feat(events): publish ref events into NATS JetStream

AGENTS.md

@@ -487,6 +487,14 @@ full cold-read/resource acceptance gates listed in `docs/spec/README.md`.
   and candidate external-boundary proof remain separate obligations; local loose objects and retired
   download membership cannot justify retirement. See the cost and remaining-evidence rows in the linked docs.
 
+- **D50 (2026-10-26): The JetStream sink's cursor lives in its own stream.** `walgit nats` publishes the
+  `ref` events of D32 into NATS JetStream and resumes from the last message on each repository's subject
+  (`Walgit-Seq` header, inclusive, then drop what the stream already holds). That cursor is the sink's state,
+  not walgit's: Principle I holds because wiping every walgit instance loses nothing, and wiping the stream
+  republishes the WAL window with older history backfilled from the WAL. The event model is the `walgit-events`
+  crate shared with the webhook bridge, whose bucket cursor (`events/cursor.json`) is unchanged. Wake-ups
+  arrive over NATS and the periodic sweep stays the backstop; the service API is the NATS micro protocol, no HTTP.
+
 ## 5. Working rules
 
 - **No backwards compatibility (pre-1.0, banner at top):** change the shape and delete the old one in the same

Cargo.toml

@@ -6,7 +6,9 @@ members = [
     "crates/walgit-config",
     "crates/walgit-git",
     "crates/walgit-wal",
+    "crates/walgit-events",
     "crates/walgit-server",
+    "crates/walgit-nats",
     "crates/walgit-cli",
 ]
 
@@ -65,7 +67,9 @@ walgit-store = { path = "crates/walgit-store" }
 walgit-config = { path = "crates/walgit-config" }
 walgit-git = { path = "crates/walgit-git" }
 walgit-wal = { path = "crates/walgit-wal" }
+walgit-events = { path = "crates/walgit-events" }
 walgit-server = { path = "crates/walgit-server" }
+walgit-nats = { path = "crates/walgit-nats" }
 
 anyhow = "1"
 thiserror = "2"
@@ -136,9 +140,11 @@ parking_lot = "0.12"
 moka = { version = "0.12", features = ["sync"] }
 mimalloc = "0.1"
 tempfile = "3"
+nkeys = "0.4"
 flate2 = "1"
 async-compression = { version = "0.4", features = ["tokio", "gzip"] }
 pin-project-lite = "0.2"
+async-nats = "0.51"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
 base64 = "0.22"
 jsonwebtoken = { version = "11.0.0", features = ["rust_crypto"] }

crates/walgit-cli/Cargo.toml

@@ -24,6 +24,7 @@ walgit-config.workspace = true
 walgit-git.workspace = true
 walgit-wal.workspace = true
 walgit-server.workspace = true
+walgit-nats.workspace = true
 gix-hash.workspace = true
 anyhow.workspace = true
 tokio.workspace = true

crates/walgit-cli/src/bin/walgit.rs

@@ -1,4 +1,4 @@
-//! `walgit` — the full CLI (serve | compact | repo | wal | synth | import | mirror | config).
+//! `walgit` — the full CLI (serve | compact | repo | wal | nats | synth | import | mirror | config).
 fn main() -> anyhow::Result<()> {
     walgit_cli::main()
 }

crates/walgit-cli/src/lib.rs

@@ -109,6 +109,8 @@ enum Command {
         #[command(subcommand)]
         action: RepoAction,
     },
+    /// Publish the WAL's ref events into NATS `JetStream` (`[events.nats]`, `docs/EVENTS.md`).
+    Nats,
     /// WAL inspection and rewind.
     Wal {
         #[command(subcommand)]
@@ -471,6 +473,7 @@ async fn dispatch(command: Command, cfg: Config) -> Result<()> {
         } => compact::run(repo, all, once, base, &cfg).await,
         Command::Repo { action } => repo::run(action, &cfg).await,
         Command::Wal { action } => wal_cmd::run(action, &cfg).await,
+        Command::Nats => walgit_nats::run(cfg.clone()).await,
         Command::Mirror {
             from,
             to,