@toon-protocol/rig 5.0.2 → 5.2.0

package/dist/{chunk-2TG4YHEC.js → chunk-Y7TUE7JT.js}

@@ -1,6 +1,11 @@
 import {
   CI_ADVERTISEMENT_KIND,
+  CI_JOB_RESULT_KIND,
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
   CI_STATUS_USAGE,
+  CI_WORKFLOW_PROGRESS_KIND,
+  CI_WORKFLOW_RESULT_KIND,
   GitRepoReader,
   InvalidRelayUrlError,
   MultiUrlRemoteError,
@@ -52,37 +57,42 @@ import {
   updateRef,
   writeGitObjects,
   writeToonConfig
-} from "./chunk-4WVH2ITA.js";
+} from "./chunk-S5R44MMB.js";
 import {
   PREFERRED_GATEWAY,
   mirrorGatewaysFor,
   readGateways,
   shaResolverFor
-} from "./chunk-CHVOXCDV.js";
+} from "./chunk-FX5GPZYU.js";
 import {
   COMMENT_KIND,
   DEFAULT_KEYSTORE_PASSWORD,
   LEGACY_COMMENT_KIND,
   MissingIdentityError,
-  authorizedStatusAuthors,
+  authorizedAuthors,
   buildComment,
   buildIssue,
   buildPatch,
   buildStatus,
   clientConfigPath,
   clientKeystorePath,
+  clientStateDir,
   commentBelongsToThread,
+  decodeEventPayload,
   defaultWebSocketFactory,
   fetchRemoteState,
   firstTagValue,
+  isPatchRevision,
   isValidEvmPayoutAddress,
   linkKeystoreInClientConfig,
   parseMaintainers,
   queryRelay,
   readClientConfigFile,
   resolveAccountIndex,
-  resolveIdentity
-} from "./chunk-QKL53YZS.js";
+  resolveIdentity,
+  revisionRootId,
+  selectRevision
+} from "./chunk-JX5P2KAA.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -311,7 +321,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("./standalone-mode-AT4S5EZG.js");
+  const mod = await import("./standalone-mode-NWCCRFCL.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -565,9 +575,23 @@ async function runPush(args, deps) {
     } else {
       identity = session.identity;
     }
-    if (toonConfig.owner && toonConfig.owner !== identity.pubkey) {
+    const foreignOwner = toonConfig.owner && toonConfig.owner.toLowerCase() !== identity.pubkey.toLowerCase() ? toonConfig.owner : void 0;
+    let maintainerRemote;
+    if (session.path === "standalone" && foreignOwner) {
+      const ownerState = await session.ctx.fetchRemote({
+        ownerPubkey: foreignOwner,
+        repoId,
+        relayUrls: relaysUsed
+      });
+      if (ownerState.announced && authorizedAuthors(foreignOwner, ownerState.announceEvent?.tags).has(
+        identity.pubkey.toLowerCase()
+      )) {
+        maintainerRemote = ownerState;
+      }
+    }
+    if (!maintainerRemote && foreignOwner) {
       io.err(
-        `warning: git config toon.owner (${toonConfig.owner.slice(0, 8)}\u2026) differs from the active identity (${identity.pubkey.slice(0, 8)}\u2026) \u2014 this push publishes under the ACTIVE identity's repo namespace, not the configured owner's. Re-run \`rig init\` to adopt the active identity.`
+        `warning: git config toon.owner (${foreignOwner.slice(0, 8)}\u2026) differs from the active identity (${identity.pubkey.slice(0, 8)}\u2026) \u2014 this push publishes under the ACTIVE identity's repo namespace, not the configured owner's. Re-run \`rig init\` to adopt the active identity.`
       );
     }
     const announcement = relaysUsed[0] === void 0 ? void 0 : {
@@ -584,7 +608,7 @@ async function runPush(args, deps) {
     let rigPageSkipDetail;
     if (session.path === "standalone") {
       const ctx = session.ctx;
-      const remoteState = await ctx.fetchRemote({
+      const remoteState = maintainerRemote ?? await ctx.fetchRemote({
         ownerPubkey: ctx.ownerPubkey,
         repoId,
         relayUrls: relaysUsed
@@ -614,6 +638,8 @@ async function runPush(args, deps) {
         rigPageSkipDetail = "skipped (--no-rig-page)";
       } else if (relaysUsed[0] === void 0) {
         rigPageSkipDetail = "skipped (no relay resolved for the pointer)";
+      } else if (maintainerRemote) {
+        rigPageSkipDetail = "skipped (the owner's rig page is the owner's to refresh)";
       } else if (!ctx.publisher.uploadBlob) {
         rigPageSkipDetail = "skipped (the active publisher cannot upload raw blobs)";
       } else {
@@ -2493,7 +2519,7 @@ async function runCi(args, deps) {
     case "status":
       return runCiStatus(rest, deps);
     case "serve":
-      return (await import("./ci-serve-BU7NDT7O.js")).runCiServe(rest, deps);
+      return (await import("./ci-serve-CA37KQVC.js")).runCiServe(rest, deps);
     case "--help":
     case "-h":
     case "help":
@@ -2766,6 +2792,8 @@ async function runClone(args, deps) {
 import { readFile } from "fs/promises";
 import { parseArgs as parseArgs8 } from "util";
 import {
+  PATCH_KIND as PATCH_KIND2,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2,
   STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2,
   STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2,
   STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
@@ -2985,7 +3013,7 @@ async function fetchAuthorizedAuthors(ctx, ownerPubkey, repoId) {
     if (latest) announceTags = latest.tags;
   } catch {
   }
-  return authorizedStatusAuthors(ownerPubkey, announceTags);
+  return authorizedAuthors(ownerPubkey, announceTags);
 }
 function parseTrackerItem(event, status) {
   const item = {
@@ -3031,7 +3059,7 @@ async function fetchItems(ctx, kind) {
     )
   ]);
   const items = [...itemEvents.values()].filter(
-    (e) => e.kind === kind && e.tags.some((t) => t[0] === "a" && t[1] === aTag)
+    (e) => e.kind === kind && e.tags.some((t) => t[0] === "a" && t[1] === aTag) && !(kind === PATCH_KIND && isPatchRevision(e))
   );
   const statuses = new Map(aStatusEvents);
   if (items.length > 0) {
@@ -3065,6 +3093,12 @@ async function fetchItem(ctx, eventId, expectedKind) {
   if (!event) {
     throw new Error(`event ${eventId} not found on ${ctx.relays.join(", ")}`);
   }
+  if (event.kind === PATCH_KIND && isPatchRevision(event)) {
+    const rootId = revisionRootId(event);
+    if (rootId !== void 0 && rootId !== eventId) {
+      return fetchItem(ctx, rootId, expectedKind);
+    }
+  }
   if (event.kind !== expectedKind) {
     const hint = event.kind === PATCH_KIND ? " (it is a kind:1617 patch \u2014 use `rig pr show`)" : event.kind === ISSUE_KIND ? " (it is a kind:1621 issue \u2014 use `rig issue show`)" : "";
     throw new Error(
@@ -3100,16 +3134,53 @@ async function fetchItem(ctx, eventId, expectedKind) {
   }));
   const repoATag2 = tagValue(event.tags, "a") ?? null;
   const parsedAddr = parseRepoATag(repoATag2) ?? ctx.repoAddr;
-  const authorized = parsedAddr ? await fetchAuthorizedAuthors(ctx, parsedAddr.ownerPubkey, parsedAddr.repoId) : /* @__PURE__ */ new Set();
-  return {
-    item: parseTrackerItem(
+  const authorized = parsedAddr ? await fetchAuthorizedAuthors(
+    ctx,
+    parsedAddr.ownerPubkey,
+    parsedAddr.repoId
+  ) : /* @__PURE__ */ new Set();
+  const item = parseTrackerItem(
+    event,
+    deriveStatus(
+      eventId,
+      statusEvents.values(),
+      withTargetAuthor(authorized, event.pubkey)
+    )
+  );
+  let revisions;
+  if (event.kind === PATCH_KIND) {
+    const revisionEvents = await queryAll(
+      ctx.relays,
+      [{ kinds: [PATCH_KIND], "#e": [eventId] }],
+      ctx.webSocketFactory
+    );
+    const { latest, earlier } = selectRevision(
       event,
-      deriveStatus(
-        eventId,
-        statusEvents.values(),
-        withTargetAuthor(authorized, event.pubkey)
-      )
-    ),
+      [...revisionEvents.values()].filter((e) => e.kind === PATCH_KIND),
+      authorized
+    );
+    const describe = (e) => ({
+      eventId: e.id,
+      authorPubkey: e.pubkey,
+      createdAt: e.created_at
+    });
+    revisions = { latest: describe(latest), earlier: earlier.map(describe) };
+    if (latest.id !== event.id) {
+      const shown = parseTrackerItem(latest, item.status);
+      item.content = shown.content;
+      item.title = shown.title;
+      item.commitShas = shown.commitShas ?? [];
+      delete item.branch;
+      delete item.description;
+      if (shown.branch !== void 0) item.branch = shown.branch;
+      if (shown.description !== void 0) {
+        item.description = shown.description;
+      }
+    }
+  }
+  return {
+    item,
+    ...revisions ? { revisions } : {},
     comments,
     repoATag: repoATag2
   };
@@ -3225,6 +3296,10 @@ async function runShow(args, deps, spec) {
         relays: ctx.relays,
         repoATag: shown.repoATag,
         [spec.jsonKey]: shown.item,
+        ...shown.revisions ? {
+          latestRevision: shown.revisions.latest,
+          earlierRevisions: shown.revisions.earlier
+        } : {},
         comments: shown.comments
       });
       return 0;
@@ -3241,6 +3316,20 @@ async function runShow(args, deps, spec) {
       io.out(`Commits: ${item.commitShas.join(", ")}`);
     }
     if (shown.repoATag !== null) io.out(`Repo:    ${shown.repoATag}`);
+    if (shown.revisions) {
+      const { latest, earlier } = shown.revisions;
+      if (earlier.length > 0) {
+        io.out(
+          `Showing: ${latest.eventId} (latest revision, by ${latest.authorPubkey.slice(0, 8)}, ${isoDate(latest.createdAt)})`
+        );
+        io.out("Earlier revisions (oldest first):");
+        for (const r of shown.revisions.earlier) {
+          io.out(
+            `  ${r.eventId}  (${r.authorPubkey.slice(0, 8)}, ${isoDate(r.createdAt)})`
+          );
+        }
+      }
+    }
     if (item.description !== void 0) {
       io.out("");
       io.out("Body:");
@@ -3341,7 +3430,11 @@ ${COMMON_FLAGS_USAGE2}
 
 Related (FREE reads \u2014 no payment):
   rig issue list [--state open|closed|all]   list the repo's issues
-  rig issue show <event-id>                  one issue + its comments`;
+  rig issue show <event-id>                  one issue + its comments
+
+Related (paid status \u2014 see \`rig issue status --help\`):
+  rig issue status <event-id> <open|closed>  set an issue's status
+  rig issue close | reopen <event-id>        shortcuts for closed / open`;
 var COMMENT_USAGE = `Usage: rig comment <target-event-id> --body <text> [options]
 
 Comment (NIP-22 kind:1111) on an issue or patch \u2014 a paid publish; writes are
@@ -3364,7 +3457,7 @@ comments published by this version.
 Options:
   --body <text>            comment body (Markdown) [required]
 ${COMMON_FLAGS_USAGE2}`;
-var PR_CREATE_USAGE = `Usage: rig pr create --title <title> (--range <range> | --patch-file <path>) [options]
+var PR_CREATE_USAGE = `Usage: rig pr create --title <title> (--range <range> | --patch-file <path>) [--revises <patch-id>] [options]
 
 Publish a patch (kind:1617) whose content is REAL \`git format-patch\` output \u2014
 a paid publish; writes are permanent and non-refundable. --range runs
@@ -3378,6 +3471,12 @@ The PR body (--body/--body-file) is carried in a dedicated \`description\`
 tag, not in the event content \u2014 the content stays pure format-patch output so
 \`rig pr show \u2026 | git am\` keeps working.
 
+--revises publishes the patch as a NIP-34 revision of an existing root patch
+(\`t root-revision\` plus a NIP-10 reply to it), keeping the original thread,
+comments and status. Readers honor a revision only from the root's author or a
+declared maintainer; otherwise rig warns and still publishes. A revision is
+always published through the embedded (standalone) path.
+
 Options:
   --title <title>      patch/PR title (subject tag) [required]
   --range <range>      revision range for format-patch: <rev>, <rev>..<rev>,
@@ -3386,6 +3485,7 @@ Options:
   --body <text>        PR description (Markdown; description tag)
   --body-file <path>   read the PR description from a file
   --branch <name>      branch name (branch-name tag)
+  --revises <patch-id> publish as a revision of this root patch (64-hex id)
 ${COMMON_FLAGS_USAGE2}`;
 var PR_STATUS_USAGE = `Usage: rig pr status <target-event-id> <open|applied|closed|draft> [options]
 
@@ -3396,6 +3496,18 @@ with the repo a-tag attached so readers can scope a status stream to the
 repository. (This command was \`rig status\` before v2 \u2014 bare \`rig status\`
 now passes through to \`git status\`.)
 
+Options:
+${COMMON_FLAGS_USAGE2}`;
+var ISSUE_STATUS_USAGE = `Usage: rig issue status <issue-event-id> <open|closed> [options]
+       rig issue close <issue-event-id> [options]
+       rig issue reopen <issue-event-id> [options]
+
+Set the status of an issue \u2014 a paid publish; writes are permanent and
+non-refundable. Aliases over \`rig pr status\`: \`closed\` / \`close\` publish
+kind:1632, \`open\` / \`reopen\` publish kind:1630, against the 64-char hex id
+of the issue, with the repo a-tag attached. \`applied\` and \`draft\` apply to
+patches only and are rejected for issues (use \`rig pr status\`).
+
 Options:
 ${COMMON_FLAGS_USAGE2}`;
 var PR_USAGE = `${PR_CREATE_USAGE}
@@ -3578,13 +3690,22 @@ async function runIssue(args, deps) {
     io.out(ISSUE_LIST_USAGE);
     io.out("");
     io.out(ISSUE_SHOW_USAGE);
+    io.out("");
+    io.out(ISSUE_STATUS_USAGE);
     return 0;
   }
+  if (sub === "status") return runStatusCommand(rest, deps, ISSUE_STATUS_SPEC);
+  if (sub === "close") {
+    return runStatusCommand(rest, deps, ISSUE_STATUS_SPEC, "closed");
+  }
+  if (sub === "reopen") {
+    return runStatusCommand(rest, deps, ISSUE_STATUS_SPEC, "open");
+  }
   if (sub === "list") return runIssueList(rest, deps);
   if (sub === "show") return runIssueShow(rest, deps);
   if (sub !== "create") {
     io.err(
-      sub === void 0 ? "missing subcommand: rig issue <create|list|show>" : `unknown rig issue subcommand: ${sub}`
+      sub === void 0 ? "missing subcommand: rig issue <create|list|show|status|close|reopen>" : `unknown rig issue subcommand: ${sub}`
     );
     io.err(ISSUE_USAGE);
     return 2;
@@ -3797,7 +3918,7 @@ async function runPr(args, deps) {
     case "create":
       return runPrCreate(rest, deps);
     case "status":
-      return runPrStatus(rest, deps);
+      return runStatusCommand(rest, deps, PR_STATUS_SPEC);
     // FREE read subcommands (#278): relay queries only, no payment path.
     case "list":
       return runPrList(rest, deps);
@@ -3816,6 +3937,69 @@ async function runPr(args, deps) {
       return 2;
   }
 }
+async function resolveRevisedRoot(deps, rootId, relayUrl, addr) {
+  if (relayUrl === void 0) {
+    throw new Error(
+      "--revises needs the root patch from a relay; pass --relay <url> or configure a remote"
+    );
+  }
+  const found = await queryRelay(
+    relayUrl,
+    { ids: [rootId] },
+    TARGET_LOOKUP_TIMEOUT_MS,
+    deps.webSocketFactory ?? defaultWebSocketFactory
+  );
+  const root = found.find((e) => e.id === rootId);
+  if (!root) {
+    throw new Error(
+      `patch ${rootId} not found on ${relayUrl} \u2014 nothing was published or paid`
+    );
+  }
+  if (root.kind !== PATCH_KIND2) {
+    throw new Error(
+      `event ${rootId} has kind ${root.kind}, not a kind:1617 patch \u2014 nothing was published or paid`
+    );
+  }
+  const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND2}:${addr.ownerPubkey}:${addr.repoId}`;
+  if (!root.tags.some((t) => t[0] === "a" && t[1] === aTag)) {
+    throw new Error(
+      `patch ${rootId} belongs to a different repository than ${aTag} \u2014 nothing was published or paid`
+    );
+  }
+  if (isPatchRevision(root)) {
+    throw new Error(
+      `patch ${rootId} is itself a revision \u2014 pass the ROOT patch id to --revises; nothing was published or paid`
+    );
+  }
+  return { pubkey: root.pubkey };
+}
+async function warnIfRevisionIgnored(deps, args, rootAuthor) {
+  const { io } = deps;
+  const { identity, addr, relayUrl } = args;
+  const me = identity.pubkey.toLowerCase();
+  if (me === rootAuthor?.toLowerCase()) return;
+  if (me === addr.ownerPubkey.toLowerCase()) return;
+  let authorized;
+  if (relayUrl !== void 0) {
+    try {
+      const remote = await fetchRemoteState({
+        relayUrls: [relayUrl],
+        ownerPubkey: addr.ownerPubkey,
+        repoId: addr.repoId,
+        ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+      });
+      authorized = authorizedAuthors(
+        addr.ownerPubkey,
+        remote.announceEvent?.tags ?? []
+      );
+    } catch {
+    }
+  }
+  if (authorized?.has(me)) return;
+  io.err(
+    authorized === void 0 ? "warning: could not read the repo announcement to verify your maintainer status \u2014 unless you are the root patch's author or a declared maintainer, readers will IGNORE this revision." : `warning: you (${identity.pubkey.slice(0, 8)}\u2026) are neither the root patch's author nor a maintainer of 30617:${addr.ownerPubkey.slice(0, 8)}\u2026:${addr.repoId} \u2014 readers will IGNORE this revision. Publishing anyway (the relay is permissionless).`
+  );
+}
 async function runPrCreate(rest, deps) {
   const { io } = deps;
   let flags;
@@ -3825,6 +4009,7 @@ async function runPrCreate(rest, deps) {
   let branch;
   let bodyFlag;
   let bodyFile;
+  let revises;
   try {
     const { values } = parseArgs8({
       args: rest,
@@ -3835,7 +4020,8 @@ async function runPrCreate(rest, deps) {
         "patch-file": { type: "string" },
         body: { type: "string" },
         "body-file": { type: "string" },
-        branch: { type: "string" }
+        branch: { type: "string" },
+        revises: { type: "string" }
       },
       allowPositionals: false
     });
@@ -3859,6 +4045,11 @@ async function runPrCreate(rest, deps) {
     branch = values.branch;
     bodyFlag = values.body;
     bodyFile = values["body-file"];
+    if (values.revises !== void 0) {
+      assertHex64(values.revises, "--revises");
+      revises = values.revises;
+      flags = { ...flags, standalone: true };
+    }
   } catch (err) {
     io.err(err instanceof Error ? err.message : String(err));
     io.err(PR_CREATE_USAGE);
@@ -3883,12 +4074,16 @@ async function runPrCreate(rest, deps) {
   }
   let builtPatchText;
   let builtCommits = [];
+  let rootAuthor;
   return runEvent({
     command: "pr",
     flags,
     deps,
     actionLabel: `patch ${JSON.stringify(title)}`,
-    buildEvent: async (addr) => {
+    buildEvent: async (addr, relayUrl) => {
+      if (revises !== void 0) {
+        rootAuthor = (await resolveRevisedRoot(deps, revises, relayUrl, addr)).pubkey;
+      }
       let patchText;
       let commits;
       if (range !== void 0) {
@@ -3908,7 +4103,9 @@ async function runPrCreate(rest, deps) {
       } else {
         patchText = await readFile(patchFile, "utf-8");
         if (patchText.trim() === "") {
-          throw new Error(`--patch-file ${patchFile} is empty \u2014 nothing to publish`);
+          throw new Error(
+            `--patch-file ${patchFile} is empty \u2014 nothing to publish`
+          );
         }
         commits = [];
       }
@@ -3921,9 +4118,16 @@ async function runPrCreate(rest, deps) {
         commits,
         branch,
         patchText,
-        body
+        body,
+        revises !== void 0 ? {
+          rootEventId: revises,
+          ...rootAuthor !== void 0 ? { rootAuthorPubkey: rootAuthor } : {}
+        } : void 0
       );
     },
+    // A revision from anyone but the root's author or a maintainer is ignored
+    // by readers: warn, but publish (the relay is permissionless).
+    preConfirm: revises === void 0 ? void 0 : (args) => warnIfRevisionIgnored(deps, args, rootAuthor),
     sendDaemon: (client, addr) => {
       if (builtPatchText === void 0) {
         throw new Error("internal: patch text not built before delegation");
@@ -3948,7 +4152,21 @@ var STATUS_KIND_BY_VALUE = {
 function isStatusValue(value) {
   return Object.hasOwn(STATUS_KIND_BY_VALUE, value);
 }
-async function runPrStatus(args, deps) {
+var PR_STATUS_SPEC = {
+  command: "pr status",
+  usage: PR_STATUS_USAGE,
+  allowed: ["open", "applied", "closed", "draft"],
+  shape: "<target-event-id> <open|applied|closed|draft>",
+  targetLabel: "<target-event-id>"
+};
+var ISSUE_STATUS_SPEC = {
+  command: "issue status",
+  usage: ISSUE_STATUS_USAGE,
+  allowed: ["open", "closed"],
+  shape: "<issue-event-id> <open|closed>",
+  targetLabel: "<issue-event-id>"
+};
+async function runStatusCommand(args, deps, spec, fixedStatus) {
   const { io } = deps;
   let flags;
   let targetEventId;
@@ -3961,30 +4179,31 @@ async function runPrStatus(args, deps) {
     });
     flags = pickCommon2(values);
     if (flags.help) {
-      io.out(PR_STATUS_USAGE);
+      io.out(spec.usage);
       return 0;
     }
-    if (positionals.length !== 2) {
+    const want = fixedStatus === void 0 ? 2 : 1;
+    if (positionals.length !== want) {
       throw new Error(
-        "expected exactly two arguments: <target-event-id> <open|applied|closed|draft>"
+        fixedStatus === void 0 ? `expected exactly two arguments: ${spec.shape}` : `expected exactly one argument: ${spec.targetLabel}`
       );
     }
     targetEventId = positionals[0];
-    assertHex64(targetEventId, "<target-event-id>");
-    const rawStatus = positionals[1];
-    if (!isStatusValue(rawStatus)) {
+    assertHex64(targetEventId, spec.targetLabel);
+    const rawStatus = fixedStatus ?? positionals[1];
+    if (!isStatusValue(rawStatus) || !spec.allowed.includes(rawStatus)) {
       throw new Error(
-        `status must be one of open | applied | closed | draft (got ${JSON.stringify(rawStatus)})`
+        `status must be one of ${spec.allowed.join(" | ")} (got ${JSON.stringify(rawStatus)})`
       );
     }
     status = rawStatus;
   } catch (err) {
     io.err(err instanceof Error ? err.message : String(err));
-    io.err(PR_STATUS_USAGE);
+    io.err(spec.usage);
     return 2;
   }
   return runEvent({
-    command: "pr status",
+    command: spec.command,
     flags,
     deps,
     actionLabel: `status ${status} on ${targetEventId.slice(0, 8)}\u2026`,
@@ -4021,7 +4240,7 @@ async function warnIfNotMaintainer(deps, args) {
       repoId: addr.repoId,
       ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
     });
-    const authorized = authorizedStatusAuthors(
+    const authorized = authorizedAuthors(
       addr.ownerPubkey,
       remote.announceEvent?.tags ?? []
     );
@@ -5254,9 +5473,569 @@ async function defaultReadSecretLine(prompt, isInteractive) {
   }
 }
 
+// src/cli/inbox.ts
+import { parseArgs as parseArgs13 } from "util";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
+import {
+  ISSUE_KIND as ISSUE_KIND2,
+  PATCH_KIND as PATCH_KIND3,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND3,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND3,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
+  STATUS_DRAFT_KIND as STATUS_DRAFT_KIND3,
+  STATUS_OPEN_KIND as STATUS_OPEN_KIND3
+} from "@toon-protocol/core/nip34";
+
+// src/cli/relay-follow.ts
+var WS_OPEN = 1;
+var CONNECT_TIMEOUT_MS = 1e4;
+function defaultBackoffMs(attempt) {
+  return Math.min(3e4, 1e3 * 2 ** Math.max(0, attempt - 1));
+}
+function connectOnce(opts, onSubscribed) {
+  return new Promise((resolve2) => {
+    let ws;
+    let done = false;
+    let subscribed = false;
+    const subIds = [];
+    let connectTimer;
+    const finish = (reason) => {
+      if (done) return;
+      done = true;
+      clearTimeout(connectTimer);
+      opts.signal.removeEventListener("abort", onAbort);
+      try {
+        if (ws.readyState === WS_OPEN) {
+          for (const id of subIds) ws.send(JSON.stringify(["CLOSE", id]));
+        }
+        ws.close();
+      } catch {
+      }
+      resolve2(reason);
+    };
+    const onAbort = () => finish(null);
+    try {
+      ws = opts.webSocketFactory(opts.url);
+    } catch (err) {
+      resolve2(`failed to connect to ${opts.url}: ${String(err)}`);
+      return;
+    }
+    opts.signal.addEventListener("abort", onAbort);
+    connectTimer = setTimeout(
+      () => finish(`timed out connecting to ${opts.url}`),
+      CONNECT_TIMEOUT_MS
+    );
+    ws.addEventListener("open", () => {
+      clearTimeout(connectTimer);
+      opts.filters().forEach((filter, i) => {
+        const subId = `follow-${Date.now()}-${i}-${Math.random().toString(36).slice(2, 8)}`;
+        subIds.push(subId);
+        ws.send(JSON.stringify(["REQ", subId, filter]));
+      });
+    });
+    ws.addEventListener("message", (msgEvent) => {
+      try {
+        const msg = JSON.parse(String(msgEvent.data));
+        if (msg[0] === "EVENT" && msg[2] !== void 0) {
+          const event = decodeEventPayload(msg[2]);
+          if (event) opts.onEvent(event, opts.url);
+        } else if (msg[0] === "EOSE" && !subscribed && subIds.includes(msg[1])) {
+          subscribed = true;
+          onSubscribed();
+        }
+      } catch {
+      }
+    });
+    ws.addEventListener("error", (event) => {
+      const detail = typeof event === "object" && event !== null && "message" in event ? String(event.message) : "unknown";
+      finish(`websocket error on ${opts.url}: ${detail}`);
+    });
+    ws.addEventListener("close", () => {
+      finish(`connection to ${opts.url} closed`);
+    });
+  });
+}
+async function followRelay(opts) {
+  let attempt = 0;
+  while (!opts.signal.aborted) {
+    const reason = await connectOnce(opts, () => {
+      attempt = 0;
+    });
+    if (opts.signal.aborted) return;
+    opts.onError(reason ?? `connection to ${opts.url} ended`);
+    attempt += 1;
+    await new Promise((resolve2) => {
+      const done = () => {
+        clearTimeout(timer);
+        opts.signal.removeEventListener("abort", done);
+        resolve2();
+      };
+      const timer = setTimeout(done, opts.backoffMs(attempt));
+      opts.signal.addEventListener("abort", done);
+    });
+  }
+}
+
+// src/cli/inbox.ts
+var INBOX_USAGE = `Usage: rig inbox [options]
+
+Print everything new since you last checked (free \u2014 relay reads only):
+patches and revisions, issues, comments, status changes and CI results for
+repos you own or maintain, plus any event that tags your pubkey.
+
+Options:
+  --since <time>       read from a unix time, an ISO date, or a relative
+                       age (30m, 2h, 7d); does not move the cursor
+  --all                read everything, ignoring the cursor; does not move it
+  --pubkey <pubkey>    act as this pubkey (npub or hex) instead of the
+                       resolved identity
+  --remote <name>      read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override; repeatable \u2014 reads are merged
+  --json               machine-readable array, one object per event
+  --follow             emit the backlog, then stay connected and stream new
+                       events as JSON lines (one object per line) until
+                       interrupted; reconnects when a relay drops
+  -h, --help           show this help`;
+var STATUS_KINDS2 = [
+  STATUS_OPEN_KIND3,
+  STATUS_APPLIED_KIND3,
+  STATUS_CLOSED_KIND3,
+  STATUS_DRAFT_KIND3
+];
+var CI_KINDS = [
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
+  CI_WORKFLOW_RESULT_KIND,
+  CI_WORKFLOW_PROGRESS_KIND,
+  CI_JOB_RESULT_KIND
+];
+var INBOX_KINDS = [
+  PATCH_KIND3,
+  ISSUE_KIND2,
+  COMMENT_KIND,
+  LEGACY_COMMENT_KIND,
+  ...STATUS_KINDS2,
+  ...CI_KINDS
+];
+var HEX64_RE4 = /^[0-9a-f]{64}$/;
+var INBOX_CURSOR_FILENAME = "inbox-cursors.json";
+function cursorPath(env) {
+  return join6(clientStateDir(env), INBOX_CURSOR_FILENAME);
+}
+function readCursors(env) {
+  try {
+    const parsed = JSON.parse(readFileSync5(cursorPath(env), "utf8"));
+    if (parsed && typeof parsed === "object") {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
+function writeCursor(env, pubkey, cursor) {
+  const cursors = readCursors(env);
+  cursors[pubkey] = cursor;
+  mkdirSync5(clientStateDir(env), { recursive: true });
+  writeFileSync4(cursorPath(env), JSON.stringify(cursors, null, 2) + "\n");
+}
+function parseSince(value, nowSec) {
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed);
+  const rel = /^(\d+)([smhdw])$/.exec(trimmed);
+  if (rel) {
+    const unit = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[rel[2]];
+    return nowSec - Number(rel[1]) * unit;
+  }
+  const ms = Date.parse(trimmed);
+  if (Number.isNaN(ms)) {
+    throw new Error(
+      `--since must be a unix time, an ISO date, or an age like 2h (got ${JSON.stringify(value)})`
+    );
+  }
+  return Math.floor(ms / 1e3);
+}
+var tagValue2 = firstTagValue;
+function hasTopic(event, topic) {
+  return event.tags.some((t) => t[0] === "t" && t[1] === topic);
+}
+function typeOf(event) {
+  if (event.kind === PATCH_KIND3) {
+    if (hasTopic(event, "root-revision")) return "revision";
+    if (hasTopic(event, "root") || tagValue2(event.tags, "e") === void 0) {
+      return "patch";
+    }
+    return null;
+  }
+  if (event.kind === ISSUE_KIND2) return "issue";
+  if (event.kind === COMMENT_KIND || event.kind === LEGACY_COMMENT_KIND) {
+    return "comment";
+  }
+  if (STATUS_KINDS2.includes(event.kind)) return "status";
+  if (CI_KINDS.includes(event.kind)) return "ci";
+  return null;
+}
+function targetOf(event, type) {
+  const root = tagValue2(event.tags, "E");
+  const parent = tagValue2(event.tags, "e");
+  switch (type) {
+    case "patch":
+    case "issue":
+      return event.id;
+    case "revision":
+      return parent ?? event.id;
+    case "comment":
+      return root ?? parent ?? event.id;
+    case "status":
+      return parent ?? event.id;
+    case "ci":
+      return root ?? tagValue2(event.tags, "c") ?? event.id;
+  }
+}
+function toInboxEntry(event) {
+  const type = typeOf(event);
+  if (type === null) return null;
+  const repo = event.tags.find(
+    (t) => t[0] === "a" && t[1]?.startsWith(`${REPOSITORY_ANNOUNCEMENT_KIND3}:`)
+  )?.[1];
+  return {
+    id: event.id,
+    kind: event.kind,
+    type,
+    repo: repo ?? null,
+    target: targetOf(event, type),
+    author: event.pubkey,
+    created_at: event.created_at
+  };
+}
+function newest(events) {
+  let winner = null;
+  for (const e of events) {
+    if (winner === null || e.created_at > winner.created_at || e.created_at === winner.created_at && e.id < winner.id) {
+      winner = e;
+    }
+  }
+  return winner;
+}
+async function ownerAnnouncement(relays, owner, repoId, ws) {
+  const found = await queryAll(
+    relays,
+    [
+      {
+        kinds: [REPOSITORY_ANNOUNCEMENT_KIND3],
+        authors: [owner],
+        "#d": [repoId]
+      }
+    ],
+    ws
+  ).catch(() => /* @__PURE__ */ new Map());
+  return newest(
+    [...found.values()].filter(
+      (e) => e.kind === REPOSITORY_ANNOUNCEMENT_KIND3 && e.pubkey.toLowerCase() === owner && tagValue2(e.tags, "d") === repoId
+    )
+  );
+}
+function relaysTag(tags) {
+  return tags.filter((t) => t[0] === "relays").flatMap((t) => t.slice(1)).filter((url) => WS_URL_RE.test(url));
+}
+var INBOX_OPTIONS = {
+  json: { type: "boolean", default: false },
+  follow: { type: "boolean", default: false },
+  all: { type: "boolean", default: false },
+  since: { type: "string" },
+  pubkey: { type: "string" },
+  remote: { type: "string" },
+  relay: { type: "string", multiple: true },
+  help: { type: "boolean", short: "h", default: false }
+};
+function renderLine(entry) {
+  const when = new Date(entry.created_at * 1e3).toISOString().slice(0, 16).replace("T", " ");
+  const repo = entry.repo ?? "(no repo)";
+  return `${when}  ${entry.type.padEnd(8)}  ${entry.id.slice(0, 8)}  \u2192 ${entry.target.slice(0, 8)}  ${repo}  (${entry.author.slice(0, 8)})`;
+}
+async function runInbox(args, deps) {
+  const { io } = deps;
+  let json = false;
+  let all = false;
+  let follow = false;
+  let sinceArg;
+  let pubkeyArg;
+  let remote;
+  let relayFlags = [];
+  try {
+    const { values, positionals } = parseArgs13({
+      args,
+      options: INBOX_OPTIONS,
+      allowPositionals: true
+    });
+    if (values.help) {
+      io.out(INBOX_USAGE);
+      return 0;
+    }
+    if (positionals.length > 0) {
+      throw new Error("rig inbox takes no positional arguments");
+    }
+    json = values.json === true;
+    all = values.all === true;
+    follow = values.follow === true;
+    sinceArg = values.since;
+    if (values.pubkey !== void 0) pubkeyArg = ownerToHex(values.pubkey);
+    remote = values.remote;
+    relayFlags = values.relay ?? [];
+    if (all && sinceArg !== void 0) {
+      throw new Error("--all and --since are mutually exclusive");
+    }
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(INBOX_USAGE);
+    return 2;
+  }
+  try {
+    const nowSec = Math.floor((deps.now ?? Date.now)() / 1e3);
+    const override = sinceArg !== void 0 ? parseSince(sinceArg, nowSec) : null;
+    const me = (pubkeyArg ?? (await (deps.resolveIdentityImpl ?? resolveIdentity)({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io.err(line)
+    })).pubkey).toLowerCase();
+    let repoRoot;
+    let toonRelays = [];
+    try {
+      repoRoot = await resolveRepoRoot(deps.cwd);
+      toonRelays = (await readToonConfig(repoRoot)).relays;
+    } catch {
+    }
+    const resolved = await resolveRelays({
+      relayFlags,
+      remoteName: remote,
+      repoRoot,
+      toonRelays
+    });
+    const configured = resolved.relays.filter((url) => WS_URL_RE.test(url));
+    if (configured.length === 0) {
+      throw new InvalidRelayUrlError(
+        resolved.relays[0] ?? "",
+        "reads need a ws:// or wss:// relay"
+      );
+    }
+    const ws = deps.webSocketFactory ?? defaultWebSocketFactory;
+    const announcements = await queryAll(
+      configured,
+      [
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND3], authors: [me] },
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND3], "#maintainers": [me] }
+      ],
+      ws
+    );
+    const byRepo = /* @__PURE__ */ new Map();
+    for (const e of announcements.values()) {
+      if (e.kind !== REPOSITORY_ANNOUNCEMENT_KIND3) continue;
+      const d = tagValue2(e.tags, "d");
+      if (!d) continue;
+      const key = `${e.pubkey.toLowerCase()}:${d}`;
+      byRepo.set(key, [...byRepo.get(key) ?? [], e]);
+    }
+    const watched = [];
+    for (const [key, events2] of byRepo) {
+      const owner = events2[0].pubkey.toLowerCase();
+      const repoId = key.slice(owner.length + 1);
+      const latest = owner === me ? newest(events2) : await ownerAnnouncement(configured, owner, repoId, ws);
+      if (latest === null) continue;
+      if (owner !== me && !parseMaintainers(latest.tags).includes(me)) continue;
+      watched.push({
+        address: `${REPOSITORY_ANNOUNCEMENT_KIND3}:${owner}:${repoId}`,
+        ownerPubkey: owner,
+        authorized: authorizedAuthors(owner, latest.tags),
+        relays: relaysTag(latest.tags)
+      });
+    }
+    const cursor = readCursors(deps.env)[me];
+    const since = all ? void 0 : override !== null ? override : cursor?.at;
+    const base = since !== void 0 ? { since } : {};
+    const events = /* @__PURE__ */ new Map();
+    const collect = (found) => {
+      for (const [id, e] of found) if (!events.has(id)) events.set(id, e);
+    };
+    collect(
+      await queryAll(
+        configured,
+        [{ kinds: INBOX_KINDS, "#p": [me], ...base }],
+        ws
+      )
+    );
+    for (const repo of watched) {
+      const relays = [.../* @__PURE__ */ new Set([...configured, ...repo.relays])];
+      collect(
+        await queryAll(
+          relays,
+          [{ kinds: INBOX_KINDS, "#a": [repo.address], ...base }],
+          ws
+        )
+      );
+    }
+    const authCache = /* @__PURE__ */ new Map();
+    for (const repo of watched) authCache.set(repo.address, repo.authorized);
+    const authorizedFor = async (address) => {
+      const hit = authCache.get(address);
+      if (hit) return hit;
+      const m = /^30617:([0-9a-f]{64}):(.+)$/i.exec(address);
+      let set = /* @__PURE__ */ new Set();
+      if (m) {
+        const owner = m[1].toLowerCase();
+        const latest = await ownerAnnouncement(
+          configured,
+          owner,
+          m[2],
+          ws
+        );
+        set = authorizedAuthors(owner, latest?.tags ?? []);
+      }
+      authCache.set(address, set);
+      return set;
+    };
+    const toEntries = async (found) => {
+      const targetAuthors = /* @__PURE__ */ new Map();
+      const statusEvents = [...found.values()].filter(
+        (e) => STATUS_KINDS2.includes(e.kind)
+      );
+      const unknownTargets = /* @__PURE__ */ new Set();
+      for (const e of statusEvents) {
+        const target = tagValue2(e.tags, "e");
+        if (!target || !HEX64_RE4.test(target)) continue;
+        const known = found.get(target);
+        if (known) targetAuthors.set(target, known.pubkey.toLowerCase());
+        else unknownTargets.add(target);
+      }
+      if (unknownTargets.size > 0) {
+        const lookedUp = await queryAll(
+          configured,
+          [{ ids: [...unknownTargets] }],
+          ws
+        ).catch(() => /* @__PURE__ */ new Map());
+        for (const [id, e] of lookedUp)
+          targetAuthors.set(id, e.pubkey.toLowerCase());
+      }
+      const entries = [];
+      for (const event of found.values()) {
+        const entry = toInboxEntry(event);
+        if (entry === null) continue;
+        if (entry.type === "status") {
+          if (entry.repo === null) continue;
+          const repoWide = await authorizedFor(entry.repo);
+          const targetAuthor = targetAuthors.get(entry.target);
+          const authors = targetAuthor === void 0 ? repoWide : withTargetAuthor(repoWide, targetAuthor);
+          if (!authors.has(event.pubkey.toLowerCase())) continue;
+        }
+        entries.push(entry);
+      }
+      return entries;
+    };
+    const entriesOf = await toEntries(events);
+    const isFresh = (e) => all || override !== null || cursor === void 0 || e.created_at > cursor.at || e.created_at === cursor.at && !cursor.seen.includes(e.id);
+    const byAge = (a, b) => a.created_at - b.created_at || (a.id < b.id ? -1 : 1);
+    const fresh = entriesOf.filter(isFresh).sort(byAge);
+    const moveCursor = !all && override === null;
+    let position = cursor;
+    const advance = (emitted) => {
+      if (!moveCursor || emitted.length === 0) return;
+      const at = Math.max(...emitted.map((e) => e.created_at));
+      const seen = emitted.filter((e) => e.created_at === at).map((e) => e.id);
+      if (position?.at === at) seen.push(...position.seen);
+      else if (position !== void 0 && position.at > at) return;
+      position = { at, seen: [...new Set(seen)] };
+      writeCursor(deps.env, me, position);
+    };
+    if (follow) {
+      const line = (entry) => io.emitJsonLine ? io.emitJsonLine(entry) : io.out(JSON.stringify(entry));
+      const emittedIds = /* @__PURE__ */ new Set();
+      let liveSince = position?.at;
+      const emit = (entries) => {
+        for (const entry of entries) {
+          emittedIds.add(entry.id);
+          liveSince = Math.max(liveSince ?? 0, entry.created_at);
+          line(entry);
+        }
+        advance(entries);
+      };
+      emit(fresh);
+      const controller = new AbortController();
+      const stop = () => controller.abort();
+      const external = deps.followSignal;
+      if (external?.aborted) return 0;
+      external?.addEventListener("abort", stop);
+      if (!external) {
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+      }
+      let chain = Promise.resolve();
+      const onEvent = (event) => {
+        chain = chain.then(async () => {
+          if (emittedIds.has(event.id)) return;
+          try {
+            const [entry] = await toEntries(/* @__PURE__ */ new Map([[event.id, event]]));
+            if (entry === void 0 || emittedIds.has(entry.id) || !isFresh(entry)) {
+              return;
+            }
+            emit([entry]);
+          } catch (err) {
+            io.err(
+              `rig inbox: could not process live event ${event.id}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        });
+      };
+      const targets = [];
+      for (const url of configured) {
+        targets.push({ url, filter: { kinds: INBOX_KINDS, "#p": [me] } });
+      }
+      for (const repo of watched) {
+        for (const url of /* @__PURE__ */ new Set([...configured, ...repo.relays])) {
+          targets.push({
+            url,
+            filter: { kinds: INBOX_KINDS, "#a": [repo.address] }
+          });
+        }
+      }
+      const urls = [...new Set(targets.map((t) => t.url))];
+      try {
+        await Promise.all(
+          urls.map(
+            (url) => followRelay({
+              url,
+              filters: () => targets.filter((t) => t.url === url).map((t) => ({ ...t.filter, since: liveSince ?? nowSec })),
+              webSocketFactory: ws,
+              onEvent,
+              onError: (message) => io.err(`rig inbox: ${message}`),
+              signal: controller.signal,
+              backoffMs: deps.followBackoffMs ?? defaultBackoffMs
+            })
+          )
+        );
+        await chain;
+      } finally {
+        external?.removeEventListener("abort", stop);
+        process.off("SIGINT", stop);
+        process.off("SIGTERM", stop);
+      }
+      return 0;
+    }
+    if (json) {
+      io.emitJson(fresh);
+    } else if (fresh.length === 0) {
+      io.out("inbox is empty");
+    } else {
+      for (const entry of fresh) io.out(renderLine(entry));
+    }
+    advance(fresh);
+    return 0;
+  } catch (err) {
+    return emitCliError(io, json, "inbox", err);
+  }
+}
+
 // src/cli/init.ts
 import { basename as basename2 } from "path";
-import { parseArgs as parseArgs13 } from "util";
+import { parseArgs as parseArgs14 } from "util";
 
 // src/cli/git-author.ts
 var PROFILE_KIND = 0;
@@ -5374,7 +6153,7 @@ Options:
   --json               machine-readable report
   -h, --help           show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs13({
+  const { values, positionals } = parseArgs14({
     args,
     options: {
       "repo-id": { type: "string" },
@@ -5601,8 +6380,9 @@ async function runInit(args, deps) {
 }
 
 // src/cli/maintainers.ts
-import { parseArgs as parseArgs14 } from "util";
-var HEX64_RE4 = /^[0-9a-f]{64}$/;
+import { parseArgs as parseArgs15 } from "util";
+var HEX64_RE5 = /^[0-9a-f]{64}$/;
+var REF_AUTHORITY_NOTICE = "Note: maintainers can move refs (publish honored repo state), not only set status.";
 var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
 
 Manage a repo's declared maintainers (#287). Status authority is consumer-side:
@@ -5654,7 +6434,7 @@ async function runList2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs14({
+    const { values, positionals } = parseArgs15({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -5721,7 +6501,7 @@ async function runMutate(op, args, deps) {
   let flags;
   let pubkey;
   try {
-    const { values, positionals } = parseArgs14({
+    const { values, positionals } = parseArgs15({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -5735,8 +6515,10 @@ async function runMutate(op, args, deps) {
       throw new Error(`expected exactly one <pubkey> to ${op}`);
     }
     pubkey = ownerToHex(positionals[0]).toLowerCase();
-    if (!HEX64_RE4.test(pubkey)) {
-      throw new Error(`<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`);
+    if (!HEX64_RE5.test(pubkey)) {
+      throw new Error(
+        `<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`
+      );
     }
   } catch (err) {
     io.err(err instanceof Error ? err.message : String(err));
@@ -5781,11 +6563,14 @@ async function runMutate(op, args, deps) {
     if (!flags.json) {
       io.out(`Republish ${action}`);
       io.out(`Repo: 30617:${ctx.owner}:${ctx.repoId}`);
-      io.out(`Maintainers after: ${next.length === 0 ? "(none)" : next.join(", ")}`);
+      io.out(
+        `Maintainers after: ${next.length === 0 ? "(none)" : next.join(", ")}`
+      );
       if (!diff.unchanged) {
         io.out("Tags changed:");
         for (const line of describeAnnouncementDiff(diff)) io.out(line);
       }
+      io.out(REF_AUTHORITY_NOTICE);
       io.out(`Fee: ${feeLabel(fee)}. Writes are permanent and non-refundable.`);
     }
     if (!flags.yes) {
@@ -5835,6 +6620,7 @@ async function runMutate(op, args, deps) {
       io.out(
         `Published ${action}: ${result.eventId}  paid ${result.feePaid} base units`
       );
+      io.out(REF_AUTHORITY_NOTICE);
     }
     return 0;
   } catch (err) {
@@ -5850,7 +6636,7 @@ async function runMutate(op, args, deps) {
 }
 
 // src/cli/refresh.ts
-import { parseArgs as parseArgs15 } from "util";
+import { parseArgs as parseArgs16 } from "util";
 var REFRESH_USAGE = `Usage: rig refresh [options]
 
 Republish this repo's kind:30617 announcement with no field edit, refreshing
@@ -5886,7 +6672,7 @@ async function runRefresh(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs15({
+    const { values, positionals } = parseArgs16({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -6009,7 +6795,7 @@ async function runRefresh(args, deps) {
 
 // src/cli/name.ts
 import { randomUUID } from "crypto";
-import { parseArgs as parseArgs16 } from "util";
+import { parseArgs as parseArgs17 } from "util";
 var ARIO_DECIMALS = 6;
 function renderMario(mario) {
   return `${mario.toString()} mARIO (~${formatUnits(mario.toString(), ARIO_DECIMALS)} ARIO)`;
@@ -6518,7 +7304,7 @@ async function resolveNameContext(deps, network, processId, mode) {
   return { identity, solanaAddress, network, processId, sdk, nostrSecretKey };
 }
 function parseNameFlags(args, env) {
-  const { values, positionals } = parseArgs16({
+  const { values, positionals } = parseArgs17({
     args,
     allowPositionals: true,
     options: {
@@ -7077,7 +7863,7 @@ async function runName(args, deps) {
 }
 
 // src/cli/payout.ts
-import { parseArgs as parseArgs17 } from "util";
+import { parseArgs as parseArgs18 } from "util";
 import { getAddress } from "viem";
 var PAYOUT_USAGE = `Usage: rig payout <set|clear|show> [<address>] [options]
 
@@ -7133,7 +7919,7 @@ async function runShow2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs17({
+    const { values, positionals } = parseArgs18({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -7195,7 +7981,7 @@ async function runMutate2(op, args, deps) {
   let flags;
   let nextPayout = null;
   try {
-    const { values, positionals } = parseArgs17({
+    const { values, positionals } = parseArgs18({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -7329,7 +8115,7 @@ async function runMutate2(op, args, deps) {
 }
 
 // src/cli/site.ts
-import { parseArgs as parseArgs18 } from "util";
+import { parseArgs as parseArgs19 } from "util";
 
 // src/arweave-manifest.ts
 var DEFAULT_INDEX = "index.html";
@@ -7348,22 +8134,22 @@ function buildArweaveManifest(entries, indexPath = DEFAULT_INDEX, fallbackTxId)
 }
 
 // src/cli/site-record.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var SITE_MANIFEST_FILENAME = "site-manifests.json";
 function storeDir2(env) {
-  return env["TOON_CLIENT_HOME"] ?? join6(homedir5(), ".toon-client");
+  return env["TOON_CLIENT_HOME"] ?? join7(homedir5(), ".toon-client");
 }
 function storePath2(env) {
-  return join6(storeDir2(env), SITE_MANIFEST_FILENAME);
+  return join7(storeDir2(env), SITE_MANIFEST_FILENAME);
 }
 function keyOf(repoId, ref) {
   return `${repoId}\0${ref}`;
 }
 function readFile2(env) {
   try {
-    const parsed = JSON.parse(readFileSync5(storePath2(env), "utf8"));
+    const parsed = JSON.parse(readFileSync6(storePath2(env), "utf8"));
     if (parsed && typeof parsed === "object") return parsed;
     return {};
   } catch {
@@ -7375,10 +8161,10 @@ function readSiteRecord(env, repoId, ref) {
 }
 function writeSiteRecord(env, record) {
   const dir = storeDir2(env);
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   const file = readFile2(env);
   file[keyOf(record.repoId, record.ref)] = record;
-  writeFileSync4(storePath2(env), `${JSON.stringify(file, null, 2)}
+  writeFileSync5(storePath2(env), `${JSON.stringify(file, null, 2)}
 `, "utf8");
 }
 
@@ -7420,7 +8206,7 @@ Options (publish):
                        estimate (nothing uploaded)
   -h, --help           show this help`;
 function parseSiteArgs(args) {
-  const { values, positionals } = parseArgs18({
+  const { values, positionals } = parseArgs19({
     args,
     options: {
       index: { type: "string" },
@@ -7821,14 +8607,23 @@ Commands rig owns:
   site url [ref]             print the last-published site URL for a ref (free)
   issue create               file an issue (kind:1621) against a repo
   issue list | show <id>     read the repo's issues + comments (free)
+  issue status <id> <open|closed>  set an issue's status (kind:1630/1632);
+                             close | reopen <id> are shortcuts
   pr list | show <id>        read the repo's patches; show prints the full
                              patch text (free)
   comment <target-event-id>  comment (NIP-22 kind:1111) on an issue or patch,
                              or reply to an existing kind:1111 comment
   pr create                  publish a patch (kind:1617) with real
-                             \`git format-patch\` content
+                             \`git format-patch\` content (--revises <patch-id>
+                             publishes a revision of an existing patch)
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
+  inbox                      everything new since you last read it (free):
+                             patches, revisions, issues, comments, statuses
+                             and CI results for repos you own or maintain,
+                             plus events that tag you; --since/--all look
+                             back without moving the cursor; --follow keeps
+                             streaming new events as JSON lines
   maintainers list           show the repo's declared maintainers (free); add/
   maintainers add <pubkey>   remove republish the kind:30617 to change who may
   maintainers remove <pubkey>  author authoritative issue/PR status (owner is
@@ -7889,7 +8684,8 @@ Any other command is passed through to git verbatim: \`rig status\` runs
 Run \`rig <command> --help\` for a rig command's flags. \`rig init\`,
 \`rig remote\`, \`rig clone\`, \`rig fetch\`, \`rig issue list/show\`,
 \`rig pr list/show\`, \`rig fund\`, \`rig balance\`, and \`rig channel list\`
-are free; push/issue create/comment/pr create/pr status are paid writes \u2014
+are free; push/issue create/issue status/close/reopen/comment/pr create/pr
+status are paid writes \u2014
 permanent and non-refundable \u2014
 and channel open/close/settle are on-chain wallet transactions; each states
 what it will spend and asks for confirmation before doing so (--yes skips,
@@ -7950,6 +8746,8 @@ async function dispatch(argv, deps) {
       return runComment(rest, deps);
     case "pr":
       return runPr(rest, deps);
+    case "inbox":
+      return runInbox(rest, deps);
     case "maintainers":
       return runMaintainers(rest, deps);
     case "payout":
@@ -8006,4 +8804,4 @@ export {
   rigVersion,
   dispatch
 };
-//# sourceMappingURL=chunk-2TG4YHEC.js.map
+//# sourceMappingURL=chunk-Y7TUE7JT.js.map