@needmoretruth/nmts-cli 0.17.2 → 0.34.1

package/dist/commands/delete-account.js

@@ -0,0 +1,63 @@
+// `nmts delete-account` — a PERSON erases this account's server record, from the terminal.
+//
+// ⛔ WHY IT EXISTS (2026-09-06 · CLI parity ③-3). Leaving is the one act the documents promise
+//    unconditionally, and an account driven only from a terminal had no door for it but a browser:
+//    the key door is shut to a bare key, and the sessionless erase door asks for a human check a
+//    program cannot pass. What opens the key door is the NMTS key's proof beside the key —
+//    the same proof a browser sign-in presents before its own erase button — so this command needs
+//    the code on this machine, is refused in mode auto before the code is opened, and has the person
+//    type the same sentence the browser asks for.
+//
+// ⛔ IT SAYS WHAT GOES AND WHAT STAYS, WORD FOR WORD WITH THE SERVER. Erased: the account row, the
+//    file list, every file's server record and share, the sessions and the keys. Not erased: the
+//    bytes on the storage network (paid through their term, and unreadable without the records),
+//    and the NMTS key — which stays on this machine until `nmts logout`, because a recovery
+//    list plus the code can still read what was stored. Not refunded: storage already paid for.
+import { accountProofFor } from "../account-proof.js";
+import { request } from "../api.js";
+import { currentMode } from "../autonomy.js";
+import { requireAccountCode } from "../code-access.js";
+import { readCredentialsFile } from "../credentials.js";
+import { NmtsError } from "../errors.js";
+import { BINARY_NAME, HOME_URL } from "../product.js";
+import { promptLine, stdinIsATerminal } from "../prompt.js";
+import { resolveServer } from "../server.js";
+import { requireApiKey } from "../session.js";
+/** The sentence the browser's erase dialog asks for — the same words, so the act is one act. */
+export const CONFIRM_SENTENCE = "I UNDERSTAND THIS IS PERMANENT";
+export async function deleteAccount(options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    // The tier gate has already refused the auto modes and, under skip-permissions, taken a
+    // --reason and the --yes. ⛔ THE SENTENCE IS STILL TYPED IN EVERY OTHER MODE: `--yes` alone does
+    //    not stand for it — only the mode that turned every question off does.
+    const typedFor = options.yes === true && currentMode() === "skip-permissions";
+    const ask = options.readLine ?? promptLine;
+    if (!typedFor && options.readLine === undefined && !stdinIsATerminal()) {
+        throw new NmtsError("There is no terminal to type into (stdin is not a TTY).", {
+            exitCode: 3,
+            nextStep: `Run this where a person can type: the erasure is confirmed by typing a sentence.`,
+        });
+    }
+    const apiKey = requireApiKey();
+    const held = await requireAccountCode();
+    const stored = readCredentialsFile();
+    const server = resolveServer(options.server ?? stored?.server);
+    say(`This erases the account's server record. It cannot be undone.`);
+    say(`  Erased:       the account, the file list, every file's record and share, sessions and keys.`);
+    say(`  Not erased:   the bytes on the storage network (paid through their term; unreadable without`);
+    say(`                the records), and the NMTS key on this machine — \`${BINARY_NAME} logout\` removes it.`);
+    say(`  Not refunded: storage already paid for. The funds went to the network, never to NMTS.`);
+    say(``);
+    const typed = typedFor ? CONFIRM_SENTENCE : (await ask(`Type exactly: ${CONFIRM_SENTENCE}\n> `)).trim();
+    if (typed !== CONFIRM_SENTENCE) {
+        say(`Nothing was erased.`);
+        return 1;
+    }
+    // ⛔ THE PROOF IS BUILT FOR THIS ONE REQUEST AND NOTHING KEEPS IT.
+    const accountProof = await accountProofFor({ code: held.code, source: held.source });
+    await request(server, "/v1/account", { method: "DELETE", token: apiKey, accountProof });
+    say(`Erased. The server holds nothing about this account now.`);
+    say(`The stored NMTS key and API key on this machine are still here; \`${BINARY_NAME} logout\` removes them.`);
+    say(`A new account can be made at any time — \`${BINARY_NAME} create\` or ${HOME_URL}.`);
+    return 0;
+}

package/dist/commands/deposit.d.ts

@@ -0,0 +1,7 @@
+export interface DepositOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    write?: (line: string) => void;
+}
+export declare function deposit(wanted: string | undefined, options?: DepositOptions): Promise<number>;

package/dist/commands/deposit.js

@@ -0,0 +1,85 @@
+// `nmts deposit [<n>]` — how many credits this account sets aside on each credit-paid upload,
+// when the upload itself does not say.
+//
+// ⛔ IT IS A DEFAULT, NOT A CHARGE. Nothing here moves a credit: it records the number `nmts put`
+//    and `nmts push` will send with the next upload. What the deposit then does is pay the chain
+//    fee of a later operation on that file, measured rather than spent whole, with the remainder
+//    returned when the storage period ends.
+//
+// ⛔ IT LIVES IN THE SEALED FILE LIST, NOT ON THIS MACHINE — the same place, and for the same
+//    reasons, as `nmts padding`: the server must not learn it (a per-account default is a small
+//    fingerprint a server could keep), and it follows the ACCOUNT, so a phone and a laptop set the
+//    same amount aside. That is why reading it costs a list read and setting it costs a list write.
+//
+// ⚠ AND IT APPLIES TO WHAT IS UPLOADED NEXT. A deposit already set aside on a stored file is that
+//   file's, and changing this number does not move it.
+import { depositDefaultOf, DEPOSIT_CREDITS_DEFAULT, DEPOSIT_CREDITS_MAX, parseDeposit, } from "../deposit.js";
+import { NmtsError } from "../errors.js";
+import { readFileList } from "../manifest.js";
+import { applyManyToList } from "../manifest-write.js";
+import { BINARY_NAME } from "../product.js";
+import { openSession } from "../session.js";
+/** What a file with no deposit pays instead, said wherever 0 is on the screen. */
+const WHAT_ZERO_COSTS = `A file uploaded with no deposit still releases: it pays twice the same chain fee out of your ` +
+    `balance at that moment, and is refused when the balance cannot cover it.`;
+export async function deposit(wanted, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    // ⛔ BEFORE THE NETWORK. A number outside the range is a command line to fix, not a question to
+    //    ask the server, and clamping it would record an amount nobody typed.
+    const asked = parseDepositArgument(wanted);
+    const session = await openSession({ server: options.server, network: options.network });
+    if (asked === undefined) {
+        const list = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+        const held = list.manifest?.settings?.depositDefault;
+        const credits = depositDefaultOf(list.manifest?.settings);
+        const chosen = held !== undefined && credits === held;
+        if (options.json === true) {
+            say(JSON.stringify({ deposit: credits, set: chosen }));
+            return 0;
+        }
+        say(chosen ? `${credits}` : `${DEPOSIT_CREDITS_DEFAULT} (not set)`);
+        say(credits === 0
+            ? `Uploads paid for with credits set no deposit aside. ${WHAT_ZERO_COSTS}`
+            : `Uploads paid for with credits set ${credits} credit${credits === 1 ? "" : "s"} aside on ` +
+                `each file, back when that file's storage period ends. Anything from 0 to ` +
+                `${DEPOSIT_CREDITS_MAX} — \`${BINARY_NAME} deposit <n>\`, or --deposit for one upload.`);
+        return 0;
+    }
+    // ⛔ NO LIST, NO SETTING — the same refusal `padding` makes, for the same reason: the default
+    //    lives inside the sealed list, and writing an empty one just to hold a setting would make a
+    //    first `ls` say "a list exists" about an account nothing was ever put in.
+    const before = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+    if (before.manifest === null) {
+        throw new NmtsError(`This account has no file list yet; the setting lives in the list, and there is nothing to write it into.`, { exitCode: 4, nextStep: `Upload once (\`${BINARY_NAME} put\`) and set it after.` });
+    }
+    const result = await applyManyToList(session, () => [], { depositDefault: asked });
+    if (options.json === true) {
+        say(JSON.stringify({ deposit: asked, set: true }));
+        return 0;
+    }
+    if (!result.changed) {
+        say(`Already ${asked}. Nothing changed.`);
+        return 0;
+    }
+    if (asked === 0) {
+        say(`Uploads from now on set no deposit aside. ${WHAT_ZERO_COSTS}`);
+        return 0;
+    }
+    say(`Set to ${asked}. It applies to what is uploaded next, from every device; deposits already ` +
+        `set aside on stored files are not moved.`);
+    return 0;
+}
+/** The operand, refused in this command's own words rather than the upload flag's. */
+function parseDepositArgument(wanted) {
+    if (wanted === undefined || wanted === "")
+        return undefined;
+    try {
+        return parseDeposit(wanted);
+    }
+    catch {
+        throw new NmtsError(`\`${BINARY_NAME} deposit\` takes a whole number of credits from 0 to ${DEPOSIT_CREDITS_MAX}, not "${wanted}".`, {
+            exitCode: 2,
+            nextStep: `Run \`${BINARY_NAME} deposit\` with no argument to see what this account sets aside.`,
+        });
+    }
+}

package/dist/commands/devices.d.ts

@@ -0,0 +1,12 @@
+export interface DevicesOptions {
+    server?: string | undefined;
+    json?: boolean;
+    /** Sign ONE device out by id, or `all` of them. A high act: the tier gate asks first. */
+    signOut?: string | undefined;
+    /** The answer the tier gate already took, or the person's own `--yes`. */
+    yes?: boolean;
+    write?: (line: string) => void;
+    /** Injected in tests: answers the one confirmation. */
+    readLine?: ((question: string) => Promise<string>) | undefined;
+}
+export declare function devices(options?: DevicesOptions): Promise<number>;

package/dist/commands/devices.js

@@ -0,0 +1,144 @@
+// `nmts devices` — what is signed in to this account.
+//
+// ⛔ WHY IT EXISTS. An account run from a terminal could see everything about itself except who
+//    was holding a session to it. The browser has had that list since sessions had names; the one
+//    account nobody is watching a screen for had nothing. The server opened the READ to a key
+//    holding the files:read permission and left the two sign-outs shut, so this command lists and
+//    cannot end anything.
+//
+// ⛔ SIGNING A DEVICE OUT IS A PERSON'S ACT, AND `--sign-out` KEEPS IT ONE (2026-09-06 · CLI parity
+//    ③-2). A key alone must never end sessions: a stolen key that could end the browser's session
+//    could lock the person out of the one screen that revokes it, and the server still refuses a
+//    bare key. What opens the door is the NMTS key's proof beside the key — whoever holds the
+//    code can sign in and do the same from a browser — so this option needs the code on this
+//    machine, is refused in mode auto before the code is opened, and asks once before it acts.
+//
+// ⚠ THE DEVICE NAME IS SEALED AND STAYS SEALED HERE. It is encrypted under a key derived from the
+//   NMTS key, which the server has never had — so what a listing can honestly show is when a
+//   session started, when it was last used, and when it runs out. This command does not open the
+//   name: opening it needs the NMTS key, and this command runs on a key alone so that it
+//   works on a machine where the code is not present at all.
+//
+// ⚠ AND THE NETWORK IS NOT RESOLVED HERE. Nothing in this answer is stored on the storage
+//   network, so demanding to be told which one a development server uses would refuse a run over
+//   a fact it never consults — the same reading `listfile` and `env` already take.
+import { accountProofFor } from "../account-proof.js";
+import { request } from "../api.js";
+import { requireAccountCode } from "../code-access.js";
+import { readCredentialsFile } from "../credentials.js";
+import { NmtsError } from "../errors.js";
+import { isRecord } from "../guards.js";
+import { BINARY_NAME, HOME_URL } from "../product.js";
+import { promptLine, stdinIsATerminal } from "../prompt.js";
+import { resolveServer } from "../server.js";
+import { requireApiKey } from "../session.js";
+function asDevices(value) {
+    if (!isRecord(value))
+        throw new NmtsError("The server's answer was not an object.");
+    const rows = value["sessions"];
+    if (!Array.isArray(rows)) {
+        throw new NmtsError("The server listed the signed-in devices in a shape this version cannot read.", { nextStep: `Update this tool — \`npm install -g ${BINARY_NAME}\` — or read it in a browser.` });
+    }
+    const out = [];
+    for (const row of rows) {
+        if (!isRecord(row))
+            continue;
+        const id = row["id"];
+        const created = row["created_at"];
+        const used = row["last_used_at"];
+        const expires = row["expires_at"];
+        // ⛔ A ROW THIS CANNOT READ IS SKIPPED, NOT INVENTED. A device shown with made-up times is
+        //    worse than one row fewer: somebody looking for a session they did not start would be
+        //    reading a fiction.
+        if (typeof id !== "string" || typeof created !== "string")
+            continue;
+        out.push({
+            id,
+            // ⚠ WHETHER IT HAS A NAME, NOT THE NAME. The value is ciphertext this command cannot open,
+            //   and printing base64 would be printing noise while implying it means something.
+            named: typeof row["label_ct"] === "string" && row["label_ct"] !== "",
+            created_at: created,
+            last_used_at: typeof used === "string" ? used : created,
+            expires_at: typeof expires === "string" ? expires : created,
+            current: row["current"] === true,
+        });
+    }
+    return out;
+}
+export async function devices(options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    // ⛔ THE KEY AND NOT THE NMTS KEY. This read needs no code, so asking for one would refuse a
+    //    run over a credential it never uses — and on a machine holding only a key it would make
+    //    the one command about that machine's own access the one command it cannot run.
+    const apiKey = requireApiKey();
+    const stored = readCredentialsFile();
+    const server = resolveServer(options.server ?? stored?.server);
+    if (options.signOut !== undefined)
+        return await signOut(server, apiKey, options, say);
+    const rows = asDevices(await request(server, "/v1/account/sessions", { token: apiKey }));
+    if (options.json === true) {
+        say(JSON.stringify({ devices: rows }));
+        return 0;
+    }
+    if (rows.length === 0) {
+        say(`Nothing is signed in to this account.`);
+        say(``);
+        say(`  An API key is not a session, so the credential this command used is not listed here.`);
+        say(`  Signing in at ${HOME_URL} is what puts a row in this list.`);
+        return 0;
+    }
+    for (const row of rows) {
+        say(`${row.named ? "named device (the name is sealed)" : "unnamed device"}${row.current ? "  ← this one" : ""}`);
+        say(`  last used   ${row.last_used_at}`);
+        say(`  signed in   ${row.created_at}`);
+        say(`  runs out    ${row.expires_at}`);
+    }
+    say(``);
+    say(`  ${rows.length} signed in. The name each device was given is encrypted with your NMTS`);
+    say(`  key, which the server has never had, so it is not shown here.`);
+    say(``);
+    // ⛔ IT SAYS WHAT THIS CANNOT DO, rather than leaving a reader to find out by trying. A refusal
+    //    discovered by running something is a refusal an agent retries.
+    say(`  \`${BINARY_NAME} devices --sign-out <id>\` (or \`all\`) ends one — a person's act that needs the`);
+    say(`  NMTS key on this machine; a key alone cannot, so a stolen key cannot end the browser's.`);
+    return 0;
+}
+/** `--sign-out <id|all>`: the refusals first, then one question, then the proof and the request. */
+async function signOut(server, apiKey, options, say) {
+    const target = (options.signOut ?? "").trim();
+    if (target === "")
+        throw new NmtsError(`--sign-out needs a device id, or \`all\`.`, { exitCode: 2 });
+    // The tier gate has already refused or asked by mode; `--yes` is the answer it took. Without
+    // it, the question is put here, to a person at a terminal.
+    const ask = options.readLine ?? promptLine;
+    if (options.yes !== true && options.readLine === undefined && !stdinIsATerminal()) {
+        throw new NmtsError("There is no terminal to answer in (stdin is not a TTY).", {
+            exitCode: 3,
+            nextStep: `Run this where a person can answer the question it asks, or with --yes after they have.`,
+        });
+    }
+    const held = await requireAccountCode();
+    const what = target === "all" ? "every device signed in to this account" : `device ${target}`;
+    if (options.yes !== true) {
+        const answer = (await ask(`Sign ${what} out? Whoever is there is signed out at once. [y/N] `)).trim();
+        if (answer !== "y" && answer !== "Y") {
+            say(`Nothing was signed out.`);
+            return 1;
+        }
+    }
+    // ⛔ THE PROOF IS BUILT FOR THIS ONE REQUEST AND NOTHING KEEPS IT.
+    const accountProof = await accountProofFor({ code: held.code, source: held.source });
+    if (target === "all") {
+        const answered = await request(server, "/v1/account/sessions", { method: "DELETE", token: apiKey, accountProof });
+        const revoked = isRecord(answered) && typeof answered["revoked"] === "number" ? answered["revoked"] : null;
+        say(revoked === null ? `Signed out everywhere.` : `Signed out ${revoked} device${revoked === 1 ? "" : "s"}.`);
+        return 0;
+    }
+    await request(server, `/v1/account/sessions/${encodeURIComponent(target)}`, {
+        method: "DELETE",
+        token: apiKey,
+        accountProof,
+    });
+    say(`Signed device ${target} out.`);
+    return 0;
+}

package/dist/commands/documents.d.ts

@@ -0,0 +1,35 @@
+export interface DocumentOptions {
+    server?: string | undefined;
+    /** Machine-readable output, where the command has one. */
+    json?: boolean;
+    /** Keep the document as a file rather than printing it. */
+    save?: boolean;
+    /** Which directory `--save` writes into. Default: this one. */
+    out?: string | undefined;
+    /** `terms`/`privacy`: which language. Default: English, which is the canonical text. */
+    lang?: string | undefined;
+    /** `terms`: the board's terms rather than the service's. */
+    board?: boolean;
+    write?: (line: string) => void;
+}
+/**
+ * The three verbs, dispatched from one module.
+ *
+ * ⛔ ONE ENTRY POINT BECAUSE THEY ARE ONE SUBJECT — the documents this service publishes — and
+ *    because every command in `main.ts` is loaded only when it is the command being run. Three
+ *    entries there would be three imports to keep in step for one file.
+ */
+export declare function runDocuments(command: string, options: DocumentOptions & {
+    id?: string | undefined;
+}): Promise<number>;
+/**
+ * `nmts notices` — the board, one notice, or one notice kept as a file.
+ *
+ * The id, when there is one, is the operand: `nmts notices <id>` prints it and
+ * `nmts notices --save <id>` writes it. With no id the command lists.
+ */
+export declare function notices(options?: DocumentOptions & {
+    id?: string | undefined;
+}): Promise<number>;
+/** `nmts terms` and `nmts privacy` — the published document, printed or kept. */
+export declare function legal(which: "terms" | "privacy", options?: DocumentOptions): Promise<number>;

package/dist/commands/documents.js

@@ -0,0 +1,212 @@
+// `nmts notices`, `nmts terms`, `nmts privacy` — the three documents a person is owed, read from
+// the terminal instead of from a browser.
+//
+// ⛔ WHY A COMMAND-LINE TOOL NEEDS THEM. The notice board is where an interruption, an incident,
+//    and the seven-day warning before a new version of the Terms takes effect are posted, and the
+//    Terms and the Privacy Policy are the documents an account is held to. Until now all three
+//    lived only on screens. An account driven from a terminal — which is most of what this tool
+//    is for — could be governed by a document it had no way to read, and told about a change it
+//    had no way to see. That is the whole reason these exist.
+//
+// ⛔ THEY ASK FOR NOTHING AND CARRY NOTHING. No NMTS key, no API key, no session: these are
+//    public documents and the routes serving them are public. Nothing here opens a session, so
+//    reading the terms cannot fail because a credential is stale, and reading them says nothing
+//    to the server about who read them.
+//
+// ⛔ THE BYTES ARE THE BROWSER'S BYTES. `--save` writes what the server sends under the name the
+//    server's own `Content-Disposition` gives it — the same name and the same bytes the browser's
+//    download button produces. A copy kept from here and a copy kept from a screen are the same
+//    file, which is what makes either one worth keeping.
+import { existsSync, statSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { HttpError, request } from "../api.js";
+import { NmtsError } from "../errors.js";
+import { isRecord } from "../guards.js";
+import { BINARY_NAME } from "../product.js";
+import { destinationFor } from "../safe-path.js";
+import { resolveServer } from "../server.js";
+/** The three ids `GET /api/legal/{id}` serves, and the two the command line names. */
+const LEGAL_IDS = { terms: "terms", privacy: "privacy", board: "board-terms" };
+/**
+ * The three verbs, dispatched from one module.
+ *
+ * ⛔ ONE ENTRY POINT BECAUSE THEY ARE ONE SUBJECT — the documents this service publishes — and
+ *    because every command in `main.ts` is loaded only when it is the command being run. Three
+ *    entries there would be three imports to keep in step for one file.
+ */
+export async function runDocuments(command, options) {
+    if (command === "notices")
+        return await notices(options);
+    return await legal(command === "terms" ? "terms" : "privacy", options);
+}
+// ── The notice board ────────────────────────────────────────────────────────────────────────
+/**
+ * `nmts notices` — the board, one notice, or one notice kept as a file.
+ *
+ * The id, when there is one, is the operand: `nmts notices <id>` prints it and
+ * `nmts notices --save <id>` writes it. With no id the command lists.
+ */
+export async function notices(options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const base = resolveServer(options.server);
+    const id = options.id;
+    if (id === undefined) {
+        if (options.save === true) {
+            throw new NmtsError("Say which notice to save.", {
+                exitCode: 2,
+                nextStep: `\`${BINARY_NAME} notices --save <id>\`. Run \`${BINARY_NAME} notices\` to see the ids.`,
+            });
+        }
+        return await listNotices(base, options, say);
+    }
+    const answer = await noticeBody(base, id);
+    if (options.save !== true) {
+        say(answer.text.replace(/\n$/u, ""));
+        return 0;
+    }
+    say(`Wrote ${keep(answer, options.out)}`);
+    return 0;
+}
+async function listNotices(base, options, say) {
+    const answer = await request(base, "/api/notices");
+    if (options.json === true) {
+        say(JSON.stringify(answer));
+        return 0;
+    }
+    const rows = noticeRows(answer);
+    if (rows.length === 0) {
+        say("No notices have been posted.");
+        return 0;
+    }
+    for (const row of rows)
+        say(`${row.date}  ${row.id}  ${row.title}`);
+    say("");
+    say(`Read one with \`${BINARY_NAME} notices <id>\`, or keep it as a dated file with ` +
+        `\`${BINARY_NAME} notices --save <id>\`.`);
+    return 0;
+}
+/**
+ * The rows of the feed, read as the route declares them.
+ *
+ * ⛔ THE TITLE IS TAKEN FROM THE ENGLISH SIDE and the row is skipped when there is no id or date,
+ *    rather than printed with a blank where one should be. A line missing the id is a line nobody
+ *    can act on, and printing it invites a person to ask this tool for a notice by a name it will
+ *    refuse.
+ */
+function noticeRows(answer) {
+    const list = isRecord(answer) ? answer["notices"] : undefined;
+    if (!Array.isArray(list)) {
+        throw new NmtsError("The server's answer did not carry a list of notices.", {
+            exitCode: 1,
+            nextStep: "Report it rather than retrying — the shape, not the network, is wrong.",
+        });
+    }
+    const rows = [];
+    for (const row of list) {
+        if (!isRecord(row))
+            continue;
+        const id = row["id"];
+        const date = row["date"];
+        const title = isRecord(row["title"]) ? row["title"]["en"] : undefined;
+        if (typeof id !== "string" || typeof date !== "string")
+            continue;
+        rows.push({ id, date, title: typeof title === "string" ? title : "" });
+    }
+    return rows;
+}
+/** One notice's text, with a refusal that names the way to find the ids that exist. */
+async function noticeBody(base, id) {
+    try {
+        return await request(base, `/api/notices/${encodeURIComponent(id)}`, { as: "text" });
+    }
+    catch (error) {
+        // ⛔ ONLY A 404 BECOMES THIS REFUSAL. A network failure or a proxy's error page is a different
+        //    problem with a different remedy, and telling somebody to check the id when the server was
+        //    unreachable sends them looking in the wrong place.
+        if (error instanceof HttpError && error.status === 404) {
+            throw new NmtsError(`No notice has been posted with the id ${id}.`, {
+                exitCode: 4,
+                nextStep: `Run \`${BINARY_NAME} notices\` to see the notices there are, with their ids.`,
+            });
+        }
+        throw error;
+    }
+}
+// ── The Terms and the Privacy Policy ────────────────────────────────────────────────────────
+/** `nmts terms` and `nmts privacy` — the published document, printed or kept. */
+export async function legal(which, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const base = resolveServer(options.server);
+    const lang = languageOf(options.lang);
+    if (options.board === true && which !== "terms") {
+        throw new NmtsError("--board belongs to the terms, not the privacy policy.", {
+            exitCode: 2,
+            nextStep: `\`${BINARY_NAME} terms --board\` is the message board's terms. \`${BINARY_NAME} privacy\` has one document.`,
+        });
+    }
+    const id = options.board === true ? LEGAL_IDS.board : LEGAL_IDS[which];
+    const answer = await request(base, `/api/legal/${id}?lang=${lang}`, { as: "text" });
+    if (options.save !== true) {
+        say(answer.text.replace(/\n$/u, ""));
+        return 0;
+    }
+    say(`Wrote ${keep(answer, options.out)}`);
+    return 0;
+}
+/**
+ * Which language to ask for.
+ *
+ * ⛔ IT REFUSES RATHER THAN FALLING BACK. The route treats anything that is not `ko` as English,
+ *    so a typo would silently hand somebody the wrong document while looking like it worked — and
+ *    the two versions of a legal document are not interchangeable to whoever is reading one.
+ */
+function languageOf(lang) {
+    if (lang === undefined || lang === "en")
+        return "en";
+    if (lang === "ko")
+        return "ko";
+    throw new NmtsError(`This tool does not have a version in "${lang}".`, {
+        exitCode: 2,
+        nextStep: "--lang takes en or ko. English is the canonical text.",
+    });
+}
+// ── Keeping a copy ──────────────────────────────────────────────────────────────────────────
+/**
+ * Write a document out under the name the server gave it, never over something already there.
+ *
+ * ⛔ IT DOES NOT REPLACE, AND THERE IS NO --force. These files carry a version and a date in their
+ *    names, so two documents never want the same one: a name already taken means the same document
+ *    is already kept, and quietly rewriting it would destroy a copy somebody kept on purpose — the
+ *    copy that says what they were told and when.
+ */
+function keep(answer, out) {
+    if (answer.filename === null) {
+        throw new NmtsError("The server did not say what to call this document.", {
+            exitCode: 1,
+            nextStep: "Nothing was written. Print it instead and redirect it to a name of your choosing.",
+        });
+    }
+    const directory = out === undefined ? process.cwd() : isAbsolute(out) ? out : resolve(process.cwd(), out);
+    if (existsSync(directory) && !statSync(directory).isDirectory()) {
+        throw new NmtsError(`${directory} is a file, and --out names the directory to write into.`, {
+            exitCode: 2,
+            nextStep: `Nothing was written. Pass --out with a directory, or leave it out to write into ${process.cwd()}.`,
+        });
+    }
+    // The name came over the network; this is what contains it to the chosen directory.
+    const destination = destinationFor(directory, answer.filename);
+    try {
+        writeFileSync(destination, answer.text, { flag: "wx" });
+    }
+    catch (error) {
+        if (error instanceof Error && Reflect.get(error, "code") === "EEXIST") {
+            throw new NmtsError(`${destination} is already there.`, {
+                exitCode: 4,
+                nextStep: `Nothing was written, and the copy already there was not touched. Pass --out to write ` +
+                    `into another directory, or move that file aside.`,
+            });
+        }
+        throw error;
+    }
+    return destination;
+}

package/dist/commands/env.d.ts

@@ -0,0 +1,5 @@
+export interface EnvOptions {
+    json?: boolean;
+    write?: (line: string) => void;
+}
+export declare function env(options?: EnvOptions): number;

package/dist/commands/env.js

@@ -1,9 +1,10 @@
-// `nmts env` — what this machine is, and what that means for the account code.
+// `nmts env` — what this machine is, and what that means for the NMTS key.
 //
 // ⛔ IT ASKS THE SERVER NOTHING AND NEEDS NO CREDENTIAL. It is the first command an agent can run
 //    on a machine it has never seen, and a command that needed to be signed in to say "there is
 //    nowhere safe to keep the code here" would say it too late.
 import { adviseFor, readEnvironment } from "../environment.js";
+import { describeSighting } from "../agent-host.js";
 import { PASSPHRASE_ENV_VAR, resolveAccountCode, resolveApiKey, } from "../credentials.js";
 import { BINARY_NAME, SUPPORT_EMAIL, VERSION } from "../product.js";
 import { checkingIsOff, NO_CHECK_ENV_VAR, readCheck } from "../update-check.js";
@@ -107,8 +108,15 @@ export function env(options = {}) {
     say(`  config        ${environment.configDir}`);
     say(`  terminal      ${environment.interactive ? "yes" : "no — nothing here can be typed"}`);
     say(`  browser       ${environment.browserReachable ? "reachable" : "not reachable"}`);
+    // ⛔ "none found" IS NOT "no agent". Three of the five hosts this tool knows clear the
+    //    environment before starting an MCP server, so an empty line here is exactly what running
+    //    inside one of them looks like. The wording has to leave room for that or it reports a
+    //    measurement as a conclusion.
+    say(`  agent host    ${environment.agentHosts.length === 0
+        ? "no marker in this environment — some agents clear it, so this is not proof there is none"
+        : environment.agentHosts.map(describeSighting).join("; ")}`);
     const found = (got, problem) => (got !== null ? `found — ${sourceWords(got.source)}` : problem !== null ? `⛔ REFUSED — ${problem}` : "not found");
-    say(`  account code  ${found(code, codeProblem)}`);
+    say(`  NMTS key      ${found(code, codeProblem)}`);
     if (code?.source === "file-locked") {
         // ⛔ THE ANSWER AN AGENT NEEDS BEFORE IT RUNS ANYTHING ELSE. A sealed code with no way to
         //    supply the passphrase is not a usable credential, and finding that out on the first

package/dist/commands/erase.d.ts

@@ -0,0 +1,13 @@
+export interface EraseOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    /** Also destroy the treasury's storage under credit-paid files, before erasing them. */
+    releaseStorage?: boolean;
+    /** Under skip-permissions only: the tier gate's answer, given with a `--reason`. */
+    yes?: boolean;
+    write?: ((line: string) => void) | undefined;
+    /** Injected in tests: answers the one typed line. */
+    readLine?: ((question: string) => Promise<string>) | undefined;
+}
+export declare function erase(paths: readonly string[], options?: EraseOptions): Promise<number>;