@toon-protocol/rig 5.3.0 → 5.4.1

package/dist/{chunk-KQ4NQV7T.js → chunk-OJ372S6M.js}

@@ -4,6 +4,7 @@ import {
   CI_SERVICE_REQUEST_KIND,
   CI_SERVICE_STOP_KIND,
   CI_STATUS_USAGE,
+  CI_TRUST_ORDER,
   CI_WORKFLOW_PROGRESS_KIND,
   CI_WORKFLOW_RESULT_KIND,
   GitRepoReader,
@@ -27,11 +28,13 @@ import {
   earliestUniqueCommit,
   emitCliError,
   encryptSecretUpdate,
+  evaluateCiGate,
   executePush,
   generateSecretsKey,
   getGitRemoteUrls,
   hexToNpub,
   initGitRepository,
+  isCiTrustLevel,
   isRelayUrl,
   isSafeRefname,
   listGitRemotes,
@@ -58,13 +61,13 @@ import {
   updateRef,
   writeGitObjects,
   writeToonConfig
-} from "./chunk-DGF7WCRW.js";
+} from "./chunk-YBJNZS5X.js";
 import {
   PREFERRED_GATEWAY,
   mirrorGatewaysFor,
   readGateways,
   shaResolverFor
-} from "./chunk-UXRWMKXV.js";
+} from "./chunk-4OAMSMXA.js";
 import {
   COMMENT_KIND,
   DEFAULT_KEYSTORE_PASSWORD,
@@ -93,7 +96,7 @@ import {
   resolveIdentity,
   revisionRootId,
   selectRevision
-} from "./chunk-OVZJ5P6E.js";
+} from "./chunk-7LB352DM.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -307,6 +310,9 @@ function writeRigPointerRecord(env, record) {
 }
 
 // src/cli/push.ts
+function foreignOwnerOf(owner, pubkey) {
+  return owner && owner.toLowerCase() !== pubkey.toLowerCase() ? owner : void 0;
+}
 function withForcedStandalone(deps) {
   return { ...deps, env: { ...deps.env, [RIG_STANDALONE_ENV]: "1" } };
 }
@@ -322,7 +328,7 @@ function loadPaidSession(deps, relayUrl) {
   });
 }
 var defaultLoadStandalone = async (options) => {
-  const mod = await import("./standalone-mode-E7TNMWGO.js");
+  const mod = await import("./standalone-mode-TWOZA5TL.js");
   return mod.createStandaloneContext(options);
 };
 function identityReport(ctx) {
@@ -567,7 +573,17 @@ async function runPush(args, deps) {
       io.err(singleRelayRefusal(resolved, "Nothing was uploaded or paid."));
       return 1;
     }
-    const session = await loadPaidSession(deps, relaysUsed[0]);
+    let session = await loadPaidSession(deps, relaysUsed[0]);
+    const daemonForeignOwner = session.path === "daemon" ? foreignOwnerOf(toonConfig.owner, session.identity.pubkey) : void 0;
+    if (daemonForeignOwner) {
+      io.err(
+        `rig: toon.owner (${daemonForeignOwner.slice(0, 8)}\u2026) is another identity's repo \u2014 running standalone instead of the daemon to read the owner's repo state (the daemon reads only its own).`
+      );
+      session = await loadPaidSession(
+        withForcedStandalone(deps),
+        relaysUsed[0]
+      );
+    }
     const path = session.path;
     let identity;
     if (session.path === "standalone") {
@@ -576,7 +592,7 @@ async function runPush(args, deps) {
     } else {
       identity = session.identity;
     }
-    const foreignOwner = toonConfig.owner && toonConfig.owner.toLowerCase() !== identity.pubkey.toLowerCase() ? toonConfig.owner : void 0;
+    const foreignOwner = foreignOwnerOf(toonConfig.owner, identity.pubkey);
     let maintainerRemote;
     if (session.path === "standalone" && foreignOwner) {
       const ownerState = await session.ctx.fetchRemote({
@@ -2520,7 +2536,7 @@ async function runCi(args, deps) {
     case "status":
       return runCiStatus(rest, deps);
     case "serve":
-      return (await import("./ci-serve-R7ZQ7GJQ.js")).runCiServe(rest, deps);
+      return (await import("./ci-serve-OOMHKKGG.js")).runCiServe(rest, deps);
     case "--help":
     case "-h":
     case "help":
@@ -2796,7 +2812,7 @@ import {
   PATCH_KIND as PATCH_KIND3,
   REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND3,
   STATUS_APPLIED_KIND as STATUS_APPLIED_KIND3,
-  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
   STATUS_DRAFT_KIND as STATUS_DRAFT_KIND2,
   STATUS_OPEN_KIND as STATUS_OPEN_KIND2
 } from "@toon-protocol/core/nip34";
@@ -2811,7 +2827,8 @@ import { promisify } from "util";
 import {
   PATCH_KIND as PATCH_KIND2,
   REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND2,
-  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2
+  STATUS_APPLIED_KIND as STATUS_APPLIED_KIND2,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND2
 } from "@toon-protocol/core/nip34";
 
 // src/cli/fetch.ts
@@ -3649,6 +3666,12 @@ reported as a partial success; retry with \`rig pr status <patch-id> applied\`.
 Options:
   --target <branch>    branch to merge onto (default: the patch's branch-name
                        tag, else the repo's default branch)
+  --require-ci-trust <level>
+                       refuse the merge, before paying, unless the patch
+                       series' head commit has a concluded green CI run at or
+                       above this trust level (same gate as \`rig ci status\`)
+  --closes <issue-id>  after a successful merge, publish closed (kind:1632)
+                       for this issue; repeatable
   --yes                skip the confirmation prompt
   --json               machine-readable output (without --yes: estimate only)
   --relay <url>        ad-hoc relay override (bypasses git remotes)
@@ -3666,6 +3689,8 @@ function parseMergeArgs(args) {
       remote: { type: "string" },
       "repo-id": { type: "string" },
       owner: { type: "string" },
+      "require-ci-trust": { type: "string" },
+      closes: { type: "string", multiple: true },
       standalone: { type: "boolean", default: false },
       "no-daemon": { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false }
@@ -3687,8 +3712,23 @@ function parseMergeArgs(args) {
     patchId,
     yes: values.yes === true,
     json: values.json === true,
-    relay: values.relay ?? []
+    relay: values.relay ?? [],
+    closes: [...new Set(values.closes ?? [])]
   };
+  for (const id of flags.closes) {
+    if (!HEX64_RE3.test(id)) {
+      throw new Error("--closes must be a 64-character lowercase hex issue id");
+    }
+  }
+  const level = values["require-ci-trust"];
+  if (level !== void 0) {
+    if (!isCiTrustLevel(level)) {
+      throw new Error(
+        `--require-ci-trust must be one of ${CI_TRUST_ORDER.join(" | ")} (got ${JSON.stringify(level)})`
+      );
+    }
+    flags.requireTrust = level;
+  }
   if (values.target !== void 0) flags.target = values.target;
   if (values.remote !== void 0) flags.remote = values.remote;
   if (values["repo-id"] !== void 0) flags.repoId = values["repo-id"];
@@ -3735,6 +3775,49 @@ var OverlayReader = class extends GitRepoReader {
     return { ...base, refs };
   }
 };
+var MAX_SERIES_DEPTH = 256;
+function replyParentId(event) {
+  const eTags = event.tags.filter((t) => t[0] === "e" && t[1] !== void 0);
+  return (eTags.find((t) => t[3] === "reply") ?? eTags.find((t) => t[3] === "root") ?? eTags.at(-1))?.[1];
+}
+async function fetchSeriesFollowOns(relays, head, authorized, webSocketFactory) {
+  const allowed = withTargetAuthor(authorized, head.pubkey);
+  const found = /* @__PURE__ */ new Map();
+  let frontier = [head.id];
+  for (let depth = 1; frontier.length > 0 && depth <= MAX_SERIES_DEPTH; depth++) {
+    const replies = await queryAll(
+      relays,
+      [{ kinds: [PATCH_KIND2], "#e": frontier }],
+      webSocketFactory
+    );
+    frontier = [];
+    for (const e of replies.values()) {
+      if (e.kind !== PATCH_KIND2 || e.id === head.id || found.has(e.id) || isPatchRevision(e) || !allowed.has(e.pubkey.toLowerCase())) {
+        continue;
+      }
+      found.set(e.id, e);
+      frontier.push(e.id);
+    }
+  }
+  const children = /* @__PURE__ */ new Map();
+  for (const e of found.values()) {
+    const parent = replyParentId(e);
+    if (parent === void 0) continue;
+    children.set(parent, [...children.get(parent) ?? [], e]);
+  }
+  const ordered = [];
+  const visit = (id) => {
+    const kids = (children.get(id) ?? []).sort(
+      (a, b) => a.created_at - b.created_at || (a.id < b.id ? -1 : 1)
+    );
+    for (const kid of kids) {
+      ordered.push(kid);
+      visit(kid.id);
+    }
+  };
+  visit(head.id);
+  return ordered;
+}
 async function applyInIsolation(repoRoot, tip, patchText, committer) {
   const scratch = await mkdtemp2(join4(tmpdir(), "rig-merge-"));
   const worktree = join4(scratch, "wt");
@@ -3869,6 +3952,15 @@ async function runPrMerge(args, deps) {
         `only the owner or a declared maintainer can merge \u2014 ${identity.pubkey.slice(0, 8)}\u2026 is neither for ${aTag}. Readers would ignore the pushed state. Nothing was pushed or paid.`
       );
     }
+    const followOns = await fetchSeriesFollowOns(
+      relays,
+      latest,
+      authorized,
+      webSocketFactory
+    );
+    const series = [latest, ...followOns];
+    const seriesText = series.map((e) => e.content.endsWith("\n") ? e.content : `${e.content}
+`).join("");
     if (!remote.announced) {
       throw new PrMergeError(
         "target_not_found",
@@ -3909,12 +4001,29 @@ async function runPrMerge(args, deps) {
     const applied = await applyInIsolation(
       repoRoot,
       tip,
-      latest.content,
+      seriesText,
       hasCommitter ? void 0 : {
         name: hexToNpub(identity.pubkey),
         email: `${hexToNpub(identity.pubkey)}@nostr`
       }
     );
+    if (flags.requireTrust !== void 0) {
+      const headCommit = (series.at(-1)?.tags.filter((t) => t[0] === "commit").at(-1)?.[1] ?? applied.newHead).toLowerCase();
+      const gate = await evaluateCiGate({
+        relays,
+        owner,
+        repoId,
+        commit: headCommit,
+        webSocketFactory,
+        requireTrust: flags.requireTrust
+      });
+      if (!gate.ok) {
+        throw new PrMergeError(
+          "ci_gate_failed",
+          `no qualifying green CI run (trust >= ${flags.requireTrust}) for ${headCommit.slice(0, 12)}: ${gate.reason ?? "not green"}. Nothing was pushed, published, or paid.`
+        );
+      }
+    }
     const overlay = new OverlayReader(repoRoot, {
       refname,
       sha: applied.newHead
@@ -3929,12 +4038,17 @@ async function runPrMerge(args, deps) {
       force: false
     });
     const plan = serializePushPlan(pushPlan);
-    const total = BigInt(plan.estimate.totalFee) + feeRates.eventFee;
+    const total = BigInt(plan.estimate.totalFee) + feeRates.eventFee * BigInt(1 + flags.closes.length);
     if (!flags.json) {
       for (const line of renderPlan(plan)) io.out(line);
       io.out(
         `  status    kind:1631 applied (${applied.commits.length} commit${applied.commits.length === 1 ? "" : "s"})   ${feeRates.eventFee}`
       );
+      if (flags.closes.length > 0) {
+        io.out(
+          `  closes    kind:1632 closed (${flags.closes.length} issue${flags.closes.length === 1 ? "" : "s"})   ${feeRates.eventFee * BigInt(flags.closes.length)}`
+        );
+      }
       io.out(`  total with status       ${total}`);
       io.out(renderIdentityLine(identity));
     }
@@ -3999,6 +4113,25 @@ async function runPrMerge(args, deps) {
     } catch (err) {
       statusError = err instanceof Error ? err.message : String(err);
     }
+    const closed = [];
+    const closeErrors = [];
+    for (const issueId of flags.closes) {
+      try {
+        await ctx.publisher.publishEvent(
+          buildStatus(owner, repoId, issueId, STATUS_CLOSED_KIND2),
+          relays
+        );
+        closed.push(issueId);
+      } catch (err) {
+        closeErrors.push({
+          issueId,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    const closeRetryHints = closeErrors.map(
+      (e) => `rig issue close ${e.issueId}`
+    );
     const retryHint = `rig pr status ${root.id} applied`;
     if (flags.json) {
       io.emitJson({
@@ -4010,6 +4143,8 @@ async function runPrMerge(args, deps) {
         revisionId: latest.id,
         target: refname,
         mergedShas: applied.commits,
+        closed,
+        ...closeErrors.length > 0 ? { closeErrors } : {},
         result,
         ...statusEventId !== void 0 ? { statusEventId } : {},
         ...statusError !== void 0 ? {
@@ -4017,6 +4152,11 @@ async function runPrMerge(args, deps) {
           error: "status_publish_failed",
           detail: statusError,
           hint: `the push succeeded but the applied status was not published \u2014 retry with \`${retryHint}\``
+        } : closeErrors.length > 0 ? {
+          partial: true,
+          error: "close_publish_failed",
+          detail: closeErrors.map((e) => `${e.issueId}: ${e.error}`).join("; "),
+          hint: `the push succeeded but some issues were not closed \u2014 retry with ${closeRetryHints.map((h) => `\`${h}\``).join(", ")}`
         } : {}
       });
     } else {
@@ -4027,14 +4167,24 @@ async function runPrMerge(args, deps) {
         );
       }
     }
+    if (!flags.json && closed.length > 0) {
+      io.out(`Closed ${closed.length} issue(s): ${closed.join(", ")}`);
+    }
     if (statusError !== void 0) {
       io.err(
         `partial success: the push succeeded but publishing the applied status failed: ${statusError}`
       );
       io.err(`retry the status with: ${retryHint}`);
-      return 1;
     }
-    return 0;
+    if (closeErrors.length > 0) {
+      for (const e of closeErrors) {
+        io.err(
+          `partial success: the push succeeded but closing issue ${e.issueId} failed: ${e.error}`
+        );
+      }
+      for (const h of closeRetryHints) io.err(`retry the close with: ${h}`);
+    }
+    return statusError !== void 0 || closeErrors.length > 0 ? 1 : 0;
   } catch (err) {
     return emitCliError(io, flags.json, "pr merge", err);
   } finally {
@@ -4819,7 +4969,7 @@ async function runPrCreate(rest, deps) {
 var STATUS_KIND_BY_VALUE = {
   open: STATUS_OPEN_KIND2,
   applied: STATUS_APPLIED_KIND3,
-  closed: STATUS_CLOSED_KIND2,
+  closed: STATUS_CLOSED_KIND3,
   draft: STATUS_DRAFT_KIND2
 };
 function isStatusValue(value) {
@@ -5202,11 +5352,15 @@ Options:
   --json               machine-readable envelope (per-chain results array)
   -h, --help           show this help`;
 var SHARED_DEVNET_SUFFIX = ".devnet.toonprotocol.dev";
+var SHARED_DEVNET_HOSTS = /* @__PURE__ */ new Set([
+  "toonprotocol.dev",
+  "relay.toonprotocol.dev"
+]);
 function devnetHost(url) {
   if (!url) return void 0;
   try {
     const { hostname } = new URL(url);
-    if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1)) {
+    if (hostname.endsWith(SHARED_DEVNET_SUFFIX) || hostname === SHARED_DEVNET_SUFFIX.slice(1) || SHARED_DEVNET_HOSTS.has(hostname)) {
       return url;
     }
   } catch {
@@ -5400,7 +5554,8 @@ async function runFund(args, deps) {
     }
     const timeoutEnv = env["TOON_CLIENT_FAUCET_TIMEOUT_MS"];
     const timeoutFor = () => {
-      if (timeoutEnv && Number.isFinite(Number(timeoutEnv))) return Number(timeoutEnv);
+      if (timeoutEnv && Number.isFinite(Number(timeoutEnv)))
+        return Number(timeoutEnv);
       if (file.faucetTimeoutMs !== void 0) return file.faucetTimeoutMs;
       return 9e4;
     };
@@ -5428,10 +5583,15 @@ async function runFund(args, deps) {
       }
       const started = Date.now();
       try {
-        const { response } = await client.fundWallet(faucetUrl, address, chain, {
-          timeout: timeoutFor(),
-          ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-        });
+        const { response } = await client.fundWallet(
+          faucetUrl,
+          address,
+          chain,
+          {
+            timeout: timeoutFor(),
+            ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+          }
+        );
         return {
           chain,
           funded: true,
@@ -5477,7 +5637,9 @@ async function runFund(args, deps) {
       }
     }
     io.out(renderIdentityLine(identity));
-    io.out("Re-check with `rig balance` (a drip can take a few blocks to land).");
+    io.out(
+      "Re-check with `rig balance` (a drip can take a few blocks to land)."
+    );
     return allFunded ? 0 : 1;
   } catch (err) {
     return emitCliError(io, json, "fund", err);
@@ -5929,7 +6091,7 @@ import {
   PATCH_KIND as PATCH_KIND4,
   REPOSITORY_ANNOUNCEMENT_KIND as REPOSITORY_ANNOUNCEMENT_KIND4,
   STATUS_APPLIED_KIND as STATUS_APPLIED_KIND4,
-  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND3,
+  STATUS_CLOSED_KIND as STATUS_CLOSED_KIND4,
   STATUS_DRAFT_KIND as STATUS_DRAFT_KIND3,
   STATUS_OPEN_KIND as STATUS_OPEN_KIND3
 } from "@toon-protocol/core/nip34";
@@ -5990,6 +6152,11 @@ function connectOnce(opts, onSubscribed) {
         } else if (msg[0] === "EOSE" && !subscribed && subIds.includes(msg[1])) {
           subscribed = true;
           onSubscribed();
+        } else if (msg[0] === "CLOSED" && subIds.includes(msg[1])) {
+          const why = typeof msg[2] === "string" && msg[2] ? msg[2] : "no reason";
+          finish(`${opts.url} closed the subscription: ${why}`);
+        } else if (msg[0] === "NOTICE") {
+          opts.onError(`notice from ${opts.url}: ${String(msg[1])}`);
         }
       } catch {
       }
@@ -6047,7 +6214,7 @@ Options:
 var STATUS_KINDS2 = [
   STATUS_OPEN_KIND3,
   STATUS_APPLIED_KIND4,
-  STATUS_CLOSED_KIND3,
+  STATUS_CLOSED_KIND4,
   STATUS_DRAFT_KIND3
 ];
 var CI_KINDS = [
@@ -9253,4 +9420,4 @@ export {
   rigVersion,
   dispatch
 };
-//# sourceMappingURL=chunk-KQ4NQV7T.js.map
+//# sourceMappingURL=chunk-OJ372S6M.js.map