@arcadiasystems/morse-cli 0.5.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,72 @@ All notable changes to `@arcadiasystems/morse-cli` are documented here. The
 format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.1] - 2026-09-09
+
+Picks up `@arcadiasystems/morse-sdk@0.6.0` and fixes a download regression it exposed. Upgrade if you use mainnet at all.
+
+### Fixed
+
+- **`file download` worked on no mainnet file, public or not.** `buildFileDownloadContext` constructed the Seal adapter eagerly, so once SDK 0.6.0 stopped pinning mainnet key servers, every download failed at context build with a Seal error before the file was even looked up. Downloading a public file never touches Seal, so the adapter is now built on first use and memoized, matching the lazy-signer pattern the same context already used. Regression covered in `test/program.test.ts` against the real context builder.
+- **Encrypted commands now explain themselves on mainnet.** They previously surfaced the SDK's `ConfigurationError`, whose advice ("pass seal.serverConfigs", "start from MAINNET_SEAL_COMMITTEE") names an API the CLI does not expose: there is no flag or env var for key servers, so on mainnet these commands cannot work at all. `entry add-encrypted`, `entry decrypt`, `file upload --encrypt` / `--recipient`, and file decryption now exit 2 with a message that says that and points at testnet or the SDK.
+- **`file upload --public` is not caught by that guard.** It shares the encrypt context but never encrypts, so `EncryptContext.seal` became a lazy factory too. Building the adapter eagerly there would have blocked public mainnet uploads the same way the eager build blocked public downloads. Both the refusal and the exemption are covered in `test/program.test.ts`.
+- **`file download` refused every public file, on every network.** The check asked whether the file had recipients, on the assumption that "a public file has no recipients". The Move contract auto-includes the owner on creation, so `members` is non-empty for every file that exists, public or not: a public file and an encrypted one both report exactly one member. The result was that `file upload --public` produced a file the CLI would not download, telling the user their plaintext was "unusable ciphertext" and pointing at `--raw`, which then wrote the correct bytes anyway.
+
+  Encryption is now determined by the Seal id prefix via the new `getRecipientFileSealPrefix` in SDK 0.7.0, which is the only reliable signal. This bug predates the mainnet work and shipped in 0.6.0 and earlier.
+
+  It escaped the tests because the download fixture defaulted to `members: []`, modelling an object the contract cannot produce. The fixture now carries a realistic owner-member, and a regression test covers a public file that has members.
+- Dependency moves to `@arcadiasystems/morse-sdk@^0.7.0`. The published 0.6.0 declared `^0.5.0`, which resolves to the SDK release whose mainnet Seal default could produce permanently unreadable ciphertext.
+
+### Known gaps
+
+- `file list` still needs `--indexer-url` on every network; public Sui fullnodes have retired the JSON-RPC event query it walks.
+- Encrypted mainnet stays blocked until Seal operator credentials are available and the CLI grows a way to pass them.
+
+## [0.6.0] - 2026-09-09
+
+Mainnet support, consuming `@arcadiasystems/morse-sdk@0.5.0`. The Move contracts
+went live on Sui mainnet on 2026-09-09; the CLI rejected `mainnet` outright until
+now.
+
+### Added
+
+- **`--network mainnet` works**, as do `MORSE_NETWORK=mainnet` and
+  `morse config add <name> --network mainnet`. `coerceNetwork` no longer
+  special-cases mainnet, and `localnet` is accepted too (it still fails at
+  startup unless you point the SDK at your own package and registry, which is
+  `morseConfig`'s error to raise, not the flag parser's).
+- **Commands that spend gas now name the network they spent on.** The resolved
+  network appears as the first detail line under the result headline, and as a
+  `network` field in `--json` output. Applied on the write contexts only, so read
+  and list output is byte-for-byte unchanged. Nothing selects mainnet implicitly
+  (with no flag, env var, or profile the CLI targets testnet), so this is there
+  to make a mainnet spend visible after the fact rather than to gate it.
+
+### Fixed
+
+- Status banner claimed v0.3.0, two releases stale, and said mainnet support was
+  pending.
+- `--network` help text listed only testnet and localnet, in both the global
+  flag (`morse --help`) and `config add --network`, as did the `MORSE_NETWORK`
+  row of the README env table.
+- Seven README links pointed into `examples/`, which is not in the package
+  `files` array, so they 404'd on the npm page. Now absolute GitHub URLs;
+  `docs/QUICKSTART.md` stays relative because `docs` does ship.
+- Dead Walrus faucet link in `docs/QUICKSTART.md`. `docs.walrus.site` no longer
+  resolves; WAL acquisition now points at the working stake-wal.wal.app swap,
+  matching the README and morse-sdk.
+- Known limitations now record that `file list` requires `--indexer-url`, since
+  public Sui fullnodes have retired the JSON-RPC event query it walks. This
+  affects testnet as well as mainnet and predates this release.
+
+### Known gaps
+
+- `file list` is unusable without `--indexer-url` on every network, per above.
+  Porting the event source off `suix_queryEvents` is tracked separately.
+- No mainnet run of the opt-in `bun run test:e2e` lifecycle; it stays pointed at
+  testnet, where it costs nothing real.
+- The Move contracts remain unaudited.
+
 ## [0.5.0] - 2026-06-09
 
 Hardening pass from CLI testing: fail fast before paying for Walrus storage,

package/README.md

@@ -6,16 +6,36 @@ content entries from your terminal, signing with a locally encrypted key.
 Content is stored on [Walrus](https://walrus.xyz); private entries are encrypted
 with [Seal](https://github.com/MystenLabs/seal).
 
-> Status: v0.3.0, targeting Sui testnet. The command surface is stable; mainnet
-> support lands when the contracts are frozen.
+> Status: v0.6.1. Mainnet and testnet are both supported for public content;
+> the command surface is stable.
+>
+> **Encrypted commands are testnet-only.** `entry add-encrypted`, `entry
+> decrypt`, `file upload --encrypt` (and `--recipient`, which implies it), and
+> decrypting a downloaded file all need Seal key servers. Testnet has an open
+> set; mainnet does not, because every mainnet Seal operator is commercial, and
+> the CLI has no flag or env var for supplying one. These commands exit 2 on
+> mainnet with an explanation.
+>
+> Everything that does not encrypt works on both networks, including
+> `file upload --public`, `file download` of a public file, and the whole
+> publication, collection and entry surface. All of that is verified against
+> live mainnet, including a public upload and download round trip.
+>
+> **The Move contracts are unaudited.** On mainnet, gas and Walrus storage cost
+> real SUI and WAL, there is no faucet, and deletions are irreversible. Nothing
+> selects mainnet for you: with no `--network`, `MORSE_NETWORK`, or profile
+> setting, the CLI targets testnet. Every command that spends gas prints the
+> network it used, and `--json` output carries a `network` field.
 
 ## Requirements
 
 - [Node.js](https://nodejs.org) >= 18, or [Bun](https://bun.sh) >= 1.2. The
   published CLI runs under either.
-- A funded Sui testnet address for gas, and testnet WAL for Walrus storage when
-  adding content. Get SUI from the [Sui faucet](https://faucet.sui.io/) and WAL
-  from the [Walrus testnet faucet](https://docs.walrus.site/usage/web-tool.html).
+- A funded Sui address for gas, and WAL for Walrus storage when adding content.
+  On testnet, get SUI from the [Sui faucet](https://faucet.sui.io/) and swap some
+  for WAL at [stake-wal.wal.app](https://stake-wal.wal.app/?network=testnet). On
+  mainnet there is no faucet: both have to be acquired, and every write spends
+  real value.
 
 ## Install
 
@@ -91,7 +111,7 @@ Environment variables (override the config file, overridden by flags):
 | Variable | Overrides | Notes |
 | --- | --- | --- |
 | `MORSE_PROFILE` | `--profile` | Profile to use. |
-| `MORSE_NETWORK` | `--network` | `testnet` or `localnet`. |
+| `MORSE_NETWORK` | `--network` | `mainnet`, `testnet`, or `localnet`. |
 | `MORSE_RPC_URL` | `--rpc` | Sui RPC URL override. |
 | `MORSE_ADDRESS` | (no flag) | Active account address, selecting which keystore to use. |
 | `MORSE_PUBLICATION` | `-P, --publication` | Active publication id. |
@@ -123,7 +143,7 @@ Global options apply to every command and must appear before the subcommand
 
 | Global option | Purpose |
 | --- | --- |
-| `--network <testnet\|localnet>` | Network to target (default: testnet). |
+| `--network <mainnet\|testnet\|localnet>` | Network to target (default: testnet). `localnet` needs a custom deployment. |
 | `-p, --profile <name>` | Config profile to use. |
 | `--rpc <url>` | Override the Sui RPC URL. |
 | `--json` | Machine-readable JSON on stdout. |
@@ -290,13 +310,13 @@ to fetch the full record per file (one read each) when you need them.
 ## Examples
 
 - [docs/QUICKSTART.md](./docs/QUICKSTART.md): a full, copy-pasteable walkthrough.
-- Runnable shell recipes in [examples/](./examples/):
-  - [`lifecycle.sh`](./examples/lifecycle.sh): create, add an entry, read, revise, tear down.
-  - [`content.sh`](./examples/content.sh): upload an image and a post, publish a revision, fetch content back, get a link, remove a collection.
-  - [`encrypt-decrypt.sh`](./examples/encrypt-decrypt.sh): encrypt with Seal and decrypt back.
-  - [`delegation.sh`](./examples/delegation.sh): issue a PublisherCap to a delegate, then revoke it.
-  - [`ci-noninteractive.sh`](./examples/ci-noninteractive.sh): env-var auth, `--yes`, and `--json` parsing.
-  - [`files.sh`](./examples/files.sh): RecipientFile round-trip (upload an encrypted file, download/decrypt via its share string, manage recipients, plus a public file).
+- Runnable shell recipes in [examples/](https://github.com/arcadiasystems/morse-dcms/tree/main/morse-cli/examples):
+  - [`lifecycle.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/lifecycle.sh): create, add an entry, read, revise, tear down.
+  - [`content.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/content.sh): upload an image and a post, publish a revision, fetch content back, get a link, remove a collection.
+  - [`encrypt-decrypt.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/encrypt-decrypt.sh): encrypt with Seal and decrypt back.
+  - [`delegation.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/delegation.sh): issue a PublisherCap to a delegate, then revoke it.
+  - [`ci-noninteractive.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/ci-noninteractive.sh): env-var auth, `--yes`, and `--json` parsing.
+  - [`files.sh`](https://github.com/arcadiasystems/morse-dcms/blob/main/morse-cli/examples/files.sh): RecipientFile round-trip (upload an encrypted file, download/decrypt via its share string, manage recipients, plus a public file).
 
 ## Limitations
 
@@ -319,7 +339,14 @@ to fetch the full record per file (one read each) when you need them.
   created but not yet populated through the CLI; `entry add` refuses them.
 - There is no command to query Walrus blob storage expiry; `--epochs` sets the
   lease at upload time, but remaining lease time is not exposed by the SDK.
-- Mainnet is not yet deployed; use `testnet`.
+- Encrypted commands do not work on mainnet, per the status note above. There
+  is no way to supply Seal key servers to the CLI; if you have credentials from
+  an operator, use the SDK directly for now.
+- `localnet` is accepted as a network but has no canonical deployment, so it
+  fails at startup unless you point the SDK at your own package and registry.
+- `file list` walks a JSON-RPC event query that public Sui fullnodes have
+  retired, so it needs `--indexer-url` pointing at a source that serves the same
+  query. This affects testnet as well as mainnet.
 
 ## Publishing
 

package/dist/index.js

@@ -148,7 +148,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@arcadiasystems/morse-cli",
-  version: "0.5.0",
+  version: "0.6.1",
   description: "Command-line interface for the Morse decentralized CMS on Sui.",
   license: "MIT",
   type: "module",
@@ -203,7 +203,7 @@ var package_default = {
     prepublishOnly: "bun run check && bun run build"
   },
   dependencies: {
-    "@arcadiasystems/morse-sdk": "^0.4.2",
+    "@arcadiasystems/morse-sdk": "^0.7.0",
     "@mysten/seal": "1.1.3",
     "@mysten/sui": "2.16.2",
     "@mysten/walrus": "1.1.6",
@@ -219,7 +219,7 @@ var package_default = {
 // src/cli/program.ts
 function buildProgram() {
   const program = new Command;
-  program.name("morse").description("Command-line interface for the Morse decentralized CMS on Sui.").version(package_default.version, "-V, --version", "Print the version and exit").option("--network <network>", "Sui network: testnet or localnet [env: MORSE_NETWORK]").option("-p, --profile <name>", "Config profile to use [env: MORSE_PROFILE]").option("--rpc <url>", "Override the Sui RPC URL [env: MORSE_RPC_URL]").option("--json", "Output machine-readable JSON on stdout").option("-q, --quiet", "Suppress progress and informational output").option("-y, --yes", "Assume yes for confirmation prompts").option("--debug", "Print stack traces on error").enablePositionalOptions().showHelpAfterError().exitOverride();
+  program.name("morse").description("Command-line interface for the Morse decentralized CMS on Sui.").version(package_default.version, "-V, --version", "Print the version and exit").option("--network <network>", "Sui network: mainnet, testnet, or localnet [env: MORSE_NETWORK]").option("-p, --profile <name>", "Config profile to use [env: MORSE_PROFILE]").option("--rpc <url>", "Override the Sui RPC URL [env: MORSE_RPC_URL]").option("--json", "Output machine-readable JSON on stdout").option("-q, --quiet", "Suppress progress and informational output").option("-y, --yes", "Assume yes for confirmation prompts").option("--debug", "Print stack traces on error").enablePositionalOptions().showHelpAfterError().exitOverride();
   return program;
 }
 
@@ -316,14 +316,39 @@ class Output {
   get isJson() {
     return this.options.json;
   }
+  withNetwork(network) {
+    return new Output({ ...this.options, network });
+  }
   result(human, data) {
     if (this.options.json) {
-      this.out(`${toJson(data)}
+      this.out(`${toJson(this.stampJson(data))}
 `);
       return;
     }
-    this.out(`${human}
+    this.out(`${this.stampHuman(human)}
+`);
+  }
+  stampJson(data) {
+    const network = this.options.network;
+    if (network === undefined || !isPlainObject(data) || "network" in data) {
+      return data;
+    }
+    return { network, ...data };
+  }
+  stampHuman(human) {
+    const network = this.options.network;
+    if (network === undefined) {
+      return human;
+    }
+    const line = `  network:      ${network}`;
+    const breakAt = human.indexOf(`
 `);
+    if (breakAt === -1) {
+      return `${human}
+${line}`;
+    }
+    return `${human.slice(0, breakAt)}
+${line}${human.slice(breakAt)}`;
   }
   info(message) {
     if (this.options.quiet || this.options.json) {
@@ -369,6 +394,9 @@ function resolveColor(json) {
   }
   return Boolean(process.stderr.isTTY);
 }
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function createOutput(opts) {
   const json = Boolean(opts.json);
   return new Output({
@@ -397,13 +425,10 @@ function isNetwork(value) {
   return typeof value === "string" && NETWORKS.has(value);
 }
 function coerceNetwork(value) {
-  if (value === Network.Mainnet) {
-    throw new UsageError("Morse is not yet deployed on mainnet. Use testnet or localnet.");
-  }
   if (isNetwork(value)) {
     return value;
   }
-  throw new UsageError(`Unknown network "${value}". Use one of: testnet, localnet.`);
+  throw new UsageError(`Unknown network "${value}". Use one of: mainnet, testnet, localnet.`);
 }
 function parseConfig(raw, source) {
   if (!isRecord(raw)) {
@@ -945,6 +970,7 @@ async function buildWriteContext(command) {
   const { base, keypair, address } = await buildSignedBase(command);
   return {
     ...base,
+    output: base.output.withNetwork(base.settings.network),
     adapter: new KeypairAdapter(keypair, base.client),
     address
   };
@@ -966,12 +992,23 @@ async function buildContentContext(command) {
   }
   const adapter = new KeypairAdapter(keypair, base.client);
   const walrus = DefaultWalrusWriteAdapter.fromConfig({ network, suiClient: base.client }, keypair);
-  return { ...base, adapter, address, walrus };
+  return {
+    ...base,
+    output: base.output.withNetwork(network),
+    adapter,
+    address,
+    walrus
+  };
+}
+function assertSealAvailable(config) {
+  if (config.sealKeyServers.length > 0) {
+    return;
+  }
+  throw new CliError(`Encrypted commands are not available on ${config.network}. Seal key servers there are operated commercially and the CLI cannot yet be pointed at one. Use --network testnet, or drive @arcadiasystems/morse-sdk directly with your own seal.serverConfigs.`, ExitCode.Usage);
 }
 async function buildEncryptContext(command) {
   const ctx = await buildContentContext(command);
-  const seal = DefaultSealAdapter.fromMorseConfig(ctx.config, {}, ctx.client);
-  return { ...ctx, seal };
+  return { ...ctx, seal: lazySeal(ctx) };
 }
 function walrusReadAdapter(base, network, viaAggregator) {
   if (viaAggregator) {
@@ -999,6 +1036,7 @@ async function buildDecryptContext(command, opts = {}) {
   if (network === "localnet") {
     throw new CliError("Seal decryption is not available on localnet. Use testnet or mainnet.", ExitCode.Usage);
   }
+  assertSealAvailable(base.config);
   const seal = DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client);
   return {
     ...base,
@@ -1020,10 +1058,18 @@ async function buildFileDownloadContext(command, opts = {}) {
       packageId: base.config.packageId
     }),
     walrusRead: walrusReadAdapter(base, network, Boolean(opts.viaAggregator)),
-    seal: DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client),
+    seal: lazySeal(base),
     unlockSigner: () => resolveSigner(base.settings.account, process.env, base.signal)
   };
 }
+function lazySeal(base) {
+  let adapter;
+  return () => {
+    assertSealAvailable(base.config);
+    adapter ??= DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client);
+    return adapter;
+  };
+}
 async function buildFileListContext(command, opts = {}) {
   const base = await buildReadContext(command);
   const originPackageId = base.config.recipientFileEventOriginPackageId;
@@ -1536,7 +1582,7 @@ function registerConfigCommands(program) {
   config.command("list").description("List profiles and show the default").action(async (_options, command) => {
     await runConfigList(outputFor(command));
   });
-  config.command("add <name>").description("Create or update a profile").requiredOption("--network <network>", "Sui network: testnet or localnet").option("--rpc <url>", "RPC URL override for this profile").action(async (name, options, command) => {
+  config.command("add <name>").description("Create or update a profile").requiredOption("--network <network>", "Sui network: mainnet, testnet, or localnet").option("--rpc <url>", "RPC URL override for this profile").action(async (name, options, command) => {
     await runConfigAdd(outputFor(command), name, options);
   });
   config.command("use <name>").description("Set the default profile").action(async (name, _options, command) => {
@@ -1649,7 +1695,7 @@ async function runEntryAddEncrypted(ctx, name, options) {
   ctx.output.info(`Encrypting and uploading ${plaintext.length} bytes...`);
   const result = await addEncryptedEntryFromBytes(ctx.adapter, ctx.config, {
     walrus: ctx.walrus,
-    seal: ctx.seal,
+    seal: ctx.seal(),
     publicationId: id,
     publisherCapId,
     collectionName: collection,
@@ -2117,7 +2163,7 @@ async function runFileUpload(ctx, path, options) {
   const upload = { epochs, deletable: true };
   const onProgress = uploadProgress(ctx.output);
   if (options.public) {
-    const result2 = await uploadRecipientFileFromBytes(ctx.adapter, ctx.config, {
+    const result = await uploadRecipientFileFromBytes(ctx.adapter, ctx.config, {
       walrus: ctx.walrus,
       bytes,
       recipients: [],
@@ -2128,15 +2174,15 @@ async function runFileUpload(ctx, path, options) {
       onProgress
     });
     const aggregator = ctx.config.walrusEndpoints.aggregator;
-    const viewUrl = aggregator.length > 0 ? `${aggregator}/v1/blobs/${result2.blobId}` : undefined;
-    const human2 = viewUrl === undefined ? `Uploaded public file ${result2.fileId}. (tx: ${result2.digest})` : `Uploaded public file ${result2.fileId}. (tx: ${result2.digest})
+    const viewUrl = aggregator.length > 0 ? `${aggregator}/v1/blobs/${result.blobId}` : undefined;
+    const human = viewUrl === undefined ? `Uploaded public file ${result.fileId}. (tx: ${result.digest})` : `Uploaded public file ${result.fileId}. (tx: ${result.digest})
   view: ${viewUrl}`;
-    ctx.output.result(human2, { ...result2, viewUrl: viewUrl ?? null });
+    ctx.output.result(human, { ...result, viewUrl: viewUrl ?? null });
     return;
   }
   const result = await uploadEncryptedRecipientFileFromBytes(ctx.adapter, ctx.config, {
     walrus: ctx.walrus,
-    seal: ctx.seal,
+    seal: ctx.seal(),
     plaintext: bytes,
     recipients,
     name: options.name,
@@ -2206,7 +2252,7 @@ async function decryptRecipientFile(ctx, fileId, ciphertext, prefix, nonce) {
     signer: keypair,
     suiClient: ctx.client
   });
-  return ctx.seal.decryptUnderRecipientFile(ciphertext, {
+  return ctx.seal().decryptUnderRecipientFile(ciphertext, {
     sessionKey,
     sealId,
     fileId
@@ -2222,9 +2268,10 @@ async function runFileDownload(ctx, positional, options) {
   }
   const fileId = toRecipientFileId(target.fileId);
   const file = await ctx.filesReader.getRecipientFile(fileId, ctx.signal);
-  if (target.decrypt === undefined && file.members.length > 0) {
+  const encrypted = target.decrypt !== undefined || await ctx.filesReader.getRecipientFileSealPrefix(fileId, ctx.signal) !== null;
+  if (target.decrypt === undefined && encrypted) {
     if (!options.raw) {
-      throw new UsageError("This file has a recipient list, so its bytes are encrypted. Pass --share (or --prefix and --nonce) to decrypt, or --raw to write the raw ciphertext anyway.");
+      throw new UsageError("This file is encrypted. Pass --share (or --prefix and --nonce) to decrypt, or --raw to write the raw ciphertext anyway.");
     }
     ctx.output.warn("Writing raw ciphertext (--raw); the output is unusable without decryption.");
   }
@@ -2588,11 +2635,11 @@ function registerRevisionCommands(program) {
 // src/commands/use.ts
 async function runUse(output, gopts, publication, collection, options, makeContext) {
   if (options.clear) {
-    const profile2 = await updateActiveProfile(gopts, {
+    const profile = await updateActiveProfile(gopts, {
       publication: undefined,
       collection: undefined
     });
-    output.result(`Cleared the active publication and collection (profile "${profile2}").`, { profile: profile2, publication: null, collection: null });
+    output.result(`Cleared the active publication and collection (profile "${profile}").`, { profile, publication: null, collection: null });
     return;
   }
   if (publication === undefined) {

package/docs/QUICKSTART.md

@@ -5,14 +5,21 @@ Sui testnet, then tears it down. Every command is copy-pasteable; expected
 output is shown beneath each step. Replace IDs in later steps with the ones your
 own runs print.
 
+The walkthrough uses testnet on purpose: it creates a publication, uploads
+content to Walrus, and deletes it all again. On mainnet that sequence costs real
+SUI and WAL. Once it works for you, the only change needed is the network on the
+profile in step 1 (`--network mainnet`); every later command reads the network
+from the profile and prints which one it spent on.
+
 ## 0. Prerequisites
 
 - Install [Bun](https://bun.sh) >= 1.2.
 - Have a Sui testnet keypair. If you use the Sui CLI, export one with
   `sui keytool export --key-identity <alias>` to get a `suiprivkey1...` string.
 - Fund the address with testnet SUI ([faucet](https://faucet.sui.io/)) for gas,
-  and with WAL ([Walrus faucet](https://docs.walrus.site/usage/web-tool.html))
-  for content uploads.
+  and with WAL by swapping some SUI at
+  [stake-wal.wal.app](https://stake-wal.wal.app/?network=testnet) for content
+  uploads.
 
 Install the CLI:
 
@@ -24,6 +31,8 @@ morse --version
 ## 1. Create a profile
 
 A profile pins the network. The first profile you add becomes the default.
+`--network` takes `mainnet`, `testnet`, or `localnet`; with no profile, flag, or
+`MORSE_NETWORK`, the CLI targets testnet.
 
 ```sh
 morse config add testnet --network testnet

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@arcadiasystems/morse-cli",
-	"version": "0.5.0",
+	"version": "0.6.1",
 	"description": "Command-line interface for the Morse decentralized CMS on Sui.",
 	"license": "MIT",
 	"type": "module",
@@ -55,7 +55,7 @@
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"dependencies": {
-		"@arcadiasystems/morse-sdk": "^0.4.2",
+		"@arcadiasystems/morse-sdk": "^0.7.0",
 		"@mysten/seal": "1.1.3",
 		"@mysten/sui": "2.16.2",
 		"@mysten/walrus": "1.1.6",