@toon-protocol/rig 4.6.0 → 5.0.0

package/dist/chunk-ZQGXFFBP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/standalone/connector-publisher.ts"],"sourcesContent":["/**\n * The paid write path on `@toon-protocol/client` 4.x: a {@link Publisher}\n * that pays a TOON connector per request.\n *\n * Everything a paid command needs comes from one connector URL: the client\n * reads the node's own `GET /ilp` (addresses, prices, x402 batch-settlement\n * terms, sealing key: connector ADR 0050), opens or resumes an x402 channel,\n * and pays each request with a signed voucher for the running total\n * (connector ADR 0075). There is no relay to discover peers\n * on (kind:10032 was removed by ADR 0046) and no topology to negotiate: a\n * destination is a route the node prices, and `send()` pays what the route\n * costs — including the per-kibibyte part of an ADR 0065 schedule, which the\n * client works out from the sealed payload so this publisher never has to.\n *\n * Three request shapes, all ordinary paid POSTs:\n *\n *  1. `publishEvent` — a NIP-34 event signed with the OWNER's Nostr key,\n *     sent as `{ event }` to the publish route; the relay answers\n *     `{ eventId, storedAt, payment? }`.\n *  2. `uploadGitObject` / `uploadBlob` — a kind:5094 store job carrying the\n *     bytes base64 in an `i` tag; the store answers the Arweave tx id.\n *  3. `submitStoreJob` — a kind:5095 / 5096 job with `param` tags; the\n *     DVM's answer comes back as data, refusal included (ADR 0020: an answer\n *     is an answer, and the payer was charged for it).\n *\n * The store route may terminate on a different node than the one addressed\n * (the edge forwards it). Then the payload must be sealed to THAT node's\n * identity — `sealTo` — and, when the store node holds its own channel, paid\n * through its own client. Both are options here; the common single-node case\n * needs neither.\n */\n\nimport { finalizeEvent } from 'nostr-tools/pure';\nimport { contentTypeForPath, DEFAULT_CONTENT_TYPE } from '../mime.js';\nimport type { UnsignedEvent } from '../nip34-events.js';\nimport {\n  uploadChargeFor,\n  type BlobUpload,\n  type FeeRates,\n  type GitObjectUpload,\n  type PublishReceipt,\n  type Publisher,\n  type StoreJobRequest,\n  type StoreJobResponse,\n  type UploadReceipt,\n} from '../publisher.js';\n\n// ---------------------------------------------------------------------------\n// The slice of ToonClient this publisher drives (structural, so tests mock it)\n// ---------------------------------------------------------------------------\n\n/** A paid request, as `ToonClient.send` takes it. */\nexport interface PaidRequest {\n  method?: string;\n  target?: string;\n  headers?: Record<string, string> | [string, string][];\n  body?: string | Uint8Array | object;\n}\n\nexport interface PaidSendOptions {\n  /** The terminating connector's `GET /ilp` URL or raw key, on a forwarded route. */\n  sealTo?: string | Uint8Array;\n  timeoutMs?: number;\n}\n\nexport interface PaidFulfilled {\n  fulfilled: true;\n  status: number;\n  body: Uint8Array;\n  /** What this request paid; absent on a route priced at zero. */\n  claim?: { amount: bigint };\n}\n\nexport interface PaidRefused {\n  fulfilled: false;\n  code: string;\n  message: string;\n  refusedBy?: string;\n}\n\nexport type PaidSendResult = PaidFulfilled | PaidRefused;\n\n/** The route terms a connector publishes: a base price and an optional slope. */\nexport interface RouteTerms {\n  price: bigint;\n  pricePerKib?: bigint;\n}\n\n/** The slice of `ToonClient` (4.x) this publisher needs. */\nexport interface PaidClientLike {\n  send(\n    destination: string,\n    request: PaidRequest,\n    options?: PaidSendOptions\n  ): Promise<PaidSendResult>;\n  /** The node's terms for a destination, or `null` when it prices no such route. */\n  routePrice(destination: string): Promise<RouteTerms | null>;\n}\n\n/** One leg of the write path: who pays, where to, and whom to seal to. */\nexport interface PaidLeg {\n  client: PaidClientLike;\n  destination: string;\n  sealTo?: string | Uint8Array;\n}\n\nexport interface ConnectorPublisherOptions {\n  /** Pays the publish route and signs nothing — the Nostr key below signs. */\n  publish: PaidLeg;\n  /** Pays the store route (often the same client as `publish`). */\n  store: PaidLeg;\n  /** The owner's Nostr secret key: signs every event this publisher sends. */\n  nostrSecretKey: Uint8Array;\n  /**\n   * A configured per-event fee. Informational floor only: the connector's\n   * published price for the publish route wins when it is higher, and the\n   * client pays that price whatever this says.\n   */\n  eventFee?: bigint;\n  /** Per-packet timeout for uploads (the store's Arweave round trip). */\n  uploadTimeoutMs?: number;\n  warn?(line: string): void;\n}\n\nexport class ConnectorPublishError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ConnectorPublishError';\n  }\n}\n\nconst ARWEAVE_TX_ID_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\nfunction decodeUtf8(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n\nfunction nowSeconds(): number {\n  return Math.floor(Date.now() / 1000);\n}\n\nfunction describeRefusal(result: PaidRefused): string {\n  const by = result.refusedBy ? ` by the ${result.refusedBy}` : '';\n  return `${result.code}${by}: ${result.message}`;\n}\n\n/**\n * Read the Arweave tx id out of a store's kind:5094 answer.\n *\n * The store answers one of two ways — `{ txId }` as JSON, or the bare id\n * base64 in `data` — and refuses with `{ accept: false, error }`. A non-2xx\n * status is a refusal too; both are thrown, because an upload without an id\n * is an upload that did not happen (even though the packet was paid for).\n */\nexport function extractArweaveTxId(status: number, body: Uint8Array): string {\n  const text = decodeUtf8(body);\n  if (status < 200 || status >= 300) {\n    throw new ConnectorPublishError(\n      `the store answered HTTP ${String(status)}${text ? ` - ${text}` : ''}`\n    );\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    if (ARWEAVE_TX_ID_REGEX.test(text.trim())) return text.trim();\n    throw new ConnectorPublishError(\n      `the store's answer was not valid JSON: ${JSON.stringify(text.slice(0, 200))}`\n    );\n  }\n  const answer = (parsed ?? {}) as {\n    accept?: unknown;\n    error?: unknown;\n    txId?: unknown;\n    data?: unknown;\n    result?: unknown;\n  };\n  if (answer.accept === false) {\n    const reason = typeof answer.error === 'string' ? `: ${answer.error}` : '';\n    throw new ConnectorPublishError(\n      `upload refused by the store (accept:false)${reason}`\n    );\n  }\n  if (\n    typeof answer.txId === 'string' &&\n    ARWEAVE_TX_ID_REGEX.test(answer.txId)\n  ) {\n    return answer.txId;\n  }\n  const nested = answer.result as { txId?: unknown } | undefined;\n  if (\n    nested &&\n    typeof nested.txId === 'string' &&\n    ARWEAVE_TX_ID_REGEX.test(nested.txId)\n  ) {\n    return nested.txId;\n  }\n  if (typeof answer.data === 'string' && answer.data.length > 0) {\n    const decoded = Buffer.from(answer.data, 'base64').toString('utf8');\n    if (ARWEAVE_TX_ID_REGEX.test(decoded)) return decoded;\n  }\n  throw new ConnectorPublishError(\n    `the store's answer carried no Arweave tx id: ${JSON.stringify(text.slice(0, 200))}`\n  );\n}\n\n// ---------------------------------------------------------------------------\n// The publisher\n// ---------------------------------------------------------------------------\n\nexport class ConnectorPublisher implements Publisher {\n  private readonly publish: PaidLeg;\n  private readonly store: PaidLeg;\n  private readonly nostrSecretKey: Uint8Array;\n  private readonly configuredEventFee: bigint;\n  private readonly uploadTimeoutMs: number | undefined;\n  private readonly warn: (line: string) => void;\n  private rates: Promise<FeeRates> | undefined;\n\n  constructor(options: ConnectorPublisherOptions) {\n    this.publish = options.publish;\n    this.store = options.store;\n    this.nostrSecretKey = options.nostrSecretKey;\n    this.configuredEventFee = options.eventFee ?? 0n;\n    this.uploadTimeoutMs = options.uploadTimeoutMs;\n    this.warn = options.warn ?? (() => undefined);\n  }\n\n  /** Where events go, and where objects go. */\n  get destinations(): { publish: string; store: string } {\n    return { publish: this.publish.destination, store: this.store.destination };\n  }\n\n  /**\n   * The two routes' published terms, read once per publisher. A route the\n   * node does not price is a configuration error and says which knob to fix.\n   */\n  getFeeRates(): Promise<FeeRates> {\n    this.rates ??= this.readFeeRates();\n    return this.rates;\n  }\n\n  private async readFeeRates(): Promise<FeeRates> {\n    const [publishTerms, storeTerms] = await Promise.all([\n      this.publish.client.routePrice(this.publish.destination),\n      this.store.client.routePrice(this.store.destination),\n    ]);\n    if (!publishTerms) {\n      throw new ConnectorPublishError(\n        `the connector prices no route for the publish destination ${this.publish.destination} ` +\n          '(set publishDestination / TOON_CLIENT_PUBLISH_DESTINATION to one of its GET /ilp routes)'\n      );\n    }\n    if (!storeTerms) {\n      throw new ConnectorPublishError(\n        `the connector prices no route for the store destination ${this.store.destination} ` +\n          '(set storeDestination / TOON_CLIENT_STORE_DESTINATION to one of its GET /ilp routes)'\n      );\n    }\n    if (\n      publishTerms.pricePerKib !== undefined &&\n      publishTerms.pricePerKib > 0n\n    ) {\n      this.warn(\n        `rig: the publish route ${this.publish.destination} meters by size ` +\n          `(${String(publishTerms.pricePerKib)}/KiB); the per-event estimate shows its base price only`\n      );\n    }\n    const eventFee =\n      this.configuredEventFee > publishTerms.price\n        ? this.configuredEventFee\n        : publishTerms.price;\n    return {\n      uploadFee: storeTerms.price,\n      ...(storeTerms.pricePerKib !== undefined && storeTerms.pricePerKib > 0n\n        ? { uploadPerKib: storeTerms.pricePerKib }\n        : {}),\n      eventFee,\n    };\n  }\n\n  private sign(template: UnsignedEvent) {\n    return finalizeEvent(\n      {\n        kind: template.kind,\n        content: template.content,\n        tags: template.tags,\n        created_at: template.created_at,\n      },\n      this.nostrSecretKey\n    );\n  }\n\n  /** One paid kind:5094 write; returns the tx id and what the voucher spent. */\n  private async storeWrite(\n    tags: string[][],\n    bodyBytes: number,\n    what: string\n  ): Promise<UploadReceipt> {\n    const rates = await this.getFeeRates();\n    const estimate = uploadChargeFor(rates, bodyBytes);\n    const event = this.sign({\n      kind: 5094,\n      content: '',\n      created_at: nowSeconds(),\n      tags: [...tags, ['bid', estimate.toString(), 'usdc']],\n    });\n    const result = await this.store.client.send(\n      this.store.destination,\n      { body: { event } },\n      {\n        ...(this.store.sealTo !== undefined\n          ? { sealTo: this.store.sealTo }\n          : {}),\n        ...(this.uploadTimeoutMs !== undefined\n          ? { timeoutMs: this.uploadTimeoutMs }\n          : {}),\n      }\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `${what} rejected — ${describeRefusal(result)}`\n      );\n    }\n    let txId: string;\n    try {\n      txId = extractArweaveTxId(result.status, result.body);\n    } catch (err) {\n      throw new ConnectorPublishError(\n        `${what}: ${err instanceof Error ? err.message : String(err)}`\n      );\n    }\n    return { txId, feePaid: result.claim?.amount ?? estimate };\n  }\n\n  async uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt> {\n    // No size gate (#102): the store route prices per KiB, so a body above\n    // FREE_TIER_MAX_ITEM_BYTES is a paid upload rather than a refusal.\n    const contentType =\n      upload.type === 'blob'\n        ? contentTypeForPath(upload.path)\n        : DEFAULT_CONTENT_TYPE;\n    return this.storeWrite(\n      [\n        ['i', upload.body.toString('base64'), 'blob'],\n        ['output', contentType],\n        ['Git-SHA', upload.sha],\n        ['Git-Type', upload.type],\n        ['Repo', upload.repoId],\n      ],\n      upload.body.length,\n      `git-object upload (${upload.sha})`\n    );\n  }\n\n  async uploadBlob(upload: BlobUpload): Promise<UploadReceipt> {\n    // No size gate (#102), matching uploadGitObject: the store route prices\n    // per KiB, so a blob above FREE_TIER_MAX_ITEM_BYTES costs more rather than\n    // being refused.\n    return this.storeWrite(\n      [\n        ['i', upload.body.toString('base64'), 'blob'],\n        ['output', upload.contentType],\n        ...(upload.repoId ? [['Repo', upload.repoId]] : []),\n      ],\n      upload.body.length,\n      'blob upload'\n    );\n  }\n\n  /**\n   * One NIP-90 job to the store node's DVM, over the paid path. A refusal is\n   * returned, not thrown: `accept: false` and a non-2xx status are the\n   * answer's content, and the payer was charged for the answer (ADR 0020).\n   */\n  async submitStoreJob(request: StoreJobRequest): Promise<StoreJobResponse> {\n    const rates = await this.getFeeRates();\n    const fee = rates.uploadFee;\n    const event = this.sign({\n      kind: request.kind,\n      content: '',\n      created_at: nowSeconds(),\n      tags: [\n        ...request.params.map(([key, value]) => ['param', key, value]),\n        ['bid', fee.toString(), 'usdc'],\n      ],\n    });\n    const result = await this.store.client.send(\n      this.store.destination,\n      { body: { event } },\n      this.store.sealTo !== undefined ? { sealTo: this.store.sealTo } : {}\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `kind:${String(request.kind)} job rejected — ${describeRefusal(result)}`\n      );\n    }\n    const text = decodeUtf8(result.body);\n    let body: {\n      accept?: unknown;\n      code?: unknown;\n      message?: unknown;\n      result?: unknown;\n    };\n    try {\n      body = JSON.parse(text) as typeof body;\n    } catch {\n      throw new ConnectorPublishError(\n        `kind:${String(request.kind)} job answer was not valid JSON ` +\n          `(HTTP ${String(result.status)}): ${JSON.stringify(text.slice(0, 200))}`\n      );\n    }\n    return {\n      status: result.status,\n      accept: body.accept === true,\n      ...(typeof body.code === 'string' ? { code: body.code } : {}),\n      ...(typeof body.message === 'string' ? { message: body.message } : {}),\n      ...(body.result !== null && typeof body.result === 'object'\n        ? { result: body.result as Record<string, unknown> }\n        : {}),\n      feePaid: result.claim?.amount ?? fee,\n    };\n  }\n\n  /**\n   * Sign the event with the owner's key and pay to publish it. `relayUrls`\n   * is the seam's plural surface: this publisher routes to one configured\n   * destination, so more than one relay is refused rather than half-done.\n   */\n  async publishEvent(\n    event: UnsignedEvent,\n    relayUrls: string[]\n  ): Promise<PublishReceipt> {\n    if (relayUrls.length > 1) {\n      throw new ConnectorPublishError(\n        `multi-relay publish is not supported (got ${String(relayUrls.length)} relays) — ` +\n          'the connector publisher routes to a single publish destination'\n      );\n    }\n    const rates = await this.getFeeRates();\n    const signed = this.sign(event);\n    const result = await this.publish.client.send(\n      this.publish.destination,\n      { body: { event: signed } },\n      this.publish.sealTo !== undefined ? { sealTo: this.publish.sealTo } : {}\n    );\n    if (!result.fulfilled) {\n      throw new ConnectorPublishError(\n        `publish rejected (kind ${String(event.kind)}) — ${describeRefusal(result)}`\n      );\n    }\n    if (result.status < 200 || result.status >= 300) {\n      throw new ConnectorPublishError(\n        `publish (kind ${String(event.kind)}): the relay answered HTTP ${String(result.status)} - ${decodeUtf8(result.body)}`\n      );\n    }\n    let eventId = signed.id;\n    try {\n      const answer = JSON.parse(decodeUtf8(result.body)) as {\n        eventId?: unknown;\n      };\n      if (typeof answer.eventId === 'string' && answer.eventId)\n        eventId = answer.eventId;\n    } catch {\n      // A 2xx without a JSON body still stored the event we signed.\n    }\n    return { eventId, feePaid: result.claim?.amount ?? rates.eventFee };\n  }\n}\n"],"mappings":";;;;;;;;;AAgCA,SAAS,qBAAqB;AA4FvB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,sBAAsB;AAE5B,SAAS,WAAW,OAA2B;AAC7C,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAEA,SAAS,aAAqB;AAC5B,SAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrC;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,KAAK,OAAO,YAAY,WAAW,OAAO,SAAS,KAAK;AAC9D,SAAO,GAAG,OAAO,IAAI,GAAG,EAAE,KAAK,OAAO,OAAO;AAC/C;AAUO,SAAS,mBAAmB,QAAgB,MAA0B;AAC3E,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,SAAS,OAAO,UAAU,KAAK;AACjC,UAAM,IAAI;AAAA,MACR,2BAA2B,OAAO,MAAM,CAAC,GAAG,OAAO,MAAM,IAAI,KAAK,EAAE;AAAA,IACtE;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,QAAI,oBAAoB,KAAK,KAAK,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAC5D,UAAM,IAAI;AAAA,MACR,0CAA0C,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,SAAU,UAAU,CAAC;AAO3B,MAAI,OAAO,WAAW,OAAO;AAC3B,UAAM,SAAS,OAAO,OAAO,UAAU,WAAW,KAAK,OAAO,KAAK,KAAK;AACxE,UAAM,IAAI;AAAA,MACR,6CAA6C,MAAM;AAAA,IACrD;AAAA,EACF;AACA,MACE,OAAO,OAAO,SAAS,YACvB,oBAAoB,KAAK,OAAO,IAAI,GACpC;AACA,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO;AACtB,MACE,UACA,OAAO,OAAO,SAAS,YACvB,oBAAoB,KAAK,OAAO,IAAI,GACpC;AACA,WAAO,OAAO;AAAA,EAChB;AACA,MAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,GAAG;AAC7D,UAAM,UAAU,OAAO,KAAK,OAAO,MAAM,QAAQ,EAAE,SAAS,MAAM;AAClE,QAAI,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAAA,EAChD;AACA,QAAM,IAAI;AAAA,IACR,gDAAgD,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,EACpF;AACF;AAMO,IAAM,qBAAN,MAA8C;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAoC;AAC9C,SAAK,UAAU,QAAQ;AACvB,SAAK,QAAQ,QAAQ;AACrB,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,qBAAqB,QAAQ,YAAY;AAC9C,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,OAAO,QAAQ,SAAS,MAAM;AAAA,EACrC;AAAA;AAAA,EAGA,IAAI,eAAmD;AACrD,WAAO,EAAE,SAAS,KAAK,QAAQ,aAAa,OAAO,KAAK,MAAM,YAAY;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAiC;AAC/B,SAAK,UAAU,KAAK,aAAa;AACjC,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,eAAkC;AAC9C,UAAM,CAAC,cAAc,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,MACnD,KAAK,QAAQ,OAAO,WAAW,KAAK,QAAQ,WAAW;AAAA,MACvD,KAAK,MAAM,OAAO,WAAW,KAAK,MAAM,WAAW;AAAA,IACrD,CAAC;AACD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR,6DAA6D,KAAK,QAAQ,WAAW;AAAA,MAEvF;AAAA,IACF;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,2DAA2D,KAAK,MAAM,WAAW;AAAA,MAEnF;AAAA,IACF;AACA,QACE,aAAa,gBAAgB,UAC7B,aAAa,cAAc,IAC3B;AACA,WAAK;AAAA,QACH,0BAA0B,KAAK,QAAQ,WAAW,oBAC5C,OAAO,aAAa,WAAW,CAAC;AAAA,MACxC;AAAA,IACF;AACA,UAAM,WACJ,KAAK,qBAAqB,aAAa,QACnC,KAAK,qBACL,aAAa;AACnB,WAAO;AAAA,MACL,WAAW,WAAW;AAAA,MACtB,GAAI,WAAW,gBAAgB,UAAa,WAAW,cAAc,KACjE,EAAE,cAAc,WAAW,YAAY,IACvC,CAAC;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,KAAK,UAAyB;AACpC,WAAO;AAAA,MACL;AAAA,QACE,MAAM,SAAS;AAAA,QACf,SAAS,SAAS;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,YAAY,SAAS;AAAA,MACvB;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,WACZ,MACA,WACA,MACwB;AACxB,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,WAAW,gBAAgB,OAAO,SAAS;AACjD,UAAM,QAAQ,KAAK,KAAK;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY,WAAW;AAAA,MACvB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,SAAS,SAAS,GAAG,MAAM,CAAC;AAAA,IACtD,CAAC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,OAAO;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,MAClB;AAAA,QACE,GAAI,KAAK,MAAM,WAAW,SACtB,EAAE,QAAQ,KAAK,MAAM,OAAO,IAC5B,CAAC;AAAA,QACL,GAAI,KAAK,oBAAoB,SACzB,EAAE,WAAW,KAAK,gBAAgB,IAClC,CAAC;AAAA,MACP;AAAA,IACF;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,oBAAe,gBAAgB,MAAM,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,mBAAmB,OAAO,QAAQ,OAAO,IAAI;AAAA,IACtD,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,GAAG,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AACA,WAAO,EAAE,MAAM,SAAS,OAAO,OAAO,UAAU,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,gBAAgB,QAAiD;AAGrE,UAAM,cACJ,OAAO,SAAS,SACZ,mBAAmB,OAAO,IAAI,IAC9B;AACN,WAAO,KAAK;AAAA,MACV;AAAA,QACE,CAAC,KAAK,OAAO,KAAK,SAAS,QAAQ,GAAG,MAAM;AAAA,QAC5C,CAAC,UAAU,WAAW;AAAA,QACtB,CAAC,WAAW,OAAO,GAAG;AAAA,QACtB,CAAC,YAAY,OAAO,IAAI;AAAA,QACxB,CAAC,QAAQ,OAAO,MAAM;AAAA,MACxB;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,sBAAsB,OAAO,GAAG;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAA4C;AAI3D,WAAO,KAAK;AAAA,MACV;AAAA,QACE,CAAC,KAAK,OAAO,KAAK,SAAS,QAAQ,GAAG,MAAM;AAAA,QAC5C,CAAC,UAAU,OAAO,WAAW;AAAA,QAC7B,GAAI,OAAO,SAAS,CAAC,CAAC,QAAQ,OAAO,MAAM,CAAC,IAAI,CAAC;AAAA,MACnD;AAAA,MACA,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,SAAqD;AACxE,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,MAAM,MAAM;AAClB,UAAM,QAAQ,KAAK,KAAK;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,SAAS;AAAA,MACT,YAAY,WAAW;AAAA,MACvB,MAAM;AAAA,QACJ,GAAG,QAAQ,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC;AAAA,QAC7D,CAAC,OAAO,IAAI,SAAS,GAAG,MAAM;AAAA,MAChC;AAAA,IACF,CAAC;AACD,UAAM,SAAS,MAAM,KAAK,MAAM,OAAO;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,EAAE,MAAM,EAAE,MAAM,EAAE;AAAA,MAClB,KAAK,MAAM,WAAW,SAAY,EAAE,QAAQ,KAAK,MAAM,OAAO,IAAI,CAAC;AAAA,IACrE;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,QAAQ,IAAI,CAAC,wBAAmB,gBAAgB,MAAM,CAAC;AAAA,MACxE;AAAA,IACF;AACA,UAAM,OAAO,WAAW,OAAO,IAAI;AACnC,QAAI;AAMJ,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,QAAQ,IAAI,CAAC,wCACjB,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,QAAQ,KAAK,WAAW;AAAA,MACxB,GAAI,OAAO,KAAK,SAAS,WAAW,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MAC3D,GAAI,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,WAAW,QAAQ,OAAO,KAAK,WAAW,WAC/C,EAAE,QAAQ,KAAK,OAAkC,IACjD,CAAC;AAAA,MACL,SAAS,OAAO,OAAO,UAAU;AAAA,IACnC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aACJ,OACA,WACyB;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,6CAA6C,OAAO,UAAU,MAAM,CAAC;AAAA,MAEvE;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,KAAK,YAAY;AACrC,UAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,UAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AAAA,MACvC,KAAK,QAAQ;AAAA,MACb,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE;AAAA,MAC1B,KAAK,QAAQ,WAAW,SAAY,EAAE,QAAQ,KAAK,QAAQ,OAAO,IAAI,CAAC;AAAA,IACzE;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,0BAA0B,OAAO,MAAM,IAAI,CAAC,YAAO,gBAAgB,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF;AACA,QAAI,OAAO,SAAS,OAAO,OAAO,UAAU,KAAK;AAC/C,YAAM,IAAI;AAAA,QACR,iBAAiB,OAAO,MAAM,IAAI,CAAC,8BAA8B,OAAO,OAAO,MAAM,CAAC,MAAM,WAAW,OAAO,IAAI,CAAC;AAAA,MACrH;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACrB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,WAAW,OAAO,IAAI,CAAC;AAGjD,UAAI,OAAO,OAAO,YAAY,YAAY,OAAO;AAC/C,kBAAU,OAAO;AAAA,IACrB,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,SAAS,SAAS,OAAO,OAAO,UAAU,MAAM,SAAS;AAAA,EACpE;AACF;","names":[]}

package/dist/{ci-serve-AYFZOY4O.js → ci-serve-BU7NDT7O.js}

@@ -1,14 +1,15 @@
 import {
-  PREFERRED_GATEWAY,
   WS_URL_RE,
   identityReport,
   loadPaidSession,
   renderIdentityLine,
   rigVersion,
   withForcedStandalone
-} from "./chunk-X232W4TG.js";
+} from "./chunk-2TG4YHEC.js";
 import {
+  CI_LIVE_LOG_TAIL_INTERVAL_MS,
   CI_MANUAL_TRIGGER_KIND,
+  CI_RUNNER_CHANNEL_KEY,
   CI_SECRET_UPDATE_KIND,
   CI_SERVICE_REQUEST_KIND,
   CI_SERVICE_STOP_KIND,
@@ -16,6 +17,7 @@ import {
   applySecretUpdate,
   buildCiAdvertisement,
   buildCiJobResult,
+  buildCiLiveLogTail,
   buildCiWorkflowProgress,
   buildCiWorkflowResult,
   collectRepoObjects,
@@ -26,6 +28,8 @@ import {
   emitCliError,
   generateSecretsKey,
   hexToNpub,
+  liveLogTailBudget,
+  liveLogTailEventBudget,
   matchesPullRequest,
   matchesPush,
   missingObjectsMessage,
@@ -39,27 +43,33 @@ import {
   repoAddress,
   runGit,
   selectServiceRequests,
+  sliceLogTail,
   validateSecretUpdate,
   writeGitObjects
-} from "./chunk-DCGV6ALH.js";
+} from "./chunk-4WVH2ITA.js";
+import {
+  PREFERRED_GATEWAY,
+  configuredGateway,
+  readGatewaysFor,
+  shaResolverFor
+} from "./chunk-CHVOXCDV.js";
 import {
-  ARWEAVE_GATEWAYS,
   REPOSITORY_STATE_KIND,
   authorizedStatusAuthors,
   defaultWebSocketFactory,
   fetchRemoteState,
   parseStateRefTags,
   queryRelay
-} from "./chunk-JBFBD7HV.js";
+} from "./chunk-QKL53YZS.js";
 import {
   ChannelMapStore,
   channelStatus,
   contentTypeForPath,
   resolveChannelPaths
-} from "./chunk-XCLUB2CY.js";
+} from "./chunk-LMZSAFAB.js";
 import {
   uploadChargeFor
-} from "./chunk-U5A7MHBP.js";
+} from "./chunk-7VIVQHRG.js";
 
 // src/cli/ci-serve.ts
 import { join as join4 } from "path";
@@ -431,7 +441,11 @@ var ActRunner = class {
             const line = buffered.slice(0, nl);
             buffered = buffered.slice(nl + 1);
             const parsedLine = parseActJsonLine(line);
-            if (!parsedLine) continue;
+            if (!parsedLine) {
+              request.onLog?.(CI_RUNNER_CHANNEL_KEY, `${line}
+`);
+              continue;
+            }
             lines.push(parsedLine);
             if (request.onLog && parsedLine.exitCode === void 0) {
               request.onLog(
@@ -444,7 +458,11 @@ var ActRunner = class {
         });
         stream.on("end", () => {
           const parsedLine = parseActJsonLine(buffered);
-          if (parsedLine) lines.push(parsedLine);
+          if (parsedLine) {
+            lines.push(parsedLine);
+          } else if (buffered !== "") {
+            request.onLog?.(CI_RUNNER_CHANNEL_KEY, buffered);
+          }
         });
       };
       consume(child.stdout);
@@ -463,7 +481,7 @@ var ActRunner = class {
         startedAtMs,
         (note) => {
           this.options.warn?.(note);
-          request.onLog?.("runner", `${note}
+          request.onLog?.(CI_RUNNER_CHANNEL_KEY, `${note}
 `);
         }
       );
@@ -890,6 +908,10 @@ var DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_ADVERTISEMENT_TTL = 30 * 60;
 var RENEW_FRACTION = 5 / 6;
 var LOG_TAIL_BYTES = 4096;
+var LOG_UPLOAD_CAP_BYTES = 1024 * 1024;
+var LOG_UPLOAD_HEAD_BYTES = 512 * 1024;
+var LOG_UPLOAD_MARKER_BUDGET_BYTES = 256;
+var LOG_UPLOAD_TAIL_BYTES = 512 * 1024 - LOG_UPLOAD_MARKER_BUDGET_BYTES;
 var SECRETS_KEY_MAX_AGE = 86400;
 function nowSeconds() {
   return Math.floor(Date.now() / 1e3);
@@ -903,6 +925,20 @@ function logTail(log) {
     omitted: bytes.byteLength - LOG_TAIL_BYTES
   };
 }
+function boundLogForUpload(log) {
+  const bytes = Buffer.from(log, "utf-8");
+  if (bytes.byteLength <= LOG_UPLOAD_CAP_BYTES) return bytes;
+  const head = bytes.subarray(0, LOG_UPLOAD_HEAD_BYTES);
+  const tail = bytes.subarray(bytes.byteLength - LOG_UPLOAD_TAIL_BYTES);
+  const omitted = bytes.byteLength - head.byteLength - tail.byteLength;
+  const marker = Buffer.from(
+    `
+[... ${omitted} bytes omitted (log capped at ${LOG_UPLOAD_CAP_BYTES} bytes) ...]
+`,
+    "utf-8"
+  );
+  return Buffer.concat([head, marker, tail]);
+}
 function gatewayRawUrl(gatewayUrl, txId) {
   return `${gatewayUrl.replace(/\/+$/, "")}/raw/${txId}`;
 }
@@ -1210,6 +1246,62 @@ async function startCoordinator(opts) {
       );
     };
     scheduleRenew();
+    const secretValues = Object.values(run.secrets);
+    const streamed = /* @__PURE__ */ new Map();
+    const finishedJobs = /* @__PURE__ */ new Set();
+    let tailClosed = false;
+    const recordLog = (jobId, chunk) => {
+      if (tailClosed || chunk === "") return;
+      streamed.set(jobId, (streamed.get(jobId) ?? "") + chunk);
+    };
+    const publishLiveLogTail = async () => {
+      const live = [];
+      for (const [key, text] of streamed) {
+        if (key !== CI_RUNNER_CHANNEL_KEY && finishedJobs.has(key)) continue;
+        live.push([key, redactSecretValues(text, secretValues)]);
+      }
+      const budget = liveLogTailBudget(live.length);
+      const jobs = [];
+      let runnerChannel;
+      for (const [key, text] of live) {
+        const sliced = sliceLogTail(text, budget);
+        if (key === CI_RUNNER_CHANNEL_KEY) runnerChannel = sliced;
+        else jobs.push({ job: key, ...sliced });
+      }
+      const now2 = clock();
+      try {
+        await publish(
+          buildCiLiveLogTail(
+            {
+              trigger,
+              runId: run.runId,
+              jobs,
+              ...runnerChannel ? { runner: runnerChannel } : {},
+              expiresAt: now2 + adTtl
+            },
+            now2
+          )
+        );
+      } catch (err) {
+        log(
+          `[ci] ${label}: live log tail not published: ${redactSecretValues(
+            err instanceof Error ? err.message : String(err),
+            secretValues
+          )}`
+        );
+      }
+    };
+    let tailTimer = null;
+    let tailPublished = false;
+    const scheduleTail = () => {
+      tailTimer = scheduler.setTimeout(() => {
+        if (tailClosed) return;
+        tailPublished = true;
+        void publishLiveLogTail();
+        scheduleTail();
+      }, CI_LIVE_LOG_TAIL_INTERVAL_MS);
+    };
+    scheduleTail();
     const abort = new AbortController();
     activeAborts.add(abort);
     run.abort = abort;
@@ -1227,6 +1319,7 @@ async function startCoordinator(opts) {
           trigger,
           secrets: run.secrets,
           timeoutMs,
+          onLog: recordLog,
           signal: abort.signal
         }),
         new Promise((resolve2) => {
@@ -1260,19 +1353,19 @@ async function startCoordinator(opts) {
     } finally {
       scheduler.clearTimeout(timeoutHandle);
       scheduler.clearTimeout(renewTimer);
+      scheduler.clearTimeout(tailTimer);
       activeAborts.delete(abort);
     }
     let conclusion = result.conclusion;
     if (timedOut) conclusion = "timed_out";
     else if (run.superseded || stopping && abort.signal.aborted)
       conclusion = "cancelled";
-    const secretValues = Object.values(run.secrets);
     for (const job of result.jobs) {
       const jobLog = redactSecretValues(job.log, secretValues);
       const { tail, omitted } = logTail(jobLog);
       const logReceipt = await serial.run(
         () => uploadBlob({
-          body: Buffer.from(jobLog, "utf-8"),
+          body: boundLogForUpload(jobLog),
           contentType: "text/plain; charset=utf-8",
           repoId: repo.repoId
         })
@@ -1334,8 +1427,11 @@ async function startCoordinator(opts) {
         pubkey: me,
         jobId: job.jobId
       });
+      finishedJobs.add(job.jobId);
       await publish(progress("in_progress"));
     }
+    if (tailPublished) await publishLiveLogTail();
+    tailClosed = true;
     const now = clock();
     const resultEventId = await publish(
       buildCiWorkflowResult(
@@ -2021,6 +2117,11 @@ Options:
   --act-bin <path>       the act executable (default: RIG_ACT_BIN, else PATH)
   --platform <label=img> runs-on label \u2192 Docker image; repeatable
                          (default: ubuntu-latest=${DEFAULT_ACT_PLATFORMS["ubuntu-latest"]})
+  --pull                 pull the runner image before each run (act's default)
+  --no-pull              never pull: run the image already on this host \u2014
+                         what a locally built or otherwise private runner
+                         image needs, since act cannot pull it (act's own
+                         spelling, --pull=false, is accepted too)
   --workdir <dir>        where commits are checked out for runs (default:
                          <state-dir>/work)
   --once                 stop after the first run concludes (its Workflow
@@ -2046,9 +2147,18 @@ half-published (story 15).
 Stop with Ctrl-C (SIGINT) or SIGTERM: active runs conclude \`cancelled\`.`;
 var ServeUsageError = class extends Error {
 };
+function pullSpelling(arg) {
+  if (!arg.startsWith("--pull=")) return arg;
+  const value = arg.slice("--pull=".length);
+  if (value === "false") return "--no-pull";
+  if (value === "true") return "--pull";
+  throw new ServeUsageError(
+    `--pull takes no value \u2014 use --pull or --no-pull, got ${JSON.stringify(arg)}`
+  );
+}
 function parseServeArgs(args) {
   const { values } = parseArgs({
-    args,
+    args: args.map(pullSpelling),
     options: {
       relay: { type: "string" },
       repo: { type: "string", multiple: true },
@@ -2058,6 +2168,8 @@ function parseServeArgs(args) {
       gateway: { type: "string" },
       "act-bin": { type: "string" },
       platform: { type: "string", multiple: true },
+      pull: { type: "boolean" },
+      "no-pull": { type: "boolean" },
       workdir: { type: "string" },
       once: { type: "boolean", default: false },
       json: { type: "boolean", default: false },
@@ -2133,6 +2245,10 @@ function parseServeArgs(args) {
       platforms[spec.slice(0, eq)] = spec.slice(eq + 1);
     }
   }
+  if (values.pull && values["no-pull"]) {
+    throw new ServeUsageError("--pull and --no-pull cannot both be given");
+  }
+  const pull = values.pull ? true : values["no-pull"] ? false : void 0;
   return {
     relay: values.relay,
     repos,
@@ -2142,18 +2258,26 @@ function parseServeArgs(args) {
     ...values.gateway !== void 0 ? { gateway: values.gateway } : {},
     ...values["act-bin"] !== void 0 ? { actBin: values["act-bin"] } : {},
     ...platforms ? { platforms } : {},
+    ...pull !== void 0 ? { pull } : {},
     ...values.workdir !== void 0 ? { workdir: values.workdir } : {},
     once: values.once,
     json: values.json
   };
 }
-function estimateRunCost(estimate) {
-  return BigInt(estimate.events) * estimate.rates.eventFee + BigInt(estimate.uploads) * uploadChargeFor(estimate.rates, 64 * 1024);
+function actRunnerOptions(flags) {
+  return {
+    ...flags.actBin !== void 0 ? { actBin: flags.actBin } : {},
+    ...flags.platforms ? { platforms: flags.platforms } : {},
+    ...flags.pull !== void 0 ? { pull: flags.pull } : {}
+  };
+}
+function estimateRunCost(estimate, runTimeoutMs) {
+  return BigInt(estimate.events) * estimate.rates.eventFee + BigInt(estimate.uploads) * uploadChargeFor(estimate.rates, LOG_UPLOAD_CAP_BYTES) + BigInt(liveLogTailEventBudget(runTimeoutMs)) * estimate.rates.eventFee;
 }
 function makeAffordabilityCheck(args) {
-  const { ctx, env, log } = args;
+  const { ctx, env, log, runTimeoutMs } = args;
   return async (estimate) => {
-    const cost = estimateRunCost(estimate);
+    const cost = estimateRunCost(estimate, runTimeoutMs);
     const store = new ChannelMapStore(resolveChannelPaths(env));
     const mine = store.list().filter(
       (record) => record.identity.toLowerCase() === ctx.ownerPubkey.toLowerCase() && record.supersededAt === void 0
@@ -2239,16 +2363,13 @@ async function runCiServe(args, deps) {
     io.err(CI_SERVE_USAGE);
     return 2;
   }
-  const gateway = (flags.gateway ?? forced.env["RIG_ARWEAVE_GATEWAY"] ?? PREFERRED_GATEWAY).replace(/\/+$/, "");
-  const readGateways = [`${gateway}/raw`, ...ARWEAVE_GATEWAYS];
+  const gateway = configuredGateway(flags.gateway, forced.env) ?? PREFERRED_GATEWAY;
+  const readGateways = readGatewaysFor(gateway);
   let runner;
   if (forced.runner) {
     runner = forced.runner;
   } else {
-    const act = new ActRunner({
-      ...flags.actBin !== void 0 ? { actBin: flags.actBin } : {},
-      ...flags.platforms ? { platforms: flags.platforms } : {}
-    });
+    const act = new ActRunner(actRunnerOptions(flags));
     if (act.binary(forced.env) === null) {
       io.err(
         "rig ci serve: the act executable was not found \u2014 install nektos/act (https://github.com/nektos/act) on this host, or point --act-bin / RIG_ACT_BIN at it. Nothing was started or paid."
@@ -2291,11 +2412,14 @@ async function runCiServe(args, deps) {
       canAfford: forced.canAfford ?? makeAffordabilityCheck({
         ctx,
         env: forced.env,
-        log: (line) => io.err(line)
+        log: (line) => io.err(line),
+        runTimeoutMs: flags.timeoutMs
       }),
       ...forced.webSocketFactory ? { webSocketFactory: forced.webSocketFactory } : {},
       ...forced.fetchFn ? { fetchFn: forced.fetchFn } : {},
-      ...forced.resolveSha ? { resolveSha: forced.resolveSha } : {},
+      // SHAs the object map does not cover are resolved against the SAME
+      // permaweb the objects are read from, not arweave.net (#183).
+      resolveSha: forced.resolveSha ?? shaResolverFor(flags.gateway, forced.env),
       ...forced.clock ? { clock: forced.clock } : {},
       ...firstRun ? { onRunConcluded: (run) => concludeFirstRun(run) } : {},
       log: (line) => io.err(line)
@@ -2365,8 +2489,10 @@ async function runCiServe(args, deps) {
 }
 export {
   CI_SERVE_USAGE,
+  actRunnerOptions,
   estimateRunCost,
   makeAffordabilityCheck,
+  parseServeArgs,
   runCiServe
 };
-//# sourceMappingURL=ci-serve-AYFZOY4O.js.map
+//# sourceMappingURL=ci-serve-BU7NDT7O.js.map