+    if (parsed !== null && typeof parsed === "object")
+      return parsed;
+  } catch {
+  }
+  try {
+    return decodeToon(payload);
+  } catch {
+    return null;
+  }
+}
+function subscribeRelay(opts) {
+  const scheduler = opts.scheduler ?? realScheduler;
+  const initialBackoff = opts.backoff?.initialMs ?? 1e3;
+  const maxBackoff = opts.backoff?.maxMs ?? 6e4;
+  const base = `ci-${Math.random().toString(36).slice(2, 8)}`;
+  let ws = null;
+  let closed = false;
+  let connected = false;
+  let connections = 0;
+  let backoffMs = initialBackoff;
+  let reconnectHandle = null;
+  let subIds = /* @__PURE__ */ new Map();
+  const status = (s, detail) => {
+    opts.onStatus?.(s, detail);
+  };
+  const scheduleReconnect = (detail) => {
+    if (closed || reconnectHandle !== null) return;
+    connected = false;
+    status("reconnecting", detail);
+    const delay = backoffMs;
+    backoffMs = Math.min(backoffMs * 2, maxBackoff);
+    reconnectHandle = scheduler.setTimeout(() => {
+      reconnectHandle = null;
+      connect();
+    }, delay);
+  };
+  const connect = () => {
+    if (closed) return;
+    const generation = ++connections;
+    subIds = /* @__PURE__ */ new Map();
+    let socket;
+    try {
+      socket = opts.webSocketFactory(opts.url);
+    } catch (err) {
+      scheduleReconnect(
+        `connect failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return;
+    }
+    ws = socket;
+    const mine = () => ws === socket && generation === connections;
+    socket.addEventListener("open", () => {
+      if (!mine() || closed) return;
+      connected = true;
+      backoffMs = initialBackoff;
+      status("open");
+      opts.filters.forEach((filter, index) => {
+        const subId = `${base}-${generation}-${index}`;
+        subIds.set(subId, index);
+        const since = filter.since ?? opts.since?.(index);
+        const sent = since !== void 0 ? { ...filter, since } : { ...filter };
+        socket.send(JSON.stringify(["REQ", subId, sent]));
+      });
+    });
+    socket.addEventListener("message", (msgEvent) => {
+      if (!mine() || closed) return;
+      let msg;
+      try {
+        msg = JSON.parse(String(msgEvent.data));
+      } catch {
+        return;
+      }
+      if (!Array.isArray(msg) || msg.length < 2) return;
+      const index = subIds.get(String(msg[1]));
+      if (index === void 0) return;
+      if (msg[0] === "EVENT" && msg[2] !== void 0) {
+        const event = decodeRelayEvent(msg[2]);
+        if (event) opts.onEvent(event, index);
+      } else if (msg[0] === "EOSE") {
+        opts.onEose?.(index);
+      } else if (msg[0] === "CLOSED") {
+        scheduleReconnect(`relay closed subscription: ${String(msg[2] ?? "")}`);
+      }
+    });
+    socket.addEventListener("error", (event) => {
+      if (!mine() || closed) return;
+      const detail = typeof event === "object" && event !== null && "message" in event ? String(event.message) : "unknown";
+      status("error", detail);
+      try {
+        socket.close();
+      } catch {
+      }
+      scheduleReconnect(`socket error: ${detail}`);
+    });
+    socket.addEventListener("close", () => {
+      if (!mine() || closed) return;
+      scheduleReconnect("socket closed");
+    });
+  };
+  connect();
+  return {
+    close() {
+      if (closed) return;
+      closed = true;
+      connected = false;
+      if (reconnectHandle !== null) {
+        scheduler.clearTimeout(reconnectHandle);
+        reconnectHandle = null;
+      }
+      const socket = ws;
+      ws = null;
+      if (socket) {
+        try {
+          if (socket.readyState === WS_OPEN) {
+            for (const subId of subIds.keys()) {
+              socket.send(JSON.stringify(["CLOSE", subId]));
+            }
+          }
+          socket.close();
+        } catch {
+        }
+      }
+      status("closed");
+    },
+    get connected() {
+      return connected;
+    },
+    get connections() {
+      return connections;
+    }
+  };
+}
+
+// src/ci/state.ts
+import { mkdir as mkdir2, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var MAX_PROCESSED_IDS = 1e3;
+function cursorPath(stateDir) {
+  return join2(stateDir, "cursor.json");
+}
+function secretsPath(stateDir) {
+  return join2(stateDir, "secrets.json");
+}
+function defaultCoordinatorStateDir(env, coordinatorPubkey) {
+  const home = env["TOON_CLIENT_HOME"] ?? join2(homedir(), ".toon-client");
+  return join2(home, "rig-ci", coordinatorPubkey.toLowerCase());
+}
+function boundProcessed(ids) {
+  return ids.length > MAX_PROCESSED_IDS ? ids.slice(ids.length - MAX_PROCESSED_IDS) : ids;
+}
+async function readJson(path) {
+  let text;
+  try {
+    text = await readFile(path, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new Error(
+      `coordinator state file ${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function writeJsonAtomic(path, value) {
+  await mkdir2(join2(path, ".."), { recursive: true });
+  const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2, 8)}`;
+  await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  await rename(tmp, path);
+}
+async function loadCoordinatorState(stateDir) {
+  const cursorFile = await readJson(cursorPath(stateDir));
+  const secrets = await readJson(secretsPath(stateDir)) ?? {};
+  const cursor = {};
+  for (const [addr, repo] of Object.entries(cursorFile?.repos ?? {})) {
+    cursor[addr] = { ...repo, processed: boundProcessed(repo.processed ?? []) };
+  }
+  const inbox = {
+    ...cursorFile?.inbox?.lastCreatedAt !== void 0 ? { lastCreatedAt: cursorFile.inbox.lastCreatedAt } : {},
+    processed: boundProcessed(cursorFile?.inbox?.processed ?? [])
+  };
+  return { cursor, inbox, secrets };
+}
+async function saveCursor(stateDir, cursor, inbox) {
+  const repos = {};
+  for (const [addr, repo] of Object.entries(cursor)) {
+    repos[addr] = { ...repo, processed: boundProcessed(repo.processed) };
+  }
+  const file = {
+    repos,
+    inbox: { ...inbox, processed: boundProcessed(inbox.processed) }
+  };
+  await writeJsonAtomic(cursorPath(stateDir), file);
+}
+async function saveSecrets(stateDir, secrets) {
+  await writeJsonAtomic(secretsPath(stateDir), secrets);
+}
+
+// src/ci/coordinator.ts
+var DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_ADVERTISEMENT_TTL = 30 * 60;
+var RENEW_FRACTION = 5 / 6;
+var LOG_TAIL_BYTES = 4096;
+var SECRETS_KEY_MAX_AGE = 86400;
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function logTail(log) {
+  const bytes = Buffer.from(log, "utf-8");
+  if (bytes.byteLength <= LOG_TAIL_BYTES) return { tail: log, omitted: 0 };
+  const cut = bytes.subarray(bytes.byteLength - LOG_TAIL_BYTES);
+  return {
+    tail: cut.toString("utf-8"),
+    omitted: bytes.byteLength - LOG_TAIL_BYTES
+  };
+}
+function gatewayRawUrl(gatewayUrl, txId) {
+  return `${gatewayUrl.replace(/\/+$/, "")}/raw/${txId}`;
+}
+function movedRefs(before, after) {
+  const moved = [];
+  for (const [ref, sha] of Object.entries(after)) {
+    if (before[ref] !== sha) moved.push({ ref, sha });
+  }
+  return moved;
+}
+function parseRefsTags(ev) {
+  const refs = {};
+  let head = null;
+  for (const [name, v1, v2] of ev.tags) {
+    if (name === "r" && v1 && v2) {
+      if (v1 === "HEAD" && v2.startsWith("ref: ")) head = v2.slice(5);
+      else refs[v1] = v2;
+    } else if (name === "HEAD" && v1?.startsWith("ref: ")) {
+      head = v1.slice(5);
+    }
+  }
+  return { refs, head };
+}
+function tagValues(tags, name) {
+  return tags.filter((t) => t[0] === name).map((t) => t[1] ?? "").filter((v) => v !== "");
+}
+var Serial = class {
+  chain = Promise.resolve();
+  run(fn) {
+    const next = this.chain.then(fn, fn);
+    this.chain = next.catch(() => void 0);
+    return next;
+  }
+};
+async function startCoordinator(opts) {
+  const me = opts.coordinatorPubkey.toLowerCase();
+  const { publisher, relayUrl, runner } = opts;
+  const concurrency = Math.max(1, opts.concurrency ?? 1);
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS;
+  const clock = opts.clock ?? nowSeconds;
+  const scheduler = opts.scheduler ?? realScheduler;
+  const log = opts.log ?? (() => void 0);
+  const materialize = opts.materialize ?? materializeCommit;
+  const canAfford = opts.canAfford ?? (async () => true);
+  const acceptedRequesters = new Set(
+    [...opts.acceptedRequesters ?? []].map((p) => p.toLowerCase())
+  );
+  const adTtl = Math.min(
+    opts.advertisementTtlSeconds ?? DEFAULT_ADVERTISEMENT_TTL,
+    1800
+  );
+  if (!publisher.uploadBlob) {
+    throw new Error(
+      "the coordinator needs a publisher that can upload blobs (job logs and artifacts) \u2014 the standalone publisher provides uploadBlob"
+    );
+  }
+  const uploadBlob = publisher.uploadBlob.bind(publisher);
+  if (opts.repos.length === 0)
+    throw new Error("the coordinator needs at least one --repo to serve");
+  const serial = new Serial();
+  const publish = (event) => serial.run(
+    async () => (await publisher.publishEvent(event, [relayUrl])).eventId
+  );
+  const state = await loadCoordinatorState(opts.stateDir);
+  const repos = /* @__PURE__ */ new Map();
+  for (const r of opts.repos) {
+    const owner = r.ownerPubkey.toLowerCase();
+    const addr = repoAddress(owner, r.repoId);
+    repos.set(addr, {
+      addr,
+      ownerPubkey: owner,
+      repoId: r.repoId,
+      authorized: /* @__PURE__ */ new Set([owner]),
+      controls: /* @__PURE__ */ new Map(),
+      cursor: state.cursor[addr],
+      secrets: state.secrets[addr] ?? {},
+      prEvents: /* @__PURE__ */ new Map(),
+      defaultBranch: null
+    });
+  }
+  const inbox = state.inbox;
+  const inboxProcessed = new Set(inbox.processed);
+  const persistCursor = async () => {
+    const cursor = {};
+    for (const repo of repos.values())
+      if (repo.cursor) cursor[repo.addr] = repo.cursor;
+    inbox.processed = [...inboxProcessed];
+    await saveCursor(opts.stateDir, cursor, inbox);
+  };
+  const persistSecrets = async () => {
+    const secrets = {};
+    for (const repo of repos.values()) secrets[repo.addr] = repo.secrets;
+    await saveSecrets(opts.stateDir, secrets);
+  };
+  for (const repo of repos.values()) {
+    const remote = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: repo.ownerPubkey,
+      repoId: repo.repoId,
+      ...opts.webSocketFactory ? { webSocketFactory: opts.webSocketFactory } : {},
+      ...opts.resolveSha ? { resolveSha: opts.resolveSha } : {}
+    });
+    if (remote.announceEvent) {
+      repo.authorized = authorizedStatusAuthors(
+        repo.ownerPubkey,
+        remote.announceEvent.tags
+      );
+    }
+    repo.defaultBranch = remote.headSymref;
+    if (repo.cursor === void 0) {
+      repo.cursor = {
+        lastCreatedAt: remote.refsEvent?.created_at ?? 0,
+        lastEventId: remote.refsEvent?.id ?? "",
+        refs: Object.fromEntries(remote.refs),
+        processed: remote.refsEvent ? [remote.refsEvent.id] : []
+      };
+      log(
+        `[ci] ${repo.repoId}: recorded ${remote.refs.size} ref(s); watching for pushes`
+      );
+    }
+  }
+  await persistCursor();
+  const isServing = (repo) => selectServiceRequests([...repo.controls.values()], {
+    coordinatorPubkey: me,
+    repoAddr: repo.addr,
+    authorized: repo.authorized,
+    acceptedRequesters
+  }).active !== null;
+  const handleControl = (ev) => {
+    const control = parseCiServiceControl(ev);
+    if (!control || control.coordinatorPubkey !== me) return;
+    const repo = repos.get(control.repoAddr);
+    if (!repo || repo.controls.has(control.eventId)) return;
+    const before = isServing(repo);
+    repo.controls.set(control.eventId, control);
+    const after = isServing(repo);
+    if (before !== after) {
+      const who = repo.authorized.has(control.pubkey) ? "maintainer" : "operator-accepted requester";
+      log(
+        `[ci] ${repo.repoId}: ${after ? `serving (${who} Service Request accepted)` : "service stopped"}`
+      );
+    } else if (control.kind === "request" && !repo.authorized.has(control.pubkey) && !acceptedRequesters.has(control.pubkey.toLowerCase())) {
+      log(
+        `[ci] ${repo.repoId}: Service Request from non-maintainer ${control.pubkey.slice(0, 8)} ignored`
+      );
+    }
+  };
+  const controlFilter = {
+    kinds: [CI_SERVICE_REQUEST_KIND, CI_SERVICE_STOP_KIND],
+    "#p": [me]
+  };
+  try {
+    const history = await queryRelay(
+      relayUrl,
+      controlFilter,
+      1e4,
+      opts.webSocketFactory ?? defaultWebSocketFactory
+    );
+    for (const ev of history) handleControl(ev);
+  } catch (err) {
+    log(
+      `[ci] could not read the Service Request history: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let secretsKey = generateSecretsKey();
+  let secretsKeyBorn = clock();
+  let advertisementId = null;
+  const liveAdvertisements = /* @__PURE__ */ new Map();
+  let adTimer = null;
+  let stopping = false;
+  const advertise = async () => {
+    if (stopping) return;
+    const now = clock();
+    if (now - secretsKeyBorn >= SECRETS_KEY_MAX_AGE) {
+      secretsKey = generateSecretsKey();
+      secretsKeyBorn = now;
+      liveAdvertisements.clear();
+      log("[ci] rotated the secrets key");
+    }
+    const expiresAt = now + adTtl;
+    const event = buildCiAdvertisement(
+      {
+        version: opts.version,
+        selectors: runner.selectors,
+        admission: "maintainer-request",
+        execution: "request-required",
+        billing: "out-of-band",
+        secretsKey: { pubkey: secretsKey.pubkey, inboxRelays: [relayUrl] },
+        expiresAt
+      },
+      now
+    );
+    try {
+      advertisementId = await publish(event);
+      liveAdvertisements.set(advertisementId, { createdAt: now, expiresAt });
+    } catch (err) {
+      log(
+        `[ci] advertisement publish failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (!stopping) {
+      adTimer = scheduler.setTimeout(
+        () => void advertise(),
+        adTtl * RENEW_FRACTION * 1e3
+      );
+    }
+  };
+  await advertise();
+  const queue = [];
+  const activeAborts = /* @__PURE__ */ new Set();
+  const activeRuns = /* @__PURE__ */ new Set();
+  let active = 0;
+  let inflight = 0;
+  const idleWaiters = [];
+  const checkIdle = () => {
+    if (inflight === 0 && queue.length === 0 && eventQueue.length === 0 && !draining) {
+      for (const w of idleWaiters.splice(0)) w();
+    }
+  };
+  const releaseCheckout = async (checkout) => {
+    checkout.refs -= 1;
+    if (checkout.refs <= 0 && !opts.keepCheckouts) {
+      await rm2(checkout.dir, { recursive: true, force: true }).catch(
+        () => void 0
+      );
+    }
+  };
+  const progressAddress = (runId) => `${CI_WORKFLOW_PROGRESS_KIND}:${me}:${runId}`;
+  const concludeWithoutJobs = async (run, conclusion, provenance, startedAt) => {
+    const base = {
+      trigger: run.trigger,
+      runId: run.runId,
+      queuedAt: run.queuedAt,
+      ...startedAt !== void 0 ? { startedAt } : {},
+      ...provenance ? { provenance } : {},
+      jobs: []
+    };
+    const now = clock();
+    const resultEventId = await publish(
+      buildCiWorkflowResult({ ...base, conclusion }, now)
+    );
+    await publish(
+      buildCiWorkflowProgress(
+        { ...base, status: "concluded", conclusion, expiresAt: now + adTtl },
+        now
+      )
+    );
+    opts.onRunConcluded?.({
+      runId: run.runId,
+      repoAddr: run.repo.addr,
+      trigger: run.trigger,
+      conclusion,
+      resultEventId
+    });
+  };
+  const executeRun = async (run) => {
+    const { repo, trigger, workflow } = run;
+    const label = `${repo.repoId} ${workflow.path}@${trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]`;
+    let provenance = run.manualProvenance;
+    if (!provenance) {
+      const { active: request } = selectServiceRequests(
+        [...repo.controls.values()],
+        {
+          coordinatorPubkey: me,
+          repoAddr: repo.addr,
+          authorized: repo.authorized,
+          acceptedRequesters
+        }
+      );
+      if (!request) {
+        log(`[ci] ${label}: service stopped before handoff \u2014 cancelled`);
+        await concludeWithoutJobs(run, "cancelled", void 0);
+        return;
+      }
+      provenance = {
+        kind: "service-request",
+        eventId: request.eventId,
+        relayUrl,
+        pubkey: request.pubkey
+      };
+    }
+    if (workflow.parseError !== void 0) {
+      log(`[ci] ${label}: workflow parse error \u2014 startup_failure`);
+      await concludeWithoutJobs(run, "startup_failure", provenance, clock());
+      return;
+    }
+    const startedAt = clock();
+    const jobIds = workflow.jobs.map((j) => j.id);
+    const quotes = [];
+    const progress = (status, conclusion2) => {
+      const now2 = clock();
+      return buildCiWorkflowProgress(
+        {
+          trigger,
+          runId: run.runId,
+          status,
+          ...conclusion2 !== void 0 ? { conclusion: conclusion2 } : {},
+          inProgress: status === "in_progress" ? jobIds.filter((id) => !quotes.some((q) => q.jobId === id)) : [],
+          queuedAt: run.queuedAt,
+          startedAt,
+          provenance,
+          jobs: quotes,
+          expiresAt: now2 + adTtl
+        },
+        now2
+      );
+    };
+    await publish(progress("in_progress"));
+    log(`[ci] ${label}: in_progress (${jobIds.length} job(s))`);
+    let renewTimer = null;
+    const scheduleRenew = () => {
+      renewTimer = scheduler.setTimeout(
+        () => {
+          void publish(progress("in_progress")).catch(() => void 0);
+          scheduleRenew();
+        },
+        adTtl * RENEW_FRACTION * 1e3
+      );
+    };
+    scheduleRenew();
+    const abort = new AbortController();
+    activeAborts.add(abort);
+    run.abort = abort;
+    let timedOut = false;
+    const timeoutHandle = scheduler.setTimeout(() => {
+      timedOut = true;
+      abort.abort();
+    }, timeoutMs);
+    let result;
+    try {
+      result = await Promise.race([
+        runner.run({
+          checkoutDir: run.checkout.dir,
+          workflow: { path: workflow.path, sha256: workflow.sha256 },
+          trigger,
+          secrets: run.secrets,
+          timeoutMs,
+          signal: abort.signal
+        }),
+        new Promise((resolve2) => {
+          abort.signal.addEventListener(
+            "abort",
+            () => {
+              scheduler.setTimeout(
+                () => resolve2({
+                  conclusion: timedOut ? "timed_out" : "cancelled",
+                  jobs: [],
+                  startedAt,
+                  finishedAt: clock()
+                }),
+                1e3
+              );
+            },
+            { once: true }
+          );
+        })
+      ]);
+    } catch (err) {
+      log(
+        `[ci] ${label}: runner failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      result = {
+        conclusion: "startup_failure",
+        jobs: [],
+        startedAt,
+        finishedAt: clock()
+      };
+    } finally {
+      scheduler.clearTimeout(timeoutHandle);
+      scheduler.clearTimeout(renewTimer);
+      activeAborts.delete(abort);
+    }
+    let conclusion = result.conclusion;
+    if (timedOut) conclusion = "timed_out";
+    else if (run.superseded || stopping && abort.signal.aborted)
+      conclusion = "cancelled";
+    for (const job of result.jobs) {
+      const { tail, omitted } = logTail(job.log);
+      const logReceipt = await serial.run(
+        () => uploadBlob({
+          body: Buffer.from(job.log, "utf-8"),
+          contentType: "text/plain; charset=utf-8",
+          repoId: repo.repoId
+        })
+      );
+      const artifacts = [];
+      for (const artifact of job.artifacts) {
+        try {
+          const body = await readFile2(artifact.path);
+          const receipt = await serial.run(
+            () => uploadBlob({
+              body,
+              contentType: contentTypeForPath(artifact.filename),
+              repoId: repo.repoId
+            })
+          );
+          artifacts.push({
+            url: gatewayRawUrl(opts.gatewayUrl, receipt.txId),
+            filename: artifact.filename,
+            name: artifact.name
+          });
+        } catch (err) {
+          log(
+            `[ci] ${label}: artifact ${artifact.filename} skipped: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+      const runsOn = workflow.jobs.find((j) => j.id === job.jobId)?.runsOn;
+      const jobConclusion = timedOut && job.conclusion === "failure" ? "timed_out" : job.conclusion;
+      const jobEventId = await publish(
+        buildCiJobResult(
+          {
+            trigger,
+            progressAddress: progressAddress(run.runId),
+            relayUrl,
+            jobId: job.jobId,
+            ...job.name !== void 0 ? { name: job.name } : {},
+            conclusion: jobConclusion,
+            logsUrl: gatewayRawUrl(opts.gatewayUrl, logReceipt.txId),
+            logTail: tail,
+            logOmittedBytes: omitted,
+            artifacts,
+            queuedAt: run.queuedAt,
+            startedAt: job.startedAt,
+            ...job.exitCode !== void 0 ? { exitCode: job.exitCode } : {},
+            ...runsOn ? { runsOn } : {}
+          },
+          clock()
+        )
+      );
+      quotes.push({
+        eventId: jobEventId,
+        relayUrl,
+        pubkey: me,
+        jobId: job.jobId
+      });
+      await publish(progress("in_progress"));
+    }
+    const now = clock();
+    const resultEventId = await publish(
+      buildCiWorkflowResult(
+        {
+          trigger,
+          runId: run.runId,
+          conclusion,
+          queuedAt: run.queuedAt,
+          startedAt,
+          provenance,
+          jobs: quotes
+        },
+        now
+      )
+    );
+    await publish(progress("concluded", conclusion));
+    log(`[ci] ${label}: ${conclusion}`);
+    opts.onRunConcluded?.({
+      runId: run.runId,
+      repoAddr: repo.addr,
+      trigger,
+      conclusion,
+      resultEventId
+    });
+  };
+  const pump = () => {
+    while (active < concurrency && queue.length > 0 && !stopping) {
+      const run = queue.shift();
+      active += 1;
+      inflight += 1;
+      activeRuns.add(run);
+      void executeRun(run).catch((err) => {
+        log(
+          `[ci] run ${run.runId.slice(0, 8)} failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }).finally(async () => {
+        activeRuns.delete(run);
+        active -= 1;
+        inflight -= 1;
+        await releaseCheckout(run.checkout);
+        pump();
+        checkIdle();
+      });
+    }
+  };
+  const enqueueRun = async (repo, trigger, workflow, checkout, secrets, manualProvenance) => {
+    let rates;
+    try {
+      rates = await publisher.getFeeRates();
+    } catch (err) {
+      log(
+        `[ci] refusing run of ${workflow.path} for ${repo.repoId}: cannot read fee rates (${err instanceof Error ? err.message : String(err)}) \u2014 is the wallet funded?`
+      );
+      return;
+    }
+    const jobs = Math.max(1, workflow.jobs.length);
+    if (!await canAfford({ events: 4 + 2 * jobs, uploads: jobs, rates })) {
+      log(
+        `[ci] refusing run of ${workflow.path} for ${repo.repoId}: wallet cannot cover its writes`
+      );
+      return;
+    }
+    const run = {
+      repo,
+      trigger,
+      workflow,
+      checkout,
+      secrets,
+      ...manualProvenance ? { manualProvenance } : {},
+      runId: randomUUID(),
+      queuedAt: clock()
+    };
+    checkout.refs += 1;
+    const position = active + queue.length + 1;
+    const now = clock();
+    await publish(
+      buildCiWorkflowProgress(
+        {
+          trigger,
+          runId: run.runId,
+          status: "queued",
+          queue: Math.ceil(position / concurrency),
+          queuedAt: run.queuedAt,
+          ...manualProvenance ? { provenance: manualProvenance } : {},
+          jobs: [],
+          expiresAt: now + adTtl
+        },
+        now
+      )
+    );
+    queue.push(run);
+    log(
+      `[ci] queued ${workflow.path} for ${repo.repoId}@${trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]`
+    );
+    pump();
+  };
+  const supersedePrRuns = async (repo, prEventId, updateEventId) => {
+    const samePr = (run) => run.repo === repo && run.trigger.pr?.prEventId === prEventId;
+    const why = `superseded by PR update ${updateEventId.slice(0, 8)} \u2014 cancelled`;
+    for (const run of queue.filter(samePr)) {
+      queue.splice(queue.indexOf(run), 1);
+      run.superseded = true;
+      log(
+        `[ci] ${repo.repoId} ${run.workflow.path}@${run.trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]: queued run ${why}`
+      );
+      await concludeWithoutJobs(run, "cancelled", void 0);
+      await releaseCheckout(run.checkout);
+    }
+    for (const run of activeRuns) {
+      if (!samePr(run) || run.superseded) continue;
+      run.superseded = true;
+      log(
+        `[ci] ${repo.repoId} ${run.workflow.path}@${run.trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]: ${why}`
+      );
+      run.abort?.abort();
+    }
+  };
+  let checkoutCounter = 0;
+  const handleTrigger = async (t) => {
+    const { repo } = t;
+    inflight += 1;
+    try {
+      const dir = join3(
+        opts.workdir,
+        `${repo.repoId}-${t.commit.slice(0, 7)}-${++checkoutCounter}`
+      );
+      let materialized;
+      try {
+        materialized = await materialize({
+          ownerPubkey: repo.ownerPubkey,
+          repoId: repo.repoId,
+          relayUrls: [relayUrl],
+          commit: t.commit,
+          dir,
+          ...t.patch ? { patch: { content: t.patch.content } } : {},
+          ...t.manual?.tagObjectIds && t.manual.tagObjectIds.length > 0 ? { extraObjectIds: t.manual.tagObjectIds } : {},
+          ...opts.webSocketFactory ? { webSocketFactory: opts.webSocketFactory } : {},
+          ...opts.fetchFn ? { fetchFn: opts.fetchFn } : {},
+          ...opts.resolveSha ? { resolveSha: opts.resolveSha } : {},
+          ...opts.gateways ? { gateways: opts.gateways } : {}
+        });
+      } catch (err) {
+        const reason = err instanceof MaterializeError ? err.message : `materialize failed: ${err instanceof Error ? err.message : String(err)}`;
+        log(`[ci] ${repo.repoId}@${t.commit.slice(0, 7)}: ${reason}`);
+        if (t.manual) {
+          const trigger = {
+            repoAddr: repo.addr,
+            commit: t.commit,
+            workflow: t.manual.workflow,
+            reason: "manual",
+            ...t.ref !== void 0 ? { ref: t.ref } : {},
+            ...t.pr ? { pr: t.pr } : {}
+          };
+          const checkout2 = { dir, refs: 0 };
+          const provenance = {
+            kind: "manual-trigger",
+            eventId: t.manual.eventId,
+            relayUrl,
+            pubkey: t.manual.pubkey
+          };
+          const broken = {
+            ...t.manual.workflow,
+            triggers: {},
+            jobs: [],
+            parseError: reason
+          };
+          await enqueueRun(repo, trigger, broken, checkout2, {}, provenance);
+        }
+        return;
+      }
+      const checkout = { dir: materialized.dir, refs: 0 };
+      const commit = materialized.commit;
+      if (t.manual?.tagObjectIds && t.manual.tagObjectIds.length > 0) {
+        const mismatch = await findUnpeelableTagId(
+          materialized.dir,
+          t.manual.tagObjectIds,
+          commit
+        );
+        if (mismatch !== null) {
+          log(
+            `[ci] manual trigger ignored: c ${mismatch.slice(0, 7)} does not peel to ${commit.slice(0, 7)} (or is not in the repo)`
+          );
+          if (!opts.keepCheckouts)
+            await rm2(materialized.dir, { recursive: true, force: true }).catch(
+              () => void 0
+            );
+          return;
+        }
+      }
+      const workflows = await discoverWorkflows(materialized.dir);
+      const tagObjectIds = [
+        ...t.manual?.tagObjectIds ?? [],
+        ...commit !== t.commit && !t.patch ? [t.commit] : [],
+        ...t.patch?.declaredTip && t.patch.declaredTip !== commit ? [t.patch.declaredTip] : []
+      ];
+      const secretsAllowed = repo.authorized.has(t.authorPubkey.toLowerCase());
+      const secrets = secretsAllowed ? effectiveSecrets(repo.secrets) : {};
+      let selected;
+      let manualProvenance;
+      if (t.manual) {
+        const wanted = t.manual.workflow;
+        const wf = workflows.find((w) => w.path === wanted.path);
+        if (!wf) {
+          log(
+            `[ci] manual trigger ignored: ${wanted.path} does not exist at ${commit.slice(0, 7)}`
+          );
+          selected = [];
+        } else if (wf.sha256 !== wanted.sha256.toLowerCase()) {
+          log(
+            `[ci] manual trigger ignored: ${wanted.path} at ${commit.slice(0, 7)} has sha256 ${wf.sha256}, request named ${wanted.sha256}`
+          );
+          selected = [];
+        } else {
+          selected = [wf];
+        }
+        manualProvenance = {
+          kind: "manual-trigger",
+          eventId: t.manual.eventId,
+          relayUrl,
+          pubkey: t.manual.pubkey
+        };
+      } else if (t.reason === "push") {
+        selected = workflows.filter(
+          (wf) => wf.parseError !== void 0 || matchesPush(wf, t.ref)
+        );
+      } else {
+        const base = repo.defaultBranch ?? void 0;
+        selected = workflows.filter(
+          (wf) => wf.parseError !== void 0 || matchesPullRequest(wf, base)
+        );
+      }
+      if (selected.length === 0) {
+        if (!opts.keepCheckouts)
+          await rm2(materialized.dir, { recursive: true, force: true }).catch(
+            () => void 0
+          );
+        return;
+      }
+      for (const wf of selected) {
+        const trigger = {
+          repoAddr: repo.addr,
+          commit,
+          ...tagObjectIds.length > 0 ? { tagObjectIds } : {},
+          workflow: { path: wf.path, sha256: wf.sha256 },
+          reason: t.reason,
+          ...t.pr ? { pr: t.pr } : t.ref !== void 0 ? { ref: t.ref } : {}
+        };
+        await enqueueRun(
+          repo,
+          trigger,
+          wf,
+          checkout,
+          secrets,
+          manualProvenance
+        );
+      }
+      if (checkout.refs === 0 && !opts.keepCheckouts) {
+        await rm2(materialized.dir, { recursive: true, force: true }).catch(
+          () => void 0
+        );
+      }
+    } finally {
+      inflight -= 1;
+      checkIdle();
+    }
+  };
+  const eventQueue = [];
+  let draining = false;
+  const markRepoProcessed = (repo, ev) => {
+    const cursor = repo.cursor;
+    cursor.processed.push(ev.id);
+    if (ev.created_at > cursor.lastCreatedAt) {
+      cursor.lastCreatedAt = ev.created_at;
+      cursor.lastEventId = ev.id;
+    }
+  };
+  const repoSeen = (repo, ev) => (repo.cursor?.processed ?? []).includes(ev.id);
+  const handleRepoState = async (repo, ev) => {
+    const cursor = repo.cursor;
+    if (repoSeen(repo, ev) || ev.created_at < cursor.lastCreatedAt) return;
+    const { refs, head } = parseRefsTags(ev);
+    if (head) repo.defaultBranch = head;
+    const moved = movedRefs(cursor.refs, refs);
+    cursor.refs = refs;
+    markRepoProcessed(repo, ev);
+    await persistCursor();
+    if (moved.length === 0) return;
+    if (!isServing(repo)) {
+      log(
+        `[ci] ${repo.repoId}: push seen but no maintainer Service Request \u2014 not running`
+      );
+      return;
+    }
+    for (const { ref, sha } of moved) {
+      if (!ref.startsWith("refs/heads/") && !ref.startsWith("refs/tags/"))
+        continue;
+      await handleTrigger({
+        repo,
+        reason: "push",
+        authorPubkey: ev.pubkey,
+        commit: sha,
+        ref
+      });
+    }
+  };
+  const handlePullRequest = async (repo, ev) => {
+    if (repoSeen(repo, ev)) return;
+    if (ev.kind === 1617 || ev.kind === 1618) repo.prEvents.set(ev.id, ev);
+    markRepoProcessed(repo, ev);
+    await persistCursor();
+    if (!isServing(repo)) {
+      log(
+        `[ci] ${repo.repoId}: pull request seen but no maintainer Service Request \u2014 not running`
+      );
+      return;
+    }
+    const author = ev.pubkey.toLowerCase();
+    if (ev.kind === 1617) {
+      const parents = tagValues(ev.tags, "parent-commit");
+      const commits = tagValues(ev.tags, "commit");
+      const base = parents[0];
+      if (!base || ev.content.trim() === "") {
+        log(
+          `[ci] ${repo.repoId}: patch ${ev.id.slice(0, 8)} has no parent-commit/content \u2014 cannot run`
+        );
+        return;
+      }
+      const declaredTip = commits[commits.length - 1];
+      await handleTrigger({
+        repo,
+        reason: "pull_request",
+        authorPubkey: author,
+        commit: base,
+        patch: { content: ev.content, ...declaredTip ? { declaredTip } : {} },
+        pr: {
+          prEventId: ev.id,
+          prAuthor: author,
+          prKind: 1617,
+          sourceEventId: ev.id,
+          sourceAuthor: author,
+          sourceKind: 1617
+        }
+      });
+      return;
+    }
+    if (ev.kind === 1618) {
+      const tip2 = tagValues(ev.tags, "c")[0];
+      if (!tip2) {
+        log(
+          `[ci] ${repo.repoId}: pull request ${ev.id.slice(0, 8)} has no tip commit \u2014 cannot run`
+        );
+        return;
+      }
+      await handleTrigger({
+        repo,
+        reason: "pull_request",
+        authorPubkey: author,
+        commit: tip2,
+        pr: {
+          prEventId: ev.id,
+          prAuthor: author,
+          prKind: 1618,
+          sourceEventId: ev.id,
+          sourceAuthor: author,
+          sourceKind: 1618
+        }
+      });
+      return;
+    }
+    const prId = tagValues(ev.tags, "E")[0];
+    const pr = prId ? repo.prEvents.get(prId) : void 0;
+    const tip = tagValues(ev.tags, "c")[0];
+    if (!pr || !tip) {
+      log(
+        `[ci] ${repo.repoId}: PR update ${ev.id.slice(0, 8)} references an unknown PR or no commit \u2014 ignored`
+      );
+      return;
+    }
+    await supersedePrRuns(repo, pr.id, ev.id);
+    await handleTrigger({
+      repo,
+      reason: "pull_request",
+      authorPubkey: author,
+      commit: tip,
+      pr: {
+        prEventId: pr.id,
+        prAuthor: pr.pubkey.toLowerCase(),
+        prKind: pr.kind === 1617 ? 1617 : 1618,
+        sourceEventId: ev.id,
+        sourceAuthor: author,
+        sourceKind: 1619
+      }
+    });
+  };
+  const handleManualTrigger = async (ev) => {
+    if (inboxProcessed.has(ev.id)) return;
+    inboxProcessed.add(ev.id);
+    inbox.lastCreatedAt = Math.max(inbox.lastCreatedAt ?? 0, ev.created_at);
+    await persistCursor();
+    const manual = parseCiManualTrigger(ev, me);
+    if (!manual) {
+      log(`[ci] malformed manual trigger ${ev.id.slice(0, 8)} ignored`);
+      return;
+    }
+    const repo = repos.get(manual.trigger.repoAddr);
+    if (!repo) {
+      log(
+        `[ci] manual trigger for unserved repo ${manual.trigger.repoAddr} ignored`
+      );
+      return;
+    }
+    if (!repo.authorized.has(manual.pubkey)) {
+      log(
+        `[ci] manual trigger from non-maintainer ${manual.pubkey.slice(0, 8)} ignored`
+      );
+      return;
+    }
+    const t = manual.trigger;
+    await handleTrigger({
+      repo,
+      reason: "manual",
+      authorPubkey: manual.pubkey,
+      commit: t.commit,
+      ...t.ref !== void 0 ? { ref: t.ref } : {},
+      ...t.pr ? { pr: t.pr } : {},
+      manual: {
+        eventId: manual.eventId,
+        pubkey: manual.pubkey,
+        workflow: t.workflow,
+        ...t.tagObjectIds ? { tagObjectIds: t.tagObjectIds } : {}
+      }
+    });
+  };
+  const handleSecretUpdate = async (ev) => {
+    if (inboxProcessed.has(ev.id)) return;
+    inboxProcessed.add(ev.id);
+    inbox.lastCreatedAt = Math.max(inbox.lastCreatedAt ?? 0, ev.created_at);
+    await persistCursor();
+    const update = parseCiSecretUpdate(ev);
+    if (!update || update.coordinatorPubkey !== me) return;
+    const perspective = parseRepoAddress(update.repoAddr);
+    const repo = perspective ? [...repos.values()].find((r) => r.repoId === perspective.repoId) : void 0;
+    if (!repo) {
+      log(`[ci] secret update for unserved repo ${update.repoAddr} ignored`);
+      return;
+    }
+    if (!repo.authorized.has(update.pubkey)) {
+      log(
+        `[ci] ${repo.repoId}: secret update from non-maintainer ${update.pubkey.slice(0, 8)} ignored`
+      );
+      return;
+    }
+    const ad = liveAdvertisements.get(update.advertisementId);
+    if (!ad || update.recipientPubkey !== secretsKey.pubkey) {
+      log(
+        `[ci] ${repo.repoId}: secret update ${ev.id.slice(0, 8)} addressed to a stale secrets key \u2014 re-send it`
+      );
+      return;
+    }
+    if (update.createdAt < ad.createdAt || update.createdAt >= ad.expiresAt) {
+      log(
+        `[ci] ${repo.repoId}: secret update ${ev.id.slice(0, 8)} outside its advertisement window \u2014 ignored`
+      );
+      return;
+    }
+    try {
+      const plain = decryptSecretUpdate(
+        update.ciphertext,
+        secretsKey.secretKey,
+        update.senderPubkey
+      );
+      validateSecretUpdate(plain, {
+        pubkey: ev.pubkey,
+        created_at: ev.created_at
+      });
+      repo.secrets = applySecretUpdate(repo.secrets, plain, ev.id);
+      await persistSecrets();
+      const names = [...Object.keys(plain.set), ...plain.remove];
+      log(
+        `[ci] ${repo.repoId}: secrets updated by ${update.pubkey.slice(0, 8)} (${names.join(", ")})`
+      );
+    } catch (err) {
+      log(
+        `[ci] ${repo.repoId}: secret update ${ev.id.slice(0, 8)} rejected: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
+  const handleEvent = async (ev) => {
+    switch (ev.kind) {
+      case REPOSITORY_ANNOUNCEMENT_KIND: {
+        const repoId = tagValues(ev.tags, "d")[0];
+        const repo = repoId ? repos.get(repoAddress(ev.pubkey, repoId)) : void 0;
+        if (repo && ev.pubkey.toLowerCase() === repo.ownerPubkey) {
+          repo.authorized = authorizedStatusAuthors(repo.ownerPubkey, ev.tags);
+        }
+        return;
+      }
+      case REPOSITORY_STATE_KIND: {
+        const repoId = tagValues(ev.tags, "d")[0];
+        const repo = repoId ? repos.get(repoAddress(ev.pubkey, repoId)) : void 0;
+        if (repo && ev.pubkey.toLowerCase() === repo.ownerPubkey)
+          await handleRepoState(repo, ev);
+        return;
+      }
+      case 1617:
+      case 1618:
+      case 1619: {
+        for (const addr of tagValues(ev.tags, "a")) {
+          const repo = repos.get(addr);
+          if (repo) {
+            await handlePullRequest(repo, ev);
+            return;
+          }
+        }
+        return;
+      }
+      case CI_SERVICE_REQUEST_KIND:
+      case CI_SERVICE_STOP_KIND:
+        handleControl(ev);
+        return;
+      case CI_MANUAL_TRIGGER_KIND:
+        await handleManualTrigger(ev);
+        return;
+      case CI_SECRET_UPDATE_KIND:
+        await handleSecretUpdate(ev);
+        return;
+      default:
+        return;
+    }
+  };
+  const drain = async () => {
+    if (draining) return;
+    draining = true;
+    try {
+      while (eventQueue.length > 0) {
+        const ev = eventQueue.shift();
+        try {
+          await handleEvent(ev);
+        } catch (err) {
+          log(
+            `[ci] event ${ev.id.slice(0, 8)} (kind ${ev.kind}) failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+    } finally {
+      draining = false;
+      checkIdle();
+    }
+  };
+  const filters = [controlFilter];
+  const sinceFor = [null];
+  for (const repo of repos.values()) {
+    filters.push({
+      kinds: [REPOSITORY_ANNOUNCEMENT_KIND, REPOSITORY_STATE_KIND],
+      authors: [repo.ownerPubkey],
+      "#d": [repo.repoId]
+    });
+    sinceFor.push(null);
+    filters.push({ kinds: [1617, 1618, 1619], "#a": [repo.addr] });
+    sinceFor.push(() => repo.cursor?.lastCreatedAt);
+  }
+  filters.push({
+    kinds: [CI_MANUAL_TRIGGER_KIND, CI_SECRET_UPDATE_KIND],
+    "#p": [me]
+  });
+  sinceFor.push(() => inbox.lastCreatedAt);
+  const subscription = subscribeRelay({
+    url: relayUrl,
+    filters,
+    webSocketFactory: opts.webSocketFactory ?? defaultWebSocketFactory,
+    scheduler,
+    onEvent: (ev) => {
+      eventQueue.push(ev);
+      void drain();
+    },
+    onStatus: (status, detail) => {
+      if (status === "open") log(`[ci] connected to ${relayUrl}`);
+      else if (status === "reconnecting")
+        log(`[ci] relay connection lost (${detail ?? ""}) \u2014 reconnecting`);
+    },
+    since: (index) => sinceFor[index]?.() ?? void 0
+  });
+  let stopResolve = () => void 0;
+  const stopped = new Promise((resolve2) => {
+    stopResolve = resolve2;
+  });
+  let stopPromise = null;
+  const stop = () => {
+    if (stopPromise) return stopPromise;
+    stopPromise = (async () => {
+      stopping = true;
+      subscription.close();
+      if (adTimer !== null) scheduler.clearTimeout(adTimer);
+      const dropped = queue.splice(0);
+      for (const run of dropped) {
+        log(
+          `[ci] dropping queued run ${run.runId.slice(0, 8)} (its queued marker expires on its own)`
+        );
+        await releaseCheckout(run.checkout);
+      }
+      for (const abort of activeAborts) abort.abort();
+      await new Promise((resolve2) => {
+        if (inflight === 0 && !draining) return resolve2();
+        idleWaiters.push(resolve2);
+      });
+      await persistCursor();
+      stopResolve();
+    })();
+    return stopPromise;
+  };
+  return {
+    pubkey: me,
+    get secretsKeyPubkey() {
+      return secretsKey.pubkey;
+    },
+    get advertisementId() {
+      return advertisementId;
+    },
+    stopped,
+    stop,
+    idle: () => new Promise((resolve2) => {
+      if (inflight === 0 && queue.length === 0 && eventQueue.length === 0 && !draining)
+        return resolve2();
+      idleWaiters.push(resolve2);
+    }),
+    serving: () => [...repos.values()].map((repo) => ({
+      repoAddr: repo.addr,
+      serving: isServing(repo)
+    }))
+  };
+}
+async function findUnpeelableTagId(checkoutDir, tagObjectIds, commit) {
+  for (const id of tagObjectIds) {
+    if (!/^[0-9a-f]{40}$/i.test(id)) return id;
+    let peeled;
+    try {
+      peeled = (await runGit(checkoutDir, [
+        "rev-parse",
+        "--verify",
+        "--quiet",
+        `${id}^{commit}`
+      ])).trim();
+    } catch {
+      return id;
+    }
+    if (peeled.toLowerCase() !== commit.toLowerCase()) return id;
+  }
+  return null;
+}
+
+// src/cli/ci-serve.ts
+var CI_SERVE_USAGE = `Usage: rig ci serve --relay <ws-url> --repo <owner>/<repo-id> [--repo \u2026] [options]
+
+Run a CI coordinator: watch the named repos on the relay, run their
+GitHub-Actions-syntax workflows with act on this host's Docker, and publish
+NIP-C1 progress and results back to the relay as PAID writes from THIS
+identity's channel. Every run is a handful of relay writes (one per progress
+update, job, and result) plus one store upload per job log and artifact.
+
+A repo is served only while one of its maintainers has published a Service
+Request (\`rig ci request <this-coordinator>\`) with no later Stop; a
+maintainer's \`rig ci trigger\` runs one workflow without a standing request.
+Secrets set with \`rig ci secret\` are injected only into runs authored by a
+maintainer \u2014 never into a third-party pull request.
+
+Options:
+  --relay <url>          the relay to watch AND publish to (ws:// or wss://)
+                         [required, exactly one]
+  --repo <owner>/<id>    a repo to serve (owner as npub or hex); repeatable
+  --requester <pubkey>   also accept Service Requests from this pubkey (npub
+                         or hex; NIP-C1 operator policy); repeatable \u2014 for
+                         running your own coordinator against a repo you do
+                         not maintain; such runs show as lower trust
+  --concurrency <n>      runs executed at once (default 1); more queue
+  --timeout <seconds>    wall-clock budget per run \u2192 timed_out (default 1800)
+  --gateway <url>        gateway that serves the store's raw bytes, for log +
+                         artifact links (default: ${PREFERRED_GATEWAY})
+  --act-bin <path>       the act executable (default: RIG_ACT_BIN, else PATH)
+  --platform <label=img> runs-on label \u2192 Docker image; repeatable
+                         (default: ubuntu-latest=${DEFAULT_ACT_PLATFORMS["ubuntu-latest"]})
+  --workdir <dir>        where commits are checked out for runs (default:
+                         <state-dir>/work)
+  --once                 stop after the first run concludes (its Workflow
+                         Result and final progress marker are on the relay);
+                         ignored or refused triggers do not count
+  --json                 emit ONE JSON document describing the coordinator
+                         at start; everything else goes to stderr
+  --standalone           accepted for symmetry; the coordinator always runs
+                         embedded (alias: --no-daemon)
+  -h, --help             show this help
+
+State (cursor, secret inventory) lives under
+<TOON_CLIENT_HOME|~/.toon-client>/rig-ci/<coordinator-pubkey>/ so a restart
+resumes from the last processed event. The NIP-44 secrets-key is generated
+fresh every start and never written to disk: after a restart maintainers
+re-send \`rig ci secret set\`; values already accepted survive.
+
+Before each run the coordinator checks that a recorded payment channel (or,
+before the first channel opens, the wallet's USDC) can cover the run's writes;
+otherwise it says so on stderr and starts nothing, so a run is never
+half-published (story 15).
+
+Stop with Ctrl-C (SIGINT) or SIGTERM: active runs conclude \`cancelled\`.`;
+var ServeUsageError = class extends Error {
+};
+function parseServeArgs(args) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      relay: { type: "string" },
+      repo: { type: "string", multiple: true },
+      requester: { type: "string", multiple: true },
+      concurrency: { type: "string" },
+      timeout: { type: "string" },
+      gateway: { type: "string" },
+      "act-bin": { type: "string" },
+      platform: { type: "string", multiple: true },
+      workdir: { type: "string" },
+      once: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      standalone: { type: "boolean", default: false },
+      "no-daemon": { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: false,
+    strict: true
+  });
+  if (values.help) return "help";
+  if (!values.relay) throw new ServeUsageError("--relay <ws-url> is required");
+  if (!WS_URL_RE.test(values.relay)) {
+    throw new ServeUsageError(
+      `--relay must be a ws:// or wss:// URL, got ${JSON.stringify(values.relay)}`
+    );
+  }
+  const repos = [];
+  for (const spec of values.repo ?? []) {
+    const slash = spec.indexOf("/");
+    if (slash <= 0 || slash === spec.length - 1) {
+      throw new ServeUsageError(
+        `--repo expects <owner>/<repo-id>, got ${JSON.stringify(spec)}`
+      );
+    }
+    let ownerPubkey;
+    try {
+      ownerPubkey = ownerToHex(spec.slice(0, slash));
+    } catch (err) {
+      throw new ServeUsageError(
+        `--repo ${JSON.stringify(spec)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    repos.push({ ownerPubkey, repoId: spec.slice(slash + 1) });
+  }
+  if (repos.length === 0)
+    throw new ServeUsageError(
+      "at least one --repo <owner>/<repo-id> is required"
+    );
+  const requesters = [];
+  for (const spec of values.requester ?? []) {
+    try {
+      requesters.push(ownerToHex(spec));
+    } catch (err) {
+      throw new ServeUsageError(
+        `--requester ${JSON.stringify(spec)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const positiveInt = (flag, raw, fallback) => {
+    if (raw === void 0) return fallback;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0)
+      throw new ServeUsageError(`${flag} expects a positive integer`);
+    return n;
+  };
+  const concurrency = positiveInt("--concurrency", values.concurrency, 1);
+  const timeoutMs = positiveInt("--timeout", values.timeout, DEFAULT_RUN_TIMEOUT_MS / 1e3) * 1e3;
+  let platforms;
+  if (values.platform && values.platform.length > 0) {
+    platforms = {};
+    for (const spec of values.platform) {
+      const eq = spec.indexOf("=");
+      if (eq <= 0 || eq === spec.length - 1) {
+        throw new ServeUsageError(
+          `--platform expects <label>=<image>, got ${JSON.stringify(spec)}`
+        );
+      }
+      platforms[spec.slice(0, eq)] = spec.slice(eq + 1);
+    }
+  }
+  return {
+    relay: values.relay,
+    repos,
+    requesters,
+    concurrency,
+    timeoutMs,
+    gateway: values.gateway ?? PREFERRED_GATEWAY,
+    ...values["act-bin"] !== void 0 ? { actBin: values["act-bin"] } : {},
+    ...platforms ? { platforms } : {},
+    ...values.workdir !== void 0 ? { workdir: values.workdir } : {},
+    once: values.once,
+    json: values.json
+  };
+}
+function estimateRunCost(estimate) {
+  return BigInt(estimate.events) * estimate.rates.eventFee + BigInt(estimate.uploads) * uploadChargeFor(estimate.rates, 64 * 1024);
+}
+function makeAffordabilityCheck(args) {
+  const { ctx, env, log } = args;
+  return async (estimate) => {
+    const cost = estimateRunCost(estimate);
+    const store = new ChannelMapStore(resolveChannelPaths(env));
+    const mine = store.list().filter(
+      (record) => record.identity.toLowerCase() === ctx.ownerPubkey.toLowerCase() && record.supersededAt === void 0
+    );
+    if (mine.length > 0) {
+      let best2 = 0n;
+      for (const record of mine) {
+        const watermark = store.readWatermark(record.channelId);
+        if (channelStatus(watermark) !== "open") continue;
+        if (record.depositTotal === void 0) continue;
+        const remaining = BigInt(record.depositTotal) - BigInt(watermark?.cumulativeAmount ?? "0");
+        if (remaining > best2) best2 = remaining;
+      }
+      if (best2 >= cost) return true;
+      log(
+        `[ci] wallet check: the best open channel has ${best2} available, the run needs ~${cost} \u2014 fund this coordinator (rig fund / rig channel open --deposit) to resume`
+      );
+      return false;
+    }
+    if (!ctx.money) {
+      log(
+        "[ci] wallet check: no channel recorded and no wallet reader \u2014 refusing"
+      );
+      return false;
+    }
+    let chains;
+    try {
+      chains = await ctx.money.walletChainBalances();
+    } catch (err) {
+      log(
+        `[ci] wallet check: wallet unreadable (${err instanceof Error ? err.message : String(err)}) \u2014 refusing`
+      );
+      return false;
+    }
+    let best = 0n;
+    for (const chain of chains) {
+      if (chain.unreadable) continue;
+      for (const token of chain.tokens) {
+        if (token.symbol !== void 0 && !/usdc/i.test(token.symbol)) continue;
+        const amount = BigInt(token.amount);
+        if (amount > best) best = amount;
+      }
+    }
+    if (best >= cost) return true;
+    log(
+      `[ci] wallet check: no channel recorded yet and the wallet holds ${best} USDC base units, the run needs ~${cost} \u2014 fund this coordinator (rig fund) to resume`
+    );
+    return false;
+  };
+}
+function untilStopRequested(signal, firstRun) {
+  return new Promise((resolve2) => {
+    let settled = false;
+    const finish = (reason) => {
+      if (settled) return;
+      settled = true;
+      process.off("SIGINT", onSigint);
+      process.off("SIGTERM", onSigterm);
+      resolve2(reason);
+    };
+    const onSigint = () => finish("SIGINT");
+    const onSigterm = () => finish("SIGTERM");
+    if (signal?.aborted) return finish("abort");
+    signal?.addEventListener("abort", () => finish("abort"), { once: true });
+    process.once("SIGINT", onSigint);
+    process.once("SIGTERM", onSigterm);
+    void firstRun?.then(finish);
+  });
+}
+async function runCiServe(args, deps) {
+  const forced = withForcedStandalone(deps);
+  const { io } = forced;
+  let flags;
+  try {
+    const parsed = parseServeArgs(args);
+    if (parsed === "help") {
+      io.out(CI_SERVE_USAGE);
+      return 0;
+    }
+    flags = parsed;
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(CI_SERVE_USAGE);
+    return 2;
+  }
+  let runner;
+  if (forced.runner) {
+    runner = forced.runner;
+  } else {
+    const act = new ActRunner({
+      ...flags.actBin !== void 0 ? { actBin: flags.actBin } : {},
+      ...flags.platforms ? { platforms: flags.platforms } : {}
+    });
+    if (act.binary(forced.env) === null) {
+      io.err(
+        "rig ci serve: the act executable was not found \u2014 install nektos/act (https://github.com/nektos/act) on this host, or point --act-bin / RIG_ACT_BIN at it. Nothing was started or paid."
+      );
+      return 1;
+    }
+    runner = act;
+  }
+  let ctx;
+  let handle;
+  try {
+    const session = await loadPaidSession(forced, flags.relay);
+    if (session.path !== "standalone") {
+      throw new Error("rig ci serve requires the standalone paid path");
+    }
+    ctx = session.ctx;
+    const identity = identityReport(ctx);
+    const coordinator = ctx.ownerPubkey.toLowerCase();
+    const stateDir = forced.stateDir ?? defaultCoordinatorStateDir(forced.env, coordinator);
+    const workdir = flags.workdir ?? join4(stateDir, "work");
+    const version = rigVersion();
+    let concludeFirstRun = () => void 0;
+    const firstRun = flags.once ? new Promise((resolve2) => {
+      concludeFirstRun = resolve2;
+    }) : void 0;
+    handle = await startCoordinator({
+      coordinatorPubkey: coordinator,
+      publisher: ctx.publisher,
+      relayUrl: flags.relay,
+      gatewayUrl: flags.gateway,
+      repos: flags.repos,
+      runner,
+      stateDir,
+      workdir,
+      version,
+      concurrency: flags.concurrency,
+      timeoutMs: flags.timeoutMs,
+      acceptedRequesters: flags.requesters,
+      canAfford: forced.canAfford ?? makeAffordabilityCheck({
+        ctx,
+        env: forced.env,
+        log: (line) => io.err(line)
+      }),
+      ...forced.webSocketFactory ? { webSocketFactory: forced.webSocketFactory } : {},
+      ...forced.fetchFn ? { fetchFn: forced.fetchFn } : {},
+      ...forced.resolveSha ? { resolveSha: forced.resolveSha } : {},
+      ...forced.clock ? { clock: forced.clock } : {},
+      ...firstRun ? { onRunConcluded: (run) => concludeFirstRun(run) } : {},
+      log: (line) => io.err(line)
+    });
+    const npub = hexToNpub(coordinator);
+    const repoLabels = flags.repos.map(
+      (r) => `${hexToNpub(r.ownerPubkey)}/${r.repoId}`
+    );
+    if (flags.json) {
+      io.emitJson({
+        command: "ci serve",
+        path: "standalone",
+        identity,
+        coordinator,
+        coordinatorNpub: npub,
+        relay: flags.relay,
+        gateway: flags.gateway,
+        repos: flags.repos,
+        requesters: flags.requesters,
+        runner: { family: runner.family, selectors: runner.selectors },
+        concurrency: flags.concurrency,
+        timeoutSeconds: flags.timeoutMs / 1e3,
+        once: flags.once,
+        stateDir,
+        workdir,
+        secretsKey: handle.secretsKeyPubkey,
+        advertisementId: handle.advertisementId,
+        version
+      });
+    } else {
+      io.out(renderIdentityLine(identity));
+      io.out(`Coordinator: ${npub}`);
+      io.out(`Relay:       ${flags.relay}`);
+      io.out(`Serving:     ${repoLabels.join(", ")}`);
+      if (flags.requesters.length > 0)
+        io.out(
+          `Requesters:  maintainers + ${flags.requesters.map(hexToNpub).join(", ")}`
+        );
+      io.out(
+        `Runner:      ${runner.family} (${runner.selectors.join(", ")}); concurrency ${flags.concurrency}, timeout ${flags.timeoutMs / 1e3}s`
+      );
+      io.out(`State:       ${stateDir}`);
+      io.out("Maintainers authorize this coordinator with:");
+      io.out(`  rig ci request ${npub}`);
+      io.out(
+        flags.once ? "Listening for one run \u2014 stops after it concludes (or Ctrl-C)." : "Listening \u2014 press Ctrl-C to stop."
+      );
+    }
+    const reason = await untilStopRequested(forced.signal, firstRun);
+    io.err(
+      typeof reason === "string" ? `rig ci serve: ${reason} \u2014 stopping (active runs conclude cancelled)` : `rig ci serve: run ${reason.runId.slice(0, 8)} concluded ${reason.conclusion} (result ${reason.resultEventId.slice(0, 8)}) \u2014 --once, stopping`
+    );
+    await handle.stop();
+    handle = void 0;
+    return 0;
+  } catch (err) {
+    if (handle) await handle.stop().catch(() => void 0);
+    return emitCliError(io, flags.json, "ci serve", err);
+  } finally {
+    if (ctx) {
+      try {
+        await ctx.stop();
+      } catch {
+      }
+    }
+  }
+}
+export {
+  CI_SERVE_USAGE,
+  estimateRunCost,
+  makeAffordabilityCheck,
+  runCiServe
+};
+//# sourceMappingURL=ci-serve-P4HOLAMP.js.map