@needmoretruth/nmts-cli 0.17.2 → 0.34.2

package/dist/commands/s3.js

@@ -2,7 +2,7 @@
 //
 // ⛔ WHY THIS EXISTS. Backup programs, sync tools and agent frameworks already know how to talk to
 //    S3. They do not know how to talk to this. Rather than ask every one of them to learn, the tool
-//    speaks the protocol they already speak, on this machine, where the account code already is.
+//    speaks the protocol they already speak, on this machine, where the NMTS key already is.
 //
 // ⛔ WHAT IT IS NOT. It is not a bridge to the internet and cannot be made into one: the address it
 //    binds is loopback and there is no option to change that (`s3/server.ts` says why). Nothing is
@@ -19,7 +19,6 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { randomUUID } from "node:crypto";
-import { isGranted } from "../consent.js";
 import { createStaging } from "../s3/staging.js";
 import { refusalFor, verdictForKey } from "../s3/same-file.js";
 import { fetchFile } from "../download.js";
@@ -118,10 +117,11 @@ export async function s3(options = {}) {
         });
         cachedAt = 0;
     };
-    // ⛔ WRITING IS OFF UNLESS THIS MACHINE ALREADY AGREED TO SPENDING. A gateway cannot ask: its
-    //    caller is a program and its stdin is not a terminal. So the question is answered before it
-    //    starts, and where the answer is no every write says so and nothing is charged.
-    const writable = isGranted("spend");
+    // ⛔ THE QUESTION WAS ANSWERED BEFORE THIS STARTED. A gateway cannot ask: its caller is a program
+    //    and its stdin is not a terminal. `s3` is a medium act (`risk.ts`) — uploads through it spend
+    //    credits — so the tier gate asked at the start, or the mode waved it through, and every write
+    //    from here on is what was agreed to.
+    const writable = true;
     const server = createGateway({
         credential,
         source: {

package/dist/commands/settings.d.ts

@@ -0,0 +1,5 @@
+import type { ParsedArgs } from "../args.ts";
+/** Is this one of the settings commands? */
+export declare function isSettingsCommand(command: string): boolean;
+/** Run it. Only call this when `isSettingsCommand` said yes. */
+export declare function runSettings(command: string, args: ParsedArgs): Promise<number>;

package/dist/commands/settings.js

@@ -6,22 +6,37 @@
 //    the next setting has an obvious home, rather than another case in the middle of the commands
 //    that move money.
 //
-// ⚠ What each setting MEANS is not here — it is beside the setting itself (`consent.ts`,
+// ⚠ What each setting MEANS is not here — it is beside the setting itself (`consent.ts` · `unlock.ts`,
 //   `autonomy.ts`, `collision.ts`), so a caller that needs the rule does not have to load a
 //   command to get it.
 /** Is this one of the settings commands? */
 export function isSettingsCommand(command) {
-    return command === "consent" || command === "mode" || command === "on-collision";
+    return (command === "consent" || command === "unlock" || command === "lock" || command === "mode" || command === "on-collision");
 }
 /** Run it. Only call this when `isSettingsCommand` said yes. */
 export async function runSettings(command, args) {
-    if (command === "consent") {
-        const { consent } = await import("./consent.js");
-        return consent(args.operands[0], args.operands[1], { json: args.json });
+    if (command === "consent" || command === "unlock" || command === "lock") {
+        const { unlock } = await import("./unlock.js");
+        // `consent grant` and `consent revoke` are the older spellings of `unlock` and `lock`.
+        const first = args.operands[0];
+        const action = command === "lock" ? "lock"
+            : command === "unlock" ? (first === undefined ? undefined : "unlock")
+                : first === "grant" ? "unlock"
+                    : first === "revoke" ? "lock"
+                        : first;
+        const target = command === "consent" ? args.operands[1] : first;
+        return await unlock(action, target, {
+            json: args.json,
+            days: args.days,
+            until: args.until,
+            scope: args.scope,
+            capWal: args.capWal,
+            capSui: args.capSui,
+        });
     }
     if (command === "mode") {
         const { mode } = await import("./mode.js");
-        return mode(args.operands[0], { json: args.json, accepted: args.iAcceptTheRisk });
+        return await mode(args.operands[0], args.operands[1], { json: args.json });
     }
     const { onCollision } = await import("./on-collision.js");
     return onCollision(args.operands[0], { json: args.json });

package/dist/commands/share-dispatch.d.ts

@@ -0,0 +1,2 @@
+import type { ParsedArgs } from "../args.ts";
+export declare function runShare(command: string, args: ParsedArgs): Promise<number>;

package/dist/commands/share-dispatch.js

@@ -0,0 +1,46 @@
+// The share verbs (share · shares · unshare · receive), dispatched here rather than in `main.ts`.
+//
+// ⛔ WHY A SECOND SWITCH. `main.ts` is measured (`check:size`) and had no room for `nmts support`;
+//    this block shares a file and an option shape, so it moved as one piece with its comments.
+export async function runShare(command, args) {
+    switch (command) {
+        case "share": {
+            const { share } = await import("./share.js");
+            return await share(args.operands[0], args.operands[1], {
+                server: args.server,
+                network: args.network,
+                json: args.json,
+                yes: args.yes,
+            });
+        }
+        case "shares": {
+            const options = { server: args.server, network: args.network, json: args.json };
+            if (args.sent !== undefined) {
+                const { sharesSent } = await import("./shares-sent.js");
+                return await sharesSent(args.sent, options);
+            }
+            const { shares } = await import("./share.js");
+            return await shares(options);
+        }
+        case "unshare": {
+            const { unshare } = await import("./share.js");
+            return await unshare(args.operands[0], {
+                server: args.server,
+                network: args.network,
+                json: args.json,
+            });
+        }
+        case "receive": {
+            const { receive } = await import("./receive.js");
+            return await receive(args.operands[0], {
+                server: args.server,
+                network: args.network,
+                out: args.out,
+                force: args.force,
+                json: args.json,
+            });
+        }
+        default:
+            throw new Error(`not a share verb: ${command}`);
+    }
+}

package/dist/commands/share.d.ts

@@ -0,0 +1,14 @@
+export interface ShareOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    /** `--yes`: the per-attempt answer `share` needs in normal mode (see `share`). */
+    yes?: boolean;
+    write?: (line: string) => void;
+}
+export declare function out(options: ShareOptions): (line: string) => void;
+/** `nmts share <path> <address>` — hand one file to one account. */
+export declare function share(target: string | undefined, typedAddress: string | undefined, options?: ShareOptions): Promise<number>;
+/** `nmts shares` — what was shared with this account, and what it shared. */
+export declare function shares(options?: ShareOptions): Promise<number>;
+export declare function unshare(id: string | undefined, options?: ShareOptions): Promise<number>;

package/dist/commands/share.js

@@ -21,7 +21,7 @@ import { request, ServerError } from "../api.js";
 import { openSession } from "../session.js";
 import { addressFromTyped, identityMatches, openReceived, sealShare, shareKeysOf, } from "../share.js";
 import { AAD, DERIVED } from "../crypto.js";
-function out(options) {
+export function out(options) {
     return options.write ?? ((line) => process.stdout.write(`${line}\n`));
 }
 function b64(bytes) {
@@ -30,7 +30,7 @@ function b64(bytes) {
 /**
  * Make sure this account has published the identity other people encrypt to.
  *
- * ⛔ IT IS THE SAME BYTES EVERY TIME. The identity is derived from the account code, so a browser
+ * ⛔ IT IS THE SAME BYTES EVERY TIME. The identity is derived from the NMTS key, so a browser
  *    and this tool publish something identical for one account — which is why publishing from here
  *    cannot claim a different account's place or overwrite anything meaningful.
  */
@@ -87,6 +87,17 @@ export async function share(target, typedAddress, options = {}) {
     }
     // ⛔ ASKED AFTER THE FILE IS KNOWN AND BEFORE ANYTHING LEAVES, so the question names a real file.
     requireConsent("share");
+    // ⭐ AND ASKED EVERY TIME (2026-09-05): the once-per-machine unlock above says sharing is
+    //    allowed at all; `--yes` says THIS file to THIS address. A high act, so the tier gate
+    //    takes the yes in every mode but skip-permissions, where it hands `--yes` in.
+    if (options.yes !== true) {
+        say(`Would share "${fullPathOf(index, entry)}" with ${typedAddress}.`);
+        say(``);
+        say(`⛔ Withdrawing later does not recall it — once the recipient has opened it, they have it.`);
+        say(`Nothing was shared. To go ahead:  ${BINARY_NAME} share ${JSON.stringify(target)} ${typedAddress} --yes`);
+        say(`⛔ If a program is reading this on somebody's behalf: show it to them and let them decide.`);
+        return 5;
+    }
     const keys = shareKeysOf(crypt, session.code);
     const derived = crypt.kdf_derive(crypt.account_code_parse(session.code));
     const dataKey = derived.slice(DERIVED.dataKey[0], DERIVED.dataKey[1]);
@@ -228,7 +239,6 @@ function printRow(say, one) {
     say(`  ${one.id}  ${one.name ?? ""}${size}`);
     say(`      from ${one.sender ?? ""}`);
 }
-/** `nmts unshare <id>` — withdraw a share you sent, or remove one you were sent. */
 export async function unshare(id, options = {}) {
     const say = out(options);
     if (id === undefined || id === "") {

package/dist/commands/shares-sent.d.ts

@@ -0,0 +1,18 @@
+import { type ShareOptions } from "./share.ts";
+/**
+ * `nmts shares --sent <path>` — who ONE file was shared with.
+ *
+ * ⛔ IT IS THE OTHER DIRECTION OF `shares`, NOT A FILTER ON IT. The inbox answers "what can I
+ *    download"; this answers "who can download this", which is the only question a person asking
+ *    whether to withdraw a share is actually asking. The server keeps the two in different tables
+ *    and gives them different routes, and joining them here would invent a view neither has.
+ *
+ * ⛔ THE ADDRESS IS PRINTED AS THE SERVER STORED IT. There is no name, no directory and nothing to
+ *    look one up against — the recipient of a share is an address and nothing else — so a line
+ *    that dressed it up as anything friendlier would be inventing an identity.
+ *
+ * ⚠ IT ONLY READS. Nothing here changes a share, and `unshare <id>` is what takes the id printed
+ *   at the end of a line and withdraws it.
+ */
+export declare function sharesSent(target: string | undefined, options?: ShareOptions): Promise<number>;
+/** `nmts unshare <id>` — withdraw a share you sent, or remove one you were sent. */

package/dist/commands/shares-sent.js

@@ -0,0 +1,95 @@
+// `nmts shares --sent` — moved out of `share.ts` whole (that file is measured by `check:size`).
+import { request } from "../api.js";
+import { buildIndex, entryAt, fullPathOf, KIND_FILE, normalisePath } from "../drive-paths.js";
+import { NmtsError } from "../errors.js";
+import { readFileList } from "../manifest.js";
+import { BINARY_NAME } from "../product.js";
+import { openSession } from "../session.js";
+import { out } from "./share.js";
+/**
+ * `nmts shares --sent <path>` — who ONE file was shared with.
+ *
+ * ⛔ IT IS THE OTHER DIRECTION OF `shares`, NOT A FILTER ON IT. The inbox answers "what can I
+ *    download"; this answers "who can download this", which is the only question a person asking
+ *    whether to withdraw a share is actually asking. The server keeps the two in different tables
+ *    and gives them different routes, and joining them here would invent a view neither has.
+ *
+ * ⛔ THE ADDRESS IS PRINTED AS THE SERVER STORED IT. There is no name, no directory and nothing to
+ *    look one up against — the recipient of a share is an address and nothing else — so a line
+ *    that dressed it up as anything friendlier would be inventing an identity.
+ *
+ * ⚠ IT ONLY READS. Nothing here changes a share, and `unshare <id>` is what takes the id printed
+ *   at the end of a line and withdraws it.
+ */
+export async function sharesSent(target, options = {}) {
+    const say = out(options);
+    if (target === undefined || target === "") {
+        throw new NmtsError("Say which file to look up.", {
+            exitCode: 2,
+            nextStep: `\`${BINARY_NAME} shares --sent <path>\` — the path as \`${BINARY_NAME} ls\` prints it.`,
+        });
+    }
+    const session = await openSession({ server: options.server, network: options.network });
+    const list = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+    if (list.manifest === null) {
+        throw new NmtsError("This account has no file list, so there is nothing to look up.", {
+            exitCode: 4,
+        });
+    }
+    const index = buildIndex(list.manifest.entries);
+    const entry = entryAt(list.manifest.entries, normalisePath(target), {
+        nothingHappened: "Nothing was changed.",
+    });
+    if (entry.kind !== KIND_FILE) {
+        throw new NmtsError(`No file at "${fullPathOf(index, entry)}".`, {
+            exitCode: 4,
+            nextStep: "That is a folder, and a share is of one file.",
+        });
+    }
+    const path = fullPathOf(index, entry);
+    const answer = await request(session.server, `/v1/shares/sent?item_id=${encodeURIComponent(entry.id)}`, { token: session.apiKey });
+    const rows = typeof answer === "object" && answer !== null ? Reflect.get(answer, "shares") : null;
+    if (!Array.isArray(rows)) {
+        throw new NmtsError("The server's answer did not carry a list of shares.", {
+            nextStep: "Nothing was changed. Report it rather than retrying — the shape, not the network, is wrong.",
+        });
+    }
+    if (options.json) {
+        // ⛔ THE SERVER'S ROWS, UNCHANGED. A reader of this arm is reading the route, and a shape
+        //    rewritten here would be a second wire to keep in step with the first.
+        say(JSON.stringify({ path, item_id: entry.id, shares: rows }));
+        return 0;
+    }
+    if (rows.length === 0) {
+        say(`${path} has not been shared with anyone.`);
+        return 0;
+    }
+    say(`${path} is shared with:`);
+    for (const row of rows)
+        say(sentLine(row));
+    return 0;
+}
+/** One row of `GET /v1/shares/sent`, as a person reads it. */
+function sentLine(row) {
+    const at = (name) => {
+        const value = typeof row === "object" && row !== null ? Reflect.get(row, name) : undefined;
+        if (typeof value !== "string") {
+            throw new NmtsError("The server listed a share this version cannot read.", {
+                nextStep: "Nothing was changed. A newer version of this tool may understand it.",
+            });
+        }
+        return value;
+    };
+    return `${at("recipient_address")}  since ${utcDay(at("created_at"))}  share ${at("id")}`;
+}
+/** The UTC day of an RFC 3339 instant, `YYYY-MM-DD`. */
+function utcDay(instant) {
+    const at = new Date(instant);
+    if (Number.isNaN(at.getTime())) {
+        throw new NmtsError("The server dated a share with something that is not a time.", {
+            nextStep: "Nothing was changed. Report it rather than retrying.",
+        });
+    }
+    return at.toISOString().slice(0, 10);
+}
+/** `nmts unshare <id>` — withdraw a share you sent, or remove one you were sent. */

package/dist/commands/support.d.ts

@@ -0,0 +1,24 @@
+export interface SupportOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    write?: (line: string) => void;
+    /** What a report is about, and optionally which part of it. */
+    category?: string | undefined;
+    sub?: string | undefined;
+    /** The message itself, or the file holding it. Neither means: read the standard input. */
+    message?: string | undefined;
+    messageFile?: string | undefined;
+    /** `--attach-log`: absent means none, empty means the default count, otherwise a number. */
+    attachLog?: string | undefined;
+    /** Values the caller says must not travel, whatever the rules make of them. */
+    omit?: readonly string[] | undefined;
+    /** Send without being asked. */
+    yes?: boolean;
+    /** Where a message with no `--message` comes from. Injected so a test needs no pipe. */
+    readInput?: () => Promise<string>;
+    /** How the person is asked. Injected for the same reason. */
+    askPerson?: (question: string) => Promise<string>;
+}
+/** `nmts support <action> [operands]`. */
+export declare function support(action: string | undefined, operands: readonly string[], options?: SupportOptions): Promise<number>;

package/dist/commands/support.js

@@ -0,0 +1,321 @@
+// `nmts support` — writing to the person who builds NMTS, from the command line.
+//
+// ⛔ WHY IT IS IN THE TOOL AND NOT ONLY AN ADDRESS IN THE README. The moment somebody wants to
+//    report something is the moment something went wrong, and that is exactly when nobody goes
+//    looking for a web page. It is also the one thing an agent can do about a defect: it cannot
+//    fix the tool, and it can describe what it ran and what came back better than the person it is
+//    working for can.
+//
+// ⛔ NOTHING LEAVES WITHOUT BEING SHOWN FIRST. The preview is not a flag and cannot be turned off:
+//    the exact text, the exact attachment and the byte count are printed before anything is sent,
+//    in every mode. What a mode changes is only whether somebody is ASKED after seeing it —
+//    filing a report is an act the owner wants agents to perform, and the preview is in the
+//    transcript either way.
+//
+// ⛔ EVERYTHING IS REDACTED HERE, ON THIS MACHINE, BEFORE IT IS SHOWN. The message, the attached
+//    log and anything named with `--omit` all go through `redact.ts` first, so the preview shows
+//    what will actually travel rather than what was typed. A preview that showed the original and
+//    sent something else would be the wrong way round.
+//
+// ⛔ THE NMTS KEY IS NOT NEEDED AND IS NOT OPENED. This command talks to the server with the
+//    API key alone, like `verify` and `trial`. A report is not worth asking somebody for a
+//    passphrase, and a command that never holds the code cannot leak it.
+import { NmtsError } from "../errors.js";
+import { BINARY_NAME } from "../product.js";
+import { promptLine } from "../prompt.js";
+import { omitLiterals, redact } from "../redact.js";
+import { MAX_ATTACHED_RUNS, readRuns } from "../run-log.js";
+import { buildLogAttachment, MAX_ATTACHMENT_BYTES } from "../support-attach.js";
+import { SUPPORT_SHORT } from "../support-copy.js";
+import { asList, asTicket, call, checkOmit, checkSub, day, MAX_MESSAGE_CHARS, MAX_REPLY_CHARS, open, requireCategory, requireLength, } from "../support-wire.js";
+/** How many runs `--attach-log` takes when it is given with no number. */
+const DEFAULT_ATTACHED_RUNS = 3;
+/** `nmts support <action> [operands]`. */
+export async function support(action, operands, options = {}) {
+    switch (action) {
+        case "send":
+            return await sendReport(options);
+        case "list":
+            return await listReports(options);
+        case "show":
+            return await showReport(operands[0], options);
+        case "reply":
+            return await replyToReport(operands[0], options);
+        default:
+            throw new NmtsError(action === undefined ? "`support` needs an action." : `Unknown support action: ${action}`, {
+                exitCode: 2,
+                nextStep: `The actions are send, list, show and reply. Run \`${BINARY_NAME} support --help\`.`,
+            });
+    }
+}
+// ── Sending ────────────────────────────────────────────────────────────────────────────────────
+async function sendReport(options) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const category = requireCategory(options.category);
+    const subcategory = checkSub(category, options.sub);
+    const omit = checkOmit(options.omit ?? []);
+    const clean = (text) => omitLiterals(redact(text), omit);
+    const message = clean(await readMessage(options)).trim();
+    requireLength(message, MAX_MESSAGE_CHARS, "message");
+    const attachment = packLog(options.attachLog, clean);
+    const total = Buffer.byteLength(message, "utf8") + (attachment?.bytes ?? 0);
+    // ⛔ THE MACHINE-READABLE PREVIEW IS THE ONLY THING PRINTED ON THAT PATH, and it is printed
+    //    INSTEAD of sending rather than before it. Two JSON objects on one stream would let a caller
+    //    read `sent: false` off a run that then went on to send.
+    if (options.json === true) {
+        if (!answeredAlready(options)) {
+            say(JSON.stringify({
+                sent: false,
+                category,
+                ...(subcategory === null ? {} : { subcategory }),
+                message,
+                ...(attachment === null ? {} : { log: attachment.text, log_runs: attachment.runs }),
+                bytes: total,
+            }));
+            return 5;
+        }
+    }
+    else {
+        for (const line of SUPPORT_SHORT)
+            say(line);
+        say(``);
+        say(`Category: ${subcategory === null ? category : `${category} / ${subcategory}`}`);
+        say(`Message (${Buffer.byteLength(message, "utf8")} bytes):`);
+        for (const line of message.split("\n"))
+            say(`  ${line}`);
+        if (attachment === null) {
+            say(`Log: none`);
+        }
+        else {
+            say(`Log (${attachment.bytes} bytes, ${attachment.runs} runs, ${attachment.dropped} dropped):`);
+            for (const line of attachment.text.split("\n"))
+                say(`  ${line}`);
+        }
+        say(`Total: ${total} bytes.`);
+        if (!(await agreed(options, say))) {
+            say(``);
+            say(`Nothing was sent. To go ahead:  ${BINARY_NAME} support send … --yes`);
+            return 5;
+        }
+    }
+    const wire = open(options);
+    const answer = await call(wire, "/v1/support/cli", {
+        method: "POST",
+        body: {
+            message,
+            category,
+            ...(subcategory === null ? {} : { subcategory }),
+            ...(attachment === null ? {} : { log: attachment.text }),
+        },
+    });
+    const ticket = asTicket(answer);
+    if (options.json === true) {
+        say(JSON.stringify(answer));
+        return 0;
+    }
+    say(``);
+    say(`Sent. ${ticket.code} — replies arrive in \`${BINARY_NAME} support show ${ticket.code}\`.`);
+    return 0;
+}
+/**
+ * Has the answer already been given, before anybody is asked anything?
+ *
+ * ⛔ THE TIER GATE HANDS THE ANSWER: a low act runs unasked in the agent modes, and the gate
+ *    passes that as `--yes`. Filing a report is an act the owner wants an agent to perform, and
+ *    the preview above it is in the transcript either way.
+ */
+function answeredAlready(options) {
+    return options.yes === true;
+}
+/**
+ * Put the question, having printed the preview.
+ *
+ * ⚠ No terminal and no `--yes` is a no, not a hang: `promptLine` answers "" where there is nobody.
+ */
+async function agreed(options, say) {
+    if (answeredAlready(options))
+        return true;
+    const ask = options.askPerson ?? promptLine;
+    say(``);
+    const answer = (await ask(`Send this? [y/N] `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+}
+/** The message: the option, then the named file, then the standard input. */
+async function readMessage(options) {
+    if (options.message !== undefined)
+        return options.message;
+    if (options.messageFile !== undefined) {
+        const { readFileSync } = await import("node:fs");
+        try {
+            return readFileSync(options.messageFile, "utf8");
+        }
+        catch {
+            // ⛔ The reason is not repeated: a filesystem error's own text quotes the path back, and
+            //    that is the one thing a caller already knows.
+            throw new NmtsError(`Could not read ${options.messageFile}.`, { exitCode: 2 });
+        }
+    }
+    const read = options.readInput ?? standardInput;
+    return await read();
+}
+function standardInput() {
+    if (process.stdin.isTTY === true)
+        return Promise.resolve("");
+    const chunks = [];
+    return new Promise((resolve, reject) => {
+        process.stdin.on("data", (chunk) => chunks.push(chunk));
+        process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        process.stdin.on("error", reject);
+    });
+}
+/** Read the newest runs and pack them, or `null` when the option was not given. */
+function packLog(asked, clean) {
+    if (asked === undefined)
+        return null;
+    const count = asked === "" ? DEFAULT_ATTACHED_RUNS : Number(asked);
+    if (!Number.isInteger(count) || count < 0 || count > MAX_ATTACHED_RUNS) {
+        throw new NmtsError(`--attach-log takes a whole number of runs, 0 to ${MAX_ATTACHED_RUNS}.`, {
+            exitCode: 2,
+        });
+    }
+    if (count === 0)
+        return null;
+    const runs = readRuns(count);
+    if (runs.length === 0)
+        return null;
+    return buildLogAttachment(runs, clean, MAX_ATTACHMENT_BYTES);
+}
+// ── Reading, and answering ─────────────────────────────────────────────────────────────────────
+async function listReports(options) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const answer = await call(open(options), "/v1/support/cli", {});
+    if (options.json === true) {
+        say(JSON.stringify(answer));
+        return 0;
+    }
+    const { tickets, unread } = asList(answer);
+    if (tickets.length === 0) {
+        say(`No reports have been filed from this account with \`${BINARY_NAME} support send\`.`);
+        return 0;
+    }
+    for (const t of tickets) {
+        const about = t.subcategory === null ? t.category : `${t.category}/${t.subcategory}`;
+        say([
+            t.code.padEnd(12),
+            about.padEnd(18),
+            t.status.padEnd(10),
+            day(t.createdAt),
+            // ⚠ THE MARK IS DERIVED, because the list carries no per-thread unread flag: the server
+            //   sends one number for the whole mailbox. What a row does carry is whether it has been
+            //   answered and whether this account has ever stamped it read, and that pair is the
+            //   honest half of the question.
+            t.status === "answered" && t.lastReadAt === null ? "  new" : "",
+        ]
+            .join(" ")
+            .trimEnd());
+    }
+    say(``);
+    say(`${unread} unread.`);
+    return 0;
+}
+async function showReport(which, options) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const wire = open(options);
+    const id = await resolveTicket(wire, which);
+    const answer = await call(wire, `/v1/support/cli/${encodeURIComponent(id)}`, {});
+    if (options.json === true) {
+        say(JSON.stringify(answer));
+        return 0;
+    }
+    const ticket = asTicket(answer);
+    const about = ticket.subcategory === null ? ticket.category : `${ticket.category}/${ticket.subcategory}`;
+    say(`${ticket.code}  ${about}  ${ticket.status}  ${ticket.createdAt}`);
+    say(``);
+    said(say, "you", ticket.createdAt, ticket.message);
+    for (const m of ticket.messages ?? []) {
+        said(say, m.fromOperator ? "NMTS" : "you", m.createdAt, bodyOf(m));
+    }
+    return 0;
+}
+async function replyToReport(which, options) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const omit = checkOmit(options.omit ?? []);
+    const message = omitLiterals(redact(await readMessage(options)), omit).trim();
+    requireLength(message, MAX_REPLY_CHARS, "reply");
+    const wire = open(options);
+    const id = await resolveTicket(wire, which);
+    if (options.json === true) {
+        if (!answeredAlready(options)) {
+            say(JSON.stringify({ sent: false, code: which, message, bytes: Buffer.byteLength(message, "utf8") }));
+            return 5;
+        }
+    }
+    else {
+        for (const line of SUPPORT_SHORT)
+            say(line);
+        say(``);
+        say(`Reply (${Buffer.byteLength(message, "utf8")} bytes):`);
+        for (const line of message.split("\n"))
+            say(`  ${line}`);
+        if (!(await agreed(options, say))) {
+            say(``);
+            say(`Nothing was sent. To go ahead:  ${BINARY_NAME} support reply … --yes`);
+            return 5;
+        }
+    }
+    // ⚠ THE FIELD IS `body`, NOT `message`. A follow-up is the same shape the browser's rail takes,
+    //   and only the FIRST message of a thread is called a message.
+    const answer = await call(wire, `/v1/support/cli/${encodeURIComponent(id)}/reply`, {
+        method: "POST",
+        body: { body: message },
+    });
+    if (options.json === true)
+        say(JSON.stringify(answer));
+    else
+        say(`Sent.`);
+    return 0;
+}
+/** One turn of a thread, printed with the words indented under who said them. */
+function said(say, who, at, body) {
+    say(`${who}  ${at}`);
+    for (const line of body.split("\n"))
+        say(`  ${line}`);
+    say(``);
+}
+/**
+ * What a row holds, when it holds no words.
+ *
+ * The server sends an empty body for a withdrawn message and for every row that is a notice rather
+ * than a sentence, and it composes a notice's words on the screen that shows it. There is no such
+ * screen here, so the row is named for what it is.
+ */
+function bodyOf(m) {
+    if (m.body !== "")
+        return m.body;
+    return m.deletedAt !== null ? `[withdrawn]` : `[a notice from NMTS]`;
+}
+/**
+ * A code or an id, turned into the id the route takes.
+ *
+ * ⛔ A CODE IS WHAT A PERSON HAS. It is the reference the ticket prints and the one they would
+ *    quote in an email, and it is not the id in the address — so this looks it up rather than
+ *    refusing a value that is obviously theirs.
+ */
+async function resolveTicket(wire, which) {
+    if (which === undefined || which === "") {
+        throw new NmtsError(`Which report? Give the code \`${BINARY_NAME} support list\` prints.`, {
+            exitCode: 2,
+        });
+    }
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(which))
+        return which;
+    const { tickets } = asList(await call(wire, "/v1/support/cli", {}));
+    const found = tickets.find((t) => t.code.toLowerCase() === which.toLowerCase());
+    if (found === undefined) {
+        throw new NmtsError(`No report of this account's is called ${which}.`, {
+            exitCode: 4,
+            nextStep: `\`${BINARY_NAME} support list\` prints the codes.`,
+        });
+    }
+    return found.id;
+}