@toon-protocol/rig 5.1.0 → 5.3.0

package/dist/{chunk-ANVDRW5F.js → chunk-KQ4NQV7T.js}

@@ -1,10 +1,16 @@
 import {
   CI_ADVERTISEMENT_KIND,
+  CI_JOB_RESULT_KIND,
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
   CI_STATUS_USAGE,
+  CI_WORKFLOW_PROGRESS_KIND,
+  CI_WORKFLOW_RESULT_KIND,
   GitRepoReader,
   InvalidRelayUrlError,
   MultiUrlRemoteError,
   NotAGitRepositoryError,
+  PrMergeError,
   RESERVED_SECRET_NAMES,
   SECRET_NAME_RE,
   UnconfiguredRepoAddressError,
@@ -52,13 +58,13 @@ import {
   updateRef,
   writeGitObjects,
   writeToonConfig
-} from "./chunk-J6GNB54J.js";
+} from "./chunk-DGF7WCRW.js";
 import {
   PREFERRED_GATEWAY,
   mirrorGatewaysFor,
   readGateways,
   shaResolverFor
-} from "./chunk-P5ZKJN6B.js";
+} from "./chunk-UXRWMKXV.js";
 import {
   COMMENT_KIND,
   DEFAULT_KEYSTORE_PASSWORD,
@@ -71,18 +77,23 @@ import {
   buildStatus,
   clientConfigPath,
   clientKeystorePath,
+  clientStateDir,
   commentBelongsToThread,
+  decodeEventPayload,
   defaultWebSocketFactory,
   fetchRemoteState,
   firstTagValue,
+  isPatchRevision,
   isValidEvmPayoutAddress,
   linkKeystoreInClientConfig,
   parseMaintainers,
   queryRelay,
   readClientConfigFile,
   resolveAccountIndex,
-  resolveIdentity
-} from "./chunk-ITC7ESTZ.js";
+  resolveIdentity,
+  revisionRootId,
+  selectRevision
+} from "./chunk-OVZJ5P6E.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -311,7 +322,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("./standalone-mode-IETLYVCE.js");
+  const mod = await import("./standalone-mode-E7TNMWGO.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -565,9 +576,23 @@ async function runPush(args, deps) {
     } else {
       identity = session.identity;
     }
-    if (toonConfig.owner && toonConfig.owner !== identity.pubkey) {
+    const foreignOwner = toonConfig.owner && toonConfig.owner.toLowerCase() !== identity.pubkey.toLowerCase() ? toonConfig.owner : void 0;
+    let maintainerRemote;
+    if (session.path === "standalone" && foreignOwner) {
+      const ownerState = await session.ctx.fetchRemote({
+        ownerPubkey: foreignOwner,
+        repoId,
+        relayUrls: relaysUsed
+      });
+      if (ownerState.announced && authorizedAuthors(foreignOwner, ownerState.announceEvent?.tags).has(
+        identity.pubkey.toLowerCase()
+      )) {
+        maintainerRemote = ownerState;
+      }
+    }
+    if (!maintainerRemote && foreignOwner) {
       io.err(
-        `warning: git config toon.owner (${toonConfig.owner.slice(0, 8)}\u2026) differs from the active identity (${identity.pubkey.slice(0, 8)}\u2026) \u2014 this push publishes under the ACTIVE identity's repo namespace, not the configured owner's. Re-run \`rig init\` to adopt the active identity.`
+        `warning: git config toon.owner (${foreignOwner.slice(0, 8)}\u2026) differs from the active identity (${identity.pubkey.slice(0, 8)}\u2026) \u2014 this push publishes under the ACTIVE identity's repo namespace, not the configured owner's. Re-run \`rig init\` to adopt the active identity.`
       );
     }
     const announcement = relaysUsed[0] === void 0 ? void 0 : {
@@ -584,7 +609,7 @@ async function runPush(args, deps) {
     let rigPageSkipDetail;
     if (session.path === "standalone") {
       const ctx = session.ctx;
-      const remoteState = await ctx.fetchRemote({
+      const remoteState = maintainerRemote ?? await ctx.fetchRemote({
         ownerPubkey: ctx.ownerPubkey,
         repoId,
         relayUrls: relaysUsed
@@ -614,6 +639,8 @@ async function runPush(args, deps) {
         rigPageSkipDetail = "skipped (--no-rig-page)";
       } else if (relaysUsed[0] === void 0) {
         rigPageSkipDetail = "skipped (no relay resolved for the pointer)";
+      } else if (maintainerRemote) {
+        rigPageSkipDetail = "skipped (the owner's rig page is the owner's to refresh)";
       } else if (!ctx.publisher.uploadBlob) {
         rigPageSkipDetail = "skipped (the active publisher cannot upload raw blobs)";
       } else {
@@ -2280,9 +2307,9 @@ async function runCiTrigger(args, deps) {
   });
 }
 async function gitShowBytes(repoRoot, commit, path) {
-  const { execFile } = await import("child_process");
+  const { execFile: execFile2 } = await import("child_process");
   return new Promise((resolve2, reject) => {
-    execFile(
+    execFile2(
       "git",
       ["show", `${commit}:${path}`],
       { cwd: repoRoot, encoding: "buffer", maxBuffer: 16 * 1024 * 1024 },
@@ -2493,7 +2520,7 @@ async function runCi(args, deps) {
     case "status":
       return runCiStatus(rest, deps);
     case "serve":
-      return (await import("./ci-serve-MPJ2WPCC.js")).runCiServe(rest, deps);
+      return (await import("./ci-serve-R7ZQ7GJQ.js")).runCiServe(rest, deps);
     case "--help":
     case "-h":
     case "help":
@@ -2764,16 +2791,257 @@ async function runClone(args, deps) {
 
 // src/cli/events.ts
 import { readFile } from "fs/promises";
-import { parseArgs as parseArgs8 } from "util";
+import { parseArgs as parseArgs10 } from "util";
 import {
-  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2,
+  PATCH_KIND as PATCH_KIND3,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND3,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND3,
   STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2,
   STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
   STATUS_OPEN_KIND as STATUS_OPEN_KIND2
 } from "@toon-protocol/core/nip34";
 
-// src/cli/tracker.ts
+// src/cli/merge.ts
+import { execFile } from "child_process";
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join4 } from "path";
+import { parseArgs as parseArgs9 } from "util";
+import { promisify } from "util";
+import {
+  PATCH_KIND as PATCH_KIND2,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2
+} from "@toon-protocol/core/nip34";
+
+// src/cli/fetch.ts
 import { parseArgs as parseArgs7 } from "util";
+var FETCH_USAGE = `Usage: rig fetch [remote] [options]
+
+Fetch from a TOON remote \u2014 FREE (relay reads + Arweave gateway downloads; no
+payments, no identity needed). Reads the kind:30618 repository state from the
+remote's relay, downloads only the git objects this repository is missing
+(SHA-1 verified), and updates the remote-tracking refs
+(refs/remotes/<remote>/*; tags land at refs/tags/*), reporting what moved.
+
+No merge happens: integrate with the git passthrough, e.g.
+\`rig merge origin/main\`. \`rig fetch\` is the TOON transport and shadows
+\`git fetch\` \u2014 plain-git fetches remain available via \`git fetch\` directly.
+
+The repo address (toon.repoid/toon.owner) comes from the config \`rig init\`
+or \`rig clone\` writes; --repo-id/--owner override.
+
+Options:
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
+  --relay <url>        ad-hoc relay override \u2014 bypasses the remote's URL
+  --gateway <url>      gateway to read objects through FIRST, on its raw-bytes
+                       route <url>/raw/<txId>, ahead of the public gateway
+                       list \u2014 name a private, local or air-gapped gateway to
+                       fetch objects the public ones do not carry
+                       (env RIG_ARWEAVE_GATEWAY also sets it)
+  --concurrency <n>    parallel gateway downloads (default 8)
+  --json               machine-readable result envelope
+  -h, --help           show this help`;
+var WS_URL_RE3 = /^wss?:\/\//i;
+function localRefFor(refname, remote) {
+  if (refname.startsWith("refs/heads/")) {
+    return `refs/remotes/${remote}/${refname.slice("refs/heads/".length)}`;
+  }
+  if (refname.startsWith("refs/tags/")) return refname;
+  return null;
+}
+async function resolveLocalRef(repoRoot, refname) {
+  try {
+    const out = await runGit(repoRoot, [
+      "rev-parse",
+      "--verify",
+      "--quiet",
+      refname
+    ]);
+    const sha = out.trim();
+    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+async function runFetch(args, deps) {
+  const { io } = deps;
+  let json = false;
+  let remote = "origin";
+  let relayFlag;
+  let repoIdFlag;
+  let ownerFlag;
+  let gatewayFlag;
+  let concurrency;
+  try {
+    const { values, positionals } = parseArgs7({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        relay: { type: "string" },
+        "repo-id": { type: "string" },
+        owner: { type: "string" },
+        gateway: { type: "string" },
+        concurrency: { type: "string" },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: true
+    });
+    if (values.help) {
+      io.out(FETCH_USAGE);
+      return 0;
+    }
+    json = values.json === true;
+    if (positionals.length > 1) {
+      throw new Error(
+        `expected at most one [remote] argument, got ${positionals.length}`
+      );
+    }
+    if (positionals[0] !== void 0) remote = positionals[0];
+    relayFlag = values.relay;
+    repoIdFlag = values["repo-id"];
+    ownerFlag = values.owner !== void 0 ? ownerToHex(values.owner) : void 0;
+    gatewayFlag = values.gateway;
+    if (values.concurrency !== void 0) {
+      concurrency = Number.parseInt(values.concurrency, 10);
+      if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
+        throw new Error("--concurrency must be a positive integer");
+      }
+    }
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(FETCH_USAGE);
+    return 2;
+  }
+  try {
+    const repoRoot = await resolveRepoRoot(deps.cwd);
+    const toonConfig = await readToonConfig(repoRoot);
+    const repoId = repoIdFlag ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const owner = ownerFlag ?? toonConfig.owner;
+    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+    let relayUrl;
+    if (relayFlag !== void 0) {
+      relayUrl = relayFlag;
+    } else {
+      const urls = await getGitRemoteUrls(repoRoot, remote);
+      if (urls.length === 0) throw new UnknownRemoteError(remote);
+      if (urls.length > 1) throw new MultiUrlRemoteError(remote, urls);
+      relayUrl = urls[0];
+    }
+    if (!WS_URL_RE3.test(relayUrl)) {
+      throw new InvalidRelayUrlError(
+        relayUrl,
+        `remote ${JSON.stringify(remote)}`
+      );
+    }
+    const remoteState = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: owner,
+      repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
+      // The GraphQL fallback for SHAs the map does not cover asks the SAME
+      // permaweb the objects are read from (#183).
+      resolveSha: deps.resolveSha ?? shaResolverFor(gatewayFlag, deps.env)
+    });
+    const planned = [];
+    for (const [refname, sha] of remoteState.refs) {
+      if (!isSafeRefname(refname)) {
+        io.err(
+          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
+        );
+        continue;
+      }
+      const localRef = localRefFor(refname, remote);
+      if (localRef === null) {
+        io.err(
+          `warning: skipping ref outside refs/heads and refs/tags: ${refname}`
+        );
+        continue;
+      }
+      planned.push({ refname, localRef, newSha: sha });
+    }
+    const reader = new GitRepoReader(repoRoot);
+    const tips = [...new Set(planned.map((p) => p.newSha))];
+    const presentLocally = new Set(await reader.listAllObjectShas());
+    const collected = await collectRepoObjects({
+      tips,
+      shaToTxId: remoteState.shaToTxId,
+      resolveMissing: (shas) => remoteState.resolveMissing(shas),
+      presentLocally,
+      // `--gateway` / RIG_ARWEAVE_GATEWAY first, public list behind it (#176).
+      gateways: readGateways(gatewayFlag, deps.env),
+      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
+      ...concurrency !== void 0 ? { concurrency } : {}
+    });
+    if (collected.missing.length > 0) {
+      throw new MissingRemoteObjectsError(
+        collected.missing,
+        `cannot fetch from ${relayUrl}`
+      );
+    }
+    const written = await writeGitObjects(repoRoot, collected.objects.values());
+    const updates = [];
+    for (const { refname, localRef, newSha } of planned) {
+      const oldSha = await resolveLocalRef(repoRoot, localRef);
+      if (oldSha === newSha) {
+        updates.push({ refname, localRef, oldSha, newSha, kind: "up-to-date" });
+        continue;
+      }
+      let kind;
+      if (oldSha === null) {
+        kind = "new";
+      } else {
+        kind = await reader.isAncestor(oldSha, newSha) ? "fast-forward" : "forced";
+      }
+      await updateRef(repoRoot, localRef, newSha);
+      updates.push({ refname, localRef, oldSha, newSha, kind });
+    }
+    const moved = updates.filter((u) => u.kind !== "up-to-date");
+    if (json) {
+      io.emitJson({
+        command: "fetch",
+        repoAddr: { ownerPubkey: owner, repoId },
+        remote,
+        relay: relayUrl,
+        objectsDownloaded: written,
+        updates,
+        executed: true
+      });
+      return 0;
+    }
+    if (moved.length === 0) {
+      io.out("Already up to date.");
+      return 0;
+    }
+    io.out(`From ${relayUrl}`);
+    for (const u of moved) {
+      const short = (refname) => refname.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/remotes\//, "");
+      const src = short(u.refname);
+      const dst = short(u.localRef);
+      if (u.kind === "new") {
+        const label = u.refname.startsWith("refs/tags/") ? "[new tag]" : "[new branch]";
+        io.out(` * ${label.padEnd(17)} ${src.padEnd(14)} -> ${dst}`);
+      } else if (u.kind === "forced") {
+        io.out(
+          ` + ${u.oldSha.slice(0, 7)}...${u.newSha.slice(0, 7)} ${src.padEnd(14)} -> ${dst}  (forced update)`
+        );
+      } else {
+        io.out(
+          `   ${u.oldSha.slice(0, 7)}..${u.newSha.slice(0, 7)}  ${src.padEnd(14)} -> ${dst}`
+        );
+      }
+    }
+    io.out(`Downloaded ${written} object(s) (SHA-1 verified).`);
+    return 0;
+  } catch (err) {
+    return emitCliError(io, json, "fetch", err);
+  }
+}
+
+// src/cli/tracker.ts
+import { parseArgs as parseArgs8 } from "util";
 import {
   ISSUE_KIND,
   PATCH_KIND,
@@ -2859,7 +3127,7 @@ function withTargetAuthor(authorized, targetAuthorPubkey) {
 }
 var RELAY_TIMEOUT_MS = 1e4;
 var HEX64_RE2 = /^[0-9a-f]{64}$/;
-var WS_URL_RE3 = /^wss?:\/\//i;
+var WS_URL_RE4 = /^wss?:\/\//i;
 function defaultWebSocketFactory2(url) {
   const ctor = globalThis.WebSocket;
   if (!ctor) {
@@ -2943,7 +3211,7 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
     repoRoot,
     toonRelays: toonConfig.relays
   });
-  const wsRelays = resolved.relays.filter((url) => WS_URL_RE3.test(url));
+  const wsRelays = resolved.relays.filter((url) => WS_URL_RE4.test(url));
   if (wsRelays.length === 0) {
     throw new InvalidRelayUrlError(
       resolved.relays[0] ?? "",
@@ -3031,7 +3299,7 @@ async function fetchItems(ctx, kind) {
     )
   ]);
   const items = [...itemEvents.values()].filter(
-    (e) => e.kind === kind && e.tags.some((t) => t[0] === "a" && t[1] === aTag)
+    (e) => e.kind === kind && e.tags.some((t) => t[0] === "a" && t[1] === aTag) && !(kind === PATCH_KIND && isPatchRevision(e))
   );
   const statuses = new Map(aStatusEvents);
   if (items.length > 0) {
@@ -3065,6 +3333,12 @@ async function fetchItem(ctx, eventId, expectedKind) {
   if (!event) {
     throw new Error(`event ${eventId} not found on ${ctx.relays.join(", ")}`);
   }
+  if (event.kind === PATCH_KIND && isPatchRevision(event)) {
+    const rootId = revisionRootId(event);
+    if (rootId !== void 0 && rootId !== eventId) {
+      return fetchItem(ctx, rootId, expectedKind);
+    }
+  }
   if (event.kind !== expectedKind) {
     const hint = event.kind === PATCH_KIND ? " (it is a kind:1617 patch \u2014 use `rig pr show`)" : event.kind === ISSUE_KIND ? " (it is a kind:1621 issue \u2014 use `rig issue show`)" : "";
     throw new Error(
@@ -3105,18 +3379,51 @@ async function fetchItem(ctx, eventId, expectedKind) {
     parsedAddr.ownerPubkey,
     parsedAddr.repoId
   ) : /* @__PURE__ */ new Set();
-  return {
-    item: parseTrackerItem(
+  const item = parseTrackerItem(
+    event,
+    deriveStatus(
+      eventId,
+      statusEvents.values(),
+      withTargetAuthor(authorized, event.pubkey)
+    )
+  );
+  let revisions;
+  if (event.kind === PATCH_KIND) {
+    const revisionEvents = await queryAll(
+      ctx.relays,
+      [{ kinds: [PATCH_KIND], "#e": [eventId] }],
+      ctx.webSocketFactory
+    );
+    const { latest, earlier } = selectRevision(
       event,
-      deriveStatus(
-        eventId,
-        statusEvents.values(),
-        withTargetAuthor(authorized, event.pubkey)
-      )
-    ),
-    comments,
-    repoATag: repoATag2
-  };
+      [...revisionEvents.values()].filter((e) => e.kind === PATCH_KIND),
+      authorized
+    );
+    const describe = (e) => ({
+      eventId: e.id,
+      authorPubkey: e.pubkey,
+      createdAt: e.created_at
+    });
+    revisions = { latest: describe(latest), earlier: earlier.map(describe) };
+    if (latest.id !== event.id) {
+      const shown = parseTrackerItem(latest, item.status);
+      item.content = shown.content;
+      item.title = shown.title;
+      item.commitShas = shown.commitShas ?? [];
+      delete item.branch;
+      delete item.description;
+      if (shown.branch !== void 0) item.branch = shown.branch;
+      if (shown.description !== void 0) {
+        item.description = shown.description;
+      }
+    }
+  }
+  return {
+    item,
+    ...revisions ? { revisions } : {},
+    comments,
+    repoATag: repoATag2
+  };
 }
 function parseRepoATag(aTag) {
   if (!aTag) return null;
@@ -3131,7 +3438,7 @@ async function runList(args, deps, spec) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs7({
+    const { values, positionals } = parseArgs8({
       args,
       options: TRACKER_OPTIONS,
       allowPositionals: true
@@ -3196,7 +3503,7 @@ async function runShow(args, deps, spec) {
   let flags;
   let eventId;
   try {
-    const { values, positionals } = parseArgs7({
+    const { values, positionals } = parseArgs8({
       args,
       options: TRACKER_OPTIONS,
       allowPositionals: true
@@ -3229,6 +3536,10 @@ async function runShow(args, deps, spec) {
         relays: ctx.relays,
         repoATag: shown.repoATag,
         [spec.jsonKey]: shown.item,
+        ...shown.revisions ? {
+          latestRevision: shown.revisions.latest,
+          earlierRevisions: shown.revisions.earlier
+        } : {},
         comments: shown.comments
       });
       return 0;
@@ -3245,6 +3556,20 @@ async function runShow(args, deps, spec) {
       io.out(`Commits: ${item.commitShas.join(", ")}`);
     }
     if (shown.repoATag !== null) io.out(`Repo:    ${shown.repoATag}`);
+    if (shown.revisions) {
+      const { latest, earlier } = shown.revisions;
+      if (earlier.length > 0) {
+        io.out(
+          `Showing: ${latest.eventId} (latest revision, by ${latest.authorPubkey.slice(0, 8)}, ${isoDate(latest.createdAt)})`
+        );
+        io.out("Earlier revisions (oldest first):");
+        for (const r of shown.revisions.earlier) {
+          io.out(
+            `  ${r.eventId}  (${r.authorPubkey.slice(0, 8)}, ${isoDate(r.createdAt)})`
+          );
+        }
+      }
+    }
     if (item.description !== void 0) {
       io.out("");
       io.out("Body:");
@@ -3306,6 +3631,435 @@ function runPrShow(args, deps) {
   });
 }
 
+// src/cli/merge.ts
+var execFileAsync = promisify(execFile);
+var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var PR_MERGE_USAGE = `Usage: rig pr merge <patch-id> [--target <branch>] [options]
+
+Apply the latest authorized revision of a patch with \`git am\` onto the
+honored tip of the target branch, push the result, and publish an applied
+status (kind:1631) naming the new commit SHAs \u2014 in that order, so the status
+never claims a merge that did not happen. A paid command; writes are permanent
+and non-refundable. Only the owner or a declared maintainer may merge.
+
+If the patch does not apply, nothing is spent and your working tree is left as
+it was. If the push succeeds but the status publish fails, the merge is
+reported as a partial success; retry with \`rig pr status <patch-id> applied\`.
+
+Options:
+  --target <branch>    branch to merge onto (default: the patch's branch-name
+                       tag, else the repo's default branch)
+  --yes                skip the confirmation prompt
+  --json               machine-readable output (without --yes: estimate only)
+  --relay <url>        ad-hoc relay override (bypasses git remotes)
+  --remote <name>      git remote to use (default: origin)
+  --repo-id <id>       repository id (default: git config toon.repoid)
+  --owner <pubkey>     repository owner (default: git config toon.owner)`;
+function parseMergeArgs(args) {
+  const { values, positionals } = parseArgs9({
+    args,
+    options: {
+      target: { type: "string" },
+      yes: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      relay: { type: "string", multiple: true },
+      remote: { type: "string" },
+      "repo-id": { type: "string" },
+      owner: { type: "string" },
+      standalone: { type: "boolean", default: false },
+      "no-daemon": { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: true
+  });
+  if (values.help) return "help";
+  if (positionals.length !== 1) {
+    throw new Error("expected exactly one argument: <patch-id>");
+  }
+  const patchId = positionals[0];
+  if (!HEX64_RE3.test(patchId)) {
+    throw new Error("<patch-id> must be a 64-character lowercase hex event id");
+  }
+  if (values.owner !== void 0 && !HEX64_RE3.test(values.owner)) {
+    throw new Error("--owner must be a 64-character lowercase hex pubkey");
+  }
+  const flags = {
+    patchId,
+    yes: values.yes === true,
+    json: values.json === true,
+    relay: values.relay ?? []
+  };
+  if (values.target !== void 0) flags.target = values.target;
+  if (values.remote !== void 0) flags.remote = values.remote;
+  if (values["repo-id"] !== void 0) flags.repoId = values["repo-id"];
+  if (values.owner !== void 0) flags.owner = values.owner;
+  return flags;
+}
+async function git(cwd, args, env) {
+  const { stdout } = await execFileAsync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    maxBuffer: 64 * 1024 * 1024,
+    ...env ? { env } : {}
+  });
+  return stdout.trim();
+}
+async function gitOk(cwd, args) {
+  try {
+    await git(cwd, args);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function gitFailure(err) {
+  const e = err;
+  return (e.stderr || e.stdout || e.message || String(err)).trim();
+}
+var OverlayReader = class extends GitRepoReader {
+  constructor(repoPath, overlay) {
+    super(repoPath);
+    this.overlay = overlay;
+  }
+  overlay;
+  async listRefs() {
+    const base = await super.listRefs();
+    const refs = base.refs.filter(
+      (r) => r.refname !== this.overlay.refname
+    );
+    refs.push({
+      refname: this.overlay.refname,
+      sha: this.overlay.sha,
+      type: "commit"
+    });
+    return { ...base, refs };
+  }
+};
+async function applyInIsolation(repoRoot, tip, patchText, committer) {
+  const scratch = await mkdtemp2(join4(tmpdir(), "rig-merge-"));
+  const worktree = join4(scratch, "wt");
+  try {
+    await git(repoRoot, ["worktree", "add", "--detach", worktree, tip]);
+    const patchFile = join4(scratch, "patch.mbox");
+    await writeFile(patchFile, patchText, "utf-8");
+    const env = { ...process.env };
+    if (committer) {
+      env["GIT_COMMITTER_NAME"] = committer.name;
+      env["GIT_COMMITTER_EMAIL"] = committer.email;
+    }
+    try {
+      await git(worktree, ["am", "--quiet", patchFile], env);
+    } catch (err) {
+      await git(worktree, ["am", "--abort"]).catch(() => void 0);
+      throw new PrMergeError(
+        "apply_conflict",
+        `the patch does not apply cleanly onto ${tip.slice(0, 7)} \u2014 ask the contributor for a revision (\`rig pr create --revises\`). Nothing was pushed, published, or paid, and your working tree is unchanged.
+` + gitFailure(err)
+      );
+    }
+    const newHead = await git(worktree, ["rev-parse", "HEAD"]);
+    const listed = await git(worktree, [
+      "rev-list",
+      "--reverse",
+      `${tip}..${newHead}`
+    ]);
+    const commits = listed === "" ? [] : listed.split("\n");
+    if (commits.length === 0) {
+      throw new PrMergeError(
+        "nothing_to_apply",
+        "the patch applied no commits (already merged?) \u2014 nothing was pushed, published, or paid."
+      );
+    }
+    return { newHead, commits };
+  } finally {
+    await git(repoRoot, ["worktree", "remove", "--force", worktree]).catch(
+      () => void 0
+    );
+    await git(repoRoot, ["worktree", "prune"]).catch(() => void 0);
+    await rm2(scratch, { recursive: true, force: true });
+  }
+}
+var BRANCH_PREFIX = "refs/heads/";
+async function runPrMerge(args, deps) {
+  const { io } = deps;
+  let flags;
+  try {
+    const parsed = parseMergeArgs(args);
+    if (parsed === "help") {
+      io.out(PR_MERGE_USAGE);
+      return 0;
+    }
+    flags = parsed;
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(PR_MERGE_USAGE);
+    return 2;
+  }
+  deps = withForcedStandalone(deps);
+  const webSocketFactory = deps.webSocketFactory ?? defaultWebSocketFactory;
+  let stop;
+  try {
+    const repoRoot = await resolveRepoRoot(deps.cwd);
+    const toonConfig = await readToonConfig(repoRoot);
+    const repoId = flags.repoId ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const resolved = await resolveRelays({
+      relayFlags: flags.relay,
+      remoteName: flags.remote,
+      repoRoot,
+      toonRelays: toonConfig.relays
+    });
+    if (resolved.nudge !== void 0) io.err(resolved.nudge);
+    const relays = resolved.relays;
+    if (relays.length > 1) {
+      io.err(singleRelayRefusal(resolved, "Nothing was pushed or paid."));
+      return 1;
+    }
+    const relay = relays[0];
+    const session = await loadPaidSession(deps, relay);
+    if (session.path !== "standalone") {
+      throw new Error("internal: rig pr merge requires the standalone session");
+    }
+    const ctx = session.ctx;
+    stop = () => ctx.stop();
+    const identity = identityReport(ctx);
+    const owner = flags.owner ?? toonConfig.owner ?? identity.pubkey;
+    const addr = { ownerPubkey: owner, repoId };
+    const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND2}:${owner}:${repoId}`;
+    const lookup = async (id) => (await queryAll(relays, [{ ids: [id] }], webSocketFactory)).get(id);
+    let root = await lookup(flags.patchId);
+    if (root && root.kind === PATCH_KIND2 && isPatchRevision(root)) {
+      const rootId = revisionRootId(root);
+      if (rootId !== void 0) root = await lookup(rootId);
+    }
+    if (!root || root.kind !== PATCH_KIND2) {
+      throw new PrMergeError(
+        "patch_not_found",
+        `patch ${flags.patchId} not found as a kind:1617 patch on ${relay} \u2014 nothing was pushed or paid`
+      );
+    }
+    if (!root.tags.some((t) => t[0] === "a" && t[1] === aTag)) {
+      throw new PrMergeError(
+        "patch_not_found",
+        `patch ${root.id} does not belong to ${aTag} \u2014 nothing was pushed or paid`
+      );
+    }
+    const remote = await ctx.fetchRemote({
+      ownerPubkey: owner,
+      repoId,
+      relayUrls: relays
+    });
+    const authorized = authorizedAuthors(
+      owner,
+      remote.announceEvent?.tags ?? []
+    );
+    const revisionEvents = await queryAll(
+      relays,
+      [{ kinds: [PATCH_KIND2], "#e": [root.id] }],
+      webSocketFactory
+    );
+    const { latest } = selectRevision(
+      root,
+      [...revisionEvents.values()].filter((e) => e.kind === PATCH_KIND2),
+      authorized
+    );
+    if (!authorized.has(identity.pubkey.toLowerCase())) {
+      throw new PrMergeError(
+        "not_authorized",
+        `only the owner or a declared maintainer can merge \u2014 ${identity.pubkey.slice(0, 8)}\u2026 is neither for ${aTag}. Readers would ignore the pushed state. Nothing was pushed or paid.`
+      );
+    }
+    if (!remote.announced) {
+      throw new PrMergeError(
+        "target_not_found",
+        `${aTag} is not announced on ${relay} \u2014 nothing to merge onto`
+      );
+    }
+    const branch = (flags.target ?? firstTagValue(latest.tags, "branch-name") ?? remote.headSymref ?? "main").replace(/^refs\/heads\//, "");
+    const refname = `${BRANCH_PREFIX}${branch}`;
+    const tip = remote.refs.get(refname);
+    if (tip === void 0) {
+      throw new PrMergeError(
+        "target_not_found",
+        `branch ${JSON.stringify(branch)} is not in the honored repo state (${[...remote.refs.keys()].join(", ") || "no refs"}) \u2014 pass --target. Nothing was pushed or paid.`
+      );
+    }
+    if (!await gitOk(repoRoot, ["cat-file", "-e", `${tip}^{commit}`])) {
+      await runFetch(
+        ["--relay", relay, "--owner", owner, "--repo-id", repoId],
+        { ...deps, io: { ...io, out: () => void 0 } }
+      );
+      if (!await gitOk(repoRoot, ["cat-file", "-e", `${tip}^{commit}`])) {
+        throw new PrMergeError(
+          "tip_unavailable",
+          `the honored tip ${tip.slice(0, 7)} of ${branch} could not be fetched \u2014 run \`rig fetch\` and retry. Nothing was pushed or paid.`
+        );
+      }
+    }
+    const reader = new GitRepoReader(repoRoot);
+    const localRefs = (await reader.listRefs()).refs;
+    const localSha = localRefs.find((r) => r.refname === refname)?.sha;
+    if (localSha !== void 0 && localSha !== tip && !await reader.isAncestor(localSha, tip)) {
+      throw new PrMergeError(
+        "local_branch_diverged",
+        `local ${branch} (${localSha.slice(0, 7)}) is not behind the honored tip (${tip.slice(0, 7)}) \u2014 push or reset it first. Nothing was pushed or paid.`
+      );
+    }
+    const hasCommitter = await gitOk(repoRoot, ["config", "user.email"]);
+    const applied = await applyInIsolation(
+      repoRoot,
+      tip,
+      latest.content,
+      hasCommitter ? void 0 : {
+        name: hexToNpub(identity.pubkey),
+        email: `${hexToNpub(identity.pubkey)}@nostr`
+      }
+    );
+    const overlay = new OverlayReader(repoRoot, {
+      refname,
+      sha: applied.newHead
+    });
+    const feeRates = await ctx.publisher.getFeeRates();
+    const pushPlan = await planPush({
+      repoReader: overlay,
+      remoteState: remote,
+      feeRates,
+      repoId,
+      refs: [refname],
+      force: false
+    });
+    const plan = serializePushPlan(pushPlan);
+    const total = BigInt(plan.estimate.totalFee) + feeRates.eventFee;
+    if (!flags.json) {
+      for (const line of renderPlan(plan)) io.out(line);
+      io.out(
+        `  status    kind:1631 applied (${applied.commits.length} commit${applied.commits.length === 1 ? "" : "s"})   ${feeRates.eventFee}`
+      );
+      io.out(`  total with status       ${total}`);
+      io.out(renderIdentityLine(identity));
+    }
+    if (!flags.yes) {
+      if (flags.json) {
+        io.emitJson({
+          command: "pr merge",
+          repoAddr: addr,
+          identity,
+          executed: false,
+          patchId: root.id,
+          revisionId: latest.id,
+          target: refname,
+          mergedShas: applied.commits,
+          plan,
+          totalFee: total.toString(),
+          hint: "estimate only \u2014 re-run with --yes to push and publish (permanent, non-refundable)"
+        });
+        return 0;
+      }
+      if (!io.isInteractive) {
+        io.err(
+          "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
+        );
+        return 1;
+      }
+      const proceed = await io.confirm(
+        `Proceed with paid merge (total ${total} base units)? [y/N] `
+      );
+      if (!proceed) {
+        io.err("aborted \u2014 nothing was pushed or published.");
+        return 1;
+      }
+    }
+    const pushResult = await executePush({
+      plan: pushPlan,
+      publisher: ctx.publisher,
+      remoteState: remote,
+      repoReader: overlay,
+      relayUrls: relays
+    });
+    const result = serializePushResult(pushPlan, pushResult);
+    const localNote = await advanceLocalBranch(
+      repoRoot,
+      reader,
+      refname,
+      applied.newHead,
+      localSha
+    );
+    if (localNote !== void 0) io.err(localNote);
+    let statusEventId;
+    let statusError;
+    try {
+      const receipt = await ctx.publisher.publishEvent(
+        buildStatus(owner, repoId, root.id, STATUS_APPLIED_KIND2, root.pubkey, {
+          commits: applied.commits,
+          revisionEventId: latest.id
+        }),
+        relays
+      );
+      statusEventId = receipt.eventId;
+    } catch (err) {
+      statusError = err instanceof Error ? err.message : String(err);
+    }
+    const retryHint = `rig pr status ${root.id} applied`;
+    if (flags.json) {
+      io.emitJson({
+        command: "pr merge",
+        repoAddr: addr,
+        identity,
+        executed: true,
+        patchId: root.id,
+        revisionId: latest.id,
+        target: refname,
+        mergedShas: applied.commits,
+        result,
+        ...statusEventId !== void 0 ? { statusEventId } : {},
+        ...statusError !== void 0 ? {
+          partial: true,
+          error: "status_publish_failed",
+          detail: statusError,
+          hint: `the push succeeded but the applied status was not published \u2014 retry with \`${retryHint}\``
+        } : {}
+      });
+    } else {
+      for (const line of renderResult(result)) io.out(line);
+      if (statusEventId !== void 0) {
+        io.out(
+          `Merged ${applied.commits.length} commit(s) onto ${branch}; applied status ${statusEventId}`
+        );
+      }
+    }
+    if (statusError !== void 0) {
+      io.err(
+        `partial success: the push succeeded but publishing the applied status failed: ${statusError}`
+      );
+      io.err(`retry the status with: ${retryHint}`);
+      return 1;
+    }
+    return 0;
+  } catch (err) {
+    return emitCliError(io, flags.json, "pr merge", err);
+  } finally {
+    if (stop) await stop().catch(() => void 0);
+  }
+}
+async function advanceLocalBranch(repoRoot, reader, refname, newHead, oldSha) {
+  try {
+    const { head } = await reader.listRefs();
+    if (head === refname) {
+      await git(repoRoot, ["merge", "--ff-only", newHead]);
+    } else {
+      await git(repoRoot, [
+        "update-ref",
+        refname,
+        newHead,
+        oldSha ?? "0".repeat(40)
+      ]);
+    }
+    return void 0;
+  } catch (err) {
+    return `warning: the push succeeded but local ${refname} could not be moved to ${newHead.slice(0, 7)}: ${gitFailure(err)} \u2014 run \`rig fetch\``;
+  }
+}
+
 // src/cli/events.ts
 var defaultReadStdin2 = async () => {
   if (process.stdin.isTTY) return "";
@@ -3372,7 +4126,7 @@ comments published by this version.
 Options:
   --body <text>            comment body (Markdown) [required]
 ${COMMON_FLAGS_USAGE2}`;
-var PR_CREATE_USAGE = `Usage: rig pr create --title <title> (--range <range> | --patch-file <path>) [options]
+var PR_CREATE_USAGE = `Usage: rig pr create --title <title> (--range <range> | --patch-file <path>) [--revises <patch-id>] [options]
 
 Publish a patch (kind:1617) whose content is REAL \`git format-patch\` output \u2014
 a paid publish; writes are permanent and non-refundable. --range runs
@@ -3386,6 +4140,12 @@ The PR body (--body/--body-file) is carried in a dedicated \`description\`
 tag, not in the event content \u2014 the content stays pure format-patch output so
 \`rig pr show \u2026 | git am\` keeps working.
 
+--revises publishes the patch as a NIP-34 revision of an existing root patch
+(\`t root-revision\` plus a NIP-10 reply to it), keeping the original thread,
+comments and status. Readers honor a revision only from the root's author or a
+declared maintainer; otherwise rig warns and still publishes. A revision is
+always published through the embedded (standalone) path.
+
 Options:
   --title <title>      patch/PR title (subject tag) [required]
   --range <range>      revision range for format-patch: <rev>, <rev>..<rev>,
@@ -3394,6 +4154,7 @@ Options:
   --body <text>        PR description (Markdown; description tag)
   --body-file <path>   read the PR description from a file
   --branch <name>      branch name (branch-name tag)
+  --revises <patch-id> publish as a revision of this root patch (64-hex id)
 ${COMMON_FLAGS_USAGE2}`;
 var PR_STATUS_USAGE = `Usage: rig pr status <target-event-id> <open|applied|closed|draft> [options]
 
@@ -3420,14 +4181,16 @@ Options:
 ${COMMON_FLAGS_USAGE2}`;
 var PR_USAGE = `${PR_CREATE_USAGE}
 
+${PR_MERGE_USAGE}
+
 ${PR_STATUS_USAGE}
 
 ${PR_LIST_USAGE}
 
 ${PR_SHOW_USAGE}`;
-var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var HEX64_RE4 = /^[0-9a-f]{64}$/;
 function assertHex64(value, what) {
-  if (!HEX64_RE3.test(value)) {
+  if (!HEX64_RE4.test(value)) {
     throw new Error(
       `${what} must be a 64-char lowercase hex id (got ${JSON.stringify(value)})`
     );
@@ -3624,7 +4387,7 @@ async function runIssue(args, deps) {
   let bodyFile;
   let labels;
   try {
-    const { values } = parseArgs8({
+    const { values } = parseArgs10({
       args: rest,
       options: {
         ...COMMON_OPTIONS2,
@@ -3720,7 +4483,7 @@ async function resolveCommentTarget(deps, targetEventId, relayUrl) {
     const rootEventId = firstTagValue(target.tags, "E");
     const rootKind = Number(firstTagValue(target.tags, "K"));
     const rootAuthor = firstTagValue(target.tags, "P");
-    if (rootEventId === void 0 || !HEX64_RE3.test(rootEventId) || !Number.isSafeInteger(rootKind) || rootAuthor === void 0 || !HEX64_RE3.test(rootAuthor)) {
+    if (rootEventId === void 0 || !HEX64_RE4.test(rootEventId) || !Number.isSafeInteger(rootKind) || rootAuthor === void 0 || !HEX64_RE4.test(rootAuthor)) {
       throw new Error(
         `kind:1111 comment ${targetEventId} carries no usable NIP-22 root scope (E/K/P tags) \u2014 cannot derive the thread root to reply into`
       );
@@ -3744,7 +4507,7 @@ async function runComment(args, deps) {
   let targetEventId;
   let body;
   try {
-    const { values, positionals } = parseArgs8({
+    const { values, positionals } = parseArgs10({
       args,
       options: {
         ...COMMON_OPTIONS2,
@@ -3825,6 +4588,8 @@ async function runPr(args, deps) {
   switch (sub) {
     case "create":
       return runPrCreate(rest, deps);
+    case "merge":
+      return runPrMerge(rest, deps);
     case "status":
       return runStatusCommand(rest, deps, PR_STATUS_SPEC);
     // FREE read subcommands (#278): relay queries only, no payment path.
@@ -3839,12 +4604,75 @@ async function runPr(args, deps) {
       return 0;
     default:
       io.err(
-        sub === void 0 ? "missing subcommand: rig pr <create|status|list|show>" : `unknown rig pr subcommand: ${sub}`
+        sub === void 0 ? "missing subcommand: rig pr <create|merge|status|list|show>" : `unknown rig pr subcommand: ${sub}`
       );
       io.err(PR_USAGE);
       return 2;
   }
 }
+async function resolveRevisedRoot(deps, rootId, relayUrl, addr) {
+  if (relayUrl === void 0) {
+    throw new Error(
+      "--revises needs the root patch from a relay; pass --relay <url> or configure a remote"
+    );
+  }
+  const found = await queryRelay(
+    relayUrl,
+    { ids: [rootId] },
+    TARGET_LOOKUP_TIMEOUT_MS,
+    deps.webSocketFactory ?? defaultWebSocketFactory
+  );
+  const root = found.find((e) => e.id === rootId);
+  if (!root) {
+    throw new Error(
+      `patch ${rootId} not found on ${relayUrl} \u2014 nothing was published or paid`
+    );
+  }
+  if (root.kind !== PATCH_KIND3) {
+    throw new Error(
+      `event ${rootId} has kind ${root.kind}, not a kind:1617 patch \u2014 nothing was published or paid`
+    );
+  }
+  const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND3}:${addr.ownerPubkey}:${addr.repoId}`;
+  if (!root.tags.some((t) => t[0] === "a" && t[1] === aTag)) {
+    throw new Error(
+      `patch ${rootId} belongs to a different repository than ${aTag} \u2014 nothing was published or paid`
+    );
+  }
+  if (isPatchRevision(root)) {
+    throw new Error(
+      `patch ${rootId} is itself a revision \u2014 pass the ROOT patch id to --revises; nothing was published or paid`
+    );
+  }
+  return { pubkey: root.pubkey };
+}
+async function warnIfRevisionIgnored(deps, args, rootAuthor) {
+  const { io } = deps;
+  const { identity, addr, relayUrl } = args;
+  const me = identity.pubkey.toLowerCase();
+  if (me === rootAuthor?.toLowerCase()) return;
+  if (me === addr.ownerPubkey.toLowerCase()) return;
+  let authorized;
+  if (relayUrl !== void 0) {
+    try {
+      const remote = await fetchRemoteState({
+        relayUrls: [relayUrl],
+        ownerPubkey: addr.ownerPubkey,
+        repoId: addr.repoId,
+        ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {}
+      });
+      authorized = authorizedAuthors(
+        addr.ownerPubkey,
+        remote.announceEvent?.tags ?? []
+      );
+    } catch {
+    }
+  }
+  if (authorized?.has(me)) return;
+  io.err(
+    authorized === void 0 ? "warning: could not read the repo announcement to verify your maintainer status \u2014 unless you are the root patch's author or a declared maintainer, readers will IGNORE this revision." : `warning: you (${identity.pubkey.slice(0, 8)}\u2026) are neither the root patch's author nor a maintainer of 30617:${addr.ownerPubkey.slice(0, 8)}\u2026:${addr.repoId} \u2014 readers will IGNORE this revision. Publishing anyway (the relay is permissionless).`
+  );
+}
 async function runPrCreate(rest, deps) {
   const { io } = deps;
   let flags;
@@ -3854,8 +4682,9 @@ async function runPrCreate(rest, deps) {
   let branch;
   let bodyFlag;
   let bodyFile;
+  let revises;
   try {
-    const { values } = parseArgs8({
+    const { values } = parseArgs10({
       args: rest,
       options: {
         ...COMMON_OPTIONS2,
@@ -3864,7 +4693,8 @@ async function runPrCreate(rest, deps) {
         "patch-file": { type: "string" },
         body: { type: "string" },
         "body-file": { type: "string" },
-        branch: { type: "string" }
+        branch: { type: "string" },
+        revises: { type: "string" }
       },
       allowPositionals: false
     });
@@ -3888,6 +4718,11 @@ async function runPrCreate(rest, deps) {
     branch = values.branch;
     bodyFlag = values.body;
     bodyFile = values["body-file"];
+    if (values.revises !== void 0) {
+      assertHex64(values.revises, "--revises");
+      revises = values.revises;
+      flags = { ...flags, standalone: true };
+    }
   } catch (err) {
     io.err(err instanceof Error ? err.message : String(err));
     io.err(PR_CREATE_USAGE);
@@ -3912,12 +4747,16 @@ async function runPrCreate(rest, deps) {
   }
   let builtPatchText;
   let builtCommits = [];
+  let rootAuthor;
   return runEvent({
     command: "pr",
     flags,
     deps,
     actionLabel: `patch ${JSON.stringify(title)}`,
-    buildEvent: async (addr) => {
+    buildEvent: async (addr, relayUrl) => {
+      if (revises !== void 0) {
+        rootAuthor = (await resolveRevisedRoot(deps, revises, relayUrl, addr)).pubkey;
+      }
       let patchText;
       let commits;
       if (range !== void 0) {
@@ -3952,9 +4791,16 @@ async function runPrCreate(rest, deps) {
         commits,
         branch,
         patchText,
-        body
+        body,
+        revises !== void 0 ? {
+          rootEventId: revises,
+          ...rootAuthor !== void 0 ? { rootAuthorPubkey: rootAuthor } : {}
+        } : void 0
       );
     },
+    // A revision from anyone but the root's author or a maintainer is ignored
+    // by readers: warn, but publish (the relay is permissionless).
+    preConfirm: revises === void 0 ? void 0 : (args) => warnIfRevisionIgnored(deps, args, rootAuthor),
     sendDaemon: (client, addr) => {
       if (builtPatchText === void 0) {
         throw new Error("internal: patch text not built before delegation");
@@ -3972,7 +4818,7 @@ async function runPrCreate(rest, deps) {
 }
 var STATUS_KIND_BY_VALUE = {
   open: STATUS_OPEN_KIND2,
-  applied: STATUS_APPLIED_KIND2,
+  applied: STATUS_APPLIED_KIND3,
   closed: STATUS_CLOSED_KIND2,
   draft: STATUS_DRAFT_KIND2
 };
@@ -3999,7 +4845,7 @@ async function runStatusCommand(args, deps, spec, fixedStatus) {
   let targetEventId;
   let status;
   try {
-    const { values, positionals } = parseArgs8({
+    const { values, positionals } = parseArgs10({
       args,
       options: COMMON_OPTIONS2,
       allowPositionals: true
@@ -4085,8 +4931,8 @@ async function warnIfNotMaintainer(deps, args) {
 // src/cli/entry.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
-import { parseArgs as parseArgs9 } from "util";
+import { dirname as dirname4, join as join5 } from "path";
+import { parseArgs as parseArgs11 } from "util";
 var ENTRY_USAGE = `Usage: rig entry [<connector-url> | clear] [options]
 
 Name the TOON connector rig pays. A connector describes itself on GET /ilp
@@ -4110,8 +4956,8 @@ Options:
   --json               machine-readable envelope
   -h, --help           show this help`;
 function configPathFor2(env) {
-  const dir = env["TOON_CLIENT_HOME"] ?? join4(homedir3(), ".toon-client");
-  return join4(dir, "config.json");
+  const dir = env["TOON_CLIENT_HOME"] ?? join5(homedir3(), ".toon-client");
+  return join5(dir, "config.json");
 }
 function readEntryConfig(configPath) {
   try {
@@ -4156,7 +5002,7 @@ async function runEntry(args, deps) {
   let relayFlag;
   let json = false;
   try {
-    const parsed = parseArgs9({
+    const parsed = parseArgs11({
       args,
       allowPositionals: true,
       options: {
@@ -4259,278 +5105,52 @@ async function runEntry(args, deps) {
       delete next.connectorUrl;
       delete next.relayUrl;
     } else {
-      next.connectorUrl = mutation.connectorUrl;
-      if (mutation.relayUrl !== void 0) next.relayUrl = mutation.relayUrl;
-    }
-    if (env["TOON_CONNECTOR"] || env["TOON_CLIENT_PROXY_URL"]) {
-      warnings.push(
-        "TOON_CONNECTOR / TOON_CLIENT_PROXY_URL is set in this shell and outranks the config file"
-      );
-    }
-    writeEntryConfig(configPath, next);
-    const wrote = {
-      connectorUrl: next.connectorUrl ?? null,
-      relayUrl: next.relayUrl ?? null
-    };
-    const state = effectiveEntry(env, next);
-    if (json) {
-      io.emitJson({
-        command: "entry",
-        ...state,
-        wrote,
-        configPath,
-        ...warnings.length > 0 ? { warnings } : {}
-      });
-      return 0;
-    }
-    if (mutation.kind === "clear") {
-      io.out(`Cleared the recorded connector in ${configPath}.`);
-    } else {
-      io.out(`Recorded connector ${mutation.connectorUrl} in ${configPath}.`);
-      if (mutation.relayUrl !== void 0)
-        io.out(`Recorded relay ${mutation.relayUrl}.`);
-    }
-    for (const w of warnings) io.out(`warning: ${w}`);
-    io.out(
-      `Effective connector: ${state.connectorUrl ?? "(none)"}  [${label(state.connectorSource)}]`
-    );
-    return 0;
-  } catch (err) {
-    return emitCliError(io, json, "entry", err);
-  }
-}
-
-// src/cli/fetch.ts
-import { parseArgs as parseArgs10 } from "util";
-var FETCH_USAGE = `Usage: rig fetch [remote] [options]
-
-Fetch from a TOON remote \u2014 FREE (relay reads + Arweave gateway downloads; no
-payments, no identity needed). Reads the kind:30618 repository state from the
-remote's relay, downloads only the git objects this repository is missing
-(SHA-1 verified), and updates the remote-tracking refs
-(refs/remotes/<remote>/*; tags land at refs/tags/*), reporting what moved.
-
-No merge happens: integrate with the git passthrough, e.g.
-\`rig merge origin/main\`. \`rig fetch\` is the TOON transport and shadows
-\`git fetch\` \u2014 plain-git fetches remain available via \`git fetch\` directly.
-
-The repo address (toon.repoid/toon.owner) comes from the config \`rig init\`
-or \`rig clone\` writes; --repo-id/--owner override.
-
-Options:
-  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
-  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
-  --relay <url>        ad-hoc relay override \u2014 bypasses the remote's URL
-  --gateway <url>      gateway to read objects through FIRST, on its raw-bytes
-                       route <url>/raw/<txId>, ahead of the public gateway
-                       list \u2014 name a private, local or air-gapped gateway to
-                       fetch objects the public ones do not carry
-                       (env RIG_ARWEAVE_GATEWAY also sets it)
-  --concurrency <n>    parallel gateway downloads (default 8)
-  --json               machine-readable result envelope
-  -h, --help           show this help`;
-var WS_URL_RE4 = /^wss?:\/\//i;
-function localRefFor(refname, remote) {
-  if (refname.startsWith("refs/heads/")) {
-    return `refs/remotes/${remote}/${refname.slice("refs/heads/".length)}`;
-  }
-  if (refname.startsWith("refs/tags/")) return refname;
-  return null;
-}
-async function resolveLocalRef(repoRoot, refname) {
-  try {
-    const out = await runGit(repoRoot, [
-      "rev-parse",
-      "--verify",
-      "--quiet",
-      refname
-    ]);
-    const sha = out.trim();
-    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
-  } catch {
-    return null;
-  }
-}
-async function runFetch(args, deps) {
-  const { io } = deps;
-  let json = false;
-  let remote = "origin";
-  let relayFlag;
-  let repoIdFlag;
-  let ownerFlag;
-  let gatewayFlag;
-  let concurrency;
-  try {
-    const { values, positionals } = parseArgs10({
-      args,
-      options: {
-        json: { type: "boolean", default: false },
-        relay: { type: "string" },
-        "repo-id": { type: "string" },
-        owner: { type: "string" },
-        gateway: { type: "string" },
-        concurrency: { type: "string" },
-        help: { type: "boolean", short: "h", default: false }
-      },
-      allowPositionals: true
-    });
-    if (values.help) {
-      io.out(FETCH_USAGE);
-      return 0;
-    }
-    json = values.json === true;
-    if (positionals.length > 1) {
-      throw new Error(
-        `expected at most one [remote] argument, got ${positionals.length}`
-      );
-    }
-    if (positionals[0] !== void 0) remote = positionals[0];
-    relayFlag = values.relay;
-    repoIdFlag = values["repo-id"];
-    ownerFlag = values.owner !== void 0 ? ownerToHex(values.owner) : void 0;
-    gatewayFlag = values.gateway;
-    if (values.concurrency !== void 0) {
-      concurrency = Number.parseInt(values.concurrency, 10);
-      if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
-        throw new Error("--concurrency must be a positive integer");
-      }
-    }
-  } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(FETCH_USAGE);
-    return 2;
-  }
-  try {
-    const repoRoot = await resolveRepoRoot(deps.cwd);
-    const toonConfig = await readToonConfig(repoRoot);
-    const repoId = repoIdFlag ?? toonConfig.repoId;
-    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
-    const owner = ownerFlag ?? toonConfig.owner;
-    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
-    let relayUrl;
-    if (relayFlag !== void 0) {
-      relayUrl = relayFlag;
-    } else {
-      const urls = await getGitRemoteUrls(repoRoot, remote);
-      if (urls.length === 0) throw new UnknownRemoteError(remote);
-      if (urls.length > 1) throw new MultiUrlRemoteError(remote, urls);
-      relayUrl = urls[0];
-    }
-    if (!WS_URL_RE4.test(relayUrl)) {
-      throw new InvalidRelayUrlError(
-        relayUrl,
-        `remote ${JSON.stringify(remote)}`
-      );
-    }
-    const remoteState = await fetchRemoteState({
-      relayUrls: [relayUrl],
-      ownerPubkey: owner,
-      repoId,
-      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
-      // The GraphQL fallback for SHAs the map does not cover asks the SAME
-      // permaweb the objects are read from (#183).
-      resolveSha: deps.resolveSha ?? shaResolverFor(gatewayFlag, deps.env)
-    });
-    const planned = [];
-    for (const [refname, sha] of remoteState.refs) {
-      if (!isSafeRefname(refname)) {
-        io.err(
-          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
-        );
-        continue;
-      }
-      const localRef = localRefFor(refname, remote);
-      if (localRef === null) {
-        io.err(
-          `warning: skipping ref outside refs/heads and refs/tags: ${refname}`
-        );
-        continue;
-      }
-      planned.push({ refname, localRef, newSha: sha });
-    }
-    const reader = new GitRepoReader(repoRoot);
-    const tips = [...new Set(planned.map((p) => p.newSha))];
-    const presentLocally = new Set(await reader.listAllObjectShas());
-    const collected = await collectRepoObjects({
-      tips,
-      shaToTxId: remoteState.shaToTxId,
-      resolveMissing: (shas) => remoteState.resolveMissing(shas),
-      presentLocally,
-      // `--gateway` / RIG_ARWEAVE_GATEWAY first, public list behind it (#176).
-      gateways: readGateways(gatewayFlag, deps.env),
-      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
-      ...concurrency !== void 0 ? { concurrency } : {}
-    });
-    if (collected.missing.length > 0) {
-      throw new MissingRemoteObjectsError(
-        collected.missing,
-        `cannot fetch from ${relayUrl}`
-      );
-    }
-    const written = await writeGitObjects(repoRoot, collected.objects.values());
-    const updates = [];
-    for (const { refname, localRef, newSha } of planned) {
-      const oldSha = await resolveLocalRef(repoRoot, localRef);
-      if (oldSha === newSha) {
-        updates.push({ refname, localRef, oldSha, newSha, kind: "up-to-date" });
-        continue;
-      }
-      let kind;
-      if (oldSha === null) {
-        kind = "new";
-      } else {
-        kind = await reader.isAncestor(oldSha, newSha) ? "fast-forward" : "forced";
-      }
-      await updateRef(repoRoot, localRef, newSha);
-      updates.push({ refname, localRef, oldSha, newSha, kind });
+      next.connectorUrl = mutation.connectorUrl;
+      if (mutation.relayUrl !== void 0) next.relayUrl = mutation.relayUrl;
     }
-    const moved = updates.filter((u) => u.kind !== "up-to-date");
+    if (env["TOON_CONNECTOR"] || env["TOON_CLIENT_PROXY_URL"]) {
+      warnings.push(
+        "TOON_CONNECTOR / TOON_CLIENT_PROXY_URL is set in this shell and outranks the config file"
+      );
+    }
+    writeEntryConfig(configPath, next);
+    const wrote = {
+      connectorUrl: next.connectorUrl ?? null,
+      relayUrl: next.relayUrl ?? null
+    };
+    const state = effectiveEntry(env, next);
     if (json) {
       io.emitJson({
-        command: "fetch",
-        repoAddr: { ownerPubkey: owner, repoId },
-        remote,
-        relay: relayUrl,
-        objectsDownloaded: written,
-        updates,
-        executed: true
+        command: "entry",
+        ...state,
+        wrote,
+        configPath,
+        ...warnings.length > 0 ? { warnings } : {}
       });
       return 0;
     }
-    if (moved.length === 0) {
-      io.out("Already up to date.");
-      return 0;
-    }
-    io.out(`From ${relayUrl}`);
-    for (const u of moved) {
-      const short = (refname) => refname.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/remotes\//, "");
-      const src = short(u.refname);
-      const dst = short(u.localRef);
-      if (u.kind === "new") {
-        const label = u.refname.startsWith("refs/tags/") ? "[new tag]" : "[new branch]";
-        io.out(` * ${label.padEnd(17)} ${src.padEnd(14)} -> ${dst}`);
-      } else if (u.kind === "forced") {
-        io.out(
-          ` + ${u.oldSha.slice(0, 7)}...${u.newSha.slice(0, 7)} ${src.padEnd(14)} -> ${dst}  (forced update)`
-        );
-      } else {
-        io.out(
-          `   ${u.oldSha.slice(0, 7)}..${u.newSha.slice(0, 7)}  ${src.padEnd(14)} -> ${dst}`
-        );
-      }
+    if (mutation.kind === "clear") {
+      io.out(`Cleared the recorded connector in ${configPath}.`);
+    } else {
+      io.out(`Recorded connector ${mutation.connectorUrl} in ${configPath}.`);
+      if (mutation.relayUrl !== void 0)
+        io.out(`Recorded relay ${mutation.relayUrl}.`);
     }
-    io.out(`Downloaded ${written} object(s) (SHA-1 verified).`);
+    for (const w of warnings) io.out(`warning: ${w}`);
+    io.out(
+      `Effective connector: ${state.connectorUrl ?? "(none)"}  [${label(state.connectorSource)}]`
+    );
     return 0;
   } catch (err) {
-    return emitCliError(io, json, "fetch", err);
+    return emitCliError(io, json, "entry", err);
   }
 }
 
 // src/cli/fund.ts
 import { readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-import { parseArgs as parseArgs11 } from "util";
+import { join as join6 } from "path";
+import { parseArgs as parseArgs12 } from "util";
 var DEVNET_FAUCET_URL = "https://faucet.devnet.toonprotocol.dev";
 var CHAINS = ["evm", "solana"];
 var CHAIN_ALIASES = {
@@ -4668,8 +5288,8 @@ function noFaucetGuidance(network, devnetOrigin) {
   return `${head}. If you meant the shared devnet, set TOON_CLIENT_NETWORK=devnet and re-run \`rig fund\` \u2014 no faucet URL is needed there. If this is a self-hosted network with its own faucet, set TOON_CLIENT_FAUCET_URL (or the faucetUrl config field). ${external}`;
 }
 function readFundConfig(env) {
-  const dir = env["TOON_CLIENT_HOME"] ?? join5(homedir4(), ".toon-client");
-  const configPath = join5(dir, "config.json");
+  const dir = env["TOON_CLIENT_HOME"] ?? join6(homedir4(), ".toon-client");
+  const configPath = join6(dir, "config.json");
   try {
     return {
       file: JSON.parse(readFileSync4(configPath, "utf8")),
@@ -4690,7 +5310,7 @@ async function runFund(args, deps) {
   let addressFlag;
   let json = false;
   try {
-    const { values, positionals } = parseArgs11({
+    const { values, positionals } = parseArgs12({
       args,
       allowPositionals: true,
       options: {
@@ -4916,7 +5536,7 @@ var runGitPassthrough = (argv, options = {}) => {
 import { existsSync, mkdirSync as mkdirSync4 } from "fs";
 import { dirname as dirname5 } from "path";
 import { createInterface } from "readline/promises";
-import { parseArgs as parseArgs12 } from "util";
+import { parseArgs as parseArgs13 } from "util";
 async function loadKeyOps() {
   const { generateKeystore, importKeystore } = await import("@toon-protocol/client");
   return { generateKeystore, importKeystore, deriveNostrKeyFromMnemonic };
@@ -5088,7 +5708,7 @@ async function runIdentity(args, deps) {
   }
 }
 function parseMintArgs(args, verb) {
-  const { values, positionals } = parseArgs12({
+  const { values, positionals } = parseArgs13({
     args,
     options: {
       force: { type: "boolean", default: false },
@@ -5193,7 +5813,7 @@ async function runIdentityShow(args, deps) {
   let json = false;
   let help = false;
   try {
-    const parsed = parseArgs12({
+    const parsed = parseArgs13({
       args,
       options: {
         json: { type: "boolean", default: false },
@@ -5300,9 +5920,569 @@ async function defaultReadSecretLine(prompt, isInteractive) {
   }
 }
 
+// src/cli/inbox.ts
+import { parseArgs as parseArgs14 } from "util";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
+import {
+  ISSUE_KIND as ISSUE_KIND2,
+  PATCH_KIND as PATCH_KIND4,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND4,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND4,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
+  STATUS_DRAFT_KIND as STATUS_DRAFT_KIND3,
+  STATUS_OPEN_KIND as STATUS_OPEN_KIND3
+} from "@toon-protocol/core/nip34";
+
+// src/cli/relay-follow.ts
+var WS_OPEN = 1;
+var CONNECT_TIMEOUT_MS = 1e4;
+function defaultBackoffMs(attempt) {
+  return Math.min(3e4, 1e3 * 2 ** Math.max(0, attempt - 1));
+}
+function connectOnce(opts, onSubscribed) {
+  return new Promise((resolve2) => {
+    let ws;
+    let done = false;
+    let subscribed = false;
+    const subIds = [];
+    let connectTimer;
+    const finish = (reason) => {
+      if (done) return;
+      done = true;
+      clearTimeout(connectTimer);
+      opts.signal.removeEventListener("abort", onAbort);
+      try {
+        if (ws.readyState === WS_OPEN) {
+          for (const id of subIds) ws.send(JSON.stringify(["CLOSE", id]));
+        }
+        ws.close();
+      } catch {
+      }
+      resolve2(reason);
+    };
+    const onAbort = () => finish(null);
+    try {
+      ws = opts.webSocketFactory(opts.url);
+    } catch (err) {
+      resolve2(`failed to connect to ${opts.url}: ${String(err)}`);
+      return;
+    }
+    opts.signal.addEventListener("abort", onAbort);
+    connectTimer = setTimeout(
+      () => finish(`timed out connecting to ${opts.url}`),
+      CONNECT_TIMEOUT_MS
+    );
+    ws.addEventListener("open", () => {
+      clearTimeout(connectTimer);
+      opts.filters().forEach((filter, i) => {
+        const subId = `follow-${Date.now()}-${i}-${Math.random().toString(36).slice(2, 8)}`;
+        subIds.push(subId);
+        ws.send(JSON.stringify(["REQ", subId, filter]));
+      });
+    });
+    ws.addEventListener("message", (msgEvent) => {
+      try {
+        const msg = JSON.parse(String(msgEvent.data));
+        if (msg[0] === "EVENT" && msg[2] !== void 0) {
+          const event = decodeEventPayload(msg[2]);
+          if (event) opts.onEvent(event, opts.url);
+        } else if (msg[0] === "EOSE" && !subscribed && subIds.includes(msg[1])) {
+          subscribed = true;
+          onSubscribed();
+        }
+      } catch {
+      }
+    });
+    ws.addEventListener("error", (event) => {
+      const detail = typeof event === "object" && event !== null && "message" in event ? String(event.message) : "unknown";
+      finish(`websocket error on ${opts.url}: ${detail}`);
+    });
+    ws.addEventListener("close", () => {
+      finish(`connection to ${opts.url} closed`);
+    });
+  });
+}
+async function followRelay(opts) {
+  let attempt = 0;
+  while (!opts.signal.aborted) {
+    const reason = await connectOnce(opts, () => {
+      attempt = 0;
+    });
+    if (opts.signal.aborted) return;
+    opts.onError(reason ?? `connection to ${opts.url} ended`);
+    attempt += 1;
+    await new Promise((resolve2) => {
+      const done = () => {
+        clearTimeout(timer);
+        opts.signal.removeEventListener("abort", done);
+        resolve2();
+      };
+      const timer = setTimeout(done, opts.backoffMs(attempt));
+      opts.signal.addEventListener("abort", done);
+    });
+  }
+}
+
+// src/cli/inbox.ts
+var INBOX_USAGE = `Usage: rig inbox [options]
+
+Print everything new since you last checked (free \u2014 relay reads only):
+patches and revisions, issues, comments, status changes and CI results for
+repos you own or maintain, plus any event that tags your pubkey.
+
+Options:
+  --since <time>       read from a unix time, an ISO date, or a relative
+                       age (30m, 2h, 7d); does not move the cursor
+  --all                read everything, ignoring the cursor; does not move it
+  --pubkey <pubkey>    act as this pubkey (npub or hex) instead of the
+                       resolved identity
+  --remote <name>      read via this configured git remote (default: origin)
+  --relay <url>        ad-hoc relay override; repeatable \u2014 reads are merged
+  --json               machine-readable array, one object per event
+  --follow             emit the backlog, then stay connected and stream new
+                       events as JSON lines (one object per line) until
+                       interrupted; reconnects when a relay drops
+  -h, --help           show this help`;
+var STATUS_KINDS2 = [
+  STATUS_OPEN_KIND3,
+  STATUS_APPLIED_KIND4,
+  STATUS_CLOSED_KIND3,
+  STATUS_DRAFT_KIND3
+];
+var CI_KINDS = [
+  CI_SERVICE_REQUEST_KIND,
+  CI_SERVICE_STOP_KIND,
+  CI_WORKFLOW_RESULT_KIND,
+  CI_WORKFLOW_PROGRESS_KIND,
+  CI_JOB_RESULT_KIND
+];
+var INBOX_KINDS = [
+  PATCH_KIND4,
+  ISSUE_KIND2,
+  COMMENT_KIND,
+  LEGACY_COMMENT_KIND,
+  ...STATUS_KINDS2,
+  ...CI_KINDS
+];
+var HEX64_RE5 = /^[0-9a-f]{64}$/;
+var INBOX_CURSOR_FILENAME = "inbox-cursors.json";
+function cursorPath(env) {
+  return join7(clientStateDir(env), INBOX_CURSOR_FILENAME);
+}
+function readCursors(env) {
+  try {
+    const parsed = JSON.parse(readFileSync5(cursorPath(env), "utf8"));
+    if (parsed && typeof parsed === "object") {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
+function writeCursor(env, pubkey, cursor) {
+  const cursors = readCursors(env);
+  cursors[pubkey] = cursor;
+  mkdirSync5(clientStateDir(env), { recursive: true });
+  writeFileSync4(cursorPath(env), JSON.stringify(cursors, null, 2) + "\n");
+}
+function parseSince(value, nowSec) {
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed);
+  const rel = /^(\d+)([smhdw])$/.exec(trimmed);
+  if (rel) {
+    const unit = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[rel[2]];
+    return nowSec - Number(rel[1]) * unit;
+  }
+  const ms = Date.parse(trimmed);
+  if (Number.isNaN(ms)) {
+    throw new Error(
+      `--since must be a unix time, an ISO date, or an age like 2h (got ${JSON.stringify(value)})`
+    );
+  }
+  return Math.floor(ms / 1e3);
+}
+var tagValue2 = firstTagValue;
+function hasTopic(event, topic) {
+  return event.tags.some((t) => t[0] === "t" && t[1] === topic);
+}
+function typeOf(event) {
+  if (event.kind === PATCH_KIND4) {
+    if (hasTopic(event, "root-revision")) return "revision";
+    if (hasTopic(event, "root") || tagValue2(event.tags, "e") === void 0) {
+      return "patch";
+    }
+    return null;
+  }
+  if (event.kind === ISSUE_KIND2) return "issue";
+  if (event.kind === COMMENT_KIND || event.kind === LEGACY_COMMENT_KIND) {
+    return "comment";
+  }
+  if (STATUS_KINDS2.includes(event.kind)) return "status";
+  if (CI_KINDS.includes(event.kind)) return "ci";
+  return null;
+}
+function targetOf(event, type) {
+  const root = tagValue2(event.tags, "E");
+  const parent = tagValue2(event.tags, "e");
+  switch (type) {
+    case "patch":
+    case "issue":
+      return event.id;
+    case "revision":
+      return parent ?? event.id;
+    case "comment":
+      return root ?? parent ?? event.id;
+    case "status":
+      return parent ?? event.id;
+    case "ci":
+      return root ?? tagValue2(event.tags, "c") ?? event.id;
+  }
+}
+function toInboxEntry(event) {
+  const type = typeOf(event);
+  if (type === null) return null;
+  const repo = event.tags.find(
+    (t) => t[0] === "a" && t[1]?.startsWith(`${REPOSITORY_ANNOUNCEMENT_KIND4}:`)
+  )?.[1];
+  return {
+    id: event.id,
+    kind: event.kind,
+    type,
+    repo: repo ?? null,
+    target: targetOf(event, type),
+    author: event.pubkey,
+    created_at: event.created_at
+  };
+}
+function newest(events) {
+  let winner = null;
+  for (const e of events) {
+    if (winner === null || e.created_at > winner.created_at || e.created_at === winner.created_at && e.id < winner.id) {
+      winner = e;
+    }
+  }
+  return winner;
+}
+async function ownerAnnouncement(relays, owner, repoId, ws) {
+  const found = await queryAll(
+    relays,
+    [
+      {
+        kinds: [REPOSITORY_ANNOUNCEMENT_KIND4],
+        authors: [owner],
+        "#d": [repoId]
+      }
+    ],
+    ws
+  ).catch(() => /* @__PURE__ */ new Map());
+  return newest(
+    [...found.values()].filter(
+      (e) => e.kind === REPOSITORY_ANNOUNCEMENT_KIND4 && e.pubkey.toLowerCase() === owner && tagValue2(e.tags, "d") === repoId
+    )
+  );
+}
+function relaysTag(tags) {
+  return tags.filter((t) => t[0] === "relays").flatMap((t) => t.slice(1)).filter((url) => WS_URL_RE.test(url));
+}
+var INBOX_OPTIONS = {
+  json: { type: "boolean", default: false },
+  follow: { type: "boolean", default: false },
+  all: { type: "boolean", default: false },
+  since: { type: "string" },
+  pubkey: { type: "string" },
+  remote: { type: "string" },
+  relay: { type: "string", multiple: true },
+  help: { type: "boolean", short: "h", default: false }
+};
+function renderLine(entry) {
+  const when = new Date(entry.created_at * 1e3).toISOString().slice(0, 16).replace("T", " ");
+  const repo = entry.repo ?? "(no repo)";
+  return `${when}  ${entry.type.padEnd(8)}  ${entry.id.slice(0, 8)}  \u2192 ${entry.target.slice(0, 8)}  ${repo}  (${entry.author.slice(0, 8)})`;
+}
+async function runInbox(args, deps) {
+  const { io } = deps;
+  let json = false;
+  let all = false;
+  let follow = false;
+  let sinceArg;
+  let pubkeyArg;
+  let remote;
+  let relayFlags = [];
+  try {
+    const { values, positionals } = parseArgs14({
+      args,
+      options: INBOX_OPTIONS,
+      allowPositionals: true
+    });
+    if (values.help) {
+      io.out(INBOX_USAGE);
+      return 0;
+    }
+    if (positionals.length > 0) {
+      throw new Error("rig inbox takes no positional arguments");
+    }
+    json = values.json === true;
+    all = values.all === true;
+    follow = values.follow === true;
+    sinceArg = values.since;
+    if (values.pubkey !== void 0) pubkeyArg = ownerToHex(values.pubkey);
+    remote = values.remote;
+    relayFlags = values.relay ?? [];
+    if (all && sinceArg !== void 0) {
+      throw new Error("--all and --since are mutually exclusive");
+    }
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(INBOX_USAGE);
+    return 2;
+  }
+  try {
+    const nowSec = Math.floor((deps.now ?? Date.now)() / 1e3);
+    const override = sinceArg !== void 0 ? parseSince(sinceArg, nowSec) : null;
+    const me = (pubkeyArg ?? (await (deps.resolveIdentityImpl ?? resolveIdentity)({
+      env: deps.env,
+      cwd: deps.cwd,
+      warn: (line) => io.err(line)
+    })).pubkey).toLowerCase();
+    let repoRoot;
+    let toonRelays = [];
+    try {
+      repoRoot = await resolveRepoRoot(deps.cwd);
+      toonRelays = (await readToonConfig(repoRoot)).relays;
+    } catch {
+    }
+    const resolved = await resolveRelays({
+      relayFlags,
+      remoteName: remote,
+      repoRoot,
+      toonRelays
+    });
+    const configured = resolved.relays.filter((url) => WS_URL_RE.test(url));
+    if (configured.length === 0) {
+      throw new InvalidRelayUrlError(
+        resolved.relays[0] ?? "",
+        "reads need a ws:// or wss:// relay"
+      );
+    }
+    const ws = deps.webSocketFactory ?? defaultWebSocketFactory;
+    const announcements = await queryAll(
+      configured,
+      [
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND4], authors: [me] },
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND4], "#maintainers": [me] }
+      ],
+      ws
+    );
+    const byRepo = /* @__PURE__ */ new Map();
+    for (const e of announcements.values()) {
+      if (e.kind !== REPOSITORY_ANNOUNCEMENT_KIND4) continue;
+      const d = tagValue2(e.tags, "d");
+      if (!d) continue;
+      const key = `${e.pubkey.toLowerCase()}:${d}`;
+      byRepo.set(key, [...byRepo.get(key) ?? [], e]);
+    }
+    const watched = [];
+    for (const [key, events2] of byRepo) {
+      const owner = events2[0].pubkey.toLowerCase();
+      const repoId = key.slice(owner.length + 1);
+      const latest = owner === me ? newest(events2) : await ownerAnnouncement(configured, owner, repoId, ws);
+      if (latest === null) continue;
+      if (owner !== me && !parseMaintainers(latest.tags).includes(me)) continue;
+      watched.push({
+        address: `${REPOSITORY_ANNOUNCEMENT_KIND4}:${owner}:${repoId}`,
+        ownerPubkey: owner,
+        authorized: authorizedAuthors(owner, latest.tags),
+        relays: relaysTag(latest.tags)
+      });
+    }
+    const cursor = readCursors(deps.env)[me];
+    const since = all ? void 0 : override !== null ? override : cursor?.at;
+    const base = since !== void 0 ? { since } : {};
+    const events = /* @__PURE__ */ new Map();
+    const collect = (found) => {
+      for (const [id, e] of found) if (!events.has(id)) events.set(id, e);
+    };
+    collect(
+      await queryAll(
+        configured,
+        [{ kinds: INBOX_KINDS, "#p": [me], ...base }],
+        ws
+      )
+    );
+    for (const repo of watched) {
+      const relays = [.../* @__PURE__ */ new Set([...configured, ...repo.relays])];
+      collect(
+        await queryAll(
+          relays,
+          [{ kinds: INBOX_KINDS, "#a": [repo.address], ...base }],
+          ws
+        )
+      );
+    }
+    const authCache = /* @__PURE__ */ new Map();
+    for (const repo of watched) authCache.set(repo.address, repo.authorized);
+    const authorizedFor = async (address) => {
+      const hit = authCache.get(address);
+      if (hit) return hit;
+      const m = /^30617:([0-9a-f]{64}):(.+)$/i.exec(address);
+      let set = /* @__PURE__ */ new Set();
+      if (m) {
+        const owner = m[1].toLowerCase();
+        const latest = await ownerAnnouncement(
+          configured,
+          owner,
+          m[2],
+          ws
+        );
+        set = authorizedAuthors(owner, latest?.tags ?? []);
+      }
+      authCache.set(address, set);
+      return set;
+    };
+    const toEntries = async (found) => {
+      const targetAuthors = /* @__PURE__ */ new Map();
+      const statusEvents = [...found.values()].filter(
+        (e) => STATUS_KINDS2.includes(e.kind)
+      );
+      const unknownTargets = /* @__PURE__ */ new Set();
+      for (const e of statusEvents) {
+        const target = tagValue2(e.tags, "e");
+        if (!target || !HEX64_RE5.test(target)) continue;
+        const known = found.get(target);
+        if (known) targetAuthors.set(target, known.pubkey.toLowerCase());
+        else unknownTargets.add(target);
+      }
+      if (unknownTargets.size > 0) {
+        const lookedUp = await queryAll(
+          configured,
+          [{ ids: [...unknownTargets] }],
+          ws
+        ).catch(() => /* @__PURE__ */ new Map());
+        for (const [id, e] of lookedUp)
+          targetAuthors.set(id, e.pubkey.toLowerCase());
+      }
+      const entries = [];
+      for (const event of found.values()) {
+        const entry = toInboxEntry(event);
+        if (entry === null) continue;
+        if (entry.type === "status") {
+          if (entry.repo === null) continue;
+          const repoWide = await authorizedFor(entry.repo);
+          const targetAuthor = targetAuthors.get(entry.target);
+          const authors = targetAuthor === void 0 ? repoWide : withTargetAuthor(repoWide, targetAuthor);
+          if (!authors.has(event.pubkey.toLowerCase())) continue;
+        }
+        entries.push(entry);
+      }
+      return entries;
+    };
+    const entriesOf = await toEntries(events);
+    const isFresh = (e) => all || override !== null || cursor === void 0 || e.created_at > cursor.at || e.created_at === cursor.at && !cursor.seen.includes(e.id);
+    const byAge = (a, b) => a.created_at - b.created_at || (a.id < b.id ? -1 : 1);
+    const fresh = entriesOf.filter(isFresh).sort(byAge);
+    const moveCursor = !all && override === null;
+    let position = cursor;
+    const advance = (emitted) => {
+      if (!moveCursor || emitted.length === 0) return;
+      const at = Math.max(...emitted.map((e) => e.created_at));
+      const seen = emitted.filter((e) => e.created_at === at).map((e) => e.id);
+      if (position?.at === at) seen.push(...position.seen);
+      else if (position !== void 0 && position.at > at) return;
+      position = { at, seen: [...new Set(seen)] };
+      writeCursor(deps.env, me, position);
+    };
+    if (follow) {
+      const line = (entry) => io.emitJsonLine ? io.emitJsonLine(entry) : io.out(JSON.stringify(entry));
+      const emittedIds = /* @__PURE__ */ new Set();
+      let liveSince = position?.at;
+      const emit = (entries) => {
+        for (const entry of entries) {
+          emittedIds.add(entry.id);
+          liveSince = Math.max(liveSince ?? 0, entry.created_at);
+          line(entry);
+        }
+        advance(entries);
+      };
+      emit(fresh);
+      const controller = new AbortController();
+      const stop = () => controller.abort();
+      const external = deps.followSignal;
+      if (external?.aborted) return 0;
+      external?.addEventListener("abort", stop);
+      if (!external) {
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+      }
+      let chain = Promise.resolve();
+      const onEvent = (event) => {
+        chain = chain.then(async () => {
+          if (emittedIds.has(event.id)) return;
+          try {
+            const [entry] = await toEntries(/* @__PURE__ */ new Map([[event.id, event]]));
+            if (entry === void 0 || emittedIds.has(entry.id) || !isFresh(entry)) {
+              return;
+            }
+            emit([entry]);
+          } catch (err) {
+            io.err(
+              `rig inbox: could not process live event ${event.id}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        });
+      };
+      const targets = [];
+      for (const url of configured) {
+        targets.push({ url, filter: { kinds: INBOX_KINDS, "#p": [me] } });
+      }
+      for (const repo of watched) {
+        for (const url of /* @__PURE__ */ new Set([...configured, ...repo.relays])) {
+          targets.push({
+            url,
+            filter: { kinds: INBOX_KINDS, "#a": [repo.address] }
+          });
+        }
+      }
+      const urls = [...new Set(targets.map((t) => t.url))];
+      try {
+        await Promise.all(
+          urls.map(
+            (url) => followRelay({
+              url,
+              filters: () => targets.filter((t) => t.url === url).map((t) => ({ ...t.filter, since: liveSince ?? nowSec })),
+              webSocketFactory: ws,
+              onEvent,
+              onError: (message) => io.err(`rig inbox: ${message}`),
+              signal: controller.signal,
+              backoffMs: deps.followBackoffMs ?? defaultBackoffMs
+            })
+          )
+        );
+        await chain;
+      } finally {
+        external?.removeEventListener("abort", stop);
+        process.off("SIGINT", stop);
+        process.off("SIGTERM", stop);
+      }
+      return 0;
+    }
+    if (json) {
+      io.emitJson(fresh);
+    } else if (fresh.length === 0) {
+      io.out("inbox is empty");
+    } else {
+      for (const entry of fresh) io.out(renderLine(entry));
+    }
+    advance(fresh);
+    return 0;
+  } catch (err) {
+    return emitCliError(io, json, "inbox", err);
+  }
+}
+
 // src/cli/init.ts
 import { basename as basename2 } from "path";
-import { parseArgs as parseArgs13 } from "util";
+import { parseArgs as parseArgs15 } from "util";
 
 // src/cli/git-author.ts
 var PROFILE_KIND = 0;
@@ -5420,7 +6600,7 @@ Options:
   --json               machine-readable report
   -h, --help           show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs13({
+  const { values, positionals } = parseArgs15({
     args,
     options: {
       "repo-id": { type: "string" },
@@ -5647,8 +6827,8 @@ async function runInit(args, deps) {
 }
 
 // src/cli/maintainers.ts
-import { parseArgs as parseArgs14 } from "util";
-var HEX64_RE4 = /^[0-9a-f]{64}$/;
+import { parseArgs as parseArgs16 } from "util";
+var HEX64_RE6 = /^[0-9a-f]{64}$/;
 var REF_AUTHORITY_NOTICE = "Note: maintainers can move refs (publish honored repo state), not only set status.";
 var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
 
@@ -5701,7 +6881,7 @@ async function runList2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs14({
+    const { values, positionals } = parseArgs16({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -5768,7 +6948,7 @@ async function runMutate(op, args, deps) {
   let flags;
   let pubkey;
   try {
-    const { values, positionals } = parseArgs14({
+    const { values, positionals } = parseArgs16({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -5782,7 +6962,7 @@ async function runMutate(op, args, deps) {
       throw new Error(`expected exactly one <pubkey> to ${op}`);
     }
     pubkey = ownerToHex(positionals[0]).toLowerCase();
-    if (!HEX64_RE4.test(pubkey)) {
+    if (!HEX64_RE6.test(pubkey)) {
       throw new Error(
         `<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`
       );
@@ -5903,7 +7083,7 @@ async function runMutate(op, args, deps) {
 }
 
 // src/cli/refresh.ts
-import { parseArgs as parseArgs15 } from "util";
+import { parseArgs as parseArgs17 } from "util";
 var REFRESH_USAGE = `Usage: rig refresh [options]
 
 Republish this repo's kind:30617 announcement with no field edit, refreshing
@@ -5939,7 +7119,7 @@ async function runRefresh(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs15({
+    const { values, positionals } = parseArgs17({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -6062,7 +7242,7 @@ async function runRefresh(args, deps) {
 
 // src/cli/name.ts
 import { randomUUID } from "crypto";
-import { parseArgs as parseArgs16 } from "util";
+import { parseArgs as parseArgs18 } from "util";
 var ARIO_DECIMALS = 6;
 function renderMario(mario) {
   return `${mario.toString()} mARIO (~${formatUnits(mario.toString(), ARIO_DECIMALS)} ARIO)`;
@@ -6571,7 +7751,7 @@ async function resolveNameContext(deps, network, processId, mode) {
   return { identity, solanaAddress, network, processId, sdk, nostrSecretKey };
 }
 function parseNameFlags(args, env) {
-  const { values, positionals } = parseArgs16({
+  const { values, positionals } = parseArgs18({
     args,
     allowPositionals: true,
     options: {
@@ -7130,7 +8310,7 @@ async function runName(args, deps) {
 }
 
 // src/cli/payout.ts
-import { parseArgs as parseArgs17 } from "util";
+import { parseArgs as parseArgs19 } from "util";
 import { getAddress } from "viem";
 var PAYOUT_USAGE = `Usage: rig payout <set|clear|show> [<address>] [options]
 
@@ -7186,7 +8366,7 @@ async function runShow2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs17({
+    const { values, positionals } = parseArgs19({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -7248,7 +8428,7 @@ async function runMutate2(op, args, deps) {
   let flags;
   let nextPayout = null;
   try {
-    const { values, positionals } = parseArgs17({
+    const { values, positionals } = parseArgs19({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -7382,7 +8562,7 @@ async function runMutate2(op, args, deps) {
 }
 
 // src/cli/site.ts
-import { parseArgs as parseArgs18 } from "util";
+import { parseArgs as parseArgs20 } from "util";
 
 // src/arweave-manifest.ts
 var DEFAULT_INDEX = "index.html";
@@ -7401,22 +8581,22 @@ function buildArweaveManifest(entries, indexPath = DEFAULT_INDEX, fallbackTxId)
 }
 
 // src/cli/site-record.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 var SITE_MANIFEST_FILENAME = "site-manifests.json";
 function storeDir2(env) {
-  return env["TOON_CLIENT_HOME"] ?? join6(homedir5(), ".toon-client");
+  return env["TOON_CLIENT_HOME"] ?? join8(homedir5(), ".toon-client");
 }
 function storePath2(env) {
-  return join6(storeDir2(env), SITE_MANIFEST_FILENAME);
+  return join8(storeDir2(env), SITE_MANIFEST_FILENAME);
 }
 function keyOf(repoId, ref) {
   return `${repoId}\0${ref}`;
 }
 function readFile2(env) {
   try {
-    const parsed = JSON.parse(readFileSync5(storePath2(env), "utf8"));
+    const parsed = JSON.parse(readFileSync6(storePath2(env), "utf8"));
     if (parsed && typeof parsed === "object") return parsed;
     return {};
   } catch {
@@ -7428,10 +8608,10 @@ function readSiteRecord(env, repoId, ref) {
 }
 function writeSiteRecord(env, record) {
   const dir = storeDir2(env);
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   const file = readFile2(env);
   file[keyOf(record.repoId, record.ref)] = record;
-  writeFileSync4(storePath2(env), `${JSON.stringify(file, null, 2)}
+  writeFileSync5(storePath2(env), `${JSON.stringify(file, null, 2)}
 `, "utf8");
 }
 
@@ -7473,7 +8653,7 @@ Options (publish):
                        estimate (nothing uploaded)
   -h, --help           show this help`;
 function parseSiteArgs(args) {
-  const { values, positionals } = parseArgs18({
+  const { values, positionals } = parseArgs20({
     args,
     options: {
       index: { type: "string" },
@@ -7881,9 +9061,18 @@ Commands rig owns:
   comment <target-event-id>  comment (NIP-22 kind:1111) on an issue or patch,
                              or reply to an existing kind:1111 comment
   pr create                  publish a patch (kind:1617) with real
-                             \`git format-patch\` content
+                             \`git format-patch\` content (--revises <patch-id>
+                             publishes a revision of an existing patch)
+  pr merge <patch-id>        apply the latest revision with git am, push, then
+                             publish the applied status (owner/maintainer)
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
+  inbox                      everything new since you last read it (free):
+                             patches, revisions, issues, comments, statuses
+                             and CI results for repos you own or maintain,
+                             plus events that tag you; --since/--all look
+                             back without moving the cursor; --follow keeps
+                             streaming new events as JSON lines
   maintainers list           show the repo's declared maintainers (free); add/
   maintainers add <pubkey>   remove republish the kind:30617 to change who may
   maintainers remove <pubkey>  author authoritative issue/PR status (owner is
@@ -8006,6 +9195,8 @@ async function dispatch(argv, deps) {
       return runComment(rest, deps);
     case "pr":
       return runPr(rest, deps);
+    case "inbox":
+      return runInbox(rest, deps);
     case "maintainers":
       return runMaintainers(rest, deps);
     case "payout":
@@ -8062,4 +9253,4 @@ export {
   rigVersion,
   dispatch
 };
-//# sourceMappingURL=chunk-ANVDRW5F.js.map
+//# sourceMappingURL=chunk-KQ4NQV7T.js.map