@needmoretruth/nmts-cli 0.17.2 → 0.34.2

package/dist/commands/wallet.d.ts

@@ -0,0 +1,36 @@
+import { type Network } from "../network.ts";
+import { type ChainReader } from "../wallet.ts";
+export interface WalletOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    write?: (line: string) => void;
+    /** `wallet address --qr`: the address as a code a phone can scan, drawn in the terminal. */
+    qr?: boolean;
+    /** `wallet send`: the operands after "send", and its flags (`wallet-send.ts`). */
+    rest?: readonly string[];
+    yes?: boolean;
+    dryRun?: boolean;
+    feeCap?: string | undefined;
+    /** `wallet swap`: the coin to receive, the venue, the slippage, and the person's say past the gate. */
+    to?: string | undefined;
+    venue?: string | undefined;
+    slippageBps?: string | undefined;
+    acceptExtremes?: boolean;
+    /** `wallet storage split`: what the resource keeps, by size or by epochs (`wallet-storage-ops.ts`). */
+    size?: string | undefined;
+    epochs?: string | undefined;
+    /** `wallet hall`: the name to be listed under, or `remove` to go back to a shortened address. */
+    name?: string | undefined;
+    remove?: boolean;
+    /**
+     * Where the balances come from.
+     *
+     * ⚠ A SEAM, NOT AN OPTION: no flag reaches it and nothing on a command line can supply one. It
+     *   is here because the alternative is a test that talks to a live chain — which cannot run
+     *   offline, answers differently every day, and can never be asked to fail on purpose, which is
+     *   most of what this command has to get right.
+     */
+    openChain?: (network: Network, address: string) => Promise<ChainReader> | ChainReader;
+}
+export declare function wallet(what: string | undefined, options?: WalletOptions): Promise<number>;

package/dist/commands/wallet.js

@@ -1,12 +1,13 @@
-// `nmts wallet` — which wallet this account code opens, and what the chain says is in it.
+// `nmts wallet` — which wallet this NMTS key opens, and what the chain says is in it.
 //
-// ⛔ IT READS. Nothing in this command signs, sends, swaps or spends, and there is no option that
-//    makes it. That is why it asks for no agreement: the agreement ladder stops a program from
-//    signing with a wallet on somebody's behalf, and asking for it here — where nothing can move —
-//    would teach a person to grant the one key that matters in order to look at a number.
+// ⛔ EVERY MODE HERE READS, EXCEPT `send`. Address, balance, activity and storage sign nothing and
+//    ask for no agreement: the agreement ladder stops a program from signing with a wallet on
+//    somebody's behalf, and asking for it where nothing can move would teach a person to grant the
+//    one key that matters in order to look at a number. `send` lives in `wallet-send.ts`, prints a
+//    review, and signs only with --yes and under the wallet agreement.
 //
 // ⛔ THE ADDRESS AND THE BALANCES ARE DIFFERENT KINDS OF FACT, so they fail differently. The
-//    address is computed on this machine from the account code and cannot fail for any reason
+//    address is computed on this machine from the NMTS key and cannot fail for any reason
 //    outside it; the balances come from a public node that can be slow, wrong or down. `nmts
 //    wallet address` is the half that never needs a network, and it exists because "what is my
 //    address" is the question somebody asks when the network is the thing that is broken.
@@ -23,21 +24,51 @@ import { BINARY_NAME } from "../product.js";
 import { resolveServer } from "../server.js";
 import { coinAmount, readBalances, walCoinType, walletAddress, SUI_COIN_TYPE, } from "../wallet.js";
 /** What the operand may say. Anything else is a command line to correct, not a guess to act on. */
-const MODES = ["address", "balance"];
+const MODES = ["address", "balance", "activity", "storage", "send", "donate", "swap", "hall"];
 function modeOf(what) {
-    if (what === undefined || what === "balance")
+    if (what === undefined)
         return "balance";
-    if (what === "address")
-        return "address";
+    const found = MODES.find((m) => m === what);
+    if (found !== undefined)
+        return found;
     throw new NmtsError(`\`${BINARY_NAME} wallet ${what}\` is not something this command does.`, {
         exitCode: 2,
-        nextStep: `\`${BINARY_NAME} wallet\` shows the address and the balances, and ` +
-            `\`${BINARY_NAME} wallet address\` shows the address alone, without touching a network.`,
+        nextStep: `\`${BINARY_NAME} wallet\` shows the address and the balances; \`${BINARY_NAME} wallet address\` ` +
+            `shows the address alone, without touching a network (add --qr for a code to scan); ` +
+            `\`${BINARY_NAME} wallet activity\` lists the recent transactions; \`${BINARY_NAME} wallet storage\` ` +
+            `lists the storage resources it holds. None of those signs. \`${BINARY_NAME} wallet send <SUI|WAL> ` +
+            `<amount|max> <address>\`, \`${BINARY_NAME} wallet swap <SUI|WAL> <amount|max>\` and ` +
+            `\`${BINARY_NAME} wallet donate <SUI|WAL> <amount>\` are the three that do, and only with --yes. ` +
+            `\`${BINARY_NAME} wallet hall\` shows the gift hall of fame; with --name it signs a name into it.`,
     });
 }
 export async function wallet(what, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const mode = modeOf(what);
+    // The two lists live in files of their own; each reads through a seam of its own.
+    if (mode === "activity")
+        return (await import("./wallet-activity.js")).walletActivity(options);
+    if (mode === "storage") {
+        const [sub, ...more] = options.rest ?? [];
+        if (sub === "split" || sub === "merge" || sub === "transfer") {
+            return (await import("./wallet-storage-ops.js")).walletStorageOps(sub, more, options);
+        }
+        if (sub !== undefined) {
+            throw new NmtsError(`\`${BINARY_NAME} wallet storage ${sub}\` is not something this command does.`, {
+                exitCode: 2,
+                nextStep: `\`${BINARY_NAME} wallet storage\` lists; \`split\`, \`merge\` and \`transfer\` sign — \`${BINARY_NAME} help wallet\`.`,
+            });
+        }
+        return (await import("./wallet-storage.js")).walletStorage(options);
+    }
+    if (mode === "send")
+        return (await import("./wallet-send.js")).walletSend(options.rest ?? [], options);
+    if (mode === "donate")
+        return (await import("./wallet-donate.js")).walletDonate(options.rest ?? [], options);
+    if (mode === "swap")
+        return (await import("./wallet-swap.js")).walletSwap(options.rest ?? [], options);
+    if (mode === "hall")
+        return (await import("./wallet-hall.js")).walletHall(options);
     const resolved = await requireAccountCode();
     const address = await walletAddress(resolved.code);
     if (mode === "address") {
@@ -49,10 +80,19 @@ export async function wallet(what, options = {}) {
             return 0;
         }
         say(`Address  ${address}`);
+        if (options.qr === true) {
+            // ⛔ THE SAME TEXT THE BROWSER'S CODE CARRIES — the bare address, nothing wrapped around it —
+            //    so a phone that reads one reads the other. Medium error correction and a two-module
+            //    quiet zone are the browser's settings too; without the quiet zone many scanners see nothing.
+            const { renderUnicodeCompact } = await import("uqr");
+            say(``);
+            for (const row of renderUnicodeCompact(address, { ecc: "M", border: 2 }).split("\n"))
+                say(`  ${row}`);
+        }
         say(``);
-        say(`  Derived on this machine from the account code. Nothing was asked of the NMTS server or`);
+        say(`  Derived on this machine from the NMTS key. Nothing was asked of the NMTS server or`);
         say(`  of any chain, so this says what the wallet is called and nothing about what is in it.`);
-        say(`  The browser app derives the same address from the same code.`);
+        say(`  The browser app derives the same address from the same NMTS key.`);
         return 0;
     }
     // ⛔ THE SERVER IS RESOLVED BUT NEVER CALLED. It is here for one thing only: the live server
@@ -80,7 +120,7 @@ export async function wallet(what, options = {}) {
     say(`SUI      ${inWords(balances.sui)}`);
     say(`WAL      ${inWords(balances.wal)}`);
     say(``);
-    say(`  The address is derived on this machine from the account code; the balances were read`);
+    say(`  The address is derived on this machine from the NMTS key; the balances were read`);
     say(`  from the ${network} chain just now, and they move without this tool.`);
     if (!balances.sui.read || !balances.wal.read) {
         say(`  A balance that could not be read is printed as that and never as zero, and this command`);
@@ -89,6 +129,8 @@ export async function wallet(what, options = {}) {
     }
     say(`  Nothing here signs or spends. \`${BINARY_NAME} extend\` is the one command that signs, and it`);
     say(`  asks for a separate agreement before it does.`);
+    say(`  Storing needs no coin here: credits pay the network. \`${BINARY_NAME} help wallet\` says where`);
+    say(`  SUI comes from when you want to pay the network yourself.`);
     return exitCodeFor(balances);
 }
 /**

package/dist/commands/whoami.d.ts

@@ -0,0 +1,10 @@
+export interface WhoamiOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    write?: (line: string) => void;
+    /** Print the NMTS key itself. A person's act — see the header. */
+    reveal?: boolean;
+    /** Machine-readable output. Only `--reveal` has one; the listing is for a person. */
+    json?: boolean;
+}
+export declare function whoami(options?: WhoamiOptions): Promise<number>;

package/dist/commands/whoami.js

@@ -4,16 +4,34 @@
 //    code on this machine; nothing is asked of a server. So it proves the code is well-formed and
 //    which account it is, and it proves nothing about whether that account exists, has credits, or
 //    is signed in. Printing an account id without saying that would read as "connected".
+//
+// ⛔ AND `--reveal` PUTS THE NMTS KEY ITSELF ON THE SCREEN. Everything else this command
+//    prints is public: an account id and a public code give nobody anything. The code is the
+//    account — every file key and the wallet derive from it — so the flag exists for one
+//    situation, a person copying it out of a machine they are sitting at, and it is refused while
+//    a mode is on. There is no MCP tool for it either: an agent driving this tool was handed the
+//    code already, so a surface that prints it can only ever move it somewhere new.
 import { identityOf } from "../account.js";
 import { requireAccountCode } from "../code-access.js";
 import { CODE_ENV_VAR, readCredentialsFile } from "../credentials.js";
-import { BINARY_NAME } from "../product.js";
 import { resolveNetwork } from "../network.js";
 import { resolveServer } from "../server.js";
 export async function whoami(options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const resolved = await requireAccountCode();
     const identity = await identityOf(resolved.code);
+    if (options.reveal === true) {
+        if (options.json === true) {
+            say(JSON.stringify({ account_code: identity.displayCode }));
+            return 0;
+        }
+        // ⛔ THE WARNING COMES FIRST AND THE CODE IS ALONE ON ITS OWN LINE. Whoever is about to copy
+        //    it reads what it is before they see it, and a line with nothing else on it is one a
+        //    person can select without dragging a label into their clipboard.
+        say(`The NMTS key is the account: anyone who reads it can open every file and delete the account.`);
+        say(identity.displayCode);
+        return 0;
+    }
     // ⛔ BOTH STORED SHAPES, and an adversarial review is why. This read `source === "file"` only,
     //    which was right while the file always held the code in the clear — and became wrong the
     //    day `login` started sealing by default. Somebody who ran `login --server … --network
@@ -21,11 +39,11 @@ export async function whoami(options = {}) {
     const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
     const server = resolveServer(options.server ?? stored?.server);
     const network = resolveNetwork(server, options.network ?? stored?.network);
-    say(`Account id   ${identity.accountId}`);
-    say(`Public code  ${identity.publicCode}`);
-    say(`Code from    ${resolved.source === "env" ? `${CODE_ENV_VAR} (not stored)` : "this machine"}`);
-    say(`Server       ${server}`);
-    say(`Network      ${network}`);
+    say(`Account id     ${identity.accountId}`);
+    say(`Public code    ${identity.publicCode}`);
+    say(`NMTS key from  ${resolved.source === "env" ? `${CODE_ENV_VAR} (not stored)` : "this machine"}`);
+    say(`Server         ${server}`);
+    say(`Network        ${network}`);
     say(``);
     say(`  Derived on this machine. Nothing was asked of the server, so this does not say whether`);
     say(`  the account exists there, has credits, or is signed in.`);

package/dist/consent.d.ts

@@ -0,0 +1,140 @@
+/** One thing worth stopping for, and everything a person needs to decide about it. */
+export interface Consent {
+    /** What the tool would do. One line, in the second person. */
+    what: string;
+    /** What can go wrong. The reason this key exists, said plainly. */
+    risk: string;
+    /** What is NOT covered, said before it matters rather than after. */
+    limit: string;
+}
+export declare const CONSENTS: {
+    /**
+     * Writing the NMTS key down UNSEALED — in the clear, in this tool's own file.
+     *
+     * ⛔ THE DEFAULT IS THE SEALED FORM, and this key is what unlocks the other one (owner,
+     *    2026-08-23: support storing it, but only behind encryption unless somebody agrees to a
+     *    disclaimer). It covers both the ordinary case, where mode 600 is the only protection and
+     *    every program running as you can read it, and the worse one, where the filesystem cannot
+     *    keep the mode either — a Windows share, some container mounts, a network drive. `login`
+     *    prints which of the two this machine is before it asks.
+     *
+     * ⚠ IT WAS NARROWER UNTIL 2026-08-23, covering only the filesystem case. Nothing had shipped
+     *   under the old meaning — the tool is not published — so no grant anywhere means less than
+     *   the words above. If it ever does, this needs a new key rather than a wider one: a grant
+     *   means what it said on the day it was given.
+     */
+    readonly "unsafe-code-storage": {
+        readonly what: "Store the NMTS key in the clear, unsealed, in this tool's own file.";
+        readonly risk: string;
+        readonly limit: string;
+    };
+    /**
+     * Reading the code out of a plain environment variable, or printing one to be set.
+     *
+     * ⛔ IT IS A DIFFERENT PLACE, NOT A SMALLER VERSION OF THE FILE (owner, 2026-08-23: an agent
+     *    must be able to choose this, with the person's agreement). An environment variable leaks
+     *    through channels a file does not: `docker inspect` prints the whole environment of a
+     *    container, `/proc/<pid>/environ` is readable by the same user for as long as the process
+     *    lives, every child process inherits it, and CI systems echo it into logs. A variable that
+     *    names a FILE — `NMTS_ACCOUNT_CODE_FILE` — has none of those, which is why it needs no
+     *    agreement.
+     */
+    readonly "plain-env": {
+        readonly what: "Use the NMTS key from a plain environment variable, or print one to be set.";
+        readonly risk: string;
+        readonly limit: string;
+    };
+    /**
+     * Signing a chain transaction with the wallet the NMTS key derives.
+     *
+     * Separate from `spend` because it is a different pot of money: credits are a promise this
+     * service made, and a wallet holds assets nobody can restore.
+     */
+    /**
+     * Handing a file to another account.
+     *
+     * ⛔ IT IS HERE BECAUSE THE UNDO DOES NOT UNDO IT. Every other irreversible thing in this tool
+     *    costs money or moves the NMTS key; this one gives somebody else a copy of a file, and
+     *    taking the share back afterwards stops future downloads and reaches nothing already
+     *    fetched. That gap is not a flaw to be fixed later — it is what handing somebody a file
+     *    means — so it is said before the first share rather than after it.
+     */
+    readonly share: {
+        readonly what: "Give another account the key to one of this account's files.";
+        readonly risk: string;
+        readonly limit: string;
+    };
+    /**
+     * ⛔ THIS ONE IS NOT A BARE DATE. `wallet-grant.ts` writes it with a scope, an expiry of at most
+     *    30 days and optional ceilings, and `requireWalletGrant` is what asks for it — the plain
+     *    `requireConsent("wallet")` would read an older bare-date record as "everything, forever".
+     */
+    readonly wallet: {
+        readonly what: "Use the wallet this NMTS key derives, and sign transactions with it.";
+        readonly risk: string;
+        readonly limit: string;
+    };
+    /** Ending another device's session — the browser's, usually. */
+    readonly "sign-out": {
+        readonly what: "Sign devices out of this account from this machine.";
+        readonly risk: string;
+        readonly limit: "This does not touch files, credits or the wallet. It ends sessions and nothing else.";
+    };
+    /** Putting the previous file list back. */
+    readonly rollback: {
+        readonly what: "Replace the current file list with the previous one.";
+        readonly risk: string;
+        readonly limit: "This covers the list. It cannot restore a file whose storage has run out.";
+    };
+    /** Printing the NMTS key. */
+    readonly reveal: {
+        readonly what: "Print the NMTS key on this screen.";
+        readonly risk: string;
+        readonly limit: "This covers printing it. Where it goes afterwards is not something this tool can see.";
+    };
+    /** Writing the NMTS key into a recovery kit. */
+    readonly kit: {
+        readonly what: "Write the NMTS key into a recovery kit file on this disk.";
+        readonly risk: string;
+        readonly limit: "The recovery list alone (`recovery-list`) holds no NMTS key and asks for nothing.";
+    };
+    /** A gift to the developer — on its own, or as a tip at payment (2026-09-06). */
+    readonly donate: {
+        readonly what: "Send gifts to the developer of NMTS from this account's wallet.";
+        readonly risk: string;
+        readonly limit: string;
+    };
+    /** Destroying the treasury-owned storage under a credit-paid file. */
+    readonly "release-storage": {
+        readonly what: "Destroy the credit-paid storage under a file, so the network stops serving its bytes.";
+        readonly risk: string;
+        readonly limit: "This covers credit-paid storage only. Storage bought with your own wallet is burned by the wallet.";
+    };
+};
+export type ConsentKey = keyof typeof CONSENTS;
+/**
+ * ⛔ DERIVED FROM THE TABLE, so a key added above cannot be missing from the checks below.
+ *    Written as `Object.keys` of the table rather than a hand-kept array: a hand-kept one goes
+ *    stale silently, and the failure is a capability nobody is ever asked about.
+ */
+export declare const CONSENT_KEYS: ConsentKey[];
+/**
+ * The whole file, as written. `wallet-grant.ts` keeps its richer record under the same key so
+ * `consent` still lists one thing per key; nothing else should reach for this.
+ */
+export declare function readConsentRecords(): Record<string, unknown>;
+export declare function writeConsentRecords(all: Record<string, unknown>): void;
+/** When this key was agreed to on this machine, or null. */
+export declare function grantedAt(key: ConsentKey): string | null;
+export declare function isGranted(key: ConsentKey): boolean;
+/** Write the grant down, with the date and the version that asked. */
+export declare function grant(key: ConsentKey, version: string, now: Date): void;
+export declare function revoke(key: ConsentKey): void;
+/**
+ * Stop unless this has been agreed to, and say exactly what agreeing would mean.
+ *
+ * ⛔ THE MESSAGE IS THE PRODUCT HERE. It is the only thing standing between somebody and a
+ *    decision they cannot take back, so it says what happens, what can go wrong, what is not
+ *    covered, and the one command that agrees — in that order, every time.
+ */
+export declare function requireConsent(key: ConsentKey): void;

package/dist/consent.js

@@ -8,7 +8,7 @@
 // ⛔ FIVE KEYS, NOT TWENTY. A tool that asks about everything trains the person to say yes
 //    without reading, and then the one question that mattered is the one they clicked through.
 //    The bar for a key existing is one of: it cannot be undone · it costs money · it puts the
-//    account code somewhere that is not this tool's sealed file. Anything else happens without
+//    NMTS key somewhere that is not this tool's sealed file. Anything else happens without
 //    asking, and the count is written here so that adding a sixth has to be a decision.
 //    ⚠ The fifth was added for sharing, which is the first thing this tool can do that hands
 //      something to a person who is not the account holder — and the only one whose undo does not
@@ -29,22 +29,7 @@ import { NmtsError } from "./errors.js";
 import { BINARY_NAME, SUPPORT_EMAIL } from "./product.js";
 export const CONSENTS = {
     /**
-     * Spending the account's credits.
-     *
-     * Asked once because the price of every single upload is printed anyway — what this covers is
-     * the person understanding that this tool can spend at all, which is not obvious from a command
-     * called `put`.
-     */
-    spend: {
-        what: "Spend this account's credits on storage.",
-        risk: "Credits are consumed and are not refundable. Storage is bought on a public network and " +
-            "cannot be un-bought. The price of each upload is printed before it happens, and daily " +
-            "ceilings apply on the server whatever this machine asks for.",
-        limit: "This does not cover anything spent from a wallet. That is a separate agreement, and this " +
-            "one does not grant it.",
-    },
-    /**
-     * Writing the account code down UNSEALED — in the clear, in this tool's own file.
+     * Writing the NMTS key down UNSEALED — in the clear, in this tool's own file.
      *
      * ⛔ THE DEFAULT IS THE SEALED FORM, and this key is what unlocks the other one (owner,
      *    2026-08-23: support storing it, but only behind encryption unless somebody agrees to a
@@ -59,14 +44,14 @@ export const CONSENTS = {
      *   means what it said on the day it was given.
      */
     "unsafe-code-storage": {
-        what: "Store the account code in the clear, unsealed, in this tool's own file.",
-        risk: "The account code opens every file in this account and derives its wallet. Written in the " +
+        what: "Store the NMTS key in the clear, unsealed, in this tool's own file.",
+        risk: "The NMTS key opens every file in this account and derives its wallet. Written in the " +
             "clear it is readable by anything running as you — every agent, every script, every " +
             "backup that copies your home directory, every image layer built from it. Where the " +
             "filesystem cannot keep a file private, it is readable by others as well.",
-        limit: "There is no recovery from a leaked code: it cannot be changed while it still opens the " +
+        limit: "There is no recovery from a leaked NMTS key: it cannot be changed while it still opens the " +
             "files it opened. The alternatives are the sealed form, which is what `login` does by " +
-            "default, and a secret file the code is read from and never copied into.",
+            "default, and a secret file the NMTS key is read from and never copied into.",
     },
     /**
      * Reading the code out of a plain environment variable, or printing one to be set.
@@ -80,7 +65,7 @@ export const CONSENTS = {
      *    agreement.
      */
     "plain-env": {
-        what: "Use the account code from a plain environment variable, or print one to be set.",
+        what: "Use the NMTS key from a plain environment variable, or print one to be set.",
         risk: "An environment variable is not private to the program that reads it. `docker inspect` " +
             "prints the entire environment of a container, anything running as you can read " +
             "/proc/<pid>/environ while the process lives, every child process inherits it, and " +
@@ -90,7 +75,7 @@ export const CONSENTS = {
             "NMTS_ACCOUNT_CODE_FILE — avoids all of the above and asks for nothing.",
     },
     /**
-     * Signing a chain transaction with the wallet the account code derives.
+     * Signing a chain transaction with the wallet the NMTS key derives.
      *
      * Separate from `spend` because it is a different pot of money: credits are a promise this
      * service made, and a wallet holds assets nobody can restore.
@@ -99,7 +84,7 @@ export const CONSENTS = {
      * Handing a file to another account.
      *
      * ⛔ IT IS HERE BECAUSE THE UNDO DOES NOT UNDO IT. Every other irreversible thing in this tool
-     *    costs money or moves the account code; this one gives somebody else a copy of a file, and
+     *    costs money or moves the NMTS key; this one gives somebody else a copy of a file, and
      *    taking the share back afterwards stops future downloads and reaches nothing already
      *    fetched. That gap is not a flaw to be fixed later — it is what handing somebody a file
      *    means — so it is said before the first share rather than after it.
@@ -112,13 +97,66 @@ export const CONSENTS = {
         limit: "This does not cover uploading, spending, or anything to do with a wallet. It covers giving " +
             "away files this account already holds.",
     },
+    /**
+     * ⛔ THIS ONE IS NOT A BARE DATE. `wallet-grant.ts` writes it with a scope, an expiry of at most
+     *    30 days and optional ceilings, and `requireWalletGrant` is what asks for it — the plain
+     *    `requireConsent("wallet")` would read an older bare-date record as "everything, forever".
+     */
     wallet: {
-        what: "Use the wallet this account code derives, and sign transactions with it.",
+        what: "Use the wallet this NMTS key derives, and sign transactions with it.",
         risk: "A signed transaction moves real assets and cannot be reversed by anybody, including NMTS. " +
-            "A mistake here is permanent.",
-        limit: "Only what this tool signs. Handing the account code to another program gives that program " +
+            "A mistake here is permanent. The agreement names a scope, runs out after at most 30 days, " +
+            "and can carry a ceiling on what this tool signs away.",
+        limit: "Only what this tool signs. Handing the NMTS key to another program gives that program " +
             "the same wallet, and nothing here can see that happen.",
     },
+    /** Ending another device's session — the browser's, usually. */
+    "sign-out": {
+        what: "Sign devices out of this account from this machine.",
+        risk: "Whoever is signed in on that device is signed out at once, in the middle of whatever they were " +
+            "doing. From a key, signing out everywhere ends every browser session, including the one that " +
+            "can revoke this machine's key.",
+        limit: "This does not touch files, credits or the wallet. It ends sessions and nothing else.",
+    },
+    /** Putting the previous file list back. */
+    rollback: {
+        what: "Replace the current file list with the previous one.",
+        risk: "Every change since the previous list was written disappears from the list: uploads since then " +
+            "are no longer named by it, and moves, renames and labels since then are undone. The files " +
+            "themselves are not touched, and a rebuild can find what the list forgot.",
+        limit: "This covers the list. It cannot restore a file whose storage has run out.",
+    },
+    /** Printing the NMTS key. */
+    reveal: {
+        what: "Print the NMTS key on this screen.",
+        risk: "The NMTS key is the account: anyone who reads it can open every file and delete the " +
+            "account. A screen is copied by terminals, session recorders and screenshots, and by any " +
+            "program reading this tool's output.",
+        limit: "This covers printing it. Where it goes afterwards is not something this tool can see.",
+    },
+    /** Writing the NMTS key into a recovery kit. */
+    kit: {
+        what: "Write the NMTS key into a recovery kit file on this disk.",
+        risk: "The kit holds the NMTS key in the clear. Anything that reads this disk — a backup, a sync " +
+            "folder, another user, an image built from it — reads it, and the NMTS key is the account.",
+        limit: "The recovery list alone (`recovery-list`) holds no NMTS key and asks for nothing.",
+    },
+    /** A gift to the developer — on its own, or as a tip at payment (2026-09-06). */
+    donate: {
+        what: "Send gifts to the developer of NMTS from this account's wallet.",
+        risk: "A gift is voluntary, buys nothing, and is not refunded. It goes to the address the site " +
+            "publishes, and like every transaction on the chain it is visible to anyone on an explorer " +
+            "such as Suiscan. Once sent it cannot be recalled by anybody, NMTS included.",
+        limit: "This covers gifts this tool sends: `wallet donate`, and a tip named at a payment. Every gift " +
+            "still asks on the run that sends it, and a standing tip above ten percent asks once more.",
+    },
+    /** Destroying the treasury-owned storage under a credit-paid file. */
+    "release-storage": {
+        what: "Destroy the credit-paid storage under a file, so the network stops serving its bytes.",
+        risk: "The bytes stop being served for good. The server allows forty of these a day for the whole " +
+            "service, so a loop here can stop other people's credit uploads for the day.",
+        limit: "This covers credit-paid storage only. Storage bought with your own wallet is burned by the wallet.",
+    },
 };
 /**
  * ⛔ DERIVED FROM THE TABLE, so a key added above cannot be missing from the checks below.
@@ -129,6 +167,27 @@ export const CONSENT_KEYS = Object.keys(CONSENTS);
 function path() {
     return join(configDir(), "consent.json");
 }
+/**
+ * The whole file, as written. `wallet-grant.ts` keeps its richer record under the same key so
+ * `consent` still lists one thing per key; nothing else should reach for this.
+ */
+export function readConsentRecords() {
+    try {
+        const parsed = JSON.parse(readFileSync(path(), "utf8"));
+        if (typeof parsed !== "object" || parsed === null)
+            return {};
+        return { ...parsed };
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConsentRecords(all) {
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    writeFileSync(path(), `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 });
+    if (modesAreEnforced())
+        chmodSync(path(), 0o600);
+}
 function read() {
     try {
         const parsed = JSON.parse(readFileSync(path(), "utf8"));
@@ -188,11 +247,11 @@ export function requireConsent(key) {
             `machine, including an AI agent. The published Terms are what govern the service; this is a`,
             `warning, not a substitute for them.`,
             "",
-            `To agree, on this machine, once:  ${BINARY_NAME} consent grant ${key}`,
-            `To see what has been agreed to:   ${BINARY_NAME} consent`,
+            `To unlock, at a terminal, once:  ${BINARY_NAME} unlock ${key}`,
+            `To see what is unlocked:         ${BINARY_NAME} unlock`,
             "",
             `⛔ If a program is reading this on somebody's behalf: show it to them and let them decide.`,
-            `   Do not run the grant command yourself.`,
+            `   Do not run the unlock command yourself.`,
             "",
             `Something wrong or confusing here? ${SUPPORT_EMAIL}`,
         ].join("\n"),