@needmoretruth/nmts-cli 0.17.2 → 0.34.2

package/dist/shared/lib/drive/manifest-ops.d.ts

@@ -0,0 +1,167 @@
+import type { AccountSettings, ManifestEntry } from "./manifest-codec.ts";
+/** One drive edit, in a form that can be replayed onto a newer list. */
+export type ManifestIntent = 
+/** Insert or replace by id. Upload-commit and folder-create both land here. */
+{
+    op: "add";
+    entry: ManifestEntry;
+}
+/** New plaintext name for one item. */
+ | {
+    op: "rename";
+    id: string;
+    name: string;
+    at: number;
+}
+/** New parent (null = drive root). */
+ | {
+    op: "move";
+    id: string;
+    parentId: string | null;
+    at: number;
+}
+/** Send to the trash. Already-trashed ids keep their original instant. */
+ | {
+    op: "trash";
+    ids: readonly string[];
+    at: number;
+}
+/** Bring back out of the trash. */
+ | {
+    op: "restore";
+    ids: readonly string[];
+    at: number;
+}
+/** Remove from the list entirely — the storage record is gone or going. */
+ | {
+    op: "purge";
+    ids: readonly string[];
+}
+/** Star / unstar. `on` is the DESIRED state, never a toggle: a replayed toggle would flip twice. */
+ | {
+    op: "favorite";
+    ids: readonly string[];
+    on: boolean;
+    at: number;
+}
+/** Pin / unpin to the top of the item's own folder. Same desired-state rule as favourite. */
+ | {
+    op: "pin";
+    ids: readonly string[];
+    on: boolean;
+    at: number;
+}
+/** Put one label on (or take it off) these items. */
+ | {
+    op: "label";
+    ids: readonly string[];
+    label: string;
+    on: boolean;
+    at: number;
+}
+/** Rename a label everywhere it appears. Items already wearing `to` do not gain a duplicate. */
+ | {
+    op: "labelRename";
+    from: string;
+    to: string;
+    at: number;
+}
+/** Remove a label from every item — which is what makes it stop existing. */
+ | {
+    op: "labelDelete";
+    label: string;
+    at: number;
+}
+/**
+ * Write MY OWN receipt that this file was shared with this address.
+ *
+ * Upsert by address, because the server replaces rather than stacks a re-share to the same
+ * person (`shares_one_per_recipient`); a second receipt would show one recipient twice.
+ */
+ | {
+    op: "shareRecord";
+    id: string;
+    address: string;
+    at: number;
+}
+/** Mark a receipt as revoked — a revocation was sent. No-op when there is no receipt for that address. */
+ | {
+    op: "shareRevoked";
+    id: string;
+    address: string;
+    at: number;
+}
+/**
+ * Drop receipts the server's listing has confirmed gone.
+ *
+ * ⛔ ONLY REVOKED RECEIPTS ARE DROPPED. An active receipt whose row is missing is the entire
+ * point of keeping receipts — pruning it would erase the warning instead of showing it — and
+ * the restriction is also what makes this intent safe to replay onto a list where the address
+ * was just re-shared.
+ */
+ | {
+    op: "sharePrune";
+    id: string;
+    addresses: readonly string[];
+    at: number;
+};
+/**
+ * Apply one intent, returning a new list. The input is never mutated: the store keeps the
+ * pre-save snapshot around to rebuild from after a version conflict.
+ *
+ * Returns the SAME array reference when nothing changed, so callers can skip a re-render and a
+ * save for an intent that turned out to be a no-op (a rename to the name it already had, a trash
+ * of something another device already purged).
+ */
+export declare function applyIntent(entries: readonly ManifestEntry[], intent: ManifestIntent): readonly ManifestEntry[];
+/**
+ * Which size-padding rule an account seals its next upload under.
+ *
+ * ⛔ DECLARED BESIDE THE PATCH THAT CARRIES IT, not in `lib/crypto/padding.ts` where the padding
+ *    itself lives. `padding.ts` imports it from here. The direction matters: this file is copied
+ *    byte-for-byte into the `nmts` command-line package, and a type reaching out of it into the
+ *    crypto tree would drag that whole tree along with it for the sake of two string literals.
+ */
+export type PaddingMode = "padme" | "pow2" | "none";
+/**
+ * One account-settings edit, as DESIRED STATE per field — never "toggle", so replaying it onto a
+ * list another device wrote lands the same answer. A default value means absence in the codec.
+ */
+export interface SettingsPatch {
+    developerMode?: boolean;
+    textScalePct?: number;
+    /** Which rule seals future uploads: `"padme"` = the default, `"none"` = the file's exact length. */
+    paddingMode?: PaddingMode;
+    /** Credits held back with each credit-paid upload, 0 to `DEPOSIT_MAX_CREDITS`. */
+    depositDefault?: number;
+    /** The standing tip in tenths of a percent (0 = none) and the instant its terms were agreed to (0 clears). */
+    tipTenths?: number;
+    tipConsentAt?: number;
+}
+/**
+ * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
+ * changed, so callers can skip a save (a version bump every other device must download).
+ *
+ * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
+ * the slider or the typed field lets through never reaches the wire out of range.
+ */
+export declare function applySettingsPatch(settings: AccountSettings, patch: SettingsPatch): AccountSettings;
+/** Replay a whole queue in order. Used to rebuild after a version conflict. */
+export declare function applyIntents(entries: readonly ManifestEntry[], intents: readonly ManifestIntent[]): readonly ManifestEntry[];
+/**
+ * True when the intent touches storage the server also tracks, so a save must not be deferred.
+ *
+ * A queued save that dies with the tab is recoverable for a rename (the name is only in the
+ * manifest, and losing it leaves the old name — annoying, not damaging). It is NOT recoverable
+ * when a file was just committed or just deleted: the storage record moved, and a manifest that
+ * disagrees leaves a file that is paid for but invisible, or one that shows but is gone.
+ *
+ * Stars, pins and labels are deliberately NOT in this list: they exist only in the manifest, so the
+ * worst a lost save can do is leave a file unstarred — the same recoverable loss as a rename.
+ *
+ * SHARE RECEIPTS ARE, for the same reason a commit is: they describe a row the server now
+ * holds, and nothing else on this side records it. A receipt lost with the tab does not degrade to
+ * a wrong colour — it degrades to a share this device can never again hold the server to.
+ * `sharePrune` stays out: losing it leaves a settled receipt that the next listing prunes again.
+ */
+export declare function mustSaveNow(intent: ManifestIntent): boolean;

package/dist/shared/lib/drive/manifest-ops.js

@@ -1,5 +1,6 @@
 // Runtime import (relative + .ts — the header's node --test rule) for the bounds the patch obeys.
 import { TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT, } from "./manifest-codec.js";
+import { applyDepositPatch, applyTipPatch } from "./manifest-settings.js";
 /**
  * Apply one intent, returning a new list. The input is never mutated: the store keeps the
  * pre-save snapshot around to rebuild from after a version conflict.
@@ -176,8 +177,8 @@ export function applySettingsPatch(settings, patch) {
     if (patch.paddingMode !== undefined) {
         // The default is spelled as absence, like every other field here — so two devices that both
         // "choose the default" write the same bytes and neither bumps the list's version.
-        if (patch.paddingMode === "pow2")
-            next.paddingMode = "pow2";
+        if (patch.paddingMode === "pow2" || patch.paddingMode === "none")
+            next.paddingMode = patch.paddingMode;
         else
             delete next.paddingMode;
     }
@@ -188,9 +189,13 @@ export function applySettingsPatch(settings, patch) {
         else
             next.textScalePct = pct;
     }
+    applyDepositPatch(next, patch.depositDefault);
+    applyTipPatch(next, patch.tipTenths, patch.tipConsentAt);
     const same = (next.developerMode === true) === (settings.developerMode === true) &&
-        next.paddingMode === settings.paddingMode &&
-        next.textScalePct === settings.textScalePct;
+        next.paddingMode === settings.paddingMode && next.depositDefault === settings.depositDefault &&
+        next.textScalePct === settings.textScalePct &&
+        next.tipTenths === settings.tipTenths &&
+        next.tipConsentAt === settings.tipConsentAt;
     return same ? settings : next;
 }
 /** Replay a whole queue in order. Used to rebuild after a version conflict. */

package/dist/shared/lib/drive/manifest-pack.d.ts

@@ -0,0 +1,65 @@
+import { type ManifestEntry } from "./manifest-codec.ts";
+import { type ManifestIndex } from "./manifest-index.ts";
+/**
+ * The marker an entry gets when its parent chain does not reach the drive root.
+ *
+ * U+FFFF is a permanent noncharacter, so no name can contain it and it sorts after every assigned
+ * character in both code-point and UTF-16 order. That is what puts "placed after every entry that
+ * can be resolved" (§6.3.3) INSIDE the key, where any comparator honours it.
+ */
+export declare const UNRESOLVED_MARK = "\uFFFF";
+/**
+ * One chunk as the packer decided it.
+ *
+ * `reuse` is a chunk's existing name: present when its entry set came through an edit untouched,
+ * so the flow can name it in the new index without writing a byte. Absent means "seal these
+ * entries and write them".
+ */
+export interface PackedChunk {
+    reuse?: string;
+    items: readonly ManifestEntry[];
+    /** Placement key of the first entry. */
+    f: string;
+    /** Placement key of the last entry. */
+    l: string;
+}
+/** A chunk this device currently holds open, as the flow read it out of the index. */
+export interface HeldChunk {
+    /** Its name — the hash the index gave it. */
+    h: string;
+    f: string;
+    l: string;
+    items: readonly ManifestEntry[];
+}
+/**
+ * The placement key of one entry: its folder path from the drive root, each segment the folder's
+ * plaintext name, then the entry's own name, joined by `/`.
+ *
+ * Trashed entries keep the key they had — the trash is a mark on an entry, not a place — so
+ * nothing here reads `deletedAt`.
+ */
+export declare function placementKey(entry: ManifestEntry, index: ManifestIndex): string;
+/**
+ * Compare two placement keys BY CODE POINT, as §6.3.3 requires.
+ *
+ * JavaScript's own `<` compares UTF-16 code units, which puts an astral character (U+10000 and up,
+ * stored as a surrogate pair starting at U+D800) BEFORE U+E000–U+FFFF instead of after it. That is
+ * a different order from the one the format specifies, so keys carrying a surrogate take the exact
+ * path; everything else takes the fast one, which is the same order for those strings.
+ */
+export declare function comparePlacementKeys(a: string, b: string): number;
+/**
+ * Pack every entry from scratch, in key order, closing a chunk when the next entry would push its
+ * plaintext past the bound. Used for the first save of an account and for the version-1
+ * conversion (§6.3.6).
+ */
+export declare function packAll(entries: readonly ManifestEntry[]): PackedChunk[];
+/**
+ * The minimal rewrite: keep every chunk whose entries came through the edit untouched, rewrite the
+ * ones that changed, split what grew past the bound and merge what shrank under half of it.
+ *
+ * An entry stays in the chunk that held it only while its key is still inside that chunk's range.
+ * A move between folders changes the key, so it leaves as a removal and arrives as an addition —
+ * which is exactly the "at most two chunks" §6.3.3 describes.
+ */
+export declare function repack(previous: readonly HeldChunk[], entries: readonly ManifestEntry[]): PackedChunk[];

package/dist/shared/lib/drive/manifest-pack.js

@@ -0,0 +1,287 @@
+// Placement and packing for the chunked file list — NCF-3 §6.3.3. ⚠ PUBLISHED — copied
+// byte-for-byte into the `nmts` command-line package; keep comments self-contained English.
+//
+// WHAT THIS DECIDES: which entry goes in which chunk, and — for a save — which chunks can be kept
+//   by name because nothing inside them moved. That second answer is the whole point of format
+//   version 2: an edit that touches one file must upload one chunk, not the list.
+//
+// PURE: no I/O, no crypto, no React. It takes entries and the previous chunks and returns a plan;
+//   sealing, naming and writing are `manifest-chunk-flow.ts`'s job.
+//
+// PLACEMENT IS THE WRITER'S DUTY AND THE READER'S CONVENIENCE. A reader must find an entry by
+//   opening every chunk the index names; it MAY open the one whose range covers the folder on
+//   screen first. So a writer that gets placement wrong has written a slow list, not a wrong one —
+//   which is why the fallbacks below prefer "repack everything" over "refuse".
+import { toWire } from "./manifest-codec.js";
+import { buildIndex, pathOf } from "./manifest-index.js";
+import { CHUNK_PLAIN_MAX } from "./manifest-chunks.js";
+/**
+ * The marker an entry gets when its parent chain does not reach the drive root.
+ *
+ * U+FFFF is a permanent noncharacter, so no name can contain it and it sorts after every assigned
+ * character in both code-point and UTF-16 order. That is what puts "placed after every entry that
+ * can be resolved" (§6.3.3) INSIDE the key, where any comparator honours it.
+ */
+export const UNRESOLVED_MARK = "\uFFFF";
+/** Bytes for `{"v":2,"seq":<up to 16 digits>,"items":[]}` — the wrapper around a chunk's items. */
+const CHUNK_DOC_OVERHEAD = 41;
+const utf8 = new TextEncoder();
+/** A key holding one half of a surrogate pair needs the slow, exact comparator below. */
+const HAS_SURROGATE = /[\uD800-\uDFFF]/;
+/**
+ * The placement key of one entry: its folder path from the drive root, each segment the folder's
+ * plaintext name, then the entry's own name, joined by `/`.
+ *
+ * Trashed entries keep the key they had — the trash is a mark on an entry, not a place — so
+ * nothing here reads `deletedAt`.
+ */
+export function placementKey(entry, index) {
+    const key = [...pathOf(index, entry), entry.name].join("/");
+    return reachesRoot(index, entry) ? key : UNRESOLVED_MARK + key;
+}
+/** Whether this entry's parent chain ends at the root rather than at a gap or a loop. */
+function reachesRoot(index, entry) {
+    const seen = new Set([entry.id]);
+    let parentId = entry.parentId;
+    while (parentId !== null) {
+        if (seen.has(parentId))
+            return false;
+        seen.add(parentId);
+        const parent = index.byId.get(parentId);
+        if (!parent)
+            return false;
+        parentId = parent.parentId;
+    }
+    return true;
+}
+/**
+ * Compare two placement keys BY CODE POINT, as §6.3.3 requires.
+ *
+ * JavaScript's own `<` compares UTF-16 code units, which puts an astral character (U+10000 and up,
+ * stored as a surrogate pair starting at U+D800) BEFORE U+E000–U+FFFF instead of after it. That is
+ * a different order from the one the format specifies, so keys carrying a surrogate take the exact
+ * path; everything else takes the fast one, which is the same order for those strings.
+ */
+export function comparePlacementKeys(a, b) {
+    if (a === b)
+        return 0;
+    if (!HAS_SURROGATE.test(a) && !HAS_SURROGATE.test(b))
+        return a < b ? -1 : 1;
+    const ca = Array.from(a);
+    const cb = Array.from(b);
+    const n = Math.min(ca.length, cb.length);
+    for (let i = 0; i < n; i += 1) {
+        const pa = ca[i]?.codePointAt(0) ?? 0;
+        const pb = cb[i]?.codePointAt(0) ?? 0;
+        if (pa !== pb)
+            return pa < pb ? -1 : 1;
+    }
+    return ca.length - cb.length;
+}
+function keyAll(entries) {
+    const index = buildIndex(entries);
+    const keyed = entries.map((entry) => {
+        const json = JSON.stringify(toWire(entry));
+        const key = placementKey(entry, index);
+        return { entry, key, json, bytes: utf8.encode(json).length, astral: HAS_SURROGATE.test(key) };
+    });
+    keyed.sort(order);
+    return keyed;
+}
+/** Placement order, with the entry id as the tie-break so two same-named files never swap places. */
+function order(a, b) {
+    const byKey = a.astral || b.astral
+        ? comparePlacementKeys(a.key, b.key)
+        : a.key < b.key
+            ? -1
+            : a.key > b.key
+                ? 1
+                : 0;
+    return byKey !== 0 ? byKey : a.entry.id < b.entry.id ? -1 : a.entry.id > b.entry.id ? 1 : 0;
+}
+/** The plaintext a chunk holding exactly these entries would occupy. */
+function sizeOf(items) {
+    let total = CHUNK_DOC_OVERHEAD;
+    for (const k of items)
+        total += k.bytes + 1;
+    return items.length === 0 ? CHUNK_DOC_OVERHEAD : total - 1;
+}
+/**
+ * Pack every entry from scratch, in key order, closing a chunk when the next entry would push its
+ * plaintext past the bound. Used for the first save of an account and for the version-1
+ * conversion (§6.3.6).
+ */
+export function packAll(entries) {
+    return close(fill(keyAll(entries)));
+}
+/** Greedy fill in key order — the "unused remainder is left unused" rule of §6.3.3. */
+function fill(keyed) {
+    const out = [];
+    let current = [];
+    let size = CHUNK_DOC_OVERHEAD;
+    for (const k of keyed) {
+        const next = size + k.bytes + (current.length === 0 ? 0 : 1);
+        if (current.length > 0 && next > CHUNK_PLAIN_MAX) {
+            out.push(current);
+            current = [k];
+            size = CHUNK_DOC_OVERHEAD + k.bytes;
+            continue;
+        }
+        current.push(k);
+        size = next;
+    }
+    if (current.length > 0)
+        out.push(current);
+    return out;
+}
+/** Turn buckets into the plan the flow writes, dropping any that ended up empty. */
+function close(buckets, reuse = []) {
+    const out = [];
+    for (let i = 0; i < buckets.length; i += 1) {
+        const items = buckets[i] ?? [];
+        if (items.length === 0)
+            continue;
+        const name = reuse[i];
+        out.push({
+            ...(name ? { reuse: name } : {}),
+            items: items.map((k) => k.entry),
+            f: items[0]?.key ?? "",
+            l: items[items.length - 1]?.key ?? "",
+        });
+    }
+    return out;
+}
+/**
+ * The minimal rewrite: keep every chunk whose entries came through the edit untouched, rewrite the
+ * ones that changed, split what grew past the bound and merge what shrank under half of it.
+ *
+ * An entry stays in the chunk that held it only while its key is still inside that chunk's range.
+ * A move between folders changes the key, so it leaves as a removal and arrives as an addition —
+ * which is exactly the "at most two chunks" §6.3.3 describes.
+ */
+export function repack(previous, entries) {
+    if (previous.length === 0)
+        return packAll(entries);
+    const keyed = keyAll(entries);
+    const owner = new Map();
+    for (let i = 0; i < previous.length; i += 1) {
+        for (const e of previous[i]?.items ?? [])
+            owner.set(e.id, i);
+    }
+    const buckets = previous.map(() => []);
+    for (const k of keyed) {
+        const held = owner.get(k.entry.id);
+        const home = held !== undefined && inRange(k.key, previous[held]) ? held : covering(k.key, previous);
+        buckets[home]?.push(k);
+    }
+    for (const bucket of buckets)
+        bucket.sort(order);
+    // ⚠ A previous index written by another build may have overlapping ranges, which the format
+    // explicitly allows (§6.3.3). Bucketing by range would then interleave keys across chunks, so
+    // the placement invariant is checked and a repack that would break it becomes a full repack —
+    // slower for one save, and correct.
+    if (!ordered(buckets))
+        return packAll(entries);
+    const reuse = buckets.map((bucket, i) => (unchanged(bucket, previous[i]) ? previous[i]?.h : undefined));
+    return close(...merge(...split(buckets, reuse)));
+}
+/** Is this key inside the chunk's declared range? */
+function inRange(key, chunk) {
+    if (!chunk)
+        return false;
+    return comparePlacementKeys(key, chunk.f) >= 0 && comparePlacementKeys(key, chunk.l) <= 0;
+}
+/** The chunk this key belongs to: the last one whose range starts at or before it, else the first. */
+function covering(key, previous) {
+    let at = 0;
+    for (let i = 0; i < previous.length; i += 1) {
+        const f = previous[i]?.f;
+        if (f !== undefined && comparePlacementKeys(f, key) <= 0)
+            at = i;
+    }
+    return at;
+}
+/** Do the buckets, read end to end, still hold every entry in placement order? */
+function ordered(buckets) {
+    let last = null;
+    for (const bucket of buckets) {
+        for (const k of bucket) {
+            if (last && order(last, k) > 0)
+                return false;
+            last = k;
+        }
+    }
+    return true;
+}
+/** Same entries, same order, same bytes — the test for "this chunk can keep its name". */
+function unchanged(bucket, chunk) {
+    if (!chunk || bucket.length !== chunk.items.length || bucket.length === 0)
+        return false;
+    for (let i = 0; i < bucket.length; i += 1) {
+        const before = chunk.items[i];
+        if (!before || before.id !== bucket[i]?.entry.id)
+            return false;
+        if (JSON.stringify(toWire(before)) !== bucket[i]?.json)
+            return false;
+    }
+    return true;
+}
+/** Split every bucket that outgrew the bound, at the median key, until each one fits. */
+function split(buckets, reuse) {
+    const outBuckets = [];
+    const outReuse = [];
+    for (let i = 0; i < buckets.length; i += 1) {
+        const queue = [buckets[i] ?? []];
+        let whole = true;
+        while (queue.length > 0) {
+            const bucket = queue.shift() ?? [];
+            if (bucket.length > 1 && sizeOf(bucket) > CHUNK_PLAIN_MAX) {
+                const at = Math.floor(bucket.length / 2);
+                queue.unshift(bucket.slice(0, at), bucket.slice(at));
+                whole = false;
+                continue;
+            }
+            outBuckets.push(bucket);
+            outReuse.push(whole ? reuse[i] : undefined);
+        }
+    }
+    return [outBuckets, outReuse];
+}
+/**
+ * Merge a chunk that fell under half the bound into the next one, when the pair fits.
+ *
+ * ⛔ BOTH SIDES HAVE TO BE UNDER HALF, which §6.3.3 does not say and this file adds. Without it a
+ * chunk emptied by a delete would pull in a FULL neighbour whenever the two happened to fit, so
+ * one removal would rewrite ~4 MiB of somebody else's untouched entries — the opposite of the
+ * property chunking exists for. With it, small neighbours combine, a full chunk is never rewritten
+ * because of its neighbour, and re-packing a freshly packed list changes nothing (the last chunk
+ * is usually the only small one and it has no next).
+ *
+ * Left to right with the result re-examined, so a run of chunks emptied by a folder delete
+ * collapses in one pass instead of leaving a trail of near-empty chunks behind.
+ */
+function merge(buckets, reuse) {
+    const outBuckets = buckets.map((b) => b.slice());
+    const outReuse = reuse.slice();
+    const half = CHUNK_PLAIN_MAX / 2;
+    let i = 0;
+    while (i < outBuckets.length) {
+        const here = outBuckets[i] ?? [];
+        // A chunk whose every entry left simply stops existing. ⛔ Dropped BEFORE the merge below, or
+        // it would be "merged" into its neighbour and cost that neighbour its name for nothing.
+        if (here.length === 0) {
+            outBuckets.splice(i, 1);
+            outReuse.splice(i, 1);
+            continue;
+        }
+        const next = outBuckets[i + 1];
+        const fits = next !== undefined && sizeOf(here) + sizeOf(next) - CHUNK_DOC_OVERHEAD <= CHUNK_PLAIN_MAX;
+        if (next !== undefined && fits && sizeOf(here) < half && sizeOf(next) < half) {
+            outBuckets.splice(i, 2, [...here, ...next]);
+            outReuse.splice(i, 2, undefined);
+            continue;
+        }
+        i += 1;
+    }
+    return [outBuckets, outReuse];
+}

package/dist/shared/lib/drive/manifest-settings.d.ts

@@ -0,0 +1,113 @@
+export interface AccountSettings {
+    /** Developer mode — technical storage facts + ciphertext links in the file detail. Absent = off. */
+    developerMode?: true;
+    /**
+     * In-app text size, percent of the DEVICE's own size. Absent = 100 = follow the device. Never a
+     * pixel value: the device's own accessibility setting stays underneath, and this multiplies it.
+     */
+    textScalePct?: number;
+    /**
+     * SIZE PADDING rule — how coarsely a file's stored size is rounded up.
+     *
+     * Absent = Padmé, the default: about 32 possible sizes per doubling, ~1% more storage.
+     * `"pow2"` rounds to the next power of two: one size per doubling, ~39% more storage.
+     * `"none"` does not round: the file's exact length is what the stored stream states, and about
+     * 1% less storage is used. It was added on the owner's rule that anything Walrus itself allows
+     * must be reachable here (2026-09-06); the cost of it is stated where the choice is made, which is
+     * what makes it a choice rather than a trap.
+     *
+     * Here, in the sealed list, for the same reason the other two are: the server must not learn it
+     * (it would be a per-account fingerprint the server could hold on to), and it
+     * follows the account rather than the device, so a phone and a laptop pad the same way.
+     *
+     * ⚠ It applies to what is uploaded NEXT. Bytes already on the storage network cannot be
+     * re-padded, and the screen says so.
+     */
+    paddingMode?: "pow2" | "none";
+    /**
+     * DEFAULT DEPOSIT — how many credits ride with each credit-paid upload as its deposit, in whole
+     * credits. Absent = the full deposit (`DEPOSIT_MAX_CREDITS`), which is what a person who has
+     * never touched this gets. `0` is a real answer and is written: it means "hold nothing back".
+     *
+     * The deposit pays the network fee when a file is released early; a file with no deposit pays
+     * that fee twice, from the balance. The payment screen opens on this number and the person can
+     * move it for that one upload.
+     *
+     * Here, in the sealed list, for the reason the padding rule beside it is: the server must not
+     * learn it, and it follows the account, so the browser and the `nmts` command both open on the
+     * same figure.
+     */
+    depositDefault?: number;
+    /**
+     * STANDING TIP — the share of every storage payment sent to the developer as a gift, in tenths
+     * of a percent (25 = 2.5 %). Absent = 0 = nothing is sent. Set by the person, once, on the
+     * wallet screen or with the CLI; from then on every payment sends it without a question, in
+     * the coin just paid (WAL).
+     */
+    tipTenths?: number;
+    /**
+     * When the person first agreed to the gift terms (voluntary · nothing in return · not refundable
+     * · goes to the published address · visible on the chain), as a UTC millisecond instant. Absent
+     * = never agreed: raising the tip above 0 asks for that agreement once, and later changes do not.
+     */
+    tipConsentAt?: number;
+}
+/** The sanity bounds a stored text scale must sit in to be USED. One place; codec and UI agree. */
+export declare const TEXT_SCALE_MIN_PCT = 80;
+export declare const TEXT_SCALE_MAX_PCT = 160;
+/** Follow the device. Not written to the wire — absence is the only spelling of it. */
+export declare const TEXT_SCALE_DEFAULT_PCT = 100;
+export interface WireSettings {
+    /** developerMode. */
+    dm?: 1;
+    /** textScalePct. */
+    tx?: number;
+    /**
+     * paddingMode, present only for the non-default rule.
+     *
+     * ⛔ ADDED 2026-08-24 AFTER MEASURING THAT IT WAS MISSING. The setting existed on
+     * `AccountSettings`, the screen wrote it and the uploader read it — but neither direction of
+     * this codec carried it, so every save dropped it and every reload went back to the default.
+     * Somebody who chose to pay about 39% more storage to round their file sizes more coarsely got
+     * the default rule instead, on every device, silently. A settings field is not saved because it
+     * is declared; it is saved because both functions below name it.
+     */
+    pd?: "pow2" | "none";
+    /**
+     * depositDefault, present only when it is NOT the full deposit.
+     *
+     * ⚠ `0` is written and read here, unlike every optional field beside it: a person who wants no
+     * deposit held has chosen something, and dropping a 0 would silently give them the full 64.
+     */
+    dd?: number;
+    /** tipTenths, present only above 0. */
+    tp?: number;
+    /** tipConsentAt. */
+    tc?: number;
+}
+/** The most a standing tip can be: the whole payment. Above the dial's 10 % it is typed and confirmed. */
+export declare const TIP_TENTHS_MAX = 1000;
+/**
+ * The deposit range this format carries: whole credits, 0 to 64.
+ *
+ * ⚠ The SERVER's own ceiling rides on the account view (`deposit_max`) and is what the payment
+ * screen holds the chosen figure inside. This pair is the format's bound, so a value written by
+ * some other build is read back only when it is one this build can also write.
+ */
+export declare const DEPOSIT_MAX_CREDITS = 64;
+/** What an account's deposit is when nobody chose. Not written to the wire — absence spells it. */
+export declare const DEPOSIT_DEFAULT_CREDITS = 64;
+/** The default deposit in force for an account, in credits. Absence is the full deposit, not 0. */
+export declare function depositDefaultOf(settings: AccountSettings | null | undefined): number;
+/** Settings → wire, or null when every field is at its default (then nothing is written). */
+export declare function settingsToWire(s: AccountSettings | undefined): WireSettings | null;
+/**
+ * Wire → settings, dropping anything unusable. A text scale outside the bounds is DROPPED, not
+ * clamped: rendering a whole app at a number some other build miswrote is worse than falling back
+ * to the device's own size, which is always readable.
+ */
+export declare function settingsFromWire(w: unknown): AccountSettings | undefined;
+/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
+export declare function applyDepositPatch(next: AccountSettings, depositDefault?: number): void;
+/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
+export declare function applyTipPatch(next: AccountSettings, tipTenths?: number, tipConsentAt?: number): void;