@toon-protocol/rig 4.6.0 → 4.7.0

package/dist/{chunk-JBFBD7HV.js → chunk-S3KKQ4IC.js}

@@ -177,6 +177,9 @@ function buildStatus(repoOwnerPubkey, repoId, targetEventId, statusKind, targetP
   };
 }
 
+// src/remote-state.ts
+import { decode as decodeToon } from "@toon-format/toon";
+
 // ../../node_modules/.pnpm/@toon-protocol+arweave@0.2.0/node_modules/@toon-protocol/arweave/dist/gateways.js
 var ARWEAVE_GATEWAYS = [
   "https://ar-io.dev",
@@ -266,7 +269,6 @@ async function resolveGitSha(sha, repo) {
 }
 
 // src/remote-state.ts
-import { decode as decodeToon } from "@toon-format/toon";
 import { REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2 } from "@toon-protocol/core/nip34";
 
 // src/nip34-refs.ts
@@ -755,7 +757,9 @@ export {
   buildStatus,
   ARWEAVE_GATEWAYS,
   ARWEAVE_FETCH_TIMEOUT_MS,
+  shaCacheKey,
   isValidArweaveTxId,
+  resolveGitSha,
   parseStateRefTags,
   defaultWebSocketFactory,
   queryRelay,
@@ -769,4 +773,4 @@ export {
   resolveAccountIndex,
   resolveIdentity
 };
-//# sourceMappingURL=chunk-JBFBD7HV.js.map
+//# sourceMappingURL=chunk-S3KKQ4IC.js.map

package/dist/chunk-S3KKQ4IC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/nip34-events.ts","../src/remote-state.ts","../../../node_modules/.pnpm/@toon-protocol+arweave@0.2.0/node_modules/@toon-protocol/arweave/src/gateways.ts","../../../node_modules/.pnpm/@toon-protocol+arweave@0.2.0/node_modules/@toon-protocol/arweave/src/git-sha.ts","../src/nip34-refs.ts","../src/cli/identity.ts"],"sourcesContent":["/**\n * Pure NIP-34 event builders for the Git-to-TOON write path.\n *\n * Promoted from `packages/rig-web/tests/e2e/seed/lib/event-builders.ts` (#223).\n * All builders return UnsignedEvent — the caller signs with their keypair\n * via finalizeEvent() and publishes through a Publisher (#226). Tag\n * structures follow the NIP-34 spec and `@toon-protocol/core/nip34`.\n *\n * The wire contract — every tag each builder writes, the NIP-34 clause it\n * follows, and any legacy shape still read (with its end condition) — is\n * `docs/nip34-wire-shapes.md`. Read that before changing a tag shape here;\n * update it after. Where the two disagree, this file's actual builders are\n * the ground truth and the document is the bug.\n */\n\nimport { getAddress, isAddress } from 'viem';\nimport {\n  ISSUE_KIND,\n  PATCH_KIND,\n  REPOSITORY_ANNOUNCEMENT_KIND,\n} from '@toon-protocol/core/nip34';\nimport type {\n  STATUS_APPLIED_KIND,\n  STATUS_CLOSED_KIND,\n  STATUS_DRAFT_KIND,\n  STATUS_OPEN_KIND,\n} from '@toon-protocol/core/nip34';\n\n// Kinds not (yet) exported by @toon-protocol/core/nip34:\n/** Repository State (refs) — replaceable, pairs with kind:30617 via `d` tag. */\nexport const REPOSITORY_STATE_KIND = 30618;\n/**\n * Comment on an issue or patch — NIP-22 `kind:1111`, which NIP-34's \"Replies\"\n * clause mandates (\"Replies … should follow NIP-22 comment\"). This is the kind\n * rig WRITES (rig#159).\n */\nexport const COMMENT_KIND = 1111;\n/**\n * rig's pre-#159 private comment dialect. READ-ONLY: never written again, kept\n * so threads published before that release keep rendering. Every reader merges\n * it with {@link COMMENT_KIND} by `created_at`.\n */\nexport const LEGACY_COMMENT_KIND = 1622;\n\n// ---------------------------------------------------------------------------\n// UnsignedEvent type (subset of nostr-tools — no id, sig, or pubkey)\n// ---------------------------------------------------------------------------\n\nexport interface UnsignedEvent {\n  kind: number;\n  content: string;\n  tags: string[][];\n  created_at: number;\n}\n\n// ---------------------------------------------------------------------------\n// kind:30617 — Repository Announcement (+ maintainer authority, #287)\n// ---------------------------------------------------------------------------\n\n/**\n * NIP-34 tag naming the repo's declared maintainers: one multi-valued tag\n * `[\"maintainers\", \"<hex-pubkey>\", \"<hex-pubkey>\", …]` on the kind:30617\n * announcement (mirrors the spec's multi-valued `relays` tag). The repo\n * OWNER — the announcement event's own pubkey — is ALWAYS an implicit\n * maintainer and need not be listed. Consumers derive an issue/PR's status\n * ONLY from kind:1630-1633 events signed by owner ∪ maintainers (#287): the\n * relay is permissionless, so this is the CONSUMER-side authority filter.\n */\nexport const MAINTAINERS_TAG = 'maintainers';\n\nconst HEX64 = /^[0-9a-f]{64}$/;\n\n/**\n * First value of the named tag, or `undefined`. Tag names are matched\n * CASE-SENSITIVELY, exactly as NIP-01 defines them: `E` (a NIP-22 root scope)\n * is a different tag from `e` (the parent item).\n */\nexport function firstTagValue(\n  tags: string[][],\n  name: string\n): string | undefined {\n  return tags.find((t) => t[0] === name)?.[1];\n}\n\n/**\n * Collect the declared maintainer pubkeys (lowercased hex) from a kind:30617\n * event's tags. Tolerant of repeated `maintainers` tags and non-hex noise —\n * only 64-char hex values survive. Does NOT include the owner (implicit).\n */\nexport function parseMaintainers(tags: string[][]): string[] {\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const tag of tags) {\n    if (tag[0] !== MAINTAINERS_TAG) continue;\n    for (const value of tag.slice(1)) {\n      const hex = value.toLowerCase();\n      if (HEX64.test(hex) && !seen.has(hex)) {\n        seen.add(hex);\n        out.push(hex);\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * The set of pubkeys whose kind:1630-1633 status events are authoritative for\n * a repo: the owner (always) ∪ the declared maintainers (from the 30617's\n * `maintainers` tag). All values are lowercased hex.\n */\nexport function authorizedStatusAuthors(\n  ownerPubkey: string,\n  repoAnnouncementTags: string[][]\n): Set<string> {\n  return new Set([\n    ownerPubkey.toLowerCase(),\n    ...parseMaintainers(repoAnnouncementTags),\n  ]);\n}\n\n// ---------------------------------------------------------------------------\n// Payout pointer (rig#92, part of the payout epic toon-protocol/toon-meta#391)\n// ---------------------------------------------------------------------------\n\n/**\n * NIP-34 tag naming the repo's declared payout pointer: a single\n * `[\"payout\", \"<chain>\", \"<address>\"]` tag on the kind:30617 announcement.\n * No pointer → no split, the serving node keeps 100% of repo-scoped write\n * fees (toon-meta#391 decision 2). The tag carries the chain label so the\n * shape survives future chains, but v1 accepts exactly one: `evm` — the\n * payout accrual ledger is EVM-only today\n * (`crates/connector-client-edge/src/btp.rs:270-272`).\n */\nexport const PAYOUT_TAG = 'payout';\n\n/** Chains the payout pointer can target. v1: `evm` only (toon-meta#391). */\nexport type PayoutChain = 'evm';\n\nconst SUPPORTED_PAYOUT_CHAINS: ReadonlySet<string> = new Set<PayoutChain>([\n  'evm',\n]);\n\n/** True when `chain` is a chain the payout pointer supports today. */\nfunction isSupportedPayoutChain(chain: string): chain is PayoutChain {\n  return SUPPORTED_PAYOUT_CHAINS.has(chain);\n}\n\n/** A repo's declared payout pointer (parsed from / built into the `payout` tag). */\nexport interface PayoutPointer {\n  chain: PayoutChain;\n  /** EIP-55 checksummed address (never a raw lowercase/mixed-case echo). */\n  address: string;\n}\n\n/**\n * True when `address` is a structurally valid, correctly-checksummed EVM\n * address: `0x` + 40 hex chars, and — when mixed-case — a valid EIP-55\n * checksum (an all-lowercase address is accepted as \"unchecksummed\").\n */\nexport function isValidEvmPayoutAddress(address: string): boolean {\n  return isAddress(address);\n}\n\n/**\n * Collect the repo's declared payout pointer from a kind:30617 event's tags.\n * Only `[\"payout\", \"evm\", <address>]` with a shape- and checksum-valid\n * address is accepted; the address is normalized to its EIP-55 checksummed\n * form. Tolerant of relay noise: an unsupported chain or malformed address\n * is skipped (not thrown). The relay is permissionless and 30617 is\n * replaceable, so a legacy/hand-crafted event could carry more than one\n * `payout` tag — the first valid one wins and the rest are ignored (a\n * `console.warn` notes the drop so a stray extra tag isn't silently\n * mysterious).\n */\nexport function parsePayout(tags: string[][]): PayoutPointer | null {\n  let result: PayoutPointer | null = null;\n  let ignored = 0;\n  for (const tag of tags) {\n    if (tag[0] !== PAYOUT_TAG) continue;\n    const [, chain, address] = tag;\n    if (\n      result === null &&\n      chain !== undefined &&\n      isSupportedPayoutChain(chain) &&\n      address !== undefined &&\n      isValidEvmPayoutAddress(address)\n    ) {\n      result = { chain, address: getAddress(address) };\n    } else {\n      ignored++;\n    }\n  }\n  if (ignored > 0) {\n    console.warn(\n      `rig: ignoring ${ignored} extra/invalid \"${PAYOUT_TAG}\" tag(s) on kind:30617` +\n        (result ? ` — using ${result.chain} ${result.address}` : '')\n    );\n  }\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// kind:30618 — Repository Refs/State\n// ---------------------------------------------------------------------------\n\n/**\n * Maximum number of `arweave` (git SHA → Arweave txId) tags on ONE kind:30618\n * event, enforced on write (here and in `executePush`) and on read\n * (`parseRefsEvent`, rig-web's `parseRepoRefs`). Before this cap the map was\n * merged cumulatively on every push and bounded by nothing, so a large repo\n * eventually produced an event relays reject (#162).\n *\n * WHY 2000 — the arithmetic, in the event's JSON serialization:\n *\n *   one arweave tag  `[\"arweave\",\"<40-hex sha>\",\"<43-char txId>\"]`\n *                    = 1 + 9 + 1 + 42 + 1 + 45 + 1 = 100 bytes, +1 comma = 101\n *   2000 of them     = 202,000 bytes ≈ 197 KiB   ← the map's whole budget\n *\n * Which limit is that 197 KiB measured against? rig's own relay\n * (`relay-ws.devnet.toonprotocol.dev`) advertises no `limitation` in its\n * NIP-11 document — probed 2026-09-17, the HTTPS origin answers `Upgrade\n * Required` rather than a relay-information document — so there is no\n * self-declared number to size against. The smallest limit any relay surveyed\n * for #153 declares is `relay.ngit.dev`'s 5 MiB message cap (probed the same\n * day), and that is the figure used here: the map is capped at under 4% of\n * it. That leaves the rest of the budget to the refs, which are the other\n * term in the same event:\n *\n *   `[\"r\",\"<refname>\",\"<sha>\"]`, and `isSafeRefname` admits refnames up to\n *   1024 bytes → ≤ 1076 bytes each. Every rig reader ingests at most\n *   MAX_REFS_PER_EVENT = 1000 of them, and 1000 at that adversarial width is\n *   ≈ 1.03 MiB, so a readable event tops out near 1.23 MiB — a quarter of the\n *   5 MiB limit. With realistic refnames (≤ 64 bytes) a full-cap event is\n *   ≈ 260 KiB.\n *\n * NOTE the asymmetry: the 1000-ref cap is a READ-side constant. `buildRepoRefs`\n * still writes every ref it is given, so a repo with more than 1000 refs can\n * publish an event past the figures above — that is the ref tags' problem, not\n * the map's, and it is the ref shape work's to fix (#153 §Repository state).\n * This cap's job is to stop the OBJECT MAP being the term that grows without\n * limit, which it was: it grew with the object count, not the ref count.\n *\n * Dropping an entry loses nothing: the object is still on Arweave under its\n * `Git-SHA` / `Repo` tags and resolves through the GraphQL resolver, which is\n * already the documented fallback (`RemoteState.resolveMissing`). The map is\n * a cache, not the index — so push planning must treat \"absent from the map\"\n * as \"ask the resolver\", NEVER as \"needs upload\".\n */\nexport const MAX_ARWEAVE_TAGS_PER_EVENT = 2000;\n\n/**\n * Build a kind:30618 repository refs/state event.\n *\n * Writes each ref in BOTH shapes, with identical SHAs (rig#157, dual-write\n * window): the NIP-34 shape `[<refPath>, <sha>]`, where the ref path IS the\n * tag name — what ngit, gitworkshop.dev and every other conformant client\n * read — alongside rig's legacy `[\"r\", <refPath>, <sha>]`, so rig installs\n * older than this release keep fetching. Both shapes are read by\n * {@link parseStateRefTags} in `./nip34-refs.ts` and by any legacy-only\n * reader that only knows the `r` shape. `HEAD` and `arweave` tags are\n * unaffected by this dual-write. The legacy write is removed in a later,\n * separately ticketed change once older rig versions are unsupported.\n *\n * At most {@link MAX_ARWEAVE_TAGS_PER_EVENT} `arweave` tags are emitted; a\n * larger `arweaveMap` is truncated to its first entries in iteration order,\n * so the caller decides priority (see `executePush`) and a repo under the cap\n * publishes byte-identically to before the cap existed.\n *\n * @param repoId - Repository identifier (d tag, matches kind:30617)\n * @param refs - Map of ref paths to commit SHAs (e.g., { 'refs/heads/main': 'abc123' })\n * @param arweaveMap - Map of git SHAs to Arweave transaction IDs\n */\nexport function buildRepoRefs(\n  repoId: string,\n  refs: Record<string, string>,\n  arweaveMap: Record<string, string> = {}\n): UnsignedEvent {\n  const tags: string[][] = [['d', repoId]];\n\n  // Add ref tags, dual-written in both shapes (rig#157).\n  for (const [refPath, commitSha] of Object.entries(refs)) {\n    tags.push([refPath, commitSha]); // NIP-34 shape: ref path is the tag name\n    tags.push(['r', refPath, commitSha]); // legacy shape, dual-write window\n  }\n\n  // Default HEAD to first ref (typically refs/heads/main)\n  const firstRef = Object.keys(refs)[0];\n  if (firstRef) {\n    tags.push(['HEAD', `ref: ${firstRef}`]);\n  }\n\n  // Add arweave SHA-to-txId mapping tags, bounded (#162).\n  const mapped = Object.entries(arweaveMap).slice(\n    0,\n    MAX_ARWEAVE_TAGS_PER_EVENT\n  );\n  for (const [sha, txId] of mapped) {\n    tags.push(['arweave', sha, txId]);\n  }\n\n  return {\n    kind: REPOSITORY_STATE_KIND,\n    content: '',\n    tags,\n    created_at: Math.floor(Date.now() / 1000),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// kind:1621 — Issue\n// ---------------------------------------------------------------------------\n\n/**\n * Build a kind:1621 issue event.\n *\n * @param repoOwnerPubkey - Pubkey of the repository owner\n * @param repoId - Repository identifier\n * @param title - Issue title (subject tag)\n * @param body - Issue body (Markdown content)\n * @param labels - Optional labels (t tags)\n */\nexport function buildIssue(\n  repoOwnerPubkey: string,\n  repoId: string,\n  title: string,\n  body: string,\n  labels: string[] = []\n): UnsignedEvent {\n  const tags: string[][] = [\n    ['a', `${REPOSITORY_ANNOUNCEMENT_KIND}:${repoOwnerPubkey}:${repoId}`],\n    ['p', repoOwnerPubkey],\n    ['subject', title],\n    ...labels.map((label) => ['t', label]),\n  ];\n\n  return {\n    kind: ISSUE_KIND,\n    content: body,\n    tags,\n    created_at: Math.floor(Date.now() / 1000),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// kind:1111 — NIP-22 comment (on an issue or patch)\n// ---------------------------------------------------------------------------\n\n/**\n * The event a comment thread hangs off: the kind:1621 issue or kind:1617\n * patch being discussed — NEVER the repository. Becomes the comment's\n * uppercase NIP-22 root scope (`E`/`K`/`P`).\n */\nexport interface CommentRoot {\n  /** Event id of the issue/patch (uppercase `E`). */\n  eventId: string;\n  /** Kind of that event, e.g. 1621 or 1617 (uppercase `K`). */\n  kind: number;\n  /** Pubkey of that event's author (uppercase `P`). */\n  authorPubkey: string;\n}\n\n/**\n * The kind:1111 comment being replied to, when the new comment is a nested\n * reply rather than a top-level comment. Becomes the lowercase parent\n * (`e`/`k`/`p`), with `k` always {@link COMMENT_KIND}.\n */\nexport interface CommentParent {\n  /** Event id of the comment replied to (lowercase `e`). */\n  eventId: string;\n  /** Pubkey of that comment's author (lowercase `p`). */\n  authorPubkey: string;\n}\n\n/**\n * Build a NIP-22 kind:1111 comment on a NIP-34 issue or patch (rig#159).\n *\n * NIP-22: \"Comments MUST point to the root scope using uppercase tag names\n * (e.g. `K`, `E`, `A` or `I`)\" and \"MUST point to the parent item with\n * lowercase ones (e.g. `k`, `e`, `a` or `i`)\", with \"`P` for the root scope\n * and `p` for the author of the parent item\". So:\n *\n * - top-level comment → parent === root: `e`/`k`/`p` repeat `E`/`K`/`P`;\n * - reply → `e` is the parent comment, `k` is `1111`, `p` its author, while\n *   `E`/`K`/`P` still name the issue/patch at the top of the thread.\n *\n * The repo coordinate rides along as an ordinary lowercase `a` tag so a\n * subscription can scope a whole repo's comments with one `#a` filter (spec\n * rig#153). It is deliberately NOT the NIP-22 parent pointer — the parent is\n * the `e` tag — so it is emitted last, after the six threading tags.\n *\n * @param repoOwnerPubkey - Pubkey of the repository owner\n * @param repoId - Repository identifier (NIP-34 `d` tag)\n * @param root - The issue/patch the thread hangs off\n * @param body - Comment body (Markdown content)\n * @param parent - The kind:1111 comment being replied to; omit for a\n *   top-level comment, whose parent is the root itself\n */\nexport function buildComment(\n  repoOwnerPubkey: string,\n  repoId: string,\n  root: CommentRoot,\n  body: string,\n  parent?: CommentParent\n): UnsignedEvent {\n  const parentTags: string[][] =\n    parent === undefined\n      ? [\n          ['e', root.eventId, '', root.authorPubkey],\n          ['k', String(root.kind)],\n          ['p', root.authorPubkey],\n        ]\n      : [\n          ['e', parent.eventId, '', parent.authorPubkey],\n          ['k', String(COMMENT_KIND)],\n          ['p', parent.authorPubkey],\n        ];\n\n  return {\n    kind: COMMENT_KIND,\n    content: body,\n    tags: [\n      ['E', root.eventId, '', root.authorPubkey],\n      ['K', String(root.kind)],\n      ['P', root.authorPubkey],\n      ...parentTags,\n      ['a', `${REPOSITORY_ANNOUNCEMENT_KIND}:${repoOwnerPubkey}:${repoId}`],\n    ],\n    created_at: Math.floor(Date.now() / 1000),\n  };\n}\n\n/**\n * Does `event` belong to the comment thread rooted at `rootEventId`?\n *\n * kind:1111 membership is decided by the **uppercase** `E` tag, matched\n * case-sensitively — the same rule rig already applies to kind:1619 PR\n * updates. A kind:1111 whose only match is a lowercase `e` is a reply to\n * something else and is NOT part of this thread. Legacy kind:1622 has no\n * uppercase form: its `e` tag is the thread root.\n */\nexport function commentBelongsToThread(\n  event: { kind: number; tags: string[][] },\n  rootEventId: string\n): boolean {\n  if (event.kind === COMMENT_KIND) {\n    return event.tags.some((t) => t[0] === 'E' && t[1] === rootEventId);\n  }\n  if (event.kind === LEGACY_COMMENT_KIND) {\n    return event.tags.some((t) => t[0] === 'e' && t[1] === rootEventId);\n  }\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// kind:1617 — Patch / PR\n// ---------------------------------------------------------------------------\n\n/**\n * Build a kind:1617 patch event.\n *\n * The PR body/description travels in a dedicated `description` tag, NEVER in\n * `content` (#280): `content` is real `git format-patch` output that readers\n * pipe straight into `git am`, and git's patch-format detection hard-fails on\n * any leading prose (verified: \"Patch format detection failed.\"). The tag\n * route keeps `git am` consumption intact while `rig pr show` and the\n * rig-web/views `parsePR` renderers surface the description.\n *\n * @param repoOwnerPubkey - Pubkey of the repository owner\n * @param repoId - Repository identifier\n * @param title - Patch/PR title (subject tag)\n * @param commits - Array of { sha, parentSha } for commit and parent-commit tags\n * @param branchTag - Branch name, written as the `branch-name` tag (#161) —\n *                    the wider NIP-34 ecosystem's spelling (used verbatim by\n *                    kind:1618 pull requests; confirmed against the NIP-34\n *                    source at implementation time). Never written to `t`:\n *                    that tag is reserved for real labels.\n * @param content - Real `git format-patch` text (NIP-34 patch body); defaults\n *                  to '' for callers that only reference commits by tag\n * @param description - PR body/cover text (`description` tag) — kept out of\n *                      `content` so `git am` still applies it\n */\nexport function buildPatch(\n  repoOwnerPubkey: string,\n  repoId: string,\n  title: string,\n  commits: { sha: string; parentSha: string }[],\n  branchTag?: string,\n  content = '',\n  description?: string\n): UnsignedEvent {\n  const tags: string[][] = [\n    ['a', `${REPOSITORY_ANNOUNCEMENT_KIND}:${repoOwnerPubkey}:${repoId}`],\n    ['p', repoOwnerPubkey],\n    ['subject', title],\n  ];\n\n  if (description !== undefined && description !== '') {\n    tags.push(['description', description]);\n  }\n\n  for (const commit of commits) {\n    tags.push(['commit', commit.sha]);\n    tags.push(['parent-commit', commit.parentSha]);\n  }\n\n  if (branchTag) {\n    tags.push(['branch-name', branchTag]);\n  }\n\n  return {\n    kind: PATCH_KIND,\n    content,\n    tags,\n    created_at: Math.floor(Date.now() / 1000),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// kind:1630-1633 — Status\n// ---------------------------------------------------------------------------\n\n/** Status kinds: 1630 open, 1631 applied/merged, 1632 closed, 1633 draft. */\nexport type StatusKind =\n  | typeof STATUS_OPEN_KIND\n  | typeof STATUS_APPLIED_KIND\n  | typeof STATUS_CLOSED_KIND\n  | typeof STATUS_DRAFT_KIND;\n\n/**\n * Build a status event (kind 1630-1633).\n *\n * rig#153/#160: the `e` tag carries the NIP-10 `root` marker\n * (`[\"e\", <target>, \"\", \"root\"]`) rather than the old bare `[\"e\", <id>]`, so\n * clients that resolve a status's root via the marker (ngit's\n * `get_event_root`, among others) honor rig statuses. The repo `a` tag rides\n * along so a status stream can be scoped to the repository without first\n * resolving the target. Readers (this package's tracker and rig-web's\n * parsers) accept BOTH this marker form and the legacy bare form — a status\n * is matched by `tags.find(t => t[0] === 'e')?.[1] === targetEventId`\n * regardless of any trailing marker elements.\n *\n * @param repoOwnerPubkey - Pubkey of the repository owner\n * @param repoId - Repository identifier\n * @param targetEventId - Event ID of the patch, PR, or issue being updated\n * @param statusKind - One of 1630 (open), 1631 (applied), 1632 (closed), 1633 (draft)\n * @param targetPubkey - Optional pubkey of the target event author (p tag per NIP-34 StatusEvent), when known\n */\nexport function buildStatus(\n  repoOwnerPubkey: string,\n  repoId: string,\n  targetEventId: string,\n  statusKind: StatusKind,\n  targetPubkey?: string\n): UnsignedEvent {\n  const tags: string[][] = [\n    ['e', targetEventId, '', 'root'],\n    ['a', `${REPOSITORY_ANNOUNCEMENT_KIND}:${repoOwnerPubkey}:${repoId}`],\n  ];\n  if (targetPubkey) {\n    tags.push(['p', targetPubkey]);\n  }\n  return {\n    kind: statusKind,\n    content: '',\n    tags,\n    created_at: Math.floor(Date.now() / 1000),\n  };\n}\n","/**\n * Remote repository state reader — the \"what does the remote have?\" half of\n * `rig push` (epic #222, ticket #225).\n *\n * Queries relay(s) over NIP-01 WebSocket for the repository's NIP-34 state:\n *   - kind:30618 (repository state): ref tags → ref map (both the NIP-34\n *     shape and rig's legacy `r` shape — see `./nip34-refs.ts`), `HEAD`\n *     symref, `arweave` tags → git SHA → Arweave txId hints.\n *   - kind:30617 (repository announcement): presence = the repo exists on\n *     TOON (first-push detection) + name/description/relays metadata.\n *\n * Both kinds are NIP-33 parameterized-replaceable: per relay only the latest\n * event per (kind, author, d) survives, but we still pick the newest across\n * relays (highest created_at, ties broken by lowest id per NIP-01).\n *\n * SHAs missing from the `arweave` tag map can be resolved via the shared\n * Arweave GraphQL Git-SHA resolver (@toon-protocol/arweave — the same module\n * the rig SPA uses) through {@link RemoteState.resolveMissing}.\n *\n * Relay payload encodings (mirrors rig's `web/relay-client.ts` decode logic):\n * EVENT payloads arrive as an inline JSON object (standard NIP-01), as a\n * double-JSON-encoded string (devnet relay quirk: a JSON string containing\n * the event JSON), or as a TOON-encoded string. All three are tolerated.\n */\n\nimport { decode as decodeToon } from '@toon-format/toon';\nimport {\n  resolveGitSha,\n  seedShaCache,\n  shaCacheKey,\n} from '@toon-protocol/arweave';\nimport { REPOSITORY_ANNOUNCEMENT_KIND } from '@toon-protocol/core/nip34';\n\nimport {\n  MAX_ARWEAVE_TAGS_PER_EVENT,\n  REPOSITORY_STATE_KIND,\n  parseMaintainers,\n  parsePayout,\n  type PayoutPointer,\n} from './nip34-events.js';\nimport { parseStateRefTags, type ParsedStateRefs } from './nip34-refs.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** A signed Nostr event as seen on a relay (read side). */\nexport interface NostrEvent {\n  id: string;\n  pubkey: string;\n  created_at: number;\n  kind: number;\n  tags: string[][];\n  content: string;\n  sig: string;\n}\n\n/** NIP-01 subscription filter (only the fields rig's readers send). */\nexport interface NostrFilter {\n  ids?: string[];\n  kinds?: number[];\n  authors?: string[];\n  '#d'?: string[];\n  /** Repo address tag filter, e.g. `30617:<owner>:<repoId>` (#278 tracker). */\n  '#a'?: string[];\n  /** Event-reference tag filter (#278 tracker: statuses + comments). */\n  '#e'?: string[];\n  /**\n   * NIP-22 UPPERCASE root-scope reference — distinct from `#e` and matched\n   * case-sensitively (#159: kind:1111 comments hang off their thread root's\n   * `E` tag, while `e` names the immediate parent).\n   */\n  '#E'?: string[];\n  /** Commit tag filter (#125 CI: results/progress/jobs for one commit). */\n  '#c'?: string[];\n  /** Addressee tag filter (#125 CI: a coordinator's inbox — 9843/9844/9840/29846). */\n  '#p'?: string[];\n  /** Only events at or after this unix time (#125 coordinator cursor resume). */\n  since?: number;\n  limit?: number;\n}\n\n/**\n * Minimal structural WebSocket type — satisfied by the WHATWG WebSocket\n * global (Node >= 22 / undici, browsers) and by the `ws` package.\n */\nexport interface WebSocketLike {\n  readyState: number;\n  send(data: string): void;\n  close(): void;\n  addEventListener(type: string, listener: (event: never) => void): void;\n}\n\n/** Factory for WebSocket connections (injectable for tests / `ws` fallback). */\nexport type WebSocketFactory = (url: string) => WebSocketLike;\n\nexport interface FetchRemoteStateOptions {\n  /**\n   * Relay WebSocket URLs to query. Plural from day one (forward-compat with\n   * multi-relay routing); size 1 is typical today. Results are merged and the\n   * newest replaceable event across all relays wins.\n   */\n  relayUrls: string[];\n  /** Repository owner's pubkey (hex) — the author of 30617/30618. */\n  ownerPubkey: string;\n  /** Repository identifier (NIP-34 `d` tag). */\n  repoId: string;\n  /** Per-relay timeout in milliseconds (default 10000). On timeout the relay contributes whatever it sent so far. */\n  timeoutMs?: number;\n  /**\n   * Git-SHA → Arweave txId resolver used by {@link RemoteState.resolveMissing}.\n   * Defaults to the shared GraphQL resolver from @toon-protocol/arweave,\n   * which asks `arweave.net` — so every command that takes a gateway passes\n   * one bound to it instead (`../git-sha-resolver.ts`, #183). Injectable for\n   * tests.\n   */\n  resolveSha?: (sha: string, repo: string) => Promise<string | null>;\n  /** WebSocket constructor override (defaults to the global WebSocket). */\n  webSocketFactory?: WebSocketFactory;\n}\n\n/** Remote repository state assembled from relay events. */\nexport interface RemoteState {\n  /** True when a kind:30617 announcement exists (false ⇒ first push). */\n  announced: boolean;\n  /** Ref map from the latest kind:30618: refname → commit SHA. */\n  refs: Map<string, string>;\n  /** HEAD symref target (e.g. `refs/heads/main`), or null if unset. */\n  headSymref: string | null;\n  /**\n   * Git SHA → Arweave txId hints from the latest kind:30618 `arweave` tags,\n   * capped at `MAX_ARWEAVE_TAGS_PER_EVENT` (#162). A HINT MAP, not an index:\n   * a SHA missing from it is resolved via {@link RemoteState.resolveMissing},\n   * never assumed absent from Arweave.\n   */\n  shaToTxId: Map<string, string>;\n  /** The latest kind:30618 event, or null if the repo has no state yet. */\n  refsEvent: NostrEvent | null;\n  /** The latest kind:30617 event, or null if the repo is unannounced. */\n  announceEvent: NostrEvent | null;\n  /** Repository name from the announcement `name` tag. */\n  name: string | null;\n  /** Announcement `description` tag (falls back to event content). */\n  description: string | null;\n  /** Relay URLs advertised in the announcement `relays` tag(s). */\n  relays: string[];\n  /**\n   * Declared maintainer pubkeys (hex) from the announcement `maintainers`\n   * tag (#287). Does NOT include the owner (an implicit maintainer). Empty\n   * when unannounced or owner-only.\n   */\n  maintainers: string[];\n  /**\n   * Declared payout pointer (rig#92) from the announcement `payout` tag, or\n   * `null` when unannounced or no pointer is declared — no pointer means the\n   * serving node keeps 100% of repo-scoped write fees (toon-meta#391).\n   */\n  payout: PayoutPointer | null;\n  /**\n   * Resolve SHAs to Arweave txIds: served from the `arweave` tag map when\n   * present, otherwise via the GraphQL Git-SHA resolver. SHAs that resolve\n   * nowhere are omitted from the returned map.\n   */\n  resolveMissing(shas: string[]): Promise<Map<string, string>>;\n}\n\n// ---------------------------------------------------------------------------\n// Relay query (NIP-01 REQ → EVENT* → EOSE)\n// ---------------------------------------------------------------------------\n\n/** Validate that a relay URL uses a WebSocket scheme (mirrors rig's url-utils). */\nfunction isValidRelayUrl(url: string): boolean {\n  return /^wss?:\\/\\//i.test(url);\n}\n\n/** WHATWG WebSocket OPEN ready state. */\nconst WS_OPEN = 1;\n\n/**\n * The production {@link WebSocketFactory}: the global WHATWG WebSocket (Node\n * >= 22). Shared by every relay reader so the \"no global WebSocket\" failure\n * reads the same everywhere.\n */\nexport function defaultWebSocketFactory(url: string): WebSocketLike {\n  const ctor = (\n    globalThis as { WebSocket?: new (url: string) => WebSocketLike }\n  ).WebSocket;\n  if (!ctor) {\n    throw new Error(\n      'No global WebSocket constructor (Node >= 22 required) — pass webSocketFactory'\n    );\n  }\n  return new ctor(url);\n}\n\n/**\n * Decode a relay EVENT payload, tolerating every encoding seen in the wild:\n * inline object (standard NIP-01), double-JSON-encoded string (devnet relay\n * serves the event as a JSON string containing the event JSON), or a\n * TOON-encoded string (rig's `decodeToonMessage` path).\n */\nfunction decodeEventPayload(payload: unknown): NostrEvent | null {\n  if (payload !== null && typeof payload === 'object') {\n    return payload as NostrEvent;\n  }\n  if (typeof payload !== 'string') {\n    return null;\n  }\n  try {\n    const parsed: unknown = JSON.parse(payload);\n    if (parsed !== null && typeof parsed === 'object') {\n      return parsed as NostrEvent;\n    }\n  } catch {\n    // Not JSON — fall through to TOON\n  }\n  try {\n    return decodeToon(payload) as unknown as NostrEvent;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Query one relay: send a REQ, collect EVENTs until EOSE, then CLOSE.\n * Mirrors rig's `queryRelay` (partial results on timeout / early close).\n * Exported for reuse by the network-bootstrap discovery (kind:10032).\n */\nexport function queryRelay(\n  relayUrl: string,\n  filter: NostrFilter,\n  timeoutMs: number,\n  webSocketFactory: WebSocketFactory\n): Promise<NostrEvent[]> {\n  return new Promise((resolve, reject) => {\n    const events: NostrEvent[] = [];\n    const subId = `git-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n    let ws: WebSocketLike;\n    // eslint-disable-next-line prefer-const -- assigned after `settle` is defined\n    let timeoutHandle: ReturnType<typeof setTimeout>;\n    let settled = false;\n\n    const settle = (outcome: 'resolve' | 'reject', error?: Error) => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timeoutHandle);\n      try {\n        if (ws.readyState === WS_OPEN) {\n          ws.send(JSON.stringify(['CLOSE', subId]));\n        }\n        ws.close();\n      } catch {\n        // Ignore close errors\n      }\n      if (outcome === 'reject') {\n        reject(error);\n      } else {\n        resolve(events);\n      }\n    };\n\n    if (!isValidRelayUrl(relayUrl)) {\n      reject(\n        new Error(\n          `Invalid relay URL protocol (must be ws:// or wss://): ${relayUrl}`\n        )\n      );\n      return;\n    }\n\n    try {\n      ws = webSocketFactory(relayUrl);\n    } catch (err) {\n      reject(\n        new Error(`Failed to connect to relay ${relayUrl}: ${String(err)}`)\n      );\n      return;\n    }\n\n    timeoutHandle = setTimeout(() => {\n      // Resolve with whatever we collected so far (partial results)\n      settle('resolve');\n    }, timeoutMs);\n\n    ws.addEventListener('open', () => {\n      ws.send(JSON.stringify(['REQ', subId, filter]));\n    });\n\n    ws.addEventListener('message', (msgEvent: { data?: unknown }) => {\n      try {\n        const msg = JSON.parse(String(msgEvent.data)) as unknown[];\n        if (!Array.isArray(msg) || msg.length < 2) return;\n\n        const msgType = msg[0];\n        if (msgType === 'EVENT' && msg[1] === subId && msg[2] !== undefined) {\n          const event = decodeEventPayload(msg[2]);\n          if (event) events.push(event);\n        } else if (msgType === 'EOSE' && msg[1] === subId) {\n          settle('resolve');\n        }\n      } catch {\n        // Ignore parse errors for individual messages\n      }\n    });\n\n    ws.addEventListener('error', (event: { message?: unknown }) => {\n      const detail =\n        typeof event === 'object' && event !== null && 'message' in event\n          ? String(event.message)\n          : 'unknown';\n      settle(\n        'reject',\n        new Error(`WebSocket error connecting to ${relayUrl}: ${detail}`)\n      );\n    });\n\n    ws.addEventListener('close', () => {\n      // If we haven't settled yet, resolve with what we have\n      settle('resolve');\n    });\n  });\n}\n\n// ---------------------------------------------------------------------------\n// NIP-33 replaceable selection + tag parsing\n// ---------------------------------------------------------------------------\n\n/**\n * Pick the winning replaceable event: highest created_at, ties broken by\n * lowest id (NIP-01 replaceable-event convention).\n */\nfunction latestReplaceable(events: NostrEvent[]): NostrEvent | null {\n  let winner: NostrEvent | null = null;\n  for (const event of events) {\n    if (\n      winner === null ||\n      event.created_at > winner.created_at ||\n      (event.created_at === winner.created_at && event.id < winner.id)\n    ) {\n      winner = event;\n    }\n  }\n  return winner;\n}\n\n/** Get the first value for a tag name. */\nfunction getTagValue(tags: string[][], name: string): string | undefined {\n  const tag = tags.find((t) => t[0] === name);\n  return tag?.[1];\n}\n\ninterface ParsedRefs extends ParsedStateRefs {\n  shaToTxId: Map<string, string>;\n}\n\n/**\n * Parse a kind:30618 event's ref / `HEAD` / `arweave` tags.\n *\n * Ref and `HEAD` tags go through the shared dual-shape parser\n * (`./nip34-refs.ts`), so a state event written by ngit (or any other\n * conformant NIP-34 client) reads exactly like one written by rig — see that\n * module for the conflict, peeled-tag and cap rules (rig#156).\n *\n * Both tag lists are capped — refs at {@link MAX_REFS_PER_EVENT} inside that\n * parser, the object map at {@link MAX_ARWEAVE_TAGS_PER_EVENT} here — so a\n * hostile relay cannot exhaust memory with one giant state event (#162).\n * Truncating the map is safe: a SHA it does not cover is resolved through the\n * GraphQL `Git-SHA` resolver by {@link RemoteState.resolveMissing}.\n */\nfunction parseRefsEvent(event: NostrEvent): ParsedRefs {\n  const { refs, headSymref } = parseStateRefTags(event.tags);\n  const shaToTxId = new Map<string, string>();\n\n  for (const tag of event.tags) {\n    if (tag[0] === 'arweave' && tag[1] && tag[2]) {\n      // Hostile-relay guard (#162): a relay may serve a state event with any\n      // number of `arweave` tags. Ingest no more than rig itself writes.\n      if (shaToTxId.size >= MAX_ARWEAVE_TAGS_PER_EVENT) continue;\n      shaToTxId.set(tag[1], tag[2]);\n    }\n  }\n\n  return { refs, headSymref, shaToTxId };\n}\n\n// ---------------------------------------------------------------------------\n// fetchRemoteState\n// ---------------------------------------------------------------------------\n\n/**\n * Fetch the remote repository state from the relay(s).\n *\n * Sends one REQ per relay for kind:30617 + kind:30618 with\n * `authors=[ownerPubkey]`, `#d=[repoId]`, collects until EOSE (or timeout),\n * and reduces to the latest replaceable event per kind.\n *\n * Resolves as long as at least one relay answers; throws only when every\n * relay fails. Events from other authors / repos are ignored (defense\n * against misbehaving relays that over-return).\n */\nexport async function fetchRemoteState(\n  options: FetchRemoteStateOptions\n): Promise<RemoteState> {\n  const {\n    relayUrls,\n    ownerPubkey,\n    repoId,\n    timeoutMs = 10000,\n    resolveSha = resolveGitSha,\n    webSocketFactory = defaultWebSocketFactory,\n  } = options;\n\n  if (relayUrls.length === 0) {\n    throw new Error('fetchRemoteState: relayUrls must not be empty');\n  }\n  if (!ownerPubkey) {\n    throw new Error('fetchRemoteState: ownerPubkey is required');\n  }\n  if (!repoId) {\n    throw new Error('fetchRemoteState: repoId is required');\n  }\n\n  const filter: NostrFilter = {\n    kinds: [REPOSITORY_ANNOUNCEMENT_KIND, REPOSITORY_STATE_KIND],\n    authors: [ownerPubkey],\n    '#d': [repoId],\n  };\n\n  const results = await Promise.allSettled(\n    relayUrls.map((url) => queryRelay(url, filter, timeoutMs, webSocketFactory))\n  );\n\n  const failures: string[] = [];\n  const byId = new Map<string, NostrEvent>();\n  for (const result of results) {\n    if (result.status === 'rejected') {\n      failures.push(String((result.reason as Error)?.message ?? result.reason));\n      continue;\n    }\n    for (const event of result.value) {\n      // Only trust events from the repo owner for this repo — relays are\n      // untrusted and may over-return.\n      if (event.pubkey !== ownerPubkey) continue;\n      if (getTagValue(event.tags, 'd') !== repoId) continue;\n      if (typeof event.id === 'string' && !byId.has(event.id)) {\n        byId.set(event.id, event);\n      }\n    }\n  }\n\n  if (failures.length === relayUrls.length) {\n    throw new Error(\n      `fetchRemoteState: all ${relayUrls.length} relay(s) failed: ${failures.join('; ')}`\n    );\n  }\n\n  const events = [...byId.values()];\n  const refsEvent = latestReplaceable(\n    events.filter((e) => e.kind === REPOSITORY_STATE_KIND)\n  );\n  const announceEvent = latestReplaceable(\n    events.filter((e) => e.kind === REPOSITORY_ANNOUNCEMENT_KIND)\n  );\n\n  const { refs, headSymref, shaToTxId } = refsEvent\n    ? parseRefsEvent(refsEvent)\n    : {\n        refs: new Map<string, string>(),\n        headSymref: null,\n        shaToTxId: new Map<string, string>(),\n      };\n\n  // Seed the shared resolver cache so later resolveGitSha calls (here or in\n  // any other consumer of @toon-protocol/arweave) skip GraphQL for known SHAs.\n  if (shaToTxId.size > 0) {\n    seedShaCache(\n      [...shaToTxId].map(\n        ([sha, txId]) => [shaCacheKey(sha, repoId), txId] as [string, string]\n      )\n    );\n  }\n\n  // Announcement metadata (mirrors views' parseRepoAnnouncement defaults).\n  const name = announceEvent\n    ? (getTagValue(announceEvent.tags, 'name') ?? null)\n    : null;\n  const description = announceEvent\n    ? (getTagValue(announceEvent.tags, 'description') ?? announceEvent.content)\n    : null;\n  // NIP-34 announcement relays tag is multi-valued: [\"relays\", url1, url2, …]\n  const relays: string[] = [];\n  if (announceEvent) {\n    for (const tag of announceEvent.tags) {\n      if (tag[0] === 'relays') {\n        relays.push(...tag.slice(1).filter((url) => url.length > 0));\n      }\n    }\n  }\n  // Declared maintainers (#287): the `maintainers` tag on the 30617. Owner is\n  // an implicit maintainer and is NOT listed here.\n  const maintainers = announceEvent ? parseMaintainers(announceEvent.tags) : [];\n  // Declared payout pointer (rig#92): the `payout` tag on the 30617.\n  const payout = announceEvent ? parsePayout(announceEvent.tags) : null;\n\n  const resolveMissing = async (\n    shas: string[]\n  ): Promise<Map<string, string>> => {\n    const resolved = new Map<string, string>();\n    const missing: string[] = [];\n    for (const sha of new Set(shas)) {\n      const known = shaToTxId.get(sha);\n      if (known !== undefined) {\n        resolved.set(sha, known);\n      } else {\n        missing.push(sha);\n      }\n    }\n    const lookups = await Promise.all(\n      missing.map(async (sha) => [sha, await resolveSha(sha, repoId)] as const)\n    );\n    for (const [sha, txId] of lookups) {\n      if (txId) resolved.set(sha, txId);\n    }\n    return resolved;\n  };\n\n  return {\n    announced: announceEvent !== null,\n    refs,\n    headSymref,\n    shaToTxId,\n    refsEvent,\n    announceEvent,\n    name,\n    description,\n    relays,\n    maintainers,\n    payout,\n    resolveMissing,\n  };\n}\n",null,null,"/**\n * Repository-state ref parsing for kind:30618 (spec rig#153, ticket rig#156).\n *\n * ONE parser shared by every rig-side reader of a repository state event —\n * the CLI's remote-state reader (`./remote-state.ts`, behind `rig clone` and\n * `rig fetch`) and the CI Coordinator's push watcher\n * (`./ci/coordinator.ts`), whose commit materialization reads the refs it\n * produces. `@toon-protocol/rig-web` cannot import this module (it is only a\n * DEVELOPMENT dependency of that package, resolved through a `dist/` that\n * does not exist when the repo's typecheck gate runs), so it keeps a\n * documented COPY of this logic in `nip34-parsers.ts` — the same\n * \"copy rather than depend, and say so\" pattern as `gateway-preference.ts`\n * and the ngit wire fixtures. Both are tested against the same captured ngit\n * events (`./nip34-fixtures/`).\n *\n * TWO ref tag shapes are accepted:\n *\n *  - **NIP-34 shape** — `[\"refs/heads/main\", \"<sha>\"]`. The ref path IS the\n *    tag name. This is what NIP-34 specifies and what ngit, gitworkshop.dev\n *    and the rest of the ecosystem write.\n *  - **Legacy rig shape** — `[\"r\", \"refs/heads/main\", \"<sha>\"]`. rig's own\n *    spelling, still written during the dual-write window (rig#157) and read\n *    forever after, so every repo pushed before rig#153 stays clonable.\n *\n * The rules, all from rig#153's Implementation Decisions:\n *\n *  - A tag is a NIP-shape ref when its name starts with `refs/heads/` or\n *    `refs/tags/`. Nothing else in the NIP shape is read as a ref, so a\n *    hostile relay cannot smuggle a bare `[\"--upload-pack=…\", …]` in as one.\n *  - A NIP-shape name ending in `^{}` is a PEELED annotated tag (ngit emits\n *    these for `git fetch --prune`). It is not a ref and is not listed.\n *  - When both shapes name the same ref with DIFFERENT shas, **the NIP shape\n *    wins**, whichever came first in tag order — so two rig versions reading\n *    the same event can never silently disagree.\n *  - {@link MAX_REFS_PER_EVENT} caps DISTINCT refs across both shapes\n *    combined, so a dual-written event cannot double the limit. The NIP shape\n *    also gets FIRST CLAIM on those slots: each shape is collected on its own\n *    and the two are merged NIP-first, so which refs survive a >1000-ref\n *    event never depends on the order a writer (or a hostile relay) happened\n *    to interleave the two shapes in.\n *\n * What this parser deliberately does NOT do is validate. Refname safety\n * (`isSafeRefname`, ./materialize.ts) and full-SHA checks live at the\n * git-invoking boundary, where they apply to every ref regardless of which\n * tag shape carried it — so the NIP shape is not a hostile-relay bypass, and\n * stays byte-for-byte as strict as the `r` shape it joins.\n *\n * See `docs/nip34-wire-shapes.md` for the full kind:30618 wire contract,\n * including the dual-write end condition and the object-map (`arweave` tag)\n * cap. Where the two disagree, this file's actual code is the ground\n * truth.\n */\n\n/**\n * Maximum number of DISTINCT refs parsed from a single kind:30618 event,\n * counted across both tag shapes combined.\n */\nexport const MAX_REFS_PER_EVENT = 1000;\n\n/** Symref prefix used in `HEAD` tags: `[\"HEAD\", \"ref: refs/heads/main\"]`. */\nconst SYMREF_PREFIX = 'ref: ';\n\n/** Tag-name prefixes that make a NIP-34-shaped tag a ref. */\nconst NIP_REF_PREFIXES = ['refs/heads/', 'refs/tags/'] as const;\n\n/** Suffix marking a peeled annotated-tag entry: `refs/tags/v1.0.0^{}`. */\nconst PEELED_SUFFIX = '^{}';\n\n/**\n * Is this tag NAME a NIP-34-shaped ref path? True for `refs/heads/…` and\n * `refs/tags/…`, including the peeled `^{}` spellings — {@link\n * parseStateRefTags} drops those separately.\n */\nfunction isNipRefTagName(name: string): boolean {\n  return NIP_REF_PREFIXES.some((prefix) => name.startsWith(prefix));\n}\n\n/**\n * Merge the two shapes' refs into one map: NIP shape first, so it both wins\n * every same-ref disagreement and takes first claim on the cap's slots;\n * legacy refs fill whatever remains.\n */\nfunction mergeShapes(\n  nip: Map<string, string>,\n  legacy: Map<string, string>\n): Map<string, string> {\n  const refs = new Map([...nip].slice(0, MAX_REFS_PER_EVENT));\n  for (const [refname, sha] of legacy) {\n    if (refs.size >= MAX_REFS_PER_EVENT) break;\n    if (nip.has(refname)) continue;\n    refs.set(refname, sha);\n  }\n  return refs;\n}\n\n/** Refs and the HEAD symref read out of one kind:30618 event's tags. */\nexport interface ParsedStateRefs {\n  /** Refname → commit sha, capped at {@link MAX_REFS_PER_EVENT} distinct refs. */\n  refs: Map<string, string>;\n  /** HEAD symref target (e.g. `refs/heads/main`), or null when unset. */\n  headSymref: string | null;\n}\n\n/**\n * Parse the ref and `HEAD` tags of a kind:30618 repository state event,\n * accepting the NIP-34 shape and rig's legacy `r` shape together. See the\n * module header for the conflict, peeled-tag and cap rules.\n *\n * `arweave` tags are NOT read here — they are an object-location map, not\n * ref state, and each caller handles them itself.\n */\nexport function parseStateRefTags(tags: string[][]): ParsedStateRefs {\n  // Each shape is staged on its own, then merged NIP-first (see mergeShapes).\n  // Both staging maps are themselves bounded, so a relay that serves a\n  // million ref tags costs bounded memory, not a million entries.\n  const nip = new Map<string, string>();\n  const legacy = new Map<string, string>();\n  let headSymref: string | null = null;\n\n  for (const tag of tags) {\n    const [name, v1, v2] = tag;\n    if (name === undefined) continue;\n\n    if (name === 'r' && v1 && v2) {\n      if (v1 === 'HEAD' && v2.startsWith(SYMREF_PREFIX)) {\n        // Alternate symref spelling: [\"r\", \"HEAD\", \"ref: refs/heads/main\"]\n        headSymref = v2.slice(SYMREF_PREFIX.length);\n        continue;\n      }\n      if (legacy.size < MAX_REFS_PER_EVENT || legacy.has(v1)) {\n        legacy.set(v1, v2);\n      }\n      continue;\n    }\n\n    if (name === 'HEAD' && v1?.startsWith(SYMREF_PREFIX)) {\n      // NIP-34 symref tag: [\"HEAD\", \"ref: refs/heads/main\"]\n      headSymref = v1.slice(SYMREF_PREFIX.length);\n      continue;\n    }\n\n    if (v1 && isNipRefTagName(name) && !name.endsWith(PEELED_SUFFIX)) {\n      // NIP-34 ref tag: [\"refs/heads/main\", \"<sha>\"]\n      if (nip.size < MAX_REFS_PER_EVENT || nip.has(name)) nip.set(name, v1);\n    }\n  }\n\n  return { refs: mergeShapes(nip, legacy), headSymref };\n}\n","/**\n * Identity resolution for the standalone-only `rig` CLI (#248).\n *\n * One precedence chain, used by every command that signs or pays:\n *\n *   1. `RIG_MNEMONIC` environment variable\n *   2. `TOON_CLIENT_MNEMONIC` environment variable — DEPRECATED alias of the\n *      env tier (a one-line stderr warning fires when it is the source)\n *   3. project-local `.env` — walked up from the working directory (through\n *      the repo root to the filesystem root); ONLY the `RIG_MNEMONIC` line is\n *      parsed out of it (never loaded into the process env, never required\n *      to exist)\n *   4. the shared `~/.toon-client` state dir (`TOON_CLIENT_HOME` override):\n *      encrypted keystore (`keystorePath` + `TOON_CLIENT_KEYSTORE_PASSWORD`,\n *      auto-password fallback for daemon-provisioned keystores), then the\n *      plain `mnemonic` config field — the pre-#248 standalone-context logic\n *\n * The BIP-44 account index follows the same env-over-config precedence:\n *\n *   1. `RIG_ACCOUNT_INDEX` environment variable (applies to every source)\n *   2. `mnemonicAccountIndex` from the shared config file — but ONLY when the\n *      phrase itself came from that shared state dir (keystore/config tiers).\n *      An env- or `.env`-sourced phrase derives at index 0 unless\n *      `RIG_ACCOUNT_INDEX` says otherwise, so an explicit `RIG_MNEMONIC`\n *      pins the same identity no matter which `TOON_CLIENT_HOME` is active\n *      (#384 — a per-home config must never silently shift an explicitly\n *      provided identity).\n *   3. account 0\n *\n * The phrase itself is never written anywhere by rig (not to git config, not\n * to any repo file) and never printed — callers report only the SOURCE and\n * the derived pubkey.\n *\n * Key derivation and keystore decryption live in the `@toon-protocol/client`\n * dependency, loaded via dynamic import so this module can be statically\n * imported by every command without dragging the client into runs that fail\n * earlier (usage errors, missing git repo, …).\n */\n\nimport { deriveNostrKeyFromMnemonic } from '../standalone/nostr-identity.js';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\n\n/** Where the mnemonic came from (reported in output; the phrase never is). */\nexport type IdentitySourceKind =\n  /** `RIG_MNEMONIC` environment variable. */\n  | 'env'\n  /** `TOON_CLIENT_MNEMONIC` environment variable (deprecated alias). */\n  | 'env-alias'\n  /** `RIG_MNEMONIC` parsed out of a project-local `.env` file. */\n  | 'dotenv'\n  /** Encrypted keystore referenced by the shared client config. */\n  | 'keystore'\n  /** Plain `mnemonic` field of the shared client config file. */\n  | 'config';\n\n/** A resolved signing identity: source + derived pubkey (never the phrase). */\nexport interface ResolvedIdentity {\n  /** The BIP-39 phrase. Handle with care; never log or persist it. */\n  mnemonic: string;\n  /** BIP-44 account index used for derivation — `RIG_ACCOUNT_INDEX` env,\n   * else `mnemonicAccountIndex` from the shared config (home-sourced phrases\n   * only), else 0. */\n  accountIndex: number;\n  source: IdentitySourceKind;\n  /** Human-facing source label, e.g. `RIG_MNEMONIC env` or a file path. */\n  sourceLabel: string;\n  /** Derived Nostr pubkey (hex) — the repo owner / `toon.owner` value. */\n  pubkey: string;\n}\n\n/** No mnemonic could be resolved anywhere on the chain. */\nexport class MissingIdentityError extends Error {\n  constructor(configPath: string) {\n    super(\n      'no identity found — rig needs a BIP-39 seed phrase to sign and pay.\\n' +\n        'Generate one now (no BIP-39 tooling needed):\\n' +\n        '  • `rig identity create` — mint a fresh identity into the encrypted ' +\n        'keystore (shows the phrase once to back up)\\n' +\n        'Or point rig at an existing phrase (highest precedence first):\\n' +\n        '  • RIG_MNEMONIC environment variable\\n' +\n        '  • RIG_MNEMONIC=<phrase> in a project-local .env file (gitignore it!)\\n' +\n        `  • the shared client config at ${configPath} (mnemonic or ` +\n        'keystorePath + TOON_CLIENT_KEYSTORE_PASSWORD)'\n    );\n    this.name = 'MissingIdentityError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Shared client config conventions (duplicated from client-mcp — the same\n// note as standalone/nonce-guard.ts: no @toon-protocol/client-mcp import)\n// ---------------------------------------------------------------------------\n\n/**\n * Duplicated daemon convention (client-mcp `daemon/config.ts`): the password\n * used to encrypt a keystore rig auto-provisions (`rig identity create`\n * with no `TOON_CLIENT_KEYSTORE_PASSWORD` set) so the identity reloads across\n * runs with no env var. At-rest obfuscation only.\n */\nexport const DEFAULT_KEYSTORE_PASSWORD = 'toon-client-default';\n\n/** Shared client state dir: `TOON_CLIENT_HOME`, else `~/.toon-client`. */\nexport function clientStateDir(env: NodeJS.ProcessEnv): string {\n  return env['TOON_CLIENT_HOME'] ?? join(homedir(), '.toon-client');\n}\n\n/** Shared client config file path (`<state-dir>/config.json`). */\nexport function clientConfigPath(env: NodeJS.ProcessEnv): string {\n  return join(clientStateDir(env), 'config.json');\n}\n\n/** Default encrypted-keystore path (`<state-dir>/keystore.json`) — the same\n * convention the daemon's first-run provisioning uses. */\nexport function clientKeystorePath(env: NodeJS.ProcessEnv): string {\n  return join(clientStateDir(env), 'keystore.json');\n}\n\n/** The subset of the shared client config file identity resolution reads. */\nexport interface ClientConfigIdentityFields {\n  mnemonic?: unknown;\n  mnemonicAccountIndex?: unknown;\n  keystorePath?: unknown;\n  keystoreAutoPassword?: unknown;\n}\n\nexport function readClientConfigFile(path: string): ClientConfigIdentityFields {\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as ClientConfigIdentityFields;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return {};\n    throw new Error(\n      `failed to read client config at ${path}: ${err instanceof Error ? err.message : String(err)}`\n    );\n  }\n}\n\n/**\n * Link a freshly written keystore into the shared client config so the\n * keystore tier of {@link resolveIdentity} (and the daemon) picks it up on the\n * next run — merging into any existing config, preserving every other field,\n * and writing owner-only (mode 0o600). `keystoreAutoPassword` records whether\n * rig chose the default password (so a user-set password still requires the\n * env var to decrypt, exactly like the daemon's first-run convention).\n */\nexport function linkKeystoreInClientConfig(\n  env: NodeJS.ProcessEnv,\n  keystorePath: string,\n  autoPassword: boolean\n): string {\n  const configPath = clientConfigPath(env);\n  mkdirSync(dirname(configPath), { recursive: true });\n  const existing = readClientConfigFile(configPath) as Record<string, unknown>;\n  const merged: Record<string, unknown> = {\n    ...existing,\n    keystorePath,\n    ...(autoPassword\n      ? { keystoreAutoPassword: true }\n      : // A user-set password: drop any stale auto flag so decryption\n        // requires TOON_CLIENT_KEYSTORE_PASSWORD.\n        { keystoreAutoPassword: false }),\n  };\n  writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\\n', {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return configPath;\n}\n\n// ---------------------------------------------------------------------------\n// .env parsing (RIG_MNEMONIC only — never arbitrary env loading)\n// ---------------------------------------------------------------------------\n\nconst DOTENV_LINE_RE = /^\\s*(?:export\\s+)?RIG_MNEMONIC\\s*=\\s*(.*)\\s*$/;\n\n/**\n * Extract ONLY the `RIG_MNEMONIC` value from `.env` file content. Supports\n * `export ` prefixes, single/double quotes, full-line `#` comments, and\n * inline ` #` comments on unquoted values. Multiple assignments: the last\n * one wins (shell-sourcing semantics). An empty value counts as unset.\n * Nothing is ever loaded into `process.env`.\n */\nexport function parseDotenvMnemonic(content: string): string | undefined {\n  let found: string | undefined;\n  for (const line of content.split(/\\r?\\n/)) {\n    const match = DOTENV_LINE_RE.exec(line);\n    if (!match) continue;\n    let value = (match[1] ?? '').trim();\n    const quote = value[0];\n    if ((quote === '\"' || quote === \"'\") && value.length >= 2 && value.endsWith(quote)) {\n      value = value.slice(1, -1);\n    } else {\n      // Unquoted: an inline comment starts at the first whitespace-preceded #.\n      const hash = value.search(/\\s#/);\n      if (hash !== -1) value = value.slice(0, hash);\n      value = value.trim();\n    }\n    if (value !== '') found = value;\n  }\n  return found;\n}\n\n/**\n * Walk up from `startDir` (the working directory — the walk passes through\n * the repo root) to the filesystem root, returning the first `.env` file\n * that defines `RIG_MNEMONIC`. `stopDir` bounds the walk (tests).\n */\nexport function findDotenvMnemonic(\n  startDir: string,\n  stopDir?: string\n): { path: string; mnemonic: string } | undefined {\n  let dir = startDir;\n  for (;;) {\n    const candidate = join(dir, '.env');\n    if (existsSync(candidate)) {\n      try {\n        const mnemonic = parseDotenvMnemonic(readFileSync(candidate, 'utf8'));\n        if (mnemonic !== undefined) return { path: candidate, mnemonic };\n      } catch {\n        // Unreadable .env → keep walking; the file is never required.\n      }\n    }\n    if (stopDir !== undefined && dir === stopDir) return undefined;\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Account index (env > per-home config for home-sourced phrases > 0)\n// ---------------------------------------------------------------------------\n\n/** Sources whose phrase lives OUTSIDE the shared state dir. For these the\n * per-home `mnemonicAccountIndex` must not apply — an explicit\n * `RIG_MNEMONIC` derives the same identity across every\n * `TOON_CLIENT_HOME` (#384). */\nconst HOME_INDEPENDENT_SOURCES: ReadonlySet<IdentitySourceKind> = new Set([\n  'env',\n  'env-alias',\n  'dotenv',\n]);\n\n/**\n * Resolve the BIP-44 account index for a phrase from `source`:\n * `RIG_ACCOUNT_INDEX` env always wins; the shared config's\n * `mnemonicAccountIndex` applies only when the phrase itself came from the\n * shared state dir (keystore/config tiers); default 0. Throws on a\n * malformed `RIG_ACCOUNT_INDEX` — silently deriving a different identity\n * is exactly the surprise this precedence exists to prevent.\n */\nexport function resolveAccountIndex(\n  env: NodeJS.ProcessEnv,\n  source: IdentitySourceKind,\n  file: ClientConfigIdentityFields\n): number {\n  const raw = env['RIG_ACCOUNT_INDEX']?.trim();\n  if (raw) {\n    const parsed = Number(raw);\n    if (!Number.isInteger(parsed) || parsed < 0) {\n      throw new Error(\n        `RIG_ACCOUNT_INDEX must be a non-negative integer, got ${JSON.stringify(raw)}`\n      );\n    }\n    return parsed;\n  }\n  if (HOME_INDEPENDENT_SOURCES.has(source)) return 0;\n  return typeof file.mnemonicAccountIndex === 'number' ? file.mnemonicAccountIndex : 0;\n}\n\n// ---------------------------------------------------------------------------\n// Resolution\n// ---------------------------------------------------------------------------\n\nexport interface ResolveIdentityOptions {\n  env: NodeJS.ProcessEnv;\n  /** Working directory the `.env` walk starts from. */\n  cwd: string;\n  /** Stderr line sink for the deprecated-alias warning. */\n  warn(line: string): void;\n  /** Bound the `.env` walk-up (tests only). */\n  dotenvStopDir?: string;\n}\n\n/** The resolved source before any derivation (dependency-free). */\ninterface MnemonicSource {\n  mnemonic: string;\n  source: IdentitySourceKind;\n  sourceLabel: string;\n}\n\nfunction resolveMnemonicSource(\n  options: ResolveIdentityOptions,\n  file: ClientConfigIdentityFields,\n  configPath: string\n): MnemonicSource | { keystorePath: string } {\n  const { env } = options;\n\n  const rigEnv = env['RIG_MNEMONIC']?.trim();\n  if (rigEnv) {\n    return { mnemonic: rigEnv, source: 'env', sourceLabel: 'RIG_MNEMONIC env' };\n  }\n\n  const aliasEnv = env['TOON_CLIENT_MNEMONIC']?.trim();\n  if (aliasEnv) {\n    options.warn(\n      'rig: TOON_CLIENT_MNEMONIC is deprecated — rename the variable to RIG_MNEMONIC'\n    );\n    return {\n      mnemonic: aliasEnv,\n      source: 'env-alias',\n      sourceLabel: 'TOON_CLIENT_MNEMONIC env (deprecated alias)',\n    };\n  }\n\n  const dotenv = findDotenvMnemonic(options.cwd, options.dotenvStopDir);\n  if (dotenv) {\n    return {\n      mnemonic: dotenv.mnemonic,\n      source: 'dotenv',\n      sourceLabel: dotenv.path,\n    };\n  }\n\n  if (typeof file.keystorePath === 'string' && file.keystorePath !== '') {\n    return { keystorePath: file.keystorePath };\n  }\n  if (typeof file.mnemonic === 'string' && file.mnemonic.trim() !== '') {\n    return {\n      mnemonic: file.mnemonic.trim(),\n      source: 'config',\n      sourceLabel: configPath,\n    };\n  }\n  throw new MissingIdentityError(configPath);\n}\n\n/**\n * Load the client key helpers. `@toon-protocol/client` is a regular runtime\n * dependency (#259); the import stays dynamic purely so commands that fail\n * earlier never pay its startup cost.\n */\nasync function loadClientKeys(): Promise<{\n  loadKeystore(path: string, password: string): string;\n  deriveNostrKeyFromMnemonic(\n    mnemonic: string,\n    accountIndex?: number\n  ): { secretKey: Uint8Array; pubkey: string };\n}> {\n  const { loadKeystore } = await import('@toon-protocol/client');\n  return { loadKeystore, deriveNostrKeyFromMnemonic };\n}\n\n/**\n * Resolve the CLI signing identity along the precedence chain and derive its\n * Nostr pubkey. Throws {@link MissingIdentityError} (with the full\n * three-option remediation) when nothing on the chain yields a phrase.\n */\nexport async function resolveIdentity(\n  options: ResolveIdentityOptions\n): Promise<ResolvedIdentity> {\n  const configPath = clientConfigPath(options.env);\n  const file = readClientConfigFile(configPath);\n  const picked = resolveMnemonicSource(options, file, configPath);\n\n  const keys = await loadClientKeys();\n  let source: MnemonicSource;\n  if ('keystorePath' in picked) {\n    const password =\n      options.env['TOON_CLIENT_KEYSTORE_PASSWORD'] ??\n      (file.keystoreAutoPassword === true ? DEFAULT_KEYSTORE_PASSWORD : undefined);\n    if (!password) {\n      throw new Error(\n        `keystorePath is set in ${configPath} but TOON_CLIENT_KEYSTORE_PASSWORD is not provided`\n      );\n    }\n    source = {\n      mnemonic: keys.loadKeystore(picked.keystorePath, password),\n      source: 'keystore',\n      sourceLabel: picked.keystorePath,\n    };\n  } else {\n    source = picked;\n  }\n\n  const accountIndex = resolveAccountIndex(options.env, source.source, file);\n  const { pubkey } = keys.deriveNostrKeyFromMnemonic(source.mnemonic, accountIndex);\n  return { ...source, accountIndex, pubkey };\n}\n"],"mappings":";;;;;AAeA,SAAS,YAAY,iBAAiB;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUA,IAAM,wBAAwB;AAM9B,IAAM,eAAe;AAMrB,IAAM,sBAAsB;AA0B5B,IAAM,kBAAkB;AAE/B,IAAM,QAAQ;AAOP,SAAS,cACd,MACA,MACoB;AACpB,SAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC;AAC5C;AAOO,SAAS,iBAAiB,MAA4B;AAC3D,QAAM,MAAgB,CAAC;AACvB,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,gBAAiB;AAChC,eAAW,SAAS,IAAI,MAAM,CAAC,GAAG;AAChC,YAAM,MAAM,MAAM,YAAY;AAC9B,UAAI,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,GAAG;AACrC,aAAK,IAAI,GAAG;AACZ,YAAI,KAAK,GAAG;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,wBACd,aACA,sBACa;AACb,SAAO,oBAAI,IAAI;AAAA,IACb,YAAY,YAAY;AAAA,IACxB,GAAG,iBAAiB,oBAAoB;AAAA,EAC1C,CAAC;AACH;AAeO,IAAM,aAAa;AAK1B,IAAM,0BAA+C,oBAAI,IAAiB;AAAA,EACxE;AACF,CAAC;AAGD,SAAS,uBAAuB,OAAqC;AACnE,SAAO,wBAAwB,IAAI,KAAK;AAC1C;AAcO,SAAS,wBAAwB,SAA0B;AAChE,SAAO,UAAU,OAAO;AAC1B;AAaO,SAAS,YAAY,MAAwC;AAClE,MAAI,SAA+B;AACnC,MAAI,UAAU;AACd,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,WAAY;AAC3B,UAAM,CAAC,EAAE,OAAO,OAAO,IAAI;AAC3B,QACE,WAAW,QACX,UAAU,UACV,uBAAuB,KAAK,KAC5B,YAAY,UACZ,wBAAwB,OAAO,GAC/B;AACA,eAAS,EAAE,OAAO,SAAS,WAAW,OAAO,EAAE;AAAA,IACjD,OAAO;AACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,YAAQ;AAAA,MACN,iBAAiB,OAAO,mBAAmB,UAAU,4BAClD,SAAS,iBAAY,OAAO,KAAK,IAAI,OAAO,OAAO,KAAK;AAAA,IAC7D;AAAA,EACF;AACA,SAAO;AACT;AAiDO,IAAM,6BAA6B;AAwBnC,SAAS,cACd,QACA,MACA,aAAqC,CAAC,GACvB;AACf,QAAM,OAAmB,CAAC,CAAC,KAAK,MAAM,CAAC;AAGvC,aAAW,CAAC,SAAS,SAAS,KAAK,OAAO,QAAQ,IAAI,GAAG;AACvD,SAAK,KAAK,CAAC,SAAS,SAAS,CAAC;AAC9B,SAAK,KAAK,CAAC,KAAK,SAAS,SAAS,CAAC;AAAA,EACrC;AAGA,QAAM,WAAW,OAAO,KAAK,IAAI,EAAE,CAAC;AACpC,MAAI,UAAU;AACZ,SAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAAA,EACxC;AAGA,QAAM,SAAS,OAAO,QAAQ,UAAU,EAAE;AAAA,IACxC;AAAA,IACA;AAAA,EACF;AACA,aAAW,CAAC,KAAK,IAAI,KAAK,QAAQ;AAChC,SAAK,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,EAC1C;AACF;AAeO,SAAS,WACd,iBACA,QACA,OACA,MACA,SAAmB,CAAC,GACL;AACf,QAAM,OAAmB;AAAA,IACvB,CAAC,KAAK,GAAG,4BAA4B,IAAI,eAAe,IAAI,MAAM,EAAE;AAAA,IACpE,CAAC,KAAK,eAAe;AAAA,IACrB,CAAC,WAAW,KAAK;AAAA,IACjB,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC;AAAA,EACvC;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,EAC1C;AACF;AAwDO,SAAS,aACd,iBACA,QACA,MACA,MACA,QACe;AACf,QAAM,aACJ,WAAW,SACP;AAAA,IACE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,YAAY;AAAA,IACzC,CAAC,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,IACvB,CAAC,KAAK,KAAK,YAAY;AAAA,EACzB,IACA;AAAA,IACE,CAAC,KAAK,OAAO,SAAS,IAAI,OAAO,YAAY;AAAA,IAC7C,CAAC,KAAK,OAAO,YAAY,CAAC;AAAA,IAC1B,CAAC,KAAK,OAAO,YAAY;AAAA,EAC3B;AAEN,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,YAAY;AAAA,MACzC,CAAC,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MACvB,CAAC,KAAK,KAAK,YAAY;AAAA,MACvB,GAAG;AAAA,MACH,CAAC,KAAK,GAAG,4BAA4B,IAAI,eAAe,IAAI,MAAM,EAAE;AAAA,IACtE;AAAA,IACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,EAC1C;AACF;AAWO,SAAS,uBACd,OACA,aACS;AACT,MAAI,MAAM,SAAS,cAAc;AAC/B,WAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,MAAM,WAAW;AAAA,EACpE;AACA,MAAI,MAAM,SAAS,qBAAqB;AACtC,WAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,MAAM,WAAW;AAAA,EACpE;AACA,SAAO;AACT;AA8BO,SAAS,WACd,iBACA,QACA,OACA,SACA,WACA,UAAU,IACV,aACe;AACf,QAAM,OAAmB;AAAA,IACvB,CAAC,KAAK,GAAG,4BAA4B,IAAI,eAAe,IAAI,MAAM,EAAE;AAAA,IACpE,CAAC,KAAK,eAAe;AAAA,IACrB,CAAC,WAAW,KAAK;AAAA,EACnB;AAEA,MAAI,gBAAgB,UAAa,gBAAgB,IAAI;AACnD,SAAK,KAAK,CAAC,eAAe,WAAW,CAAC;AAAA,EACxC;AAEA,aAAW,UAAU,SAAS;AAC5B,SAAK,KAAK,CAAC,UAAU,OAAO,GAAG,CAAC;AAChC,SAAK,KAAK,CAAC,iBAAiB,OAAO,SAAS,CAAC;AAAA,EAC/C;AAEA,MAAI,WAAW;AACb,SAAK,KAAK,CAAC,eAAe,SAAS,CAAC;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,EAC1C;AACF;AAgCO,SAAS,YACd,iBACA,QACA,eACA,YACA,cACe;AACf,QAAM,OAAmB;AAAA,IACvB,CAAC,KAAK,eAAe,IAAI,MAAM;AAAA,IAC/B,CAAC,KAAK,GAAG,4BAA4B,IAAI,eAAe,IAAI,MAAM,EAAE;AAAA,EACtE;AACA,MAAI,cAAc;AAChB,SAAK,KAAK,CAAC,KAAK,YAAY,CAAC;AAAA,EAC/B;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,IACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,EAC1C;AACF;;;AC9hBA,SAAS,UAAU,kBAAkB;;;ACV9B,IAAM,mBAAmB;EAC9B;EACA;EACA;;AAIK,IAAM,2BAA2B;;;ACLxC,IAAM,sBAAsB;AAG5B,IAAM,qBAAqB;AAG3B,IAAM,iBAAiB,oBAAI,IAAG;AAK9B,SAAS,cAAc,KAAW;AAChC,SAAO,kBAAkB,KAAK,GAAG;AACnC;AAOA,SAAS,qBAAqB,OAAa;AAEzC,SAAO,MAAM,QAAQ,4BAA4B,EAAE;AACrD;AAQM,SAAU,YAAY,KAAa,MAAY;AACnD,SAAO,GAAG,GAAG,IAAI,IAAI;AACvB;AAiBM,SAAU,aACd,UAAkD;AAElD,QAAM,UAAU,oBAAoB,MAAM,SAAS,QAAO,IAAK;AAC/D,aAAW,CAAC,KAAK,IAAI,KAAK,SAAS;AACjC,QAAI,eAAe,QAAQ,oBAAoB;AAC7C,YAAM,WAAW,eAAe,KAAI,EAAG,KAAI,EAAG;AAC9C,UAAI,aAAa,QAAW;AAC1B,uBAAe,OAAO,QAAQ;MAChC;IACF;AACA,mBAAe,IAAI,KAAK,IAAI;EAC9B;AACF;AAGA,IAAM,mBAAmB;AAMnB,SAAU,mBAAmB,MAAY;AAC7C,SAAO,iBAAiB,KAAK,IAAI;AACnC;AAYA,eAAsB,cACpB,KACA,MAAY;AAGZ,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;EACT;AAEA,QAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAM,SAAS,eAAe,IAAI,QAAQ;AAC1C,MAAI,WAAW,QAAW;AACxB,WAAO;EACT;AAEA,QAAM,UAAU,qBAAqB,GAAG;AACxC,QAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAM,QAAQ;;mCAEmB,OAAO;gCACV,QAAQ;;;;;AAMtC,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,qBAAqB;MAChD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAkB;MAC7C,MAAM,KAAK,UAAU,EAAE,MAAK,CAAE;MAC9B,QAAQ,YAAY,QAAQ,wBAAwB;KACrD;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;IACT;AAEA,UAAM,OAAQ,MAAM,SAAS,KAAI;AAQjC,UAAM,QAAQ,KAAK,MAAM,cAAc;AACvC,QAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,aAAO;IACT;AAEA,UAAM,OAAO,MAAM,CAAC,GAAG,MAAM;AAC7B,QAAI,CAAC,QAAQ,CAAC,mBAAmB,IAAI,GAAG;AACtC,aAAO;IACT;AAGA,QAAI,eAAe,QAAQ,oBAAoB;AAC7C,YAAM,WAAW,eAAe,KAAI,EAAG,KAAI,EAAG;AAC9C,UAAI,aAAa,QAAW;AAC1B,uBAAe,OAAO,QAAQ;MAChC;IACF;AACA,mBAAe,IAAI,UAAU,IAAI;AACjC,WAAO;EACT,QAAQ;AACN,WAAO;EACT;AACF;;;AF5IA,SAAS,gCAAAA,qCAAoC;;;AG0BtC,IAAM,qBAAqB;AAGlC,IAAM,gBAAgB;AAGtB,IAAM,mBAAmB,CAAC,eAAe,YAAY;AAGrD,IAAM,gBAAgB;AAOtB,SAAS,gBAAgB,MAAuB;AAC9C,SAAO,iBAAiB,KAAK,CAAC,WAAW,KAAK,WAAW,MAAM,CAAC;AAClE;AAOA,SAAS,YACP,KACA,QACqB;AACrB,QAAM,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAAC;AAC1D,aAAW,CAAC,SAAS,GAAG,KAAK,QAAQ;AACnC,QAAI,KAAK,QAAQ,mBAAoB;AACrC,QAAI,IAAI,IAAI,OAAO,EAAG;AACtB,SAAK,IAAI,SAAS,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAkBO,SAAS,kBAAkB,MAAmC;AAInE,QAAM,MAAM,oBAAI,IAAoB;AACpC,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI,aAA4B;AAEhC,aAAW,OAAO,MAAM;AACtB,UAAM,CAAC,MAAM,IAAI,EAAE,IAAI;AACvB,QAAI,SAAS,OAAW;AAExB,QAAI,SAAS,OAAO,MAAM,IAAI;AAC5B,UAAI,OAAO,UAAU,GAAG,WAAW,aAAa,GAAG;AAEjD,qBAAa,GAAG,MAAM,cAAc,MAAM;AAC1C;AAAA,MACF;AACA,UAAI,OAAO,OAAO,sBAAsB,OAAO,IAAI,EAAE,GAAG;AACtD,eAAO,IAAI,IAAI,EAAE;AAAA,MACnB;AACA;AAAA,IACF;AAEA,QAAI,SAAS,UAAU,IAAI,WAAW,aAAa,GAAG;AAEpD,mBAAa,GAAG,MAAM,cAAc,MAAM;AAC1C;AAAA,IACF;AAEA,QAAI,MAAM,gBAAgB,IAAI,KAAK,CAAC,KAAK,SAAS,aAAa,GAAG;AAEhE,UAAI,IAAI,OAAO,sBAAsB,IAAI,IAAI,IAAI,EAAG,KAAI,IAAI,MAAM,EAAE;AAAA,IACtE;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,YAAY,KAAK,MAAM,GAAG,WAAW;AACtD;;;AHuBA,SAAS,gBAAgB,KAAsB;AAC7C,SAAO,cAAc,KAAK,GAAG;AAC/B;AAGA,IAAM,UAAU;AAOT,SAAS,wBAAwB,KAA4B;AAClE,QAAM,OACJ,WACA;AACF,MAAI,CAAC,MAAM;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,KAAK,GAAG;AACrB;AAQA,SAAS,mBAAmB,SAAqC;AAC/D,MAAI,YAAY,QAAQ,OAAO,YAAY,UAAU;AACnD,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,QAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,MAAI;AACF,WAAO,WAAW,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,WACd,UACA,QACA,WACA,kBACuB;AACvB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAuB,CAAC;AAC9B,UAAM,QAAQ,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACzE,QAAI;AAEJ,QAAI;AACJ,QAAI,UAAU;AAEd,UAAM,SAAS,CAAC,SAA+B,UAAkB;AAC/D,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,aAAa;AAC1B,UAAI;AACF,YAAI,GAAG,eAAe,SAAS;AAC7B,aAAG,KAAK,KAAK,UAAU,CAAC,SAAS,KAAK,CAAC,CAAC;AAAA,QAC1C;AACA,WAAG,MAAM;AAAA,MACX,QAAQ;AAAA,MAER;AACA,UAAI,YAAY,UAAU;AACxB,eAAO,KAAK;AAAA,MACd,OAAO;AACL,gBAAQ,MAAM;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,gBAAgB,QAAQ,GAAG;AAC9B;AAAA,QACE,IAAI;AAAA,UACF,yDAAyD,QAAQ;AAAA,QACnE;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI;AACF,WAAK,iBAAiB,QAAQ;AAAA,IAChC,SAAS,KAAK;AACZ;AAAA,QACE,IAAI,MAAM,8BAA8B,QAAQ,KAAK,OAAO,GAAG,CAAC,EAAE;AAAA,MACpE;AACA;AAAA,IACF;AAEA,oBAAgB,WAAW,MAAM;AAE/B,aAAO,SAAS;AAAA,IAClB,GAAG,SAAS;AAEZ,OAAG,iBAAiB,QAAQ,MAAM;AAChC,SAAG,KAAK,KAAK,UAAU,CAAC,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,IAChD,CAAC;AAED,OAAG,iBAAiB,WAAW,CAAC,aAAiC;AAC/D,UAAI;AACF,cAAM,MAAM,KAAK,MAAM,OAAO,SAAS,IAAI,CAAC;AAC5C,YAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,EAAG;AAE3C,cAAM,UAAU,IAAI,CAAC;AACrB,YAAI,YAAY,WAAW,IAAI,CAAC,MAAM,SAAS,IAAI,CAAC,MAAM,QAAW;AACnE,gBAAM,QAAQ,mBAAmB,IAAI,CAAC,CAAC;AACvC,cAAI,MAAO,QAAO,KAAK,KAAK;AAAA,QAC9B,WAAW,YAAY,UAAU,IAAI,CAAC,MAAM,OAAO;AACjD,iBAAO,SAAS;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AAED,OAAG,iBAAiB,SAAS,CAAC,UAAiC;AAC7D,YAAM,SACJ,OAAO,UAAU,YAAY,UAAU,QAAQ,aAAa,QACxD,OAAO,MAAM,OAAO,IACpB;AACN;AAAA,QACE;AAAA,QACA,IAAI,MAAM,iCAAiC,QAAQ,KAAK,MAAM,EAAE;AAAA,MAClE;AAAA,IACF,CAAC;AAED,OAAG,iBAAiB,SAAS,MAAM;AAEjC,aAAO,SAAS;AAAA,IAClB,CAAC;AAAA,EACH,CAAC;AACH;AAUA,SAAS,kBAAkB,QAAyC;AAClE,MAAI,SAA4B;AAChC,aAAW,SAAS,QAAQ;AAC1B,QACE,WAAW,QACX,MAAM,aAAa,OAAO,cACzB,MAAM,eAAe,OAAO,cAAc,MAAM,KAAK,OAAO,IAC7D;AACA,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,YAAY,MAAkB,MAAkC;AACvE,QAAM,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI;AAC1C,SAAO,MAAM,CAAC;AAChB;AAoBA,SAAS,eAAe,OAA+B;AACrD,QAAM,EAAE,MAAM,WAAW,IAAI,kBAAkB,MAAM,IAAI;AACzD,QAAM,YAAY,oBAAI,IAAoB;AAE1C,aAAW,OAAO,MAAM,MAAM;AAC5B,QAAI,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;AAG5C,UAAI,UAAU,QAAQ,2BAA4B;AAClD,gBAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,YAAY,UAAU;AACvC;AAiBA,eAAsB,iBACpB,SACsB;AACtB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,mBAAmB;AAAA,EACrB,IAAI;AAEJ,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,SAAsB;AAAA,IAC1B,OAAO,CAACC,+BAA8B,qBAAqB;AAAA,IAC3D,SAAS,CAAC,WAAW;AAAA,IACrB,MAAM,CAAC,MAAM;AAAA,EACf;AAEA,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,UAAU,IAAI,CAAC,QAAQ,WAAW,KAAK,QAAQ,WAAW,gBAAgB,CAAC;AAAA,EAC7E;AAEA,QAAM,WAAqB,CAAC;AAC5B,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,YAAY;AAChC,eAAS,KAAK,OAAQ,OAAO,QAAkB,WAAW,OAAO,MAAM,CAAC;AACxE;AAAA,IACF;AACA,eAAW,SAAS,OAAO,OAAO;AAGhC,UAAI,MAAM,WAAW,YAAa;AAClC,UAAI,YAAY,MAAM,MAAM,GAAG,MAAM,OAAQ;AAC7C,UAAI,OAAO,MAAM,OAAO,YAAY,CAAC,KAAK,IAAI,MAAM,EAAE,GAAG;AACvD,aAAK,IAAI,MAAM,IAAI,KAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,UAAU,QAAQ;AACxC,UAAM,IAAI;AAAA,MACR,yBAAyB,UAAU,MAAM,qBAAqB,SAAS,KAAK,IAAI,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC;AAChC,QAAM,YAAY;AAAA,IAChB,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,qBAAqB;AAAA,EACvD;AACA,QAAM,gBAAgB;AAAA,IACpB,OAAO,OAAO,CAAC,MAAM,EAAE,SAASA,6BAA4B;AAAA,EAC9D;AAEA,QAAM,EAAE,MAAM,YAAY,UAAU,IAAI,YACpC,eAAe,SAAS,IACxB;AAAA,IACE,MAAM,oBAAI,IAAoB;AAAA,IAC9B,YAAY;AAAA,IACZ,WAAW,oBAAI,IAAoB;AAAA,EACrC;AAIJ,MAAI,UAAU,OAAO,GAAG;AACtB;AAAA,MACE,CAAC,GAAG,SAAS,EAAE;AAAA,QACb,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,GAAG,IAAI;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAGA,QAAM,OAAO,gBACR,YAAY,cAAc,MAAM,MAAM,KAAK,OAC5C;AACJ,QAAM,cAAc,gBACf,YAAY,cAAc,MAAM,aAAa,KAAK,cAAc,UACjE;AAEJ,QAAM,SAAmB,CAAC;AAC1B,MAAI,eAAe;AACjB,eAAW,OAAO,cAAc,MAAM;AACpC,UAAI,IAAI,CAAC,MAAM,UAAU;AACvB,eAAO,KAAK,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAGA,QAAM,cAAc,gBAAgB,iBAAiB,cAAc,IAAI,IAAI,CAAC;AAE5E,QAAM,SAAS,gBAAgB,YAAY,cAAc,IAAI,IAAI;AAEjE,QAAM,iBAAiB,OACrB,SACiC;AACjC,UAAM,WAAW,oBAAI,IAAoB;AACzC,UAAM,UAAoB,CAAC;AAC3B,eAAW,OAAO,IAAI,IAAI,IAAI,GAAG;AAC/B,YAAM,QAAQ,UAAU,IAAI,GAAG;AAC/B,UAAI,UAAU,QAAW;AACvB,iBAAS,IAAI,KAAK,KAAK;AAAA,MACzB,OAAO;AACL,gBAAQ,KAAK,GAAG;AAAA,MAClB;AAAA,IACF;AACA,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,MAAM,WAAW,KAAK,MAAM,CAAC,CAAU;AAAA,IAC1E;AACA,eAAW,CAAC,KAAK,IAAI,KAAK,SAAS;AACjC,UAAI,KAAM,UAAS,IAAI,KAAK,IAAI;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,WAAW,kBAAkB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;AIpfA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AA+BvB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,YAAoB;AAC9B;AAAA,MACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uCAOqC,UAAU;AAAA,IAEjD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAaO,IAAM,4BAA4B;AAGlC,SAAS,eAAe,KAAgC;AAC7D,SAAO,IAAI,kBAAkB,KAAK,KAAK,QAAQ,GAAG,cAAc;AAClE;AAGO,SAAS,iBAAiB,KAAgC;AAC/D,SAAO,KAAK,eAAe,GAAG,GAAG,aAAa;AAChD;AAIO,SAAS,mBAAmB,KAAgC;AACjE,SAAO,KAAK,eAAe,GAAG,GAAG,eAAe;AAClD;AAUO,SAAS,qBAAqB,MAA0C;AAC7E,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO,CAAC;AAC9D,UAAM,IAAI;AAAA,MACR,mCAAmC,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;AAUO,SAAS,2BACd,KACA,cACA,cACQ;AACR,QAAM,aAAa,iBAAiB,GAAG;AACvC,YAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,QAAM,WAAW,qBAAqB,UAAU;AAChD,QAAM,SAAkC;AAAA,IACtC,GAAG;AAAA,IACH;AAAA,IACA,GAAI,eACA,EAAE,sBAAsB,KAAK;AAAA;AAAA;AAAA,MAG7B,EAAE,sBAAsB,MAAM;AAAA;AAAA,EACpC;AACA,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM;AAAA,IAChE,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,SAAO;AACT;AAMA,IAAM,iBAAiB;AAShB,SAAS,oBAAoB,SAAqC;AACvE,MAAI;AACJ,aAAW,QAAQ,QAAQ,MAAM,OAAO,GAAG;AACzC,UAAM,QAAQ,eAAe,KAAK,IAAI;AACtC,QAAI,CAAC,MAAO;AACZ,QAAI,SAAS,MAAM,CAAC,KAAK,IAAI,KAAK;AAClC,UAAM,QAAQ,MAAM,CAAC;AACrB,SAAK,UAAU,OAAO,UAAU,QAAQ,MAAM,UAAU,KAAK,MAAM,SAAS,KAAK,GAAG;AAClF,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B,OAAO;AAEL,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,SAAS,GAAI,SAAQ,MAAM,MAAM,GAAG,IAAI;AAC5C,cAAQ,MAAM,KAAK;AAAA,IACrB;AACA,QAAI,UAAU,GAAI,SAAQ;AAAA,EAC5B;AACA,SAAO;AACT;AAOO,SAAS,mBACd,UACA,SACgD;AAChD,MAAI,MAAM;AACV,aAAS;AACP,UAAM,YAAY,KAAK,KAAK,MAAM;AAClC,QAAI,WAAW,SAAS,GAAG;AACzB,UAAI;AACF,cAAM,WAAW,oBAAoB,aAAa,WAAW,MAAM,CAAC;AACpE,YAAI,aAAa,OAAW,QAAO,EAAE,MAAM,WAAW,SAAS;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,YAAY,UAAa,QAAQ,QAAS,QAAO;AACrD,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAUA,IAAM,2BAA4D,oBAAI,IAAI;AAAA,EACxE;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUM,SAAS,oBACd,KACA,QACA,MACQ;AACR,QAAM,MAAM,IAAI,mBAAmB,GAAG,KAAK;AAC3C,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,GAAG;AAC3C,YAAM,IAAI;AAAA,QACR,yDAAyD,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,yBAAyB,IAAI,MAAM,EAAG,QAAO;AACjD,SAAO,OAAO,KAAK,yBAAyB,WAAW,KAAK,uBAAuB;AACrF;AAuBA,SAAS,sBACP,SACA,MACA,YAC2C;AAC3C,QAAM,EAAE,IAAI,IAAI;AAEhB,QAAM,SAAS,IAAI,cAAc,GAAG,KAAK;AACzC,MAAI,QAAQ;AACV,WAAO,EAAE,UAAU,QAAQ,QAAQ,OAAO,aAAa,mBAAmB;AAAA,EAC5E;AAEA,QAAM,WAAW,IAAI,sBAAsB,GAAG,KAAK;AACnD,MAAI,UAAU;AACZ,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AAEA,QAAM,SAAS,mBAAmB,QAAQ,KAAK,QAAQ,aAAa;AACpE,MAAI,QAAQ;AACV,WAAO;AAAA,MACL,UAAU,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF;AAEA,MAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,IAAI;AACrE,WAAO,EAAE,cAAc,KAAK,aAAa;AAAA,EAC3C;AACA,MAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAK,MAAM,IAAI;AACpE,WAAO;AAAA,MACL,UAAU,KAAK,SAAS,KAAK;AAAA,MAC7B,QAAQ;AAAA,MACR,aAAa;AAAA,IACf;AAAA,EACF;AACA,QAAM,IAAI,qBAAqB,UAAU;AAC3C;AAOA,eAAe,iBAMZ;AACD,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,uBAAuB;AAC7D,SAAO,EAAE,cAAc,2BAA2B;AACpD;AAOA,eAAsB,gBACpB,SAC2B;AAC3B,QAAM,aAAa,iBAAiB,QAAQ,GAAG;AAC/C,QAAM,OAAO,qBAAqB,UAAU;AAC5C,QAAM,SAAS,sBAAsB,SAAS,MAAM,UAAU;AAE9D,QAAM,OAAO,MAAM,eAAe;AAClC,MAAI;AACJ,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,WACJ,QAAQ,IAAI,+BAA+B,MAC1C,KAAK,yBAAyB,OAAO,4BAA4B;AACpE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,0BAA0B,UAAU;AAAA,MACtC;AAAA,IACF;AACA,aAAS;AAAA,MACP,UAAU,KAAK,aAAa,OAAO,cAAc,QAAQ;AAAA,MACzD,QAAQ;AAAA,MACR,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,OAAO;AACL,aAAS;AAAA,EACX;AAEA,QAAM,eAAe,oBAAoB,QAAQ,KAAK,OAAO,QAAQ,IAAI;AACzE,QAAM,EAAE,OAAO,IAAI,KAAK,2BAA2B,OAAO,UAAU,YAAY;AAChF,SAAO,EAAE,GAAG,QAAQ,cAAc,OAAO;AAC3C;","names":["REPOSITORY_ANNOUNCEMENT_KIND","REPOSITORY_ANNOUNCEMENT_KIND"]}

package/dist/chunk-XQ2AWNHQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gateway-preference.ts","../src/git-sha-resolver.ts"],"sourcesContent":["/**\n * Which Arweave gateway rig PRINTS — and which one it READS through (#176).\n *\n * Fetches try every gateway in `@toon-protocol/arweave`'s shared list, so the\n * order there only matters for redundancy. A printed URL is different: it is\n * the one link a reader clicks. `ar-io.dev` heads the shared list but is\n * ar.io's TESTNET gateway — its ArNS resolver runs against the Solana devnet\n * contracts and it serves testnet-bundler uploads that never reach Arweave —\n * so a mainnet upload printed there is a guaranteed 404 (toon-client#577\n * reorders the shared list). Until then rig prefers the first MAINNET gateway\n * of that list and never prints the testnet one as the primary.\n */\n\nimport { ARWEAVE_GATEWAYS } from '@toon-protocol/arweave';\n\nconst TESTNET_GATEWAY = /(^|\\.)ar-io\\.dev$/i;\n\n/** Every gateway that is not ar.io's testnet. Malformed URLs are not gateways. */\nexport function isMainnetGateway(url: string): boolean {\n  try {\n    return !TESTNET_GATEWAY.test(new URL(url).hostname);\n  } catch {\n    return false;\n  }\n}\n\n/** The gateway a printed URL defaults to: the shared list's first mainnet one. */\nexport const PREFERRED_GATEWAY: string =\n  ARWEAVE_GATEWAYS.find(isMainnetGateway) ?? 'https://arweave.net';\n\n/** The shared list minus one gateway, for \"also at\" mirrors under a primary. */\nexport function mirrorGatewaysFor(primary: string): string[] {\n  const p = primary.replace(/\\/+$/, '');\n  return ARWEAVE_GATEWAYS.filter((g) => g.replace(/\\/+$/, '') !== p);\n}\n\n// ---------------------------------------------------------------------------\n// The gateway override on the READ path (#176)\n// ---------------------------------------------------------------------------\n\n/** Environment variable naming the gateway rig writes through and reads from. */\nexport const ARWEAVE_GATEWAY_ENV = 'RIG_ARWEAVE_GATEWAY';\n\n/** Trailing slashes off a gateway base URL, so `${g}/raw` never doubles up. */\nexport function normalizeGatewayUrl(url: string): string {\n  return url.replace(/\\/+$/, '');\n}\n\n/**\n * The gateway this invocation was configured with: `--gateway`, else\n * `RIG_ARWEAVE_GATEWAY`, else null — nothing configured, blank counting as\n * unset. Normalized, so a caller can append a route to it.\n */\nexport function configuredGateway(\n  flag: string | undefined,\n  env: NodeJS.ProcessEnv\n): string | null {\n  const raw = (flag ?? env[ARWEAVE_GATEWAY_ENV] ?? '').trim();\n  return raw === '' ? null : normalizeGatewayUrl(raw);\n}\n\n/**\n * Where object bytes are read from once a gateway IS configured: its raw-bytes\n * route FIRST, then the shared public list as the fallback.\n *\n * `<gateway>/raw/<txId>`, not `<gateway>/<txId>`: an ar.io node serves raw\n * transaction bytes there whether or not it does sandboxed-subdomain\n * redirects, and the TOON store's own gateway (the dev sandbox's) answers on\n * that route ALONE. A public gateway serves the same bytes on both.\n */\nexport function readGatewaysFor(gateway: string): string[] {\n  return [`${normalizeGatewayUrl(gateway)}/raw`, ...ARWEAVE_GATEWAYS];\n}\n\n/**\n * The read path's gateway list for a command that takes `--gateway`: the\n * configured gateway first ({@link readGatewaysFor}), or — nothing configured\n * — the shared public list exactly as it stands today.\n *\n * This is what gives `rig clone` / `rig fetch` the reach `rig push` has: a\n * repository whose objects live only on a private, local or air-gapped\n * gateway becomes readable by naming it, with the public gateways still\n * serving everyone else.\n */\nexport function readGateways(\n  flag: string | undefined,\n  env: NodeJS.ProcessEnv\n): readonly string[] {\n  const gateway = configuredGateway(flag, env);\n  return gateway === null ? ARWEAVE_GATEWAYS : readGatewaysFor(gateway);\n}\n","/**\n * The Git-SHA → Arweave txId fallback, pointed at the CONFIGURED gateway\n * (#183, follow-up to #176).\n *\n * A kind:30618 object map is a HINT map, not an index: it is capped (#162),\n * so a SHA it does not carry is resolved by asking a gateway's GraphQL\n * endpoint which transaction carries the `Git-SHA` + `Repo` tag pair the\n * store stamps on every object upload. `@toon-protocol/arweave`'s shared\n * `resolveGitSha` does exactly that — but against ONE baked-in endpoint,\n * `https://arweave.net/graphql`. After #176 gave `rig clone` / `rig fetch` /\n * `rig ci serve` a gateway override for object bytes, that fallback was the\n * one read left crossing to the public permaweb: on a self-hosted, local or\n * air-gapped stack it either fails or — worse — answers about a DIFFERENT\n * network, and a wrong txId is served as fact.\n *\n * So when (and only when) a gateway is configured, rig asks that gateway\n * instead, with the same query. Nothing configured and\n * {@link shaResolverFor} hands back the shared resolver itself: the default\n * path stays byte-for-byte what it was, one implementation, one cache.\n *\n * ## Why there is no public fallback behind the configured gateway\n *\n * Object BYTES keep the public list behind the configured gateway (#176):\n * they are content-addressed and SHA-verified on arrival, so any mirror may\n * serve them and a wrong answer cannot survive. A tag query is the opposite\n * kind of fact — an unverifiable statement about which transaction holds an\n * object ON ONE NETWORK — so it goes to the network the user named and\n * nowhere else. A gateway that serves no GraphQL resolves nothing, which\n * surfaces as the honest \"missing objects\" report the read pipeline already\n * prints, not as a silent cross-network read.\n *\n * ## The cache is keyed per endpoint\n *\n * The shared resolver's cache is keyed `sha:repo` alone, so two endpoints\n * answering about the same repository would overwrite each other's answers in\n * one process — a sandbox txId served to a mainnet query, or the reverse.\n * This module therefore keeps its OWN cache, keyed by endpoint as well, and\n * neither reads nor writes the shared one. (Hints seeded from a 30618 are\n * unaffected: `RemoteState.resolveMissing` serves those from the event's own\n * map before any resolver is called.)\n */\n\nimport {\n  ARWEAVE_FETCH_TIMEOUT_MS,\n  isValidArweaveTxId,\n  resolveGitSha,\n  shaCacheKey,\n} from '@toon-protocol/arweave';\n\nimport {\n  configuredGateway,\n  normalizeGatewayUrl,\n} from './gateway-preference.js';\n\n/** Git SHA → Arweave txId, the shape `fetchRemoteState` takes as `resolveSha`. */\nexport type ShaResolver = (\n  sha: string,\n  repo: string\n) => Promise<string | null>;\n\n/** WHATWG-fetch seam for the GraphQL POST (injectable for tests). */\nexport type GraphqlFetch = (\n  url: string,\n  init: {\n    method: string;\n    headers: Record<string, string>;\n    body: string;\n    signal?: AbortSignal;\n  }\n) => Promise<{ ok: boolean; json(): Promise<unknown> }>;\n\n/** A git SHA-1 as a full 40-hex string — anything else is never queried. */\nconst FULL_SHA_RE = /^[0-9a-f]{40}$/i;\n\n/** Entries kept in the per-endpoint cache (mirrors the shared resolver's cap). */\nconst SHA_CACHE_MAX_SIZE = 10000;\n\n/** `endpoint\\nsha:repo` → txId. Endpoint-keyed: see the module header. */\nconst cache = new Map<string, string>();\n\n/** Drop every cached answer. Test isolation only. */\nexport function clearGatewayShaCache(): void {\n  cache.clear();\n}\n\n/**\n * Where a gateway answers tag queries: `<gateway>/graphql`. Every ar.io node\n * and the public Arweave gateways serve GraphQL on that path, so the one\n * URL the user already gives rig is enough to reach it.\n */\nexport function graphqlEndpointFor(gateway: string): string {\n  return `${normalizeGatewayUrl(gateway)}/graphql`;\n}\n\n/**\n * Strip what would break out of a GraphQL string literal. Same guard as the\n * shared resolver's — the repo id reaches the query from a relay event.\n */\nfunction sanitizeGraphQLValue(value: string): string {\n  // eslint-disable-next-line no-control-regex -- intentional: strip control chars for GraphQL safety\n  return value.replace(/[\"\\\\\\n\\r\u0000-\u001f`]/g, '');\n}\n\n/** The tag query, byte-identical to the shared resolver's. */\nfunction tagQuery(sha: string, repo: string): string {\n  return `query {\n  transactions(tags: [\n    { name: \"Git-SHA\", values: [\"${sanitizeGraphQLValue(sha)}\"] },\n    { name: \"Repo\", values: [\"${sanitizeGraphQLValue(repo)}\"] }\n  ]) {\n    edges { node { id } }\n  }\n}`;\n}\n\ninterface TagQueryResponse {\n  data?: { transactions?: { edges?: { node?: { id?: string } }[] } };\n}\n\n/**\n * A resolver bound to one gateway: it asks `<gateway>/graphql` and nothing\n * else. Unresolvable is `null`, never a throw — a SHA that resolves nowhere\n * is a missing object, which the read pipeline already reports honestly.\n */\nexport function gatewayShaResolver(\n  gateway: string,\n  fetchFn?: GraphqlFetch\n): ShaResolver {\n  const endpoint = graphqlEndpointFor(gateway);\n  const post: GraphqlFetch =\n    fetchFn ?? ((url, init) => fetch(url, init) as ReturnType<GraphqlFetch>);\n\n  return async (sha, repo) => {\n    if (!FULL_SHA_RE.test(sha)) return null;\n\n    const key = `${endpoint}\\n${shaCacheKey(sha, repo)}`;\n    const cached = cache.get(key);\n    if (cached !== undefined) return cached;\n\n    let txId: string | undefined;\n    try {\n      const response = await post(endpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ query: tagQuery(sha, repo) }),\n        signal: AbortSignal.timeout(ARWEAVE_FETCH_TIMEOUT_MS),\n      });\n      if (!response.ok) return null;\n      const json = (await response.json()) as TagQueryResponse;\n      txId = json.data?.transactions?.edges?.[0]?.node?.id;\n    } catch {\n      return null;\n    }\n    if (txId === undefined || !isValidArweaveTxId(txId)) return null;\n\n    if (cache.size >= SHA_CACHE_MAX_SIZE) {\n      const oldest = cache.keys().next().value;\n      if (oldest !== undefined) cache.delete(oldest);\n    }\n    cache.set(key, txId);\n    return txId;\n  };\n}\n\n/**\n * The resolver a command hands `fetchRemoteState` as `resolveSha`: one bound\n * to the gateway this invocation was configured with (`--gateway`, else\n * `RIG_ARWEAVE_GATEWAY`), or — nothing configured — the shared\n * `resolveGitSha` itself, unchanged.\n *\n * This is the {@link configuredGateway} decision #176 introduced, applied to\n * the one read that was still leaving the configured permaweb.\n */\nexport function shaResolverFor(\n  flag: string | undefined,\n  env: NodeJS.ProcessEnv,\n  fetchFn?: GraphqlFetch\n): ShaResolver {\n  const gateway = configuredGateway(flag, env);\n  return gateway === null\n    ? resolveGitSha\n    : gatewayShaResolver(gateway, fetchFn);\n}\n"],"mappings":";;;;;;;;;AAeA,IAAM,kBAAkB;AAGjB,SAAS,iBAAiB,KAAsB;AACrD,MAAI;AACF,WAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG,EAAE,QAAQ;AAAA,EACpD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,IAAM,oBACX,iBAAiB,KAAK,gBAAgB,KAAK;AAGtC,SAAS,kBAAkB,SAA2B;AAC3D,QAAM,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AACpC,SAAO,iBAAiB,OAAO,CAAC,MAAM,EAAE,QAAQ,QAAQ,EAAE,MAAM,CAAC;AACnE;AAOO,IAAM,sBAAsB;AAG5B,SAAS,oBAAoB,KAAqB;AACvD,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAOO,SAAS,kBACd,MACA,KACe;AACf,QAAM,OAAO,QAAQ,IAAI,mBAAmB,KAAK,IAAI,KAAK;AAC1D,SAAO,QAAQ,KAAK,OAAO,oBAAoB,GAAG;AACpD;AAWO,SAAS,gBAAgB,SAA2B;AACzD,SAAO,CAAC,GAAG,oBAAoB,OAAO,CAAC,QAAQ,GAAG,gBAAgB;AACpE;AAYO,SAAS,aACd,MACA,KACmB;AACnB,QAAM,UAAU,kBAAkB,MAAM,GAAG;AAC3C,SAAO,YAAY,OAAO,mBAAmB,gBAAgB,OAAO;AACtE;;;AClBA,IAAM,cAAc;AAGpB,IAAM,qBAAqB;AAG3B,IAAM,QAAQ,oBAAI,IAAoB;AAY/B,SAAS,mBAAmB,SAAyB;AAC1D,SAAO,GAAG,oBAAoB,OAAO,CAAC;AACxC;AAMA,SAAS,qBAAqB,OAAuB;AAEnD,SAAO,MAAM,QAAQ,kBAAkB,EAAE;AAC3C;AAGA,SAAS,SAAS,KAAa,MAAsB;AACnD,SAAO;AAAA;AAAA,mCAE0B,qBAAqB,GAAG,CAAC;AAAA,gCAC5B,qBAAqB,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAK1D;AAWO,SAAS,mBACd,SACA,SACa;AACb,QAAM,WAAW,mBAAmB,OAAO;AAC3C,QAAM,OACJ,YAAY,CAAC,KAAK,SAAS,MAAM,KAAK,IAAI;AAE5C,SAAO,OAAO,KAAK,SAAS;AAC1B,QAAI,CAAC,YAAY,KAAK,GAAG,EAAG,QAAO;AAEnC,UAAM,MAAM,GAAG,QAAQ;AAAA,EAAK,YAAY,KAAK,IAAI,CAAC;AAClD,UAAM,SAAS,MAAM,IAAI,GAAG;AAC5B,QAAI,WAAW,OAAW,QAAO;AAEjC,QAAI;AACJ,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA,QACnD,QAAQ,YAAY,QAAQ,wBAAwB;AAAA,MACtD,CAAC;AACD,UAAI,CAAC,SAAS,GAAI,QAAO;AACzB,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,KAAK,MAAM,cAAc,QAAQ,CAAC,GAAG,MAAM;AAAA,IACpD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,SAAS,UAAa,CAAC,mBAAmB,IAAI,EAAG,QAAO;AAE5D,QAAI,MAAM,QAAQ,oBAAoB;AACpC,YAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,UAAI,WAAW,OAAW,OAAM,OAAO,MAAM;AAAA,IAC/C;AACA,UAAM,IAAI,KAAK,IAAI;AACnB,WAAO;AAAA,EACT;AACF;AAWO,SAAS,eACd,MACA,KACA,SACa;AACb,QAAM,UAAU,kBAAkB,MAAM,GAAG;AAC3C,SAAO,YAAY,OACf,gBACA,mBAAmB,SAAS,OAAO;AACzC;","names":[]}

package/dist/{ci-serve-AYFZOY4O.js → ci-serve-T33FCQVT.js}

@@ -1,14 +1,15 @@
 import {
-  PREFERRED_GATEWAY,
   WS_URL_RE,
   identityReport,
   loadPaidSession,
   renderIdentityLine,
   rigVersion,
   withForcedStandalone
-} from "./chunk-X232W4TG.js";
+} from "./chunk-J6Y3U645.js";
 import {
+  CI_LIVE_LOG_TAIL_INTERVAL_MS,
   CI_MANUAL_TRIGGER_KIND,
+  CI_RUNNER_CHANNEL_KEY,
   CI_SECRET_UPDATE_KIND,
   CI_SERVICE_REQUEST_KIND,
   CI_SERVICE_STOP_KIND,
@@ -16,6 +17,7 @@ import {
   applySecretUpdate,
   buildCiAdvertisement,
   buildCiJobResult,
+  buildCiLiveLogTail,
   buildCiWorkflowProgress,
   buildCiWorkflowResult,
   collectRepoObjects,
@@ -26,6 +28,8 @@ import {
   emitCliError,
   generateSecretsKey,
   hexToNpub,
+  liveLogTailBudget,
+  liveLogTailEventBudget,
   matchesPullRequest,
   matchesPush,
   missingObjectsMessage,
@@ -39,18 +43,24 @@ import {
   repoAddress,
   runGit,
   selectServiceRequests,
+  sliceLogTail,
   validateSecretUpdate,
   writeGitObjects
-} from "./chunk-DCGV6ALH.js";
+} from "./chunk-3IVO2MSZ.js";
+import {
+  PREFERRED_GATEWAY,
+  configuredGateway,
+  readGatewaysFor,
+  shaResolverFor
+} from "./chunk-XQ2AWNHQ.js";
 import {
-  ARWEAVE_GATEWAYS,
   REPOSITORY_STATE_KIND,
   authorizedStatusAuthors,
   defaultWebSocketFactory,
   fetchRemoteState,
   parseStateRefTags,
   queryRelay
-} from "./chunk-JBFBD7HV.js";
+} from "./chunk-S3KKQ4IC.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -431,7 +441,11 @@ var ActRunner = class {
             const line = buffered.slice(0, nl);
             buffered = buffered.slice(nl + 1);
             const parsedLine = parseActJsonLine(line);
-            if (!parsedLine) continue;
+            if (!parsedLine) {
+              request.onLog?.(CI_RUNNER_CHANNEL_KEY, `${line}
+`);
+              continue;
+            }
             lines.push(parsedLine);
             if (request.onLog && parsedLine.exitCode === void 0) {
               request.onLog(
@@ -444,7 +458,11 @@ var ActRunner = class {
         });
         stream.on("end", () => {
           const parsedLine = parseActJsonLine(buffered);
-          if (parsedLine) lines.push(parsedLine);
+          if (parsedLine) {
+            lines.push(parsedLine);
+          } else if (buffered !== "") {
+            request.onLog?.(CI_RUNNER_CHANNEL_KEY, buffered);
+          }
         });
       };
       consume(child.stdout);
@@ -463,7 +481,7 @@ var ActRunner = class {
         startedAtMs,
         (note) => {
           this.options.warn?.(note);
-          request.onLog?.("runner", `${note}
+          request.onLog?.(CI_RUNNER_CHANNEL_KEY, `${note}
 `);
         }
       );
@@ -890,6 +908,10 @@ var DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_ADVERTISEMENT_TTL = 30 * 60;
 var RENEW_FRACTION = 5 / 6;
 var LOG_TAIL_BYTES = 4096;
+var LOG_UPLOAD_CAP_BYTES = 1024 * 1024;
+var LOG_UPLOAD_HEAD_BYTES = 512 * 1024;
+var LOG_UPLOAD_MARKER_BUDGET_BYTES = 256;
+var LOG_UPLOAD_TAIL_BYTES = 512 * 1024 - LOG_UPLOAD_MARKER_BUDGET_BYTES;
 var SECRETS_KEY_MAX_AGE = 86400;
 function nowSeconds() {
   return Math.floor(Date.now() / 1e3);
@@ -903,6 +925,20 @@ function logTail(log) {
     omitted: bytes.byteLength - LOG_TAIL_BYTES
   };
 }
+function boundLogForUpload(log) {
+  const bytes = Buffer.from(log, "utf-8");
+  if (bytes.byteLength <= LOG_UPLOAD_CAP_BYTES) return bytes;
+  const head = bytes.subarray(0, LOG_UPLOAD_HEAD_BYTES);
+  const tail = bytes.subarray(bytes.byteLength - LOG_UPLOAD_TAIL_BYTES);
+  const omitted = bytes.byteLength - head.byteLength - tail.byteLength;
+  const marker = Buffer.from(
+    `
+[... ${omitted} bytes omitted (log capped at ${LOG_UPLOAD_CAP_BYTES} bytes) ...]
+`,
+    "utf-8"
+  );
+  return Buffer.concat([head, marker, tail]);
+}
 function gatewayRawUrl(gatewayUrl, txId) {
   return `${gatewayUrl.replace(/\/+$/, "")}/raw/${txId}`;
 }
@@ -1210,6 +1246,62 @@ async function startCoordinator(opts) {
       );
     };
     scheduleRenew();
+    const secretValues = Object.values(run.secrets);
+    const streamed = /* @__PURE__ */ new Map();
+    const finishedJobs = /* @__PURE__ */ new Set();
+    let tailClosed = false;
+    const recordLog = (jobId, chunk) => {
+      if (tailClosed || chunk === "") return;
+      streamed.set(jobId, (streamed.get(jobId) ?? "") + chunk);
+    };
+    const publishLiveLogTail = async () => {
+      const live = [];
+      for (const [key, text] of streamed) {
+        if (key !== CI_RUNNER_CHANNEL_KEY && finishedJobs.has(key)) continue;
+        live.push([key, redactSecretValues(text, secretValues)]);
+      }
+      const budget = liveLogTailBudget(live.length);
+      const jobs = [];
+      let runnerChannel;
+      for (const [key, text] of live) {
+        const sliced = sliceLogTail(text, budget);
+        if (key === CI_RUNNER_CHANNEL_KEY) runnerChannel = sliced;
+        else jobs.push({ job: key, ...sliced });
+      }
+      const now2 = clock();
+      try {
+        await publish(
+          buildCiLiveLogTail(
+            {
+              trigger,
+              runId: run.runId,
+              jobs,
+              ...runnerChannel ? { runner: runnerChannel } : {},
+              expiresAt: now2 + adTtl
+            },
+            now2
+          )
+        );
+      } catch (err) {
+        log(
+          `[ci] ${label}: live log tail not published: ${redactSecretValues(
+            err instanceof Error ? err.message : String(err),
+            secretValues
+          )}`
+        );
+      }
+    };
+    let tailTimer = null;
+    let tailPublished = false;
+    const scheduleTail = () => {
+      tailTimer = scheduler.setTimeout(() => {
+        if (tailClosed) return;
+        tailPublished = true;
+        void publishLiveLogTail();
+        scheduleTail();
+      }, CI_LIVE_LOG_TAIL_INTERVAL_MS);
+    };
+    scheduleTail();
     const abort = new AbortController();
     activeAborts.add(abort);
     run.abort = abort;
@@ -1227,6 +1319,7 @@ async function startCoordinator(opts) {
           trigger,
           secrets: run.secrets,
           timeoutMs,
+          onLog: recordLog,
           signal: abort.signal
         }),
         new Promise((resolve2) => {
@@ -1260,19 +1353,19 @@ async function startCoordinator(opts) {
     } finally {
       scheduler.clearTimeout(timeoutHandle);
       scheduler.clearTimeout(renewTimer);
+      scheduler.clearTimeout(tailTimer);
       activeAborts.delete(abort);
     }
     let conclusion = result.conclusion;
     if (timedOut) conclusion = "timed_out";
     else if (run.superseded || stopping && abort.signal.aborted)
       conclusion = "cancelled";
-    const secretValues = Object.values(run.secrets);
     for (const job of result.jobs) {
       const jobLog = redactSecretValues(job.log, secretValues);
       const { tail, omitted } = logTail(jobLog);
       const logReceipt = await serial.run(
         () => uploadBlob({
-          body: Buffer.from(jobLog, "utf-8"),
+          body: boundLogForUpload(jobLog),
           contentType: "text/plain; charset=utf-8",
           repoId: repo.repoId
         })
@@ -1334,8 +1427,11 @@ async function startCoordinator(opts) {
         pubkey: me,
         jobId: job.jobId
       });
+      finishedJobs.add(job.jobId);
       await publish(progress("in_progress"));
     }
+    if (tailPublished) await publishLiveLogTail();
+    tailClosed = true;
     const now = clock();
     const resultEventId = await publish(
       buildCiWorkflowResult(
@@ -2021,6 +2117,11 @@ Options:
   --act-bin <path>       the act executable (default: RIG_ACT_BIN, else PATH)
   --platform <label=img> runs-on label \u2192 Docker image; repeatable
                          (default: ubuntu-latest=${DEFAULT_ACT_PLATFORMS["ubuntu-latest"]})
+  --pull                 pull the runner image before each run (act's default)
+  --no-pull              never pull: run the image already on this host \u2014
+                         what a locally built or otherwise private runner
+                         image needs, since act cannot pull it (act's own
+                         spelling, --pull=false, is accepted too)
   --workdir <dir>        where commits are checked out for runs (default:
                          <state-dir>/work)
   --once                 stop after the first run concludes (its Workflow
@@ -2046,9 +2147,18 @@ half-published (story 15).
 Stop with Ctrl-C (SIGINT) or SIGTERM: active runs conclude \`cancelled\`.`;
 var ServeUsageError = class extends Error {
 };
+function pullSpelling(arg) {
+  if (!arg.startsWith("--pull=")) return arg;
+  const value = arg.slice("--pull=".length);
+  if (value === "false") return "--no-pull";
+  if (value === "true") return "--pull";
+  throw new ServeUsageError(
+    `--pull takes no value \u2014 use --pull or --no-pull, got ${JSON.stringify(arg)}`
+  );
+}
 function parseServeArgs(args) {
   const { values } = parseArgs({
-    args,
+    args: args.map(pullSpelling),
     options: {
       relay: { type: "string" },
       repo: { type: "string", multiple: true },
@@ -2058,6 +2168,8 @@ function parseServeArgs(args) {
       gateway: { type: "string" },
       "act-bin": { type: "string" },
       platform: { type: "string", multiple: true },
+      pull: { type: "boolean" },
+      "no-pull": { type: "boolean" },
       workdir: { type: "string" },
       once: { type: "boolean", default: false },
       json: { type: "boolean", default: false },
@@ -2133,6 +2245,10 @@ function parseServeArgs(args) {
       platforms[spec.slice(0, eq)] = spec.slice(eq + 1);
     }
   }
+  if (values.pull && values["no-pull"]) {
+    throw new ServeUsageError("--pull and --no-pull cannot both be given");
+  }
+  const pull = values.pull ? true : values["no-pull"] ? false : void 0;
   return {
     relay: values.relay,
     repos,
@@ -2142,18 +2258,26 @@ function parseServeArgs(args) {
     ...values.gateway !== void 0 ? { gateway: values.gateway } : {},
     ...values["act-bin"] !== void 0 ? { actBin: values["act-bin"] } : {},
     ...platforms ? { platforms } : {},
+    ...pull !== void 0 ? { pull } : {},
     ...values.workdir !== void 0 ? { workdir: values.workdir } : {},
     once: values.once,
     json: values.json
   };
 }
-function estimateRunCost(estimate) {
-  return BigInt(estimate.events) * estimate.rates.eventFee + BigInt(estimate.uploads) * uploadChargeFor(estimate.rates, 64 * 1024);
+function actRunnerOptions(flags) {
+  return {
+    ...flags.actBin !== void 0 ? { actBin: flags.actBin } : {},
+    ...flags.platforms ? { platforms: flags.platforms } : {},
+    ...flags.pull !== void 0 ? { pull: flags.pull } : {}
+  };
+}
+function estimateRunCost(estimate, runTimeoutMs) {
+  return BigInt(estimate.events) * estimate.rates.eventFee + BigInt(estimate.uploads) * uploadChargeFor(estimate.rates, LOG_UPLOAD_CAP_BYTES) + BigInt(liveLogTailEventBudget(runTimeoutMs)) * estimate.rates.eventFee;
 }
 function makeAffordabilityCheck(args) {
-  const { ctx, env, log } = args;
+  const { ctx, env, log, runTimeoutMs } = args;
   return async (estimate) => {
-    const cost = estimateRunCost(estimate);
+    const cost = estimateRunCost(estimate, runTimeoutMs);
     const store = new ChannelMapStore(resolveChannelPaths(env));
     const mine = store.list().filter(
       (record) => record.identity.toLowerCase() === ctx.ownerPubkey.toLowerCase() && record.supersededAt === void 0
@@ -2239,16 +2363,13 @@ async function runCiServe(args, deps) {
     io.err(CI_SERVE_USAGE);
     return 2;
   }
-  const gateway = (flags.gateway ?? forced.env["RIG_ARWEAVE_GATEWAY"] ?? PREFERRED_GATEWAY).replace(/\/+$/, "");
-  const readGateways = [`${gateway}/raw`, ...ARWEAVE_GATEWAYS];
+  const gateway = configuredGateway(flags.gateway, forced.env) ?? PREFERRED_GATEWAY;
+  const readGateways = readGatewaysFor(gateway);
   let runner;
   if (forced.runner) {
     runner = forced.runner;
   } else {
-    const act = new ActRunner({
-      ...flags.actBin !== void 0 ? { actBin: flags.actBin } : {},
-      ...flags.platforms ? { platforms: flags.platforms } : {}
-    });
+    const act = new ActRunner(actRunnerOptions(flags));
     if (act.binary(forced.env) === null) {
       io.err(
         "rig ci serve: the act executable was not found \u2014 install nektos/act (https://github.com/nektos/act) on this host, or point --act-bin / RIG_ACT_BIN at it. Nothing was started or paid."
@@ -2291,11 +2412,14 @@ async function runCiServe(args, deps) {
       canAfford: forced.canAfford ?? makeAffordabilityCheck({
         ctx,
         env: forced.env,
-        log: (line) => io.err(line)
+        log: (line) => io.err(line),
+        runTimeoutMs: flags.timeoutMs
       }),
       ...forced.webSocketFactory ? { webSocketFactory: forced.webSocketFactory } : {},
       ...forced.fetchFn ? { fetchFn: forced.fetchFn } : {},
-      ...forced.resolveSha ? { resolveSha: forced.resolveSha } : {},
+      // SHAs the object map does not cover are resolved against the SAME
+      // permaweb the objects are read from, not arweave.net (#183).
+      resolveSha: forced.resolveSha ?? shaResolverFor(flags.gateway, forced.env),
       ...forced.clock ? { clock: forced.clock } : {},
       ...firstRun ? { onRunConcluded: (run) => concludeFirstRun(run) } : {},
       log: (line) => io.err(line)
@@ -2365,8 +2489,10 @@ async function runCiServe(args, deps) {
 }
 export {
   CI_SERVE_USAGE,
+  actRunnerOptions,
   estimateRunCost,
   makeAffordabilityCheck,
+  parseServeArgs,
   runCiServe
 };
-//# sourceMappingURL=ci-serve-AYFZOY4O.js.map
+//# sourceMappingURL=ci-serve-T33FCQVT.js.map