@toon-protocol/rig 5.2.0 → 5.4.0

package/dist/{chunk-Y7TUE7JT.js → chunk-Z3XRZ5E5.js}

@@ -4,12 +4,14 @@ import {
   CI_SERVICE_REQUEST_KIND,
   CI_SERVICE_STOP_KIND,
   CI_STATUS_USAGE,
+  CI_TRUST_ORDER,
   CI_WORKFLOW_PROGRESS_KIND,
   CI_WORKFLOW_RESULT_KIND,
   GitRepoReader,
   InvalidRelayUrlError,
   MultiUrlRemoteError,
   NotAGitRepositoryError,
+  PrMergeError,
   RESERVED_SECRET_NAMES,
   SECRET_NAME_RE,
   UnconfiguredRepoAddressError,
@@ -26,11 +28,13 @@ import {
   earliestUniqueCommit,
   emitCliError,
   encryptSecretUpdate,
+  evaluateCiGate,
   executePush,
   generateSecretsKey,
   getGitRemoteUrls,
   hexToNpub,
   initGitRepository,
+  isCiTrustLevel,
   isRelayUrl,
   isSafeRefname,
   listGitRemotes,
@@ -57,13 +61,13 @@ import {
   updateRef,
   writeGitObjects,
   writeToonConfig
-} from "./chunk-S5R44MMB.js";
+} from "./chunk-MIK7SRWE.js";
 import {
   PREFERRED_GATEWAY,
   mirrorGatewaysFor,
   readGateways,
   shaResolverFor
-} from "./chunk-FX5GPZYU.js";
+} from "./chunk-QSUO7J4H.js";
 import {
   COMMENT_KIND,
   DEFAULT_KEYSTORE_PASSWORD,
@@ -92,7 +96,7 @@ import {
   resolveIdentity,
   revisionRootId,
   selectRevision
-} from "./chunk-JX5P2KAA.js";
+} from "./chunk-3KS6S4S5.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -321,7 +325,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("./standalone-mode-NWCCRFCL.js");
+  const mod = await import("./standalone-mode-LUWNCDPL.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -2306,9 +2310,9 @@ async function runCiTrigger(args, deps) {
   });
 }
 async function gitShowBytes(repoRoot, commit, path) {
-  const { execFile } = await import("child_process");
+  const { execFile: execFile2 } = await import("child_process");
   return new Promise((resolve2, reject) => {
-    execFile(
+    execFile2(
       "git",
       ["show", `${commit}:${path}`],
       { cwd: repoRoot, encoding: "buffer", maxBuffer: 16 * 1024 * 1024 },
@@ -2519,7 +2523,7 @@ async function runCi(args, deps) {
     case "status":
       return runCiStatus(rest, deps);
     case "serve":
-      return (await import("./ci-serve-CA37KQVC.js")).runCiServe(rest, deps);
+      return (await import("./ci-serve-4RJCKEPV.js")).runCiServe(rest, deps);
     case "--help":
     case "-h":
     case "help":
@@ -2790,18 +2794,258 @@ async function runClone(args, deps) {
 
 // src/cli/events.ts
 import { readFile } from "fs/promises";
-import { parseArgs as parseArgs8 } from "util";
+import { parseArgs as parseArgs10 } from "util";
+import {
+  PATCH_KIND as PATCH_KIND3,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND3,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND3,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
+  STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
+  STATUS_OPEN_KIND as STATUS_OPEN_KIND2
+} from "@toon-protocol/core/nip34";
+
+// src/cli/merge.ts
+import { execFile } from "child_process";
+import { mkdtemp as mkdtemp2, rm as rm2, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join4 } from "path";
+import { parseArgs as parseArgs9 } from "util";
+import { promisify } from "util";
 import {
   PATCH_KIND as PATCH_KIND2,
   REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2,
   STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2,
-  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2,
-  STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
-  STATUS_OPEN_KIND as STATUS_OPEN_KIND2
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2
 } from "@toon-protocol/core/nip34";
 
-// src/cli/tracker.ts
+// src/cli/fetch.ts
 import { parseArgs as parseArgs7 } from "util";
+var FETCH_USAGE = `Usage: rig fetch [remote] [options]
+
+Fetch from a TOON remote \u2014 FREE (relay reads + Arweave gateway downloads; no
+payments, no identity needed). Reads the kind:30618 repository state from the
+remote's relay, downloads only the git objects this repository is missing
+(SHA-1 verified), and updates the remote-tracking refs
+(refs/remotes/<remote>/*; tags land at refs/tags/*), reporting what moved.
+
+No merge happens: integrate with the git passthrough, e.g.
+\`rig merge origin/main\`. \`rig fetch\` is the TOON transport and shadows
+\`git fetch\` \u2014 plain-git fetches remain available via \`git fetch\` directly.
+
+The repo address (toon.repoid/toon.owner) comes from the config \`rig init\`
+or \`rig clone\` writes; --repo-id/--owner override.
+
+Options:
+  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
+  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
+  --relay <url>        ad-hoc relay override \u2014 bypasses the remote's URL
+  --gateway <url>      gateway to read objects through FIRST, on its raw-bytes
+                       route <url>/raw/<txId>, ahead of the public gateway
+                       list \u2014 name a private, local or air-gapped gateway to
+                       fetch objects the public ones do not carry
+                       (env RIG_ARWEAVE_GATEWAY also sets it)
+  --concurrency <n>    parallel gateway downloads (default 8)
+  --json               machine-readable result envelope
+  -h, --help           show this help`;
+var WS_URL_RE3 = /^wss?:\/\//i;
+function localRefFor(refname, remote) {
+  if (refname.startsWith("refs/heads/")) {
+    return `refs/remotes/${remote}/${refname.slice("refs/heads/".length)}`;
+  }
+  if (refname.startsWith("refs/tags/")) return refname;
+  return null;
+}
+async function resolveLocalRef(repoRoot, refname) {
+  try {
+    const out = await runGit(repoRoot, [
+      "rev-parse",
+      "--verify",
+      "--quiet",
+      refname
+    ]);
+    const sha = out.trim();
+    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+async function runFetch(args, deps) {
+  const { io } = deps;
+  let json = false;
+  let remote = "origin";
+  let relayFlag;
+  let repoIdFlag;
+  let ownerFlag;
+  let gatewayFlag;
+  let concurrency;
+  try {
+    const { values, positionals } = parseArgs7({
+      args,
+      options: {
+        json: { type: "boolean", default: false },
+        relay: { type: "string" },
+        "repo-id": { type: "string" },
+        owner: { type: "string" },
+        gateway: { type: "string" },
+        concurrency: { type: "string" },
+        help: { type: "boolean", short: "h", default: false }
+      },
+      allowPositionals: true
+    });
+    if (values.help) {
+      io.out(FETCH_USAGE);
+      return 0;
+    }
+    json = values.json === true;
+    if (positionals.length > 1) {
+      throw new Error(
+        `expected at most one [remote] argument, got ${positionals.length}`
+      );
+    }
+    if (positionals[0] !== void 0) remote = positionals[0];
+    relayFlag = values.relay;
+    repoIdFlag = values["repo-id"];
+    ownerFlag = values.owner !== void 0 ? ownerToHex(values.owner) : void 0;
+    gatewayFlag = values.gateway;
+    if (values.concurrency !== void 0) {
+      concurrency = Number.parseInt(values.concurrency, 10);
+      if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
+        throw new Error("--concurrency must be a positive integer");
+      }
+    }
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(FETCH_USAGE);
+    return 2;
+  }
+  try {
+    const repoRoot = await resolveRepoRoot(deps.cwd);
+    const toonConfig = await readToonConfig(repoRoot);
+    const repoId = repoIdFlag ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const owner = ownerFlag ?? toonConfig.owner;
+    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
+    let relayUrl;
+    if (relayFlag !== void 0) {
+      relayUrl = relayFlag;
+    } else {
+      const urls = await getGitRemoteUrls(repoRoot, remote);
+      if (urls.length === 0) throw new UnknownRemoteError(remote);
+      if (urls.length > 1) throw new MultiUrlRemoteError(remote, urls);
+      relayUrl = urls[0];
+    }
+    if (!WS_URL_RE3.test(relayUrl)) {
+      throw new InvalidRelayUrlError(
+        relayUrl,
+        `remote ${JSON.stringify(remote)}`
+      );
+    }
+    const remoteState = await fetchRemoteState({
+      relayUrls: [relayUrl],
+      ownerPubkey: owner,
+      repoId,
+      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
+      // The GraphQL fallback for SHAs the map does not cover asks the SAME
+      // permaweb the objects are read from (#183).
+      resolveSha: deps.resolveSha ?? shaResolverFor(gatewayFlag, deps.env)
+    });
+    const planned = [];
+    for (const [refname, sha] of remoteState.refs) {
+      if (!isSafeRefname(refname)) {
+        io.err(
+          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
+        );
+        continue;
+      }
+      const localRef = localRefFor(refname, remote);
+      if (localRef === null) {
+        io.err(
+          `warning: skipping ref outside refs/heads and refs/tags: ${refname}`
+        );
+        continue;
+      }
+      planned.push({ refname, localRef, newSha: sha });
+    }
+    const reader = new GitRepoReader(repoRoot);
+    const tips = [...new Set(planned.map((p) => p.newSha))];
+    const presentLocally = new Set(await reader.listAllObjectShas());
+    const collected = await collectRepoObjects({
+      tips,
+      shaToTxId: remoteState.shaToTxId,
+      resolveMissing: (shas) => remoteState.resolveMissing(shas),
+      presentLocally,
+      // `--gateway` / RIG_ARWEAVE_GATEWAY first, public list behind it (#176).
+      gateways: readGateways(gatewayFlag, deps.env),
+      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
+      ...concurrency !== void 0 ? { concurrency } : {}
+    });
+    if (collected.missing.length > 0) {
+      throw new MissingRemoteObjectsError(
+        collected.missing,
+        `cannot fetch from ${relayUrl}`
+      );
+    }
+    const written = await writeGitObjects(repoRoot, collected.objects.values());
+    const updates = [];
+    for (const { refname, localRef, newSha } of planned) {
+      const oldSha = await resolveLocalRef(repoRoot, localRef);
+      if (oldSha === newSha) {
+        updates.push({ refname, localRef, oldSha, newSha, kind: "up-to-date" });
+        continue;
+      }
+      let kind;
+      if (oldSha === null) {
+        kind = "new";
+      } else {
+        kind = await reader.isAncestor(oldSha, newSha) ? "fast-forward" : "forced";
+      }
+      await updateRef(repoRoot, localRef, newSha);
+      updates.push({ refname, localRef, oldSha, newSha, kind });
+    }
+    const moved = updates.filter((u) => u.kind !== "up-to-date");
+    if (json) {
+      io.emitJson({
+        command: "fetch",
+        repoAddr: { ownerPubkey: owner, repoId },
+        remote,
+        relay: relayUrl,
+        objectsDownloaded: written,
+        updates,
+        executed: true
+      });
+      return 0;
+    }
+    if (moved.length === 0) {
+      io.out("Already up to date.");
+      return 0;
+    }
+    io.out(`From ${relayUrl}`);
+    for (const u of moved) {
+      const short = (refname) => refname.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/remotes\//, "");
+      const src = short(u.refname);
+      const dst = short(u.localRef);
+      if (u.kind === "new") {
+        const label = u.refname.startsWith("refs/tags/") ? "[new tag]" : "[new branch]";
+        io.out(` * ${label.padEnd(17)} ${src.padEnd(14)} -> ${dst}`);
+      } else if (u.kind === "forced") {
+        io.out(
+          ` + ${u.oldSha.slice(0, 7)}...${u.newSha.slice(0, 7)} ${src.padEnd(14)} -> ${dst}  (forced update)`
+        );
+      } else {
+        io.out(
+          `   ${u.oldSha.slice(0, 7)}..${u.newSha.slice(0, 7)}  ${src.padEnd(14)} -> ${dst}`
+        );
+      }
+    }
+    io.out(`Downloaded ${written} object(s) (SHA-1 verified).`);
+    return 0;
+  } catch (err) {
+    return emitCliError(io, json, "fetch", err);
+  }
+}
+
+// src/cli/tracker.ts
+import { parseArgs as parseArgs8 } from "util";
 import {
   ISSUE_KIND,
   PATCH_KIND,
@@ -2887,7 +3131,7 @@ function withTargetAuthor(authorized, targetAuthorPubkey) {
 }
 var RELAY_TIMEOUT_MS = 1e4;
 var HEX64_RE2 = /^[0-9a-f]{64}$/;
-var WS_URL_RE3 = /^wss?:\/\//i;
+var WS_URL_RE4 = /^wss?:\/\//i;
 function defaultWebSocketFactory2(url) {
   const ctor = globalThis.WebSocket;
   if (!ctor) {
@@ -2971,7 +3215,7 @@ async function resolveTrackerContext(flags, deps, needRepoAddr) {
     repoRoot,
     toonRelays: toonConfig.relays
   });
-  const wsRelays = resolved.relays.filter((url) => WS_URL_RE3.test(url));
+  const wsRelays = resolved.relays.filter((url) => WS_URL_RE4.test(url));
   if (wsRelays.length === 0) {
     throw new InvalidRelayUrlError(
       resolved.relays[0] ?? "",
@@ -3198,7 +3442,7 @@ async function runList(args, deps, spec) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs7({
+    const { values, positionals } = parseArgs8({
       args,
       options: TRACKER_OPTIONS,
       allowPositionals: true
@@ -3263,7 +3507,7 @@ async function runShow(args, deps, spec) {
   let flags;
   let eventId;
   try {
-    const { values, positionals } = parseArgs7({
+    const { values, positionals } = parseArgs8({
       args,
       options: TRACKER_OPTIONS,
       allowPositionals: true
@@ -3381,14 +3625,524 @@ function runPrList(args, deps) {
     jsonKey: "prs"
   });
 }
-function runPrShow(args, deps) {
-  return runShow(args, deps, {
-    command: "pr show",
-    kind: PATCH_KIND,
-    usage: PR_SHOW_USAGE,
-    jsonKey: "pr",
-    bodyLabel: "Patch"
-  });
+function runPrShow(args, deps) {
+  return runShow(args, deps, {
+    command: "pr show",
+    kind: PATCH_KIND,
+    usage: PR_SHOW_USAGE,
+    jsonKey: "pr",
+    bodyLabel: "Patch"
+  });
+}
+
+// src/cli/merge.ts
+var execFileAsync = promisify(execFile);
+var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var PR_MERGE_USAGE = `Usage: rig pr merge <patch-id> [--target <branch>] [options]
+
+Apply the latest authorized revision of a patch with \`git am\` onto the
+honored tip of the target branch, push the result, and publish an applied
+status (kind:1631) naming the new commit SHAs \u2014 in that order, so the status
+never claims a merge that did not happen. A paid command; writes are permanent
+and non-refundable. Only the owner or a declared maintainer may merge.
+
+If the patch does not apply, nothing is spent and your working tree is left as
+it was. If the push succeeds but the status publish fails, the merge is
+reported as a partial success; retry with \`rig pr status <patch-id> applied\`.
+
+Options:
+  --target <branch>    branch to merge onto (default: the patch's branch-name
+                       tag, else the repo's default branch)
+  --require-ci-trust <level>
+                       refuse the merge, before paying, unless the patch
+                       series' head commit has a concluded green CI run at or
+                       above this trust level (same gate as \`rig ci status\`)
+  --closes <issue-id>  after a successful merge, publish closed (kind:1632)
+                       for this issue; repeatable
+  --yes                skip the confirmation prompt
+  --json               machine-readable output (without --yes: estimate only)
+  --relay <url>        ad-hoc relay override (bypasses git remotes)
+  --remote <name>      git remote to use (default: origin)
+  --repo-id <id>       repository id (default: git config toon.repoid)
+  --owner <pubkey>     repository owner (default: git config toon.owner)`;
+function parseMergeArgs(args) {
+  const { values, positionals } = parseArgs9({
+    args,
+    options: {
+      target: { type: "string" },
+      yes: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      relay: { type: "string", multiple: true },
+      remote: { type: "string" },
+      "repo-id": { type: "string" },
+      owner: { type: "string" },
+      "require-ci-trust": { type: "string" },
+      closes: { type: "string", multiple: true },
+      standalone: { type: "boolean", default: false },
+      "no-daemon": { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    },
+    allowPositionals: true
+  });
+  if (values.help) return "help";
+  if (positionals.length !== 1) {
+    throw new Error("expected exactly one argument: <patch-id>");
+  }
+  const patchId = positionals[0];
+  if (!HEX64_RE3.test(patchId)) {
+    throw new Error("<patch-id> must be a 64-character lowercase hex event id");
+  }
+  if (values.owner !== void 0 && !HEX64_RE3.test(values.owner)) {
+    throw new Error("--owner must be a 64-character lowercase hex pubkey");
+  }
+  const flags = {
+    patchId,
+    yes: values.yes === true,
+    json: values.json === true,
+    relay: values.relay ?? [],
+    closes: [...new Set(values.closes ?? [])]
+  };
+  for (const id of flags.closes) {
+    if (!HEX64_RE3.test(id)) {
+      throw new Error("--closes must be a 64-character lowercase hex issue id");
+    }
+  }
+  const level = values["require-ci-trust"];
+  if (level !== void 0) {
+    if (!isCiTrustLevel(level)) {
+      throw new Error(
+        `--require-ci-trust must be one of ${CI_TRUST_ORDER.join(" | ")} (got ${JSON.stringify(level)})`
+      );
+    }
+    flags.requireTrust = level;
+  }
+  if (values.target !== void 0) flags.target = values.target;
+  if (values.remote !== void 0) flags.remote = values.remote;
+  if (values["repo-id"] !== void 0) flags.repoId = values["repo-id"];
+  if (values.owner !== void 0) flags.owner = values.owner;
+  return flags;
+}
+async function git(cwd, args, env) {
+  const { stdout } = await execFileAsync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    maxBuffer: 64 * 1024 * 1024,
+    ...env ? { env } : {}
+  });
+  return stdout.trim();
+}
+async function gitOk(cwd, args) {
+  try {
+    await git(cwd, args);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function gitFailure(err) {
+  const e = err;
+  return (e.stderr || e.stdout || e.message || String(err)).trim();
+}
+var OverlayReader = class extends GitRepoReader {
+  constructor(repoPath, overlay) {
+    super(repoPath);
+    this.overlay = overlay;
+  }
+  overlay;
+  async listRefs() {
+    const base = await super.listRefs();
+    const refs = base.refs.filter(
+      (r) => r.refname !== this.overlay.refname
+    );
+    refs.push({
+      refname: this.overlay.refname,
+      sha: this.overlay.sha,
+      type: "commit"
+    });
+    return { ...base, refs };
+  }
+};
+async function applyInIsolation(repoRoot, tip, patchText, committer) {
+  const scratch = await mkdtemp2(join4(tmpdir(), "rig-merge-"));
+  const worktree = join4(scratch, "wt");
+  try {
+    await git(repoRoot, ["worktree", "add", "--detach", worktree, tip]);
+    const patchFile = join4(scratch, "patch.mbox");
+    await writeFile(patchFile, patchText, "utf-8");
+    const env = { ...process.env };
+    if (committer) {
+      env["GIT_COMMITTER_NAME"] = committer.name;
+      env["GIT_COMMITTER_EMAIL"] = committer.email;
+    }
+    try {
+      await git(worktree, ["am", "--quiet", patchFile], env);
+    } catch (err) {
+      await git(worktree, ["am", "--abort"]).catch(() => void 0);
+      throw new PrMergeError(
+        "apply_conflict",
+        `the patch does not apply cleanly onto ${tip.slice(0, 7)} \u2014 ask the contributor for a revision (\`rig pr create --revises\`). Nothing was pushed, published, or paid, and your working tree is unchanged.
+` + gitFailure(err)
+      );
+    }
+    const newHead = await git(worktree, ["rev-parse", "HEAD"]);
+    const listed = await git(worktree, [
+      "rev-list",
+      "--reverse",
+      `${tip}..${newHead}`
+    ]);
+    const commits = listed === "" ? [] : listed.split("\n");
+    if (commits.length === 0) {
+      throw new PrMergeError(
+        "nothing_to_apply",
+        "the patch applied no commits (already merged?) \u2014 nothing was pushed, published, or paid."
+      );
+    }
+    return { newHead, commits };
+  } finally {
+    await git(repoRoot, ["worktree", "remove", "--force", worktree]).catch(
+      () => void 0
+    );
+    await git(repoRoot, ["worktree", "prune"]).catch(() => void 0);
+    await rm2(scratch, { recursive: true, force: true });
+  }
+}
+var BRANCH_PREFIX = "refs/heads/";
+async function runPrMerge(args, deps) {
+  const { io } = deps;
+  let flags;
+  try {
+    const parsed = parseMergeArgs(args);
+    if (parsed === "help") {
+      io.out(PR_MERGE_USAGE);
+      return 0;
+    }
+    flags = parsed;
+  } catch (err) {
+    io.err(err instanceof Error ? err.message : String(err));
+    io.err(PR_MERGE_USAGE);
+    return 2;
+  }
+  deps = withForcedStandalone(deps);
+  const webSocketFactory = deps.webSocketFactory ?? defaultWebSocketFactory;
+  let stop;
+  try {
+    const repoRoot = await resolveRepoRoot(deps.cwd);
+    const toonConfig = await readToonConfig(repoRoot);
+    const repoId = flags.repoId ?? toonConfig.repoId;
+    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
+    const resolved = await resolveRelays({
+      relayFlags: flags.relay,
+      remoteName: flags.remote,
+      repoRoot,
+      toonRelays: toonConfig.relays
+    });
+    if (resolved.nudge !== void 0) io.err(resolved.nudge);
+    const relays = resolved.relays;
+    if (relays.length > 1) {
+      io.err(singleRelayRefusal(resolved, "Nothing was pushed or paid."));
+      return 1;
+    }
+    const relay = relays[0];
+    const session = await loadPaidSession(deps, relay);
+    if (session.path !== "standalone") {
+      throw new Error("internal: rig pr merge requires the standalone session");
+    }
+    const ctx = session.ctx;
+    stop = () => ctx.stop();
+    const identity = identityReport(ctx);
+    const owner = flags.owner ?? toonConfig.owner ?? identity.pubkey;
+    const addr = { ownerPubkey: owner, repoId };
+    const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND2}:${owner}:${repoId}`;
+    const lookup = async (id) => (await queryAll(relays, [{ ids: [id] }], webSocketFactory)).get(id);
+    let root = await lookup(flags.patchId);
+    if (root && root.kind === PATCH_KIND2 && isPatchRevision(root)) {
+      const rootId = revisionRootId(root);
+      if (rootId !== void 0) root = await lookup(rootId);
+    }
+    if (!root || root.kind !== PATCH_KIND2) {
+      throw new PrMergeError(
+        "patch_not_found",
+        `patch ${flags.patchId} not found as a kind:1617 patch on ${relay} \u2014 nothing was pushed or paid`
+      );
+    }
+    if (!root.tags.some((t) => t[0] === "a" && t[1] === aTag)) {
+      throw new PrMergeError(
+        "patch_not_found",
+        `patch ${root.id} does not belong to ${aTag} \u2014 nothing was pushed or paid`
+      );
+    }
+    const remote = await ctx.fetchRemote({
+      ownerPubkey: owner,
+      repoId,
+      relayUrls: relays
+    });
+    const authorized = authorizedAuthors(
+      owner,
+      remote.announceEvent?.tags ?? []
+    );
+    const revisionEvents = await queryAll(
+      relays,
+      [{ kinds: [PATCH_KIND2], "#e": [root.id] }],
+      webSocketFactory
+    );
+    const { latest } = selectRevision(
+      root,
+      [...revisionEvents.values()].filter((e) => e.kind === PATCH_KIND2),
+      authorized
+    );
+    if (!authorized.has(identity.pubkey.toLowerCase())) {
+      throw new PrMergeError(
+        "not_authorized",
+        `only the owner or a declared maintainer can merge \u2014 ${identity.pubkey.slice(0, 8)}\u2026 is neither for ${aTag}. Readers would ignore the pushed state. Nothing was pushed or paid.`
+      );
+    }
+    if (!remote.announced) {
+      throw new PrMergeError(
+        "target_not_found",
+        `${aTag} is not announced on ${relay} \u2014 nothing to merge onto`
+      );
+    }
+    const branch = (flags.target ?? firstTagValue(latest.tags, "branch-name") ?? remote.headSymref ?? "main").replace(/^refs\/heads\//, "");
+    const refname = `${BRANCH_PREFIX}${branch}`;
+    const tip = remote.refs.get(refname);
+    if (tip === void 0) {
+      throw new PrMergeError(
+        "target_not_found",
+        `branch ${JSON.stringify(branch)} is not in the honored repo state (${[...remote.refs.keys()].join(", ") || "no refs"}) \u2014 pass --target. Nothing was pushed or paid.`
+      );
+    }
+    if (!await gitOk(repoRoot, ["cat-file", "-e", `${tip}^{commit}`])) {
+      await runFetch(
+        ["--relay", relay, "--owner", owner, "--repo-id", repoId],
+        { ...deps, io: { ...io, out: () => void 0 } }
+      );
+      if (!await gitOk(repoRoot, ["cat-file", "-e", `${tip}^{commit}`])) {
+        throw new PrMergeError(
+          "tip_unavailable",
+          `the honored tip ${tip.slice(0, 7)} of ${branch} could not be fetched \u2014 run \`rig fetch\` and retry. Nothing was pushed or paid.`
+        );
+      }
+    }
+    const reader = new GitRepoReader(repoRoot);
+    const localRefs = (await reader.listRefs()).refs;
+    const localSha = localRefs.find((r) => r.refname === refname)?.sha;
+    if (localSha !== void 0 && localSha !== tip && !await reader.isAncestor(localSha, tip)) {
+      throw new PrMergeError(
+        "local_branch_diverged",
+        `local ${branch} (${localSha.slice(0, 7)}) is not behind the honored tip (${tip.slice(0, 7)}) \u2014 push or reset it first. Nothing was pushed or paid.`
+      );
+    }
+    const hasCommitter = await gitOk(repoRoot, ["config", "user.email"]);
+    const applied = await applyInIsolation(
+      repoRoot,
+      tip,
+      latest.content,
+      hasCommitter ? void 0 : {
+        name: hexToNpub(identity.pubkey),
+        email: `${hexToNpub(identity.pubkey)}@nostr`
+      }
+    );
+    if (flags.requireTrust !== void 0) {
+      const headCommit = (latest.tags.filter((t) => t[0] === "commit").at(-1)?.[1] ?? applied.newHead).toLowerCase();
+      const gate = await evaluateCiGate({
+        relays,
+        owner,
+        repoId,
+        commit: headCommit,
+        webSocketFactory,
+        requireTrust: flags.requireTrust
+      });
+      if (!gate.ok) {
+        throw new PrMergeError(
+          "ci_gate_failed",
+          `no qualifying green CI run (trust >= ${flags.requireTrust}) for ${headCommit.slice(0, 12)}: ${gate.reason ?? "not green"}. Nothing was pushed, published, or paid.`
+        );
+      }
+    }
+    const overlay = new OverlayReader(repoRoot, {
+      refname,
+      sha: applied.newHead
+    });
+    const feeRates = await ctx.publisher.getFeeRates();
+    const pushPlan = await planPush({
+      repoReader: overlay,
+      remoteState: remote,
+      feeRates,
+      repoId,
+      refs: [refname],
+      force: false
+    });
+    const plan = serializePushPlan(pushPlan);
+    const total = BigInt(plan.estimate.totalFee) + feeRates.eventFee * BigInt(1 + flags.closes.length);
+    if (!flags.json) {
+      for (const line of renderPlan(plan)) io.out(line);
+      io.out(
+        `  status    kind:1631 applied (${applied.commits.length} commit${applied.commits.length === 1 ? "" : "s"})   ${feeRates.eventFee}`
+      );
+      if (flags.closes.length > 0) {
+        io.out(
+          `  closes    kind:1632 closed (${flags.closes.length} issue${flags.closes.length === 1 ? "" : "s"})   ${feeRates.eventFee * BigInt(flags.closes.length)}`
+        );
+      }
+      io.out(`  total with status       ${total}`);
+      io.out(renderIdentityLine(identity));
+    }
+    if (!flags.yes) {
+      if (flags.json) {
+        io.emitJson({
+          command: "pr merge",
+          repoAddr: addr,
+          identity,
+          executed: false,
+          patchId: root.id,
+          revisionId: latest.id,
+          target: refname,
+          mergedShas: applied.commits,
+          plan,
+          totalFee: total.toString(),
+          hint: "estimate only \u2014 re-run with --yes to push and publish (permanent, non-refundable)"
+        });
+        return 0;
+      }
+      if (!io.isInteractive) {
+        io.err(
+          "refusing to spend channel funds without confirmation in a non-interactive session \u2014 re-run with --yes (or use --json for an estimate)"
+        );
+        return 1;
+      }
+      const proceed = await io.confirm(
+        `Proceed with paid merge (total ${total} base units)? [y/N] `
+      );
+      if (!proceed) {
+        io.err("aborted \u2014 nothing was pushed or published.");
+        return 1;
+      }
+    }
+    const pushResult = await executePush({
+      plan: pushPlan,
+      publisher: ctx.publisher,
+      remoteState: remote,
+      repoReader: overlay,
+      relayUrls: relays
+    });
+    const result = serializePushResult(pushPlan, pushResult);
+    const localNote = await advanceLocalBranch(
+      repoRoot,
+      reader,
+      refname,
+      applied.newHead,
+      localSha
+    );
+    if (localNote !== void 0) io.err(localNote);
+    let statusEventId;
+    let statusError;
+    try {
+      const receipt = await ctx.publisher.publishEvent(
+        buildStatus(owner, repoId, root.id, STATUS_APPLIED_KIND2, root.pubkey, {
+          commits: applied.commits,
+          revisionEventId: latest.id
+        }),
+        relays
+      );
+      statusEventId = receipt.eventId;
+    } catch (err) {
+      statusError = err instanceof Error ? err.message : String(err);
+    }
+    const closed = [];
+    const closeErrors = [];
+    for (const issueId of flags.closes) {
+      try {
+        await ctx.publisher.publishEvent(
+          buildStatus(owner, repoId, issueId, STATUS_CLOSED_KIND2),
+          relays
+        );
+        closed.push(issueId);
+      } catch (err) {
+        closeErrors.push({
+          issueId,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    const closeRetryHints = closeErrors.map(
+      (e) => `rig issue close ${e.issueId}`
+    );
+    const retryHint = `rig pr status ${root.id} applied`;
+    if (flags.json) {
+      io.emitJson({
+        command: "pr merge",
+        repoAddr: addr,
+        identity,
+        executed: true,
+        patchId: root.id,
+        revisionId: latest.id,
+        target: refname,
+        mergedShas: applied.commits,
+        closed,
+        ...closeErrors.length > 0 ? { closeErrors } : {},
+        result,
+        ...statusEventId !== void 0 ? { statusEventId } : {},
+        ...statusError !== void 0 ? {
+          partial: true,
+          error: "status_publish_failed",
+          detail: statusError,
+          hint: `the push succeeded but the applied status was not published \u2014 retry with \`${retryHint}\``
+        } : closeErrors.length > 0 ? {
+          partial: true,
+          error: "close_publish_failed",
+          detail: closeErrors.map((e) => `${e.issueId}: ${e.error}`).join("; "),
+          hint: `the push succeeded but some issues were not closed \u2014 retry with ${closeRetryHints.map((h) => `\`${h}\``).join(", ")}`
+        } : {}
+      });
+    } else {
+      for (const line of renderResult(result)) io.out(line);
+      if (statusEventId !== void 0) {
+        io.out(
+          `Merged ${applied.commits.length} commit(s) onto ${branch}; applied status ${statusEventId}`
+        );
+      }
+    }
+    if (!flags.json && closed.length > 0) {
+      io.out(`Closed ${closed.length} issue(s): ${closed.join(", ")}`);
+    }
+    if (statusError !== void 0) {
+      io.err(
+        `partial success: the push succeeded but publishing the applied status failed: ${statusError}`
+      );
+      io.err(`retry the status with: ${retryHint}`);
+    }
+    if (closeErrors.length > 0) {
+      for (const e of closeErrors) {
+        io.err(
+          `partial success: the push succeeded but closing issue ${e.issueId} failed: ${e.error}`
+        );
+      }
+      for (const h of closeRetryHints) io.err(`retry the close with: ${h}`);
+    }
+    return statusError !== void 0 || closeErrors.length > 0 ? 1 : 0;
+  } catch (err) {
+    return emitCliError(io, flags.json, "pr merge", err);
+  } finally {
+    if (stop) await stop().catch(() => void 0);
+  }
+}
+async function advanceLocalBranch(repoRoot, reader, refname, newHead, oldSha) {
+  try {
+    const { head } = await reader.listRefs();
+    if (head === refname) {
+      await git(repoRoot, ["merge", "--ff-only", newHead]);
+    } else {
+      await git(repoRoot, [
+        "update-ref",
+        refname,
+        newHead,
+        oldSha ?? "0".repeat(40)
+      ]);
+    }
+    return void 0;
+  } catch (err) {
+    return `warning: the push succeeded but local ${refname} could not be moved to ${newHead.slice(0, 7)}: ${gitFailure(err)} \u2014 run \`rig fetch\``;
+  }
 }
 
 // src/cli/events.ts
@@ -3512,14 +4266,16 @@ Options:
 ${COMMON_FLAGS_USAGE2}`;
 var PR_USAGE = `${PR_CREATE_USAGE}
 
+${PR_MERGE_USAGE}
+
 ${PR_STATUS_USAGE}
 
 ${PR_LIST_USAGE}
 
 ${PR_SHOW_USAGE}`;
-var HEX64_RE3 = /^[0-9a-f]{64}$/;
+var HEX64_RE4 = /^[0-9a-f]{64}$/;
 function assertHex64(value, what) {
-  if (!HEX64_RE3.test(value)) {
+  if (!HEX64_RE4.test(value)) {
     throw new Error(
       `${what} must be a 64-char lowercase hex id (got ${JSON.stringify(value)})`
     );
@@ -3716,7 +4472,7 @@ async function runIssue(args, deps) {
   let bodyFile;
   let labels;
   try {
-    const { values } = parseArgs8({
+    const { values } = parseArgs10({
       args: rest,
       options: {
         ...COMMON_OPTIONS2,
@@ -3812,7 +4568,7 @@ async function resolveCommentTarget(deps, targetEventId, relayUrl) {
     const rootEventId = firstTagValue(target.tags, "E");
     const rootKind = Number(firstTagValue(target.tags, "K"));
     const rootAuthor = firstTagValue(target.tags, "P");
-    if (rootEventId === void 0 || !HEX64_RE3.test(rootEventId) || !Number.isSafeInteger(rootKind) || rootAuthor === void 0 || !HEX64_RE3.test(rootAuthor)) {
+    if (rootEventId === void 0 || !HEX64_RE4.test(rootEventId) || !Number.isSafeInteger(rootKind) || rootAuthor === void 0 || !HEX64_RE4.test(rootAuthor)) {
       throw new Error(
         `kind:1111 comment ${targetEventId} carries no usable NIP-22 root scope (E/K/P tags) \u2014 cannot derive the thread root to reply into`
       );
@@ -3836,7 +4592,7 @@ async function runComment(args, deps) {
   let targetEventId;
   let body;
   try {
-    const { values, positionals } = parseArgs8({
+    const { values, positionals } = parseArgs10({
       args,
       options: {
         ...COMMON_OPTIONS2,
@@ -3917,6 +4673,8 @@ async function runPr(args, deps) {
   switch (sub) {
     case "create":
       return runPrCreate(rest, deps);
+    case "merge":
+      return runPrMerge(rest, deps);
     case "status":
       return runStatusCommand(rest, deps, PR_STATUS_SPEC);
     // FREE read subcommands (#278): relay queries only, no payment path.
@@ -3931,7 +4689,7 @@ async function runPr(args, deps) {
       return 0;
     default:
       io.err(
-        sub === void 0 ? "missing subcommand: rig pr <create|status|list|show>" : `unknown rig pr subcommand: ${sub}`
+        sub === void 0 ? "missing subcommand: rig pr <create|merge|status|list|show>" : `unknown rig pr subcommand: ${sub}`
       );
       io.err(PR_USAGE);
       return 2;
@@ -3955,12 +4713,12 @@ async function resolveRevisedRoot(deps, rootId, relayUrl, addr) {
       `patch ${rootId} not found on ${relayUrl} \u2014 nothing was published or paid`
     );
   }
-  if (root.kind !== PATCH_KIND2) {
+  if (root.kind !== PATCH_KIND3) {
     throw new Error(
       `event ${rootId} has kind ${root.kind}, not a kind:1617 patch \u2014 nothing was published or paid`
     );
   }
-  const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND2}:${addr.ownerPubkey}:${addr.repoId}`;
+  const aTag = `${REPOSITORY_ANNOUNCEMENT_KIND3}:${addr.ownerPubkey}:${addr.repoId}`;
   if (!root.tags.some((t) => t[0] === "a" && t[1] === aTag)) {
     throw new Error(
       `patch ${rootId} belongs to a different repository than ${aTag} \u2014 nothing was published or paid`
@@ -4011,7 +4769,7 @@ async function runPrCreate(rest, deps) {
   let bodyFile;
   let revises;
   try {
-    const { values } = parseArgs8({
+    const { values } = parseArgs10({
       args: rest,
       options: {
         ...COMMON_OPTIONS2,
@@ -4145,8 +4903,8 @@ async function runPrCreate(rest, deps) {
 }
 var STATUS_KIND_BY_VALUE = {
   open: STATUS_OPEN_KIND2,
-  applied: STATUS_APPLIED_KIND2,
-  closed: STATUS_CLOSED_KIND2,
+  applied: STATUS_APPLIED_KIND3,
+  closed: STATUS_CLOSED_KIND3,
   draft: STATUS_DRAFT_KIND2
 };
 function isStatusValue(value) {
@@ -4172,7 +4930,7 @@ async function runStatusCommand(args, deps, spec, fixedStatus) {
   let targetEventId;
   let status;
   try {
-    const { values, positionals } = parseArgs8({
+    const { values, positionals } = parseArgs10({
       args,
       options: COMMON_OPTIONS2,
       allowPositionals: true
@@ -4258,8 +5016,8 @@ async function warnIfNotMaintainer(deps, args) {
 // src/cli/entry.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
-import { parseArgs as parseArgs9 } from "util";
+import { dirname as dirname4, join as join5 } from "path";
+import { parseArgs as parseArgs11 } from "util";
 var ENTRY_USAGE = `Usage: rig entry [<connector-url> | clear] [options]
 
 Name the TOON connector rig pays. A connector describes itself on GET /ilp
@@ -4283,8 +5041,8 @@ Options:
   --json               machine-readable envelope
   -h, --help           show this help`;
 function configPathFor2(env) {
-  const dir = env["TOON_CLIENT_HOME"] ?? join4(homedir3(), ".toon-client");
-  return join4(dir, "config.json");
+  const dir = env["TOON_CLIENT_HOME"] ?? join5(homedir3(), ".toon-client");
+  return join5(dir, "config.json");
 }
 function readEntryConfig(configPath) {
   try {
@@ -4329,381 +5087,155 @@ async function runEntry(args, deps) {
   let relayFlag;
   let json = false;
   try {
-    const parsed = parseArgs9({
+    const parsed = parseArgs11({
       args,
       allowPositionals: true,
       options: {
-        relay: { type: "string" },
-        json: { type: "boolean", default: false },
-        help: { type: "boolean", short: "h", default: false }
-      }
-    });
-    if (parsed.values.help) {
-      io.out(ENTRY_USAGE);
-      return 0;
-    }
-    positionals = parsed.positionals;
-    relayFlag = parsed.values.relay;
-    json = parsed.values.json ?? false;
-  } catch (err) {
-    io.err(err instanceof Error ? err.message : String(err));
-    io.err(ENTRY_USAGE);
-    return 2;
-  }
-  if (positionals.length > 1) {
-    io.err(
-      `rig entry takes at most one argument, got ${String(positionals.length)}: ${positionals.join(" ")}`
-    );
-    io.err(ENTRY_USAGE);
-    return 2;
-  }
-  const target = positionals[0];
-  let mutation;
-  if (target !== void 0) {
-    if (target === "clear") {
-      if (relayFlag !== void 0) {
-        io.err("--relay only applies to a <connector-url> entry");
-        io.err(ENTRY_USAGE);
-        return 2;
-      }
-      mutation = { kind: "clear" };
-    } else if (HTTP_URL.test(target)) {
-      if (relayFlag !== void 0 && !WS_URL.test(relayFlag)) {
-        io.err(`--relay must be a ws(s) URL, got ${JSON.stringify(relayFlag)}`);
-        io.err(ENTRY_USAGE);
-        return 2;
-      }
-      mutation = {
-        kind: "url",
-        connectorUrl: target.replace(/\/+$/, ""),
-        ...relayFlag !== void 0 ? { relayUrl: relayFlag } : {}
-      };
-    } else if (WS_URL.test(target)) {
-      io.err(
-        `${JSON.stringify(target)} is a WebSocket URL \u2014 the entry is the connector's http(s) URL (the one whose GET /ilp describes it); pass the relay with --relay`
-      );
-      io.err(ENTRY_USAGE);
-      return 2;
-    } else {
-      io.err(
-        `unknown entry ${JSON.stringify(target)} \u2014 expected a connector http(s):// URL or \`clear\``
-      );
-      io.err(ENTRY_USAGE);
-      return 2;
-    }
-  }
-  try {
-    const configPath = configPathFor2(env);
-    const file = readEntryConfig(configPath);
-    const label = (source) => source === "env" ? "env" : source === "legacy-env" ? "env (TOON_CLIENT_PROXY_URL, pre-4.0 spelling \u2014 set TOON_CONNECTOR)" : source === "config" ? `config (${configPath})` : source === "legacy-config" ? `config proxyUrl (${configPath}, pre-4.0 spelling)` : "not configured";
-    if (mutation === void 0) {
-      const state2 = effectiveEntry(env, file);
-      if (json) {
-        io.emitJson({
-          command: "entry",
-          ...state2,
-          configPath
-        });
-        return 0;
-      }
-      io.out(
-        `Connector  ${state2.connectorUrl ?? "(none)"}  [${label(state2.connectorSource)}]`
-      );
-      io.out(
-        `Relay      ${state2.relayUrl ?? "(none)"}  [${label(state2.relaySource)}]`
-      );
-      if (!state2.connectorUrl) {
-        io.out(
-          "Set one with `rig entry <connector-url>` (or export TOON_CONNECTOR)."
-        );
-      }
-      return 0;
-    }
-    const warnings = [];
-    const next = { ...file };
-    if (file.proxyUrl !== void 0 || file.btpUrl !== void 0) {
-      delete next.proxyUrl;
-      delete next.btpUrl;
-      warnings.push(
-        "removed the pre-4.0 proxyUrl/btpUrl fields (the connector URL replaces both)"
-      );
-    }
-    if (mutation.kind === "clear") {
-      delete next.connectorUrl;
-      delete next.relayUrl;
-    } else {
-      next.connectorUrl = mutation.connectorUrl;
-      if (mutation.relayUrl !== void 0) next.relayUrl = mutation.relayUrl;
-    }
-    if (env["TOON_CONNECTOR"] || env["TOON_CLIENT_PROXY_URL"]) {
-      warnings.push(
-        "TOON_CONNECTOR / TOON_CLIENT_PROXY_URL is set in this shell and outranks the config file"
-      );
-    }
-    writeEntryConfig(configPath, next);
-    const wrote = {
-      connectorUrl: next.connectorUrl ?? null,
-      relayUrl: next.relayUrl ?? null
-    };
-    const state = effectiveEntry(env, next);
-    if (json) {
-      io.emitJson({
-        command: "entry",
-        ...state,
-        wrote,
-        configPath,
-        ...warnings.length > 0 ? { warnings } : {}
-      });
-      return 0;
-    }
-    if (mutation.kind === "clear") {
-      io.out(`Cleared the recorded connector in ${configPath}.`);
-    } else {
-      io.out(`Recorded connector ${mutation.connectorUrl} in ${configPath}.`);
-      if (mutation.relayUrl !== void 0)
-        io.out(`Recorded relay ${mutation.relayUrl}.`);
-    }
-    for (const w of warnings) io.out(`warning: ${w}`);
-    io.out(
-      `Effective connector: ${state.connectorUrl ?? "(none)"}  [${label(state.connectorSource)}]`
-    );
-    return 0;
-  } catch (err) {
-    return emitCliError(io, json, "entry", err);
-  }
-}
-
-// src/cli/fetch.ts
-import { parseArgs as parseArgs10 } from "util";
-var FETCH_USAGE = `Usage: rig fetch [remote] [options]
-
-Fetch from a TOON remote \u2014 FREE (relay reads + Arweave gateway downloads; no
-payments, no identity needed). Reads the kind:30618 repository state from the
-remote's relay, downloads only the git objects this repository is missing
-(SHA-1 verified), and updates the remote-tracking refs
-(refs/remotes/<remote>/*; tags land at refs/tags/*), reporting what moved.
-
-No merge happens: integrate with the git passthrough, e.g.
-\`rig merge origin/main\`. \`rig fetch\` is the TOON transport and shadows
-\`git fetch\` \u2014 plain-git fetches remain available via \`git fetch\` directly.
-
-The repo address (toon.repoid/toon.owner) comes from the config \`rig init\`
-or \`rig clone\` writes; --repo-id/--owner override.
-
-Options:
-  --repo-id <id>       repository id / NIP-34 d-tag (default: git config)
-  --owner <pubkey>     repository owner (npub or 64-char hex; default: git config)
-  --relay <url>        ad-hoc relay override \u2014 bypasses the remote's URL
-  --gateway <url>      gateway to read objects through FIRST, on its raw-bytes
-                       route <url>/raw/<txId>, ahead of the public gateway
-                       list \u2014 name a private, local or air-gapped gateway to
-                       fetch objects the public ones do not carry
-                       (env RIG_ARWEAVE_GATEWAY also sets it)
-  --concurrency <n>    parallel gateway downloads (default 8)
-  --json               machine-readable result envelope
-  -h, --help           show this help`;
-var WS_URL_RE4 = /^wss?:\/\//i;
-function localRefFor(refname, remote) {
-  if (refname.startsWith("refs/heads/")) {
-    return `refs/remotes/${remote}/${refname.slice("refs/heads/".length)}`;
-  }
-  if (refname.startsWith("refs/tags/")) return refname;
-  return null;
-}
-async function resolveLocalRef(repoRoot, refname) {
-  try {
-    const out = await runGit(repoRoot, [
-      "rev-parse",
-      "--verify",
-      "--quiet",
-      refname
-    ]);
-    const sha = out.trim();
-    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
-  } catch {
-    return null;
-  }
-}
-async function runFetch(args, deps) {
-  const { io } = deps;
-  let json = false;
-  let remote = "origin";
-  let relayFlag;
-  let repoIdFlag;
-  let ownerFlag;
-  let gatewayFlag;
-  let concurrency;
-  try {
-    const { values, positionals } = parseArgs10({
-      args,
-      options: {
-        json: { type: "boolean", default: false },
-        relay: { type: "string" },
-        "repo-id": { type: "string" },
-        owner: { type: "string" },
-        gateway: { type: "string" },
-        concurrency: { type: "string" },
-        help: { type: "boolean", short: "h", default: false }
-      },
-      allowPositionals: true
-    });
-    if (values.help) {
-      io.out(FETCH_USAGE);
-      return 0;
-    }
-    json = values.json === true;
-    if (positionals.length > 1) {
-      throw new Error(
-        `expected at most one [remote] argument, got ${positionals.length}`
-      );
-    }
-    if (positionals[0] !== void 0) remote = positionals[0];
-    relayFlag = values.relay;
-    repoIdFlag = values["repo-id"];
-    ownerFlag = values.owner !== void 0 ? ownerToHex(values.owner) : void 0;
-    gatewayFlag = values.gateway;
-    if (values.concurrency !== void 0) {
-      concurrency = Number.parseInt(values.concurrency, 10);
-      if (!Number.isSafeInteger(concurrency) || concurrency < 1) {
-        throw new Error("--concurrency must be a positive integer");
+        relay: { type: "string" },
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false }
       }
+    });
+    if (parsed.values.help) {
+      io.out(ENTRY_USAGE);
+      return 0;
     }
+    positionals = parsed.positionals;
+    relayFlag = parsed.values.relay;
+    json = parsed.values.json ?? false;
   } catch (err) {
     io.err(err instanceof Error ? err.message : String(err));
-    io.err(FETCH_USAGE);
+    io.err(ENTRY_USAGE);
     return 2;
   }
-  try {
-    const repoRoot = await resolveRepoRoot(deps.cwd);
-    const toonConfig = await readToonConfig(repoRoot);
-    const repoId = repoIdFlag ?? toonConfig.repoId;
-    if (!repoId) throw new UnconfiguredRepoAddressError("repository id");
-    const owner = ownerFlag ?? toonConfig.owner;
-    if (!owner) throw new UnconfiguredRepoAddressError("repository owner");
-    let relayUrl;
-    if (relayFlag !== void 0) {
-      relayUrl = relayFlag;
+  if (positionals.length > 1) {
+    io.err(
+      `rig entry takes at most one argument, got ${String(positionals.length)}: ${positionals.join(" ")}`
+    );
+    io.err(ENTRY_USAGE);
+    return 2;
+  }
+  const target = positionals[0];
+  let mutation;
+  if (target !== void 0) {
+    if (target === "clear") {
+      if (relayFlag !== void 0) {
+        io.err("--relay only applies to a <connector-url> entry");
+        io.err(ENTRY_USAGE);
+        return 2;
+      }
+      mutation = { kind: "clear" };
+    } else if (HTTP_URL.test(target)) {
+      if (relayFlag !== void 0 && !WS_URL.test(relayFlag)) {
+        io.err(`--relay must be a ws(s) URL, got ${JSON.stringify(relayFlag)}`);
+        io.err(ENTRY_USAGE);
+        return 2;
+      }
+      mutation = {
+        kind: "url",
+        connectorUrl: target.replace(/\/+$/, ""),
+        ...relayFlag !== void 0 ? { relayUrl: relayFlag } : {}
+      };
+    } else if (WS_URL.test(target)) {
+      io.err(
+        `${JSON.stringify(target)} is a WebSocket URL \u2014 the entry is the connector's http(s) URL (the one whose GET /ilp describes it); pass the relay with --relay`
+      );
+      io.err(ENTRY_USAGE);
+      return 2;
     } else {
-      const urls = await getGitRemoteUrls(repoRoot, remote);
-      if (urls.length === 0) throw new UnknownRemoteError(remote);
-      if (urls.length > 1) throw new MultiUrlRemoteError(remote, urls);
-      relayUrl = urls[0];
-    }
-    if (!WS_URL_RE4.test(relayUrl)) {
-      throw new InvalidRelayUrlError(
-        relayUrl,
-        `remote ${JSON.stringify(remote)}`
+      io.err(
+        `unknown entry ${JSON.stringify(target)} \u2014 expected a connector http(s):// URL or \`clear\``
       );
+      io.err(ENTRY_USAGE);
+      return 2;
     }
-    const remoteState = await fetchRemoteState({
-      relayUrls: [relayUrl],
-      ownerPubkey: owner,
-      repoId,
-      ...deps.webSocketFactory ? { webSocketFactory: deps.webSocketFactory } : {},
-      // The GraphQL fallback for SHAs the map does not cover asks the SAME
-      // permaweb the objects are read from (#183).
-      resolveSha: deps.resolveSha ?? shaResolverFor(gatewayFlag, deps.env)
-    });
-    const planned = [];
-    for (const [refname, sha] of remoteState.refs) {
-      if (!isSafeRefname(refname)) {
-        io.err(
-          `warning: skipping unsafe ref name from relay: ${JSON.stringify(refname)}`
-        );
-        continue;
+  }
+  try {
+    const configPath = configPathFor2(env);
+    const file = readEntryConfig(configPath);
+    const label = (source) => source === "env" ? "env" : source === "legacy-env" ? "env (TOON_CLIENT_PROXY_URL, pre-4.0 spelling \u2014 set TOON_CONNECTOR)" : source === "config" ? `config (${configPath})` : source === "legacy-config" ? `config proxyUrl (${configPath}, pre-4.0 spelling)` : "not configured";
+    if (mutation === void 0) {
+      const state2 = effectiveEntry(env, file);
+      if (json) {
+        io.emitJson({
+          command: "entry",
+          ...state2,
+          configPath
+        });
+        return 0;
       }
-      const localRef = localRefFor(refname, remote);
-      if (localRef === null) {
-        io.err(
-          `warning: skipping ref outside refs/heads and refs/tags: ${refname}`
+      io.out(
+        `Connector  ${state2.connectorUrl ?? "(none)"}  [${label(state2.connectorSource)}]`
+      );
+      io.out(
+        `Relay      ${state2.relayUrl ?? "(none)"}  [${label(state2.relaySource)}]`
+      );
+      if (!state2.connectorUrl) {
+        io.out(
+          "Set one with `rig entry <connector-url>` (or export TOON_CONNECTOR)."
         );
-        continue;
       }
-      planned.push({ refname, localRef, newSha: sha });
+      return 0;
     }
-    const reader = new GitRepoReader(repoRoot);
-    const tips = [...new Set(planned.map((p) => p.newSha))];
-    const presentLocally = new Set(await reader.listAllObjectShas());
-    const collected = await collectRepoObjects({
-      tips,
-      shaToTxId: remoteState.shaToTxId,
-      resolveMissing: (shas) => remoteState.resolveMissing(shas),
-      presentLocally,
-      // `--gateway` / RIG_ARWEAVE_GATEWAY first, public list behind it (#176).
-      gateways: readGateways(gatewayFlag, deps.env),
-      ...deps.fetchFn ? { fetchFn: deps.fetchFn } : {},
-      ...concurrency !== void 0 ? { concurrency } : {}
-    });
-    if (collected.missing.length > 0) {
-      throw new MissingRemoteObjectsError(
-        collected.missing,
-        `cannot fetch from ${relayUrl}`
+    const warnings = [];
+    const next = { ...file };
+    if (file.proxyUrl !== void 0 || file.btpUrl !== void 0) {
+      delete next.proxyUrl;
+      delete next.btpUrl;
+      warnings.push(
+        "removed the pre-4.0 proxyUrl/btpUrl fields (the connector URL replaces both)"
       );
     }
-    const written = await writeGitObjects(repoRoot, collected.objects.values());
-    const updates = [];
-    for (const { refname, localRef, newSha } of planned) {
-      const oldSha = await resolveLocalRef(repoRoot, localRef);
-      if (oldSha === newSha) {
-        updates.push({ refname, localRef, oldSha, newSha, kind: "up-to-date" });
-        continue;
-      }
-      let kind;
-      if (oldSha === null) {
-        kind = "new";
-      } else {
-        kind = await reader.isAncestor(oldSha, newSha) ? "fast-forward" : "forced";
-      }
-      await updateRef(repoRoot, localRef, newSha);
-      updates.push({ refname, localRef, oldSha, newSha, kind });
+    if (mutation.kind === "clear") {
+      delete next.connectorUrl;
+      delete next.relayUrl;
+    } else {
+      next.connectorUrl = mutation.connectorUrl;
+      if (mutation.relayUrl !== void 0) next.relayUrl = mutation.relayUrl;
     }
-    const moved = updates.filter((u) => u.kind !== "up-to-date");
+    if (env["TOON_CONNECTOR"] || env["TOON_CLIENT_PROXY_URL"]) {
+      warnings.push(
+        "TOON_CONNECTOR / TOON_CLIENT_PROXY_URL is set in this shell and outranks the config file"
+      );
+    }
+    writeEntryConfig(configPath, next);
+    const wrote = {
+      connectorUrl: next.connectorUrl ?? null,
+      relayUrl: next.relayUrl ?? null
+    };
+    const state = effectiveEntry(env, next);
     if (json) {
       io.emitJson({
-        command: "fetch",
-        repoAddr: { ownerPubkey: owner, repoId },
-        remote,
-        relay: relayUrl,
-        objectsDownloaded: written,
-        updates,
-        executed: true
+        command: "entry",
+        ...state,
+        wrote,
+        configPath,
+        ...warnings.length > 0 ? { warnings } : {}
       });
       return 0;
     }
-    if (moved.length === 0) {
-      io.out("Already up to date.");
-      return 0;
-    }
-    io.out(`From ${relayUrl}`);
-    for (const u of moved) {
-      const short = (refname) => refname.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/remotes\//, "");
-      const src = short(u.refname);
-      const dst = short(u.localRef);
-      if (u.kind === "new") {
-        const label = u.refname.startsWith("refs/tags/") ? "[new tag]" : "[new branch]";
-        io.out(` * ${label.padEnd(17)} ${src.padEnd(14)} -> ${dst}`);
-      } else if (u.kind === "forced") {
-        io.out(
-          ` + ${u.oldSha.slice(0, 7)}...${u.newSha.slice(0, 7)} ${src.padEnd(14)} -> ${dst}  (forced update)`
-        );
-      } else {
-        io.out(
-          `   ${u.oldSha.slice(0, 7)}..${u.newSha.slice(0, 7)}  ${src.padEnd(14)} -> ${dst}`
-        );
-      }
+    if (mutation.kind === "clear") {
+      io.out(`Cleared the recorded connector in ${configPath}.`);
+    } else {
+      io.out(`Recorded connector ${mutation.connectorUrl} in ${configPath}.`);
+      if (mutation.relayUrl !== void 0)
+        io.out(`Recorded relay ${mutation.relayUrl}.`);
     }
-    io.out(`Downloaded ${written} object(s) (SHA-1 verified).`);
+    for (const w of warnings) io.out(`warning: ${w}`);
+    io.out(
+      `Effective connector: ${state.connectorUrl ?? "(none)"}  [${label(state.connectorSource)}]`
+    );
     return 0;
   } catch (err) {
-    return emitCliError(io, json, "fetch", err);
+    return emitCliError(io, json, "entry", err);
   }
 }
 
 // src/cli/fund.ts
 import { readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-import { parseArgs as parseArgs11 } from "util";
+import { join as join6 } from "path";
+import { parseArgs as parseArgs12 } from "util";
 var DEVNET_FAUCET_URL = "https://faucet.devnet.toonprotocol.dev";
 var CHAINS = ["evm", "solana"];
 var CHAIN_ALIASES = {
@@ -4755,11 +5287,15 @@ Options:
   --json               machine-readable envelope (per-chain results array)
   -h, --help           show this help`;
 var SHARED_DEVNET_SUFFIX = ".devnet.toonprotocol.dev";
+var SHARED_DEVNET_HOSTS = /* @__PURE__ */ new Set([
+  "toonprotocol.dev",
+  "relay.toonprotocol.dev"
+]);
 function devnetHost(url) {
   if (!url) return void 0;
   try {
     const { hostname } = new URL(url);
-    if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1)) {
+    if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1) || SHARED_DEVNET_HOSTS.has(hostname)) {
       return url;
     }
   } catch {
@@ -4841,8 +5377,8 @@ function noFaucetGuidance(network, devnetOrigin) {
   return `${head}. If you meant the shared devnet, set TOON_CLIENT_NETWORK=devnet and re-run \`rig fund\` \u2014 no faucet URL is needed there. If this is a self-hosted network with its own faucet, set TOON_CLIENT_FAUCET_URL (or the faucetUrl config field). ${external}`;
 }
 function readFundConfig(env) {
-  const dir = env["TOON_CLIENT_HOME"] ?? join5(homedir4(), ".toon-client");
-  const configPath = join5(dir, "config.json");
+  const dir = env["TOON_CLIENT_HOME"] ?? join6(homedir4(), ".toon-client");
+  const configPath = join6(dir, "config.json");
   try {
     return {
       file: JSON.parse(readFileSync4(configPath, "utf8")),
@@ -4863,7 +5399,7 @@ async function runFund(args, deps) {
   let addressFlag;
   let json = false;
   try {
-    const { values, positionals } = parseArgs11({
+    const { values, positionals } = parseArgs12({
       args,
       allowPositionals: true,
       options: {
@@ -4953,7 +5489,8 @@ async function runFund(args, deps) {
     }
     const timeoutEnv = env["TOON_CLIENT_FAUCET_TIMEOUT_MS"];
     const timeoutFor = () => {
-      if (timeoutEnv && Number.isFinite(Number(timeoutEnv))) return Number(timeoutEnv);
+      if (timeoutEnv && Number.isFinite(Number(timeoutEnv)))
+        return Number(timeoutEnv);
       if (file.faucetTimeoutMs !== void 0) return file.faucetTimeoutMs;
       return 9e4;
     };
@@ -4981,10 +5518,15 @@ async function runFund(args, deps) {
       }
       const started = Date.now();
       try {
-        const { response } = await client.fundWallet(faucetUrl, address, chain, {
-          timeout: timeoutFor(),
-          ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-        });
+        const { response } = await client.fundWallet(
+          faucetUrl,
+          address,
+          chain,
+          {
+            timeout: timeoutFor(),
+            ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+          }
+        );
         return {
           chain,
           funded: true,
@@ -5030,7 +5572,9 @@ async function runFund(args, deps) {
       }
     }
     io.out(renderIdentityLine(identity));
-    io.out("Re-check with `rig balance` (a drip can take a few blocks to land).");
+    io.out(
+      "Re-check with `rig balance` (a drip can take a few blocks to land)."
+    );
     return allFunded ? 0 : 1;
   } catch (err) {
     return emitCliError(io, json, "fund", err);
@@ -5089,7 +5633,7 @@ var runGitPassthrough = (argv, options = {}) => {
 import { existsSync, mkdirSync as mkdirSync4 } from "fs";
 import { dirname as dirname5 } from "path";
 import { createInterface } from "readline/promises";
-import { parseArgs as parseArgs12 } from "util";
+import { parseArgs as parseArgs13 } from "util";
 async function loadKeyOps() {
   const { generateKeystore, importKeystore } = await import("@toon-protocol/client");
   return { generateKeystore, importKeystore, deriveNostrKeyFromMnemonic };
@@ -5261,7 +5805,7 @@ async function runIdentity(args, deps) {
   }
 }
 function parseMintArgs(args, verb) {
-  const { values, positionals } = parseArgs12({
+  const { values, positionals } = parseArgs13({
     args,
     options: {
       force: { type: "boolean", default: false },
@@ -5366,7 +5910,7 @@ async function runIdentityShow(args, deps) {
   let json = false;
   let help = false;
   try {
-    const parsed = parseArgs12({
+    const parsed = parseArgs13({
       args,
       options: {
         json: { type: "boolean", default: false },
@@ -5474,15 +6018,15 @@ async function defaultReadSecretLine(prompt, isInteractive) {
 }
 
 // src/cli/inbox.ts
-import { parseArgs as parseArgs13 } from "util";
+import { parseArgs as parseArgs14 } from "util";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import {
   ISSUE_KIND as ISSUE_KIND2,
-  PATCH_KIND as PATCH_KIND3,
-  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND3,
-  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND3,
-  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
+  PATCH_KIND as PATCH_KIND4,
+  REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND4,
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND4,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND4,
   STATUS_DRAFT_KIND as STATUS_DRAFT_KIND3,
   STATUS_OPEN_KIND as STATUS_OPEN_KIND3
 } from "@toon-protocol/core/nip34";
@@ -5599,8 +6143,8 @@ Options:
   -h, --help           show this help`;
 var STATUS_KINDS2 = [
   STATUS_OPEN_KIND3,
-  STATUS_APPLIED_KIND3,
-  STATUS_CLOSED_KIND3,
+  STATUS_APPLIED_KIND4,
+  STATUS_CLOSED_KIND4,
   STATUS_DRAFT_KIND3
 ];
 var CI_KINDS = [
@@ -5611,17 +6155,17 @@ var CI_KINDS = [
   CI_JOB_RESULT_KIND
 ];
 var INBOX_KINDS = [
-  PATCH_KIND3,
+  PATCH_KIND4,
   ISSUE_KIND2,
   COMMENT_KIND,
   LEGACY_COMMENT_KIND,
   ...STATUS_KINDS2,
   ...CI_KINDS
 ];
-var HEX64_RE4 = /^[0-9a-f]{64}$/;
+var HEX64_RE5 = /^[0-9a-f]{64}$/;
 var INBOX_CURSOR_FILENAME = "inbox-cursors.json";
 function cursorPath(env) {
-  return join6(clientStateDir(env), INBOX_CURSOR_FILENAME);
+  return join7(clientStateDir(env), INBOX_CURSOR_FILENAME);
 }
 function readCursors(env) {
   try {
@@ -5660,7 +6204,7 @@ function hasTopic(event, topic) {
   return event.tags.some((t) => t[0] === "t" && t[1] === topic);
 }
 function typeOf(event) {
-  if (event.kind === PATCH_KIND3) {
+  if (event.kind === PATCH_KIND4) {
     if (hasTopic(event, "root-revision")) return "revision";
     if (hasTopic(event, "root") || tagValue2(event.tags, "e") === void 0) {
       return "patch";
@@ -5696,7 +6240,7 @@ function toInboxEntry(event) {
   const type = typeOf(event);
   if (type === null) return null;
   const repo = event.tags.find(
-    (t) => t[0] === "a" && t[1]?.startsWith(`${REPOSITORY_ANNOUNCEMENT_KIND3}:`)
+    (t) => t[0] === "a" && t[1]?.startsWith(`${REPOSITORY_ANNOUNCEMENT_KIND4}:`)
   )?.[1];
   return {
     id: event.id,
@@ -5722,7 +6266,7 @@ async function ownerAnnouncement(relays, owner, repoId, ws) {
     relays,
     [
       {
-        kinds: [REPOSITORY_ANNOUNCEMENT_KIND3],
+        kinds: [REPOSITORY_ANNOUNCEMENT_KIND4],
         authors: [owner],
         "#d": [repoId]
       }
@@ -5731,7 +6275,7 @@ async function ownerAnnouncement(relays, owner, repoId, ws) {
   ).catch(() => /* @__PURE__ */ new Map());
   return newest(
     [...found.values()].filter(
-      (e) => e.kind === REPOSITORY_ANNOUNCEMENT_KIND3 && e.pubkey.toLowerCase() === owner && tagValue2(e.tags, "d") === repoId
+      (e) => e.kind === REPOSITORY_ANNOUNCEMENT_KIND4 && e.pubkey.toLowerCase() === owner && tagValue2(e.tags, "d") === repoId
     )
   );
 }
@@ -5763,7 +6307,7 @@ async function runInbox(args, deps) {
   let remote;
   let relayFlags = [];
   try {
-    const { values, positionals } = parseArgs13({
+    const { values, positionals } = parseArgs14({
       args,
       options: INBOX_OPTIONS,
       allowPositionals: true
@@ -5822,14 +6366,14 @@ async function runInbox(args, deps) {
     const announcements = await queryAll(
       configured,
       [
-        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND3], authors: [me] },
-        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND3], "#maintainers": [me] }
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND4], authors: [me] },
+        { kinds: [REPOSITORY_ANNOUNCEMENT_KIND4], "#maintainers": [me] }
       ],
       ws
     );
     const byRepo = /* @__PURE__ */ new Map();
     for (const e of announcements.values()) {
-      if (e.kind !== REPOSITORY_ANNOUNCEMENT_KIND3) continue;
+      if (e.kind !== REPOSITORY_ANNOUNCEMENT_KIND4) continue;
       const d = tagValue2(e.tags, "d");
       if (!d) continue;
       const key = `${e.pubkey.toLowerCase()}:${d}`;
@@ -5843,7 +6387,7 @@ async function runInbox(args, deps) {
       if (latest === null) continue;
       if (owner !== me && !parseMaintainers(latest.tags).includes(me)) continue;
       watched.push({
-        address: `${REPOSITORY_ANNOUNCEMENT_KIND3}:${owner}:${repoId}`,
+        address: `${REPOSITORY_ANNOUNCEMENT_KIND4}:${owner}:${repoId}`,
         ownerPubkey: owner,
         authorized: authorizedAuthors(owner, latest.tags),
         relays: relaysTag(latest.tags)
@@ -5901,7 +6445,7 @@ async function runInbox(args, deps) {
       const unknownTargets = /* @__PURE__ */ new Set();
       for (const e of statusEvents) {
         const target = tagValue2(e.tags, "e");
-        if (!target || !HEX64_RE4.test(target)) continue;
+        if (!target || !HEX64_RE5.test(target)) continue;
         const known = found.get(target);
         if (known) targetAuthors.set(target, known.pubkey.toLowerCase());
         else unknownTargets.add(target);
@@ -6035,7 +6579,7 @@ async function runInbox(args, deps) {
 
 // src/cli/init.ts
 import { basename as basename2 } from "path";
-import { parseArgs as parseArgs14 } from "util";
+import { parseArgs as parseArgs15 } from "util";
 
 // src/cli/git-author.ts
 var PROFILE_KIND = 0;
@@ -6153,7 +6697,7 @@ Options:
   --json               machine-readable report
   -h, --help           show this help`;
 function parseInitArgs(args) {
-  const { values, positionals } = parseArgs14({
+  const { values, positionals } = parseArgs15({
     args,
     options: {
       "repo-id": { type: "string" },
@@ -6380,8 +6924,8 @@ async function runInit(args, deps) {
 }
 
 // src/cli/maintainers.ts
-import { parseArgs as parseArgs15 } from "util";
-var HEX64_RE5 = /^[0-9a-f]{64}$/;
+import { parseArgs as parseArgs16 } from "util";
+var HEX64_RE6 = /^[0-9a-f]{64}$/;
 var REF_AUTHORITY_NOTICE = "Note: maintainers can move refs (publish honored repo state), not only set status.";
 var MAINTAINERS_USAGE = `Usage: rig maintainers <list|add|remove> [<pubkey>] [options]
 
@@ -6434,7 +6978,7 @@ async function runList2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs15({
+    const { values, positionals } = parseArgs16({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -6501,7 +7045,7 @@ async function runMutate(op, args, deps) {
   let flags;
   let pubkey;
   try {
-    const { values, positionals } = parseArgs15({
+    const { values, positionals } = parseArgs16({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -6515,7 +7059,7 @@ async function runMutate(op, args, deps) {
       throw new Error(`expected exactly one <pubkey> to ${op}`);
     }
     pubkey = ownerToHex(positionals[0]).toLowerCase();
-    if (!HEX64_RE5.test(pubkey)) {
+    if (!HEX64_RE6.test(pubkey)) {
       throw new Error(
         `<pubkey> must resolve to 64-char hex (got ${JSON.stringify(positionals[0])})`
       );
@@ -6636,7 +7180,7 @@ async function runMutate(op, args, deps) {
 }
 
 // src/cli/refresh.ts
-import { parseArgs as parseArgs16 } from "util";
+import { parseArgs as parseArgs17 } from "util";
 var REFRESH_USAGE = `Usage: rig refresh [options]
 
 Republish this repo's kind:30617 announcement with no field edit, refreshing
@@ -6672,7 +7216,7 @@ async function runRefresh(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs16({
+    const { values, positionals } = parseArgs17({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -6795,7 +7339,7 @@ async function runRefresh(args, deps) {
 
 // src/cli/name.ts
 import { randomUUID } from "crypto";
-import { parseArgs as parseArgs17 } from "util";
+import { parseArgs as parseArgs18 } from "util";
 var ARIO_DECIMALS = 6;
 function renderMario(mario) {
   return `${mario.toString()} mARIO (~${formatUnits(mario.toString(), ARIO_DECIMALS)} ARIO)`;
@@ -7304,7 +7848,7 @@ async function resolveNameContext(deps, network, processId, mode) {
   return { identity, solanaAddress, network, processId, sdk, nostrSecretKey };
 }
 function parseNameFlags(args, env) {
-  const { values, positionals } = parseArgs17({
+  const { values, positionals } = parseArgs18({
     args,
     allowPositionals: true,
     options: {
@@ -7863,7 +8407,7 @@ async function runName(args, deps) {
 }
 
 // src/cli/payout.ts
-import { parseArgs as parseArgs18 } from "util";
+import { parseArgs as parseArgs19 } from "util";
 import { getAddress } from "viem";
 var PAYOUT_USAGE = `Usage: rig payout <set|clear|show> [<address>] [options]
 
@@ -7919,7 +8463,7 @@ async function runShow2(args, deps) {
   const { io } = deps;
   let flags;
   try {
-    const { values, positionals } = parseArgs18({
+    const { values, positionals } = parseArgs19({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -7981,7 +8525,7 @@ async function runMutate2(op, args, deps) {
   let flags;
   let nextPayout = null;
   try {
-    const { values, positionals } = parseArgs18({
+    const { values, positionals } = parseArgs19({
       args,
       options: REPO_COMMAND_OPTIONS,
       allowPositionals: true
@@ -8115,7 +8659,7 @@ async function runMutate2(op, args, deps) {
 }
 
 // src/cli/site.ts
-import { parseArgs as parseArgs19 } from "util";
+import { parseArgs as parseArgs20 } from "util";
 
 // src/arweave-manifest.ts
 var DEFAULT_INDEX = "index.html";
@@ -8136,13 +8680,13 @@ function buildArweaveManifest(entries, indexPath = DEFAULT_INDEX, fallbackTxId)
 // src/cli/site-record.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var SITE_MANIFEST_FILENAME = "site-manifests.json";
 function storeDir2(env) {
-  return env["TOON_CLIENT_HOME"] ?? join7(homedir5(), ".toon-client");
+  return env["TOON_CLIENT_HOME"] ?? join8(homedir5(), ".toon-client");
 }
 function storePath2(env) {
-  return join7(storeDir2(env), SITE_MANIFEST_FILENAME);
+  return join8(storeDir2(env), SITE_MANIFEST_FILENAME);
 }
 function keyOf(repoId, ref) {
   return `${repoId}\0${ref}`;
@@ -8206,7 +8750,7 @@ Options (publish):
                        estimate (nothing uploaded)
   -h, --help           show this help`;
 function parseSiteArgs(args) {
-  const { values, positionals } = parseArgs19({
+  const { values, positionals } = parseArgs20({
     args,
     options: {
       index: { type: "string" },
@@ -8616,6 +9160,8 @@ Commands rig owns:
   pr create                  publish a patch (kind:1617) with real
                              \`git format-patch\` content (--revises <patch-id>
                              publishes a revision of an existing patch)
+  pr merge <patch-id>        apply the latest revision with git am, push, then
+                             publish the applied status (owner/maintainer)
   pr status <event-id> <state>  set an issue/patch status (kind:1630-1633):
                              open | applied | closed | draft
   inbox                      everything new since you last read it (free):
@@ -8804,4 +9350,4 @@ export {
   rigVersion,
   dispatch
 };
-//# sourceMappingURL=chunk-Y7TUE7JT.js.map
+//# sourceMappingURL=chunk-Z3XRZ5E5.js.map