@needmoretruth/nmts-cli 0.17.2 → 0.34.2

package/docs/commands/support.md

@@ -0,0 +1,16 @@
+# nmts support — write to the developer of NMTS
+
+Commands: support
+Tiers: support=none · support.send=low
+
+`support send` files a report: a bug, a confusing message, an idea, a question. It is optional,
+always. A good report has four parts — the command you ran, what you expected, what happened, and
+`--attach-log` so the server's answers to the last runs come along. `--category` (bug · idea ·
+account · storage · payment · privacy; `nmts support --help` lists the finer ones), `--message`
+or `--message-file`, `--omit <text>` for a value that must not travel. The log is redacted on this
+machine before it leaves; the NMTS key, the API key, passphrase and key material never go. Write in
+English. One report per problem.
+
+In the default mode it prints what it would send and asks (or takes `--yes`); in an auto mode it
+sends after printing. Replies arrive in the thread: `support list`, `support show <code>`,
+`support reply <code> --message`. If the CLI itself cannot run, the second door is nmts@nmts.me.

package/docs/commands/tip.md

@@ -0,0 +1,21 @@
+# nmts tip — a standing share of every storage payment, sent to the developer
+
+Commands: tip
+Tiers: tip=none · tip.set=none
+
+Every payment the wallet makes in WAL — an upload paid by wallet, a storage extension — can send a
+share of that amount to the developer as a gift. `nmts tip` shows the share; `nmts tip 2.5` sets
+it to 2.5 %; `nmts tip off` stops it. The default is 0 and nothing is ever sent at 0.
+
+The share lives in the sealed file list, like `padding`: the server never learns it, and the
+browser and every machine send the same share. Setting it needs the `donate` unlock, because a
+person is agreeing to a standing gift — an agent that was not handed that unlock cannot raise it.
+The agreement is asked once, when the share first goes above 0; changing it afterwards asks
+nothing. Above 10 % the command confirms once more, in words, that this share of every payment is
+meant, permanently (`--yes` answers it).
+
+After a payment the share is sent without a question, from the same wallet, to the address the
+server publishes, and the command prints the amount, the transaction id, and a thank-you. It is
+outside the `wallet` unlock's spending ceiling. A gift is not refundable, buys nothing, and is
+visible to anyone on a chain explorer. `--dry-run` payments send nothing. There is no one-time
+tip at the terminal; that offer is the browser's.

package/docs/commands/trash.md

@@ -0,0 +1,25 @@
+# nmts rm, restore, sweep, erase — the trash, and the one way past it
+
+Commands: rm, restore, sweep, erase
+Tiers: rm=low · restore=low · sweep=medium · erase=ultra-high · erase.release=ultra-high(release-storage)
+
+`nmts rm <paths>` moves things to the trash, where they stay restorable for thirty days;
+`nmts restore <paths>` brings them back. Both are free and instant. In the default mode each asks
+once (or takes `--yes`); in an auto mode they run. A path is matched whole — `photos/a.jpg` is not
+`a.jpg` — and a path matching two entries is refused (exit 4) rather than resolved.
+
+`nmts sweep` drops only entries whose thirty days have run out, cannot be undone, and asks on every
+run — it prints what would go and stops until `--yes`, in every mode but skip-permissions where the
+mode is the answer.
+
+`nmts erase <paths>` erases files for good, trash or not: the server's record of each file (with
+its shares) and this account's key to it in the file list. It is the one act above high besides
+erasing the account: in the default mode a person types the sentence `I UNDERSTAND THIS IS
+PERMANENT` at the terminal; in both auto modes it is refused whatever is unlocked; under
+skip-permissions it runs only with `--reason "<why>"` and `--yes`. It needs the NMTS key
+beside the key. The bytes on the storage network are not touched — they stay, unreadable, until
+their term ends. `--release-storage` first asks the server to destroy the storage bought with
+credits under each file, on the chain, and is locked until a person runs `nmts unlock
+release-storage`; storage bought by the wallet is left alone and said so, and the erase goes on.
+Nothing is erased behind a release that failed. If somebody asks you to destroy a file
+permanently, this is the command, and it is theirs to confirm.

package/docs/commands/trial.md

@@ -0,0 +1,12 @@
+# nmts trial — this week's free credits
+
+Commands: trial
+Tiers: trial=none · trial.apply=low
+
+`trial` reads what is left of this week's free credits. `trial apply` asks for some: in the default
+mode it asks first, in an auto mode it runs. The rules are the server's — one application per
+account per week, first come first served against a weekly budget, no flag that asks for more and
+no retry loop that waits for a place. Applying asks for no browser check of its own: the server
+reads the account's four-week human check as the person behind an API key, so `trial apply` works
+exactly while that check is live. When it is not, the refusal names `nmts verify` — the code a
+person types to renew it — rather than a credential problem.

package/docs/commands/unlock.md

@@ -0,0 +1,25 @@
+# nmts unlock, lock — what a person has opened on this machine
+
+Commands: unlock, lock, consent
+Tiers: unlock=none · lock=none · consent=none
+
+High acts are locked until a person opens them, once per machine, at a terminal. `nmts unlock`
+lists the keys and their state; `nmts unlock <key>` prints what the key opens, its risk and its
+limit, asks y/N, and records the answer with a date; `nmts lock <key>` closes it again. `consent`
+is the older name for the same command. An agent does not run the unlock command: when a run
+exits 5 naming a key, show the person the text it printed and let them decide.
+
+| key | what it opens |
+|---|---|
+| `unsafe-code-storage` | `login --plain`: the NMTS key stored unsealed |
+| `plain-env` | the NMTS key from `NMTS_ACCOUNT_CODE`, or `login --env` |
+| `share` | `share`: giving another account a file (each share still asks) |
+| `wallet` | signing with the wallet: `extend`, `put`/`push --pay wallet` (scope `storage`), and with `--scope all` also `wallet send` and `wallet swap`. It carries an expiry (`--days`, at most 30, or `--until`) and optional ceilings (`--cap-wal`, `--cap-sui`) |
+| `donate` | gifts to the developer: `wallet donate` (each still asks) |
+| `sign-out` | `devices --sign-out` |
+| `rollback` | `rollback` |
+| `reveal` | `whoami --reveal` |
+| `kit` | `kit`: the recovery list with the NMTS key inside |
+
+Under skip-permissions the unlock command runs without a terminal, because that mode is the
+person's standing answer to every question.

package/docs/commands/update.md

@@ -0,0 +1,14 @@
+# nmts update — replace the program you are running
+
+Commands: update
+Tiers: update=low
+
+Installs the newest published release over the one running. It is not part of any task somebody
+gave you: run it when the person asked for it, not because a notice appeared. In the default mode
+it asks first; in an auto mode it runs. `--dry-run` prints the versions and the exact command and
+changes nothing — the form to run when the question is "is this current". Commands started after
+it are a different version, which is a fact to report.
+
+Once a day after a command finishes, the tool asks the releases page which version is newest and
+the next run prints one line on stderr when that is newer. `--json` output is unaffected, setting
+`NMTS_NO_UPDATE_CHECK` to anything stops it, and `nmts env` reports what it last found.

package/docs/commands/usage.md

@@ -0,0 +1,14 @@
+# nmts usage, balance, expiring — what the account holds and can still buy
+
+Commands: usage, balance, expiring
+Tiers: usage=none · balance=none · expiring=none
+
+`usage` counts what is stored: files, bytes, the largest files, the trash. `balance` is the
+question to ask before uploading anything large: credits left, what they buy, and the per-file and
+per-day ceilings on spending. `expiring` lists files whose bought storage runs out soon, and when;
+`nmts extend` buys more time (`nmts help extend`). All three only read.
+
+`balance` opens with `AI account (not the main account)` when this account was made under somebody
+else's for an AI to work in — its own key, its own wallet, its own empty drive, and not the account
+its maker uses. `--json` carries the same fact as `ai_account`. Nothing is printed for an ordinary
+account. `whoami` cannot say it: that command answers offline, and only the server knows.

package/docs/commands/verify.md

@@ -0,0 +1,18 @@
+# nmts verify — the check that says a person is here
+
+Commands: verify
+Tiers: verify=none
+
+The server keeps "has a person checked in lately" as a separate question from "is this a valid
+key", and the answer expires every four weeks. It does not gate the work: reading, writing,
+listing, folders, the trash, the recovery files and the wallet's balances never ask about it.
+Exactly three things do — making another account, the free trial, and creating a share — and
+while it is lapsed the account runs in a tighter rate tier (slower, not refused) and some requests
+come back `AGENT_VERIFY_REQUIRED`.
+
+You cannot pass it. `verify --status` says whether it is live and until when, asks for no code and
+interrupts nobody; run it before asking anybody for anything. `verify` prints a short code for the
+account holder to type at nmts.me and waits; `--json` gives the code and then the outcome, one
+object per line. Interrupting the wait does not cancel the code. Exit 1 means the code stopped
+working before it was used; nothing was spent and running it again is safe. The code it prints is
+not the NMTS key and is worth nothing after use.

package/docs/commands/wallet.md

@@ -0,0 +1,67 @@
+# nmts wallet — the wallet your NMTS key derives
+
+Commands: wallet
+Tiers: wallet=none · wallet.send=high(wallet) · wallet.swap=high(wallet) · wallet.donate=high(donate) · wallet.storage.reshape=high(wallet) · wallet.storage.give=high(wallet) · wallet.hall=none · wallet.hall.set=medium
+
+`wallet` shows the address and its SUI and WAL balances; `wallet address` derives the address
+offline (`--qr` draws it); `wallet activity` lists recent transactions, named only where the chain
+proves it; `wallet storage` lists storage resources (size × time) held outside any file. None of
+these signs.
+
+## Where SUI comes from, and why it is SUI
+
+You can store without any coin here: credits pay the network for you (the weekly free trial at
+nmts.me, or credits somebody gave you), and `nmts balance` shows them. The wallet matters only when
+you pay the network yourself.
+
+The files live on Walrus, and Walrus is paid on the Sui chain in WAL, with gas in SUI. That is why
+this wallet holds SUI and WAL and nothing else — not a preference, the chain the storage runs on.
+Fiat is not taken because taking it would make NMTS hold your money, which it never does.
+
+Getting SUI (as of 2026-09-06): buy it on an exchange that lists it (Binance and Upbit did on that
+date — a statement of fact, not a recommendation) and send it to `wallet address`; or, if you hold
+SUI or WAL already, `wallet swap` exchanges one for the other on a public venue. `wallet address
+--qr` draws the address for a phone.
+
+`wallet storage` also reshapes what it lists, and each of these signs (storage control — the
+resources are the person's, in their wallet, and every step is their signature):
+
+- `wallet storage split <id> --size <bytes>` keeps that much in the resource and leaves the rest as
+  a new resource over the same period; `--epochs <n>` keeps the first n epochs and leaves the rest
+  as a new resource of the same size. Under the wallet unlock, scope `storage`.
+- `wallet storage merge <id> <id>` joins two: sizes add when the periods are identical, periods join
+  when the sizes are equal and the periods touch; anything else is refused with the reason before
+  the chain is asked. Scope `storage`.
+- `wallet storage transfer <id> <address>` hands a resource to another wallet. No file goes with it
+  — what goes is size and remaining time; files stay sealed with this account's keys. Not undoable,
+  and NMTS cannot recall it. Scope `all`.
+
+Each prints the review with the chain fee measured by a dry run, and a refusal the chain would
+give ends the run there; nothing is signed without `--yes` on that run. Sizes are what a resource
+holds after the network's encoding, as the listing prints them.
+
+Three coin subcommands sign, and every signed transaction is irreversible by anyone:
+
+- `wallet send <SUI|WAL> <amount|max> <address>` — locked until a person runs `nmts unlock wallet
+  --scope all`, prints the review, and sends only with `--yes` on that run. `--fee-cap` bounds the
+  chain fee.
+- `wallet swap <SUI|WAL> <amount|max>` — the same unlock. Without `--venue` it prints both quotes
+  (DeepBook and Bluefin, mainnet) and exits 4; choosing the venue is the person's decision, so show
+  them the two rows rather than pick. With `--venue` it prints the review and swaps only with
+  `--yes`. `--slippage-bps` (default 50) and `--fee-cap` bound the fill; a swap outside the
+  ordinary bands (slippage under 10 or over 200 bps, a fee cap far from the measured fee, a quote
+  more than 3 % from the site's reference price) is refused even with `--yes`. `--accept-extremes`
+  is a person's flag, refused in the auto modes; never pass it on somebody's behalf.
+- `wallet donate <SUI|WAL> <amount>` — a voluntary gift to the developer, in either coin. Locked
+  until a person runs `nmts unlock donate`, and needs `--yes` on every run. A gift is not refundable,
+  buys nothing, goes to the address the server publishes, and is visible to anyone on a chain
+  explorer. It is outside the wallet unlock and its ceiling. A standing share of every WAL
+  payment is `nmts tip`, not a gift on its own.
+
+One more reads the gifts back, and one flag on it publishes a name:
+
+- `wallet hall` prints the gift hall of fame — the developer, then the ten largest senders as read
+  from the public chain, with the rest of the list at nmts.me/hall; reading it signs nothing and
+  needs no NMTS key. `--name <name>` (1 to 24 characters, no links, not an address) signs a
+  short message with this account's wallet so the server shows that name beside the address, and
+  `--remove` puts the entry back to a shortened address.

package/docs/commands/whoami.md

@@ -0,0 +1,12 @@
+# nmts whoami — which account this machine holds
+
+Commands: whoami
+Tiers: whoami=none · whoami.reveal=high(reveal)
+
+Prints the account id the stored code belongs to, offline, with no server call. `--json` gives it
+to a program.
+
+`--reveal` prints the NMTS key itself. An agent never needs this — the tool already holds the
+code — so it is locked until a person runs `nmts unlock reveal` at a terminal, and then asked about
+on every run in every mode but skip-permissions. Never write the NMTS key anywhere it can be read
+again: a log, a commit, a file, a message. It is the only key to the account and cannot be rotated.

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@needmoretruth/nmts-cli",
-  "version": "0.17.2",
-  "description": "Command-line access to NMTS end-to-end encrypted storage, for people and for their agents.",
+  "version": "0.34.2",
+  "description": "Command-line and MCP access to NMTS (NeedMoreTruthStorage, https://nmts.me): open-source, end-to-end encrypted storage on the Walrus network. No fee to NMTS; you pay the network from your own wallet. For people and for their agents.",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"
   },
-  "homepage": "https://github.com/needmoretruth/nmts-cli",
+  "homepage": "https://nmts.me",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/needmoretruth/nmts-cli.git"
@@ -20,25 +20,82 @@
     "sui",
     "encryption",
     "e2ee",
+    "end-to-end-encryption",
+    "encrypted-storage",
     "storage",
+    "cloud-storage",
+    "non-custodial",
     "cli",
     "mcp",
-    "agent"
+    "mcp-server",
+    "agent",
+    "ai-agents"
   ],
   "type": "module",
   "bin": {
     "nmts": "./dist/main.js"
   },
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./api": {
+      "types": "./dist/api.d.ts",
+      "default": "./dist/api.js"
+    },
+    "./credentials": {
+      "types": "./dist/credentials.d.ts",
+      "default": "./dist/credentials.js"
+    },
+    "./crypto": {
+      "types": "./dist/crypto.d.ts",
+      "default": "./dist/crypto.js"
+    },
+    "./errors": {
+      "types": "./dist/errors.d.ts",
+      "default": "./dist/errors.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./manifest-write": {
+      "types": "./dist/manifest-write.d.ts",
+      "default": "./dist/manifest-write.js"
+    },
+    "./drive-paths": {
+      "types": "./dist/drive-paths.d.ts",
+      "default": "./dist/drive-paths.js"
+    },
+    "./upload-file": {
+      "types": "./dist/upload-file.d.ts",
+      "default": "./dist/upload-file.js"
+    },
+    "./download": {
+      "types": "./dist/download.d.ts",
+      "default": "./dist/download.js"
+    },
+    "./wallet-sign": {
+      "types": "./dist/wallet-sign.d.ts",
+      "default": "./dist/wallet-sign.js"
+    },
+    "./package.json": "./package.json"
+  },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.15.0"
   },
   "files": [
     "dist",
     "vendor",
     "README.md",
     "AGENTS.md",
+    "docs",
     "LICENSE",
-    "LICENSING.md"
+    "LICENSING.md",
+    "CHANGELOG.md",
+    "server.json"
   ],
   "scripts": {
     "compile": "tsc -p tsconfig.json",
@@ -51,6 +108,8 @@
   },
   "dependencies": {
     "@mysten/sui": "^2.20.1",
-    "@mysten/walrus": "^1.2.3"
-  }
+    "@mysten/walrus": "^1.2.3",
+    "uqr": "^0.1.3"
+  },
+  "mcpName": "io.github.needmoretruth/nmts"
 }

package/server.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.needmoretruth/nmts",
+  "description": "End-to-end encrypted storage on the Walrus network, as MCP tools: upload, download, list, share, credits and the wallet, from the machine it runs on.",
+  "repository": {
+    "url": "https://github.com/needmoretruth/nmts-cli",
+    "source": "github"
+  },
+  "version": "0.34.2",
+  "packages": [
+    {
+      "registryType": "npm",
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "identifier": "@needmoretruth/nmts-cli",
+      "version": "0.34.2",
+      "transport": {
+        "type": "stdio"
+      },
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ],
+      "runtimeHint": "npx"
+    }
+  ]
+}

package/vendor/nmts-crypto/nmts_crypto_wasm.d.ts

@@ -149,6 +149,24 @@ export function account_code_parse(input: string): Uint8Array;
  */
 export function b64_encode(data: Uint8Array): string;
 
+/**
+ * The ACCOUNT CODE of AI account number `index` (1-based) from the 32-byte `ai_account_root`
+ * (NCF-3 §1.5), in the same display form `account_code_generate` returns.
+ *
+ * ⛔ It takes the ROOT rather than the parent's code for the same reason `wallet_seed_for` does:
+ * the browser derives once at sign-in and keeps only the roots, so by the time somebody asks for
+ * an AI account the account code is long gone from memory and re-running Argon2id would mean
+ * asking them to type it again.
+ *
+ * The 20 bytes it returns are an ordinary account code — the child derives its own chain from
+ * them, including its own AI-account root, so the tree carries on downward under one rule. The
+ * expansion is one-way: a child's code reveals nothing about the parent's.
+ *
+ * Rejects `index` 0: AI accounts are numbered from 1, so that walking `1..=n` from the top code
+ * reaches every code that can exist beneath it.
+ */
+export function derive_ai_account_code(ai_account_root: Uint8Array, index: number): string;
+
 /**
  * Derives the 32-byte wrapping key for a passphrase-protected "remember this device" record.
  *
@@ -206,7 +224,7 @@ export function header_plaintext_len(header: Uint8Array): number;
 /**
  * Derives the account keys from the 20 raw account-code bytes (NCF-3 §1).
  *
- * Returns one concatenated buffer (`KDF_DERIVE_LEN` = 256 bytes) the caller slices:
+ * Returns one concatenated buffer (`KDF_DERIVE_LEN` = 288 bytes) the caller slices:
  * ```text
  *   0.. 16  account_id         public — the server's lookup key
  *  16.. 48  auth_secret        secret — sent to the server over TLS at login
@@ -217,11 +235,13 @@ export function header_plaintext_len(header: Uint8Array): number;
  * 176..208  wallet_root        secret — parent of EVERY wallet, including the first
  * 208..224  share_address      public — the address a user hands out to be shared with
  * 224..256  share_sig_seed     secret — ML-DSA-44 seed; its key IS the identity root (§5.2a)
+ * 256..288  ai_account_root    secret — parent of every AI-account code (§1.5, the product rule of 2026-09-06)
  * ```
  * Every secret region above must be retained inside the crypto worker and never cross the
  * postMessage boundary.
  *
- * ⚠ **This layout only ever grows at the TAIL.** `share_sig_seed` was appended in 2026-08-02
+ * ⚠ **This layout only ever grows at the TAIL**, and `ai_account_root` was appended on 2026-09-06
+ * under the same rule. `share_sig_seed` was appended in 2026-08-02
  * rather than filed beside the other two share secrets, where it would read better, because
  * inserting it there would shift `wallet_root` and `share_address` and every constant on the
  * JS side would be silently wrong about which 32 bytes it was holding. Readability loses to
@@ -399,6 +419,7 @@ export interface InitOutput {
     readonly account_code_generate: () => [number, number];
     readonly account_code_parse: (a: number, b: number) => [number, number, number, number];
     readonly b64_encode: (a: number, b: number) => [number, number];
+    readonly derive_ai_account_code: (a: number, b: number, c: number) => [number, number, number, number];
     readonly device_wrap_key: (a: number, b: number, c: number, d: number) => [number, number, number, number];
     readonly envelope_open: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
     readonly envelope_seal: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];

package/vendor/nmts-crypto/nmts_crypto_wasm.js

@@ -352,6 +352,46 @@ export function b64_encode(data) {
     }
 }
 
+/**
+ * The ACCOUNT CODE of AI account number `index` (1-based) from the 32-byte `ai_account_root`
+ * (NCF-3 §1.5), in the same display form `account_code_generate` returns.
+ *
+ * ⛔ It takes the ROOT rather than the parent's code for the same reason `wallet_seed_for` does:
+ * the browser derives once at sign-in and keeps only the roots, so by the time somebody asks for
+ * an AI account the account code is long gone from memory and re-running Argon2id would mean
+ * asking them to type it again.
+ *
+ * The 20 bytes it returns are an ordinary account code — the child derives its own chain from
+ * them, including its own AI-account root, so the tree carries on downward under one rule. The
+ * expansion is one-way: a child's code reveals nothing about the parent's.
+ *
+ * Rejects `index` 0: AI accounts are numbered from 1, so that walking `1..=n` from the top code
+ * reaches every code that can exist beneath it.
+ * @param {Uint8Array} ai_account_root
+ * @param {number} index
+ * @returns {string}
+ */
+export function derive_ai_account_code(ai_account_root, index) {
+    let deferred3_0;
+    let deferred3_1;
+    try {
+        const ptr0 = passArray8ToWasm0(ai_account_root, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.derive_ai_account_code(ptr0, len0, index);
+        var ptr2 = ret[0];
+        var len2 = ret[1];
+        if (ret[3]) {
+            ptr2 = 0; len2 = 0;
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        deferred3_0 = ptr2;
+        deferred3_1 = len2;
+        return getStringFromWasm0(ptr2, len2);
+    } finally {
+        wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+    }
+}
+
 /**
  * Derives the 32-byte wrapping key for a passphrase-protected "remember this device" record.
  *
@@ -518,7 +558,7 @@ export function header_plaintext_len(header) {
 /**
  * Derives the account keys from the 20 raw account-code bytes (NCF-3 §1).
  *
- * Returns one concatenated buffer (`KDF_DERIVE_LEN` = 256 bytes) the caller slices:
+ * Returns one concatenated buffer (`KDF_DERIVE_LEN` = 288 bytes) the caller slices:
  * ```text
  *   0.. 16  account_id         public — the server's lookup key
  *  16.. 48  auth_secret        secret — sent to the server over TLS at login
@@ -529,11 +569,13 @@ export function header_plaintext_len(header) {
  * 176..208  wallet_root        secret — parent of EVERY wallet, including the first
  * 208..224  share_address      public — the address a user hands out to be shared with
  * 224..256  share_sig_seed     secret — ML-DSA-44 seed; its key IS the identity root (§5.2a)
+ * 256..288  ai_account_root    secret — parent of every AI-account code (§1.5, the product rule of 2026-09-06)
  * ```
  * Every secret region above must be retained inside the crypto worker and never cross the
  * postMessage boundary.
  *
- * ⚠ **This layout only ever grows at the TAIL.** `share_sig_seed` was appended in 2026-08-02
+ * ⚠ **This layout only ever grows at the TAIL**, and `ai_account_root` was appended on 2026-09-06
+ * under the same rule. `share_sig_seed` was appended in 2026-08-02
  * rather than filed beside the other two share secrets, where it would read better, because
  * inserting it there would shift `wallet_root` and `share_address` and every constant on the
  * JS side would be silently wrong about which 32 bytes it was holding. Readability loses to

package/vendor/nmts-crypto/nmts_crypto_wasm_bg.wasm.d.ts

@@ -8,6 +8,7 @@ export const account_code_display: (a: number, b: number) => [number, number, nu
 export const account_code_generate: () => [number, number];
 export const account_code_parse: (a: number, b: number) => [number, number, number, number];
 export const b64_encode: (a: number, b: number) => [number, number];
+export const derive_ai_account_code: (a: number, b: number, c: number) => [number, number, number, number];
 export const device_wrap_key: (a: number, b: number, c: number, d: number) => [number, number, number, number];
 export const envelope_open: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];
 export const envelope_seal: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number, number];

package/vendor/nmts-crypto/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "description": "wasm-bindgen surface over nmts-crypto (NCF-1) for nmts/web. Production build only — never enable the `vectors` feature here.",
   "version": "0.1.0",
-  "license": "AGPL-3.0-only",
+  "license": "Apache-2.0",
   "files": [
     "nmts_crypto_wasm_bg.wasm",
     "nmts_crypto_wasm.js",

package/dist/commands/consent.js

@@ -1,77 +0,0 @@
-// `nmts consent` — see what this machine has agreed to, and change it.
-//
-// ⛔ IT IS A COMMAND AND NOT A PROMPT. A yes/no question in the middle of another command cannot
-//    be answered by anything that is not a terminal, which is most of the places this tool runs:
-//    a container, a build step, an agent's subprocess. Making agreement its own command means the
-//    same answer works everywhere, is recorded with a date, and can be looked at afterwards —
-//    none of which is true of a keystroke.
-import { CONSENTS, CONSENT_KEYS, grant, grantedAt, revoke } from "../consent.js";
-import { NmtsError } from "../errors.js";
-import { BINARY_NAME, SUPPORT_EMAIL, VERSION } from "../product.js";
-function isKey(value) {
-    return CONSENT_KEYS.includes(value);
-}
-function keyOrFail(raw) {
-    if (raw === undefined || raw === "") {
-        throw new NmtsError("Say which one.", {
-            exitCode: 2,
-            nextStep: `One of: ${CONSENT_KEYS.join(" · ")}`,
-        });
-    }
-    if (!isKey(raw)) {
-        throw new NmtsError(`There is nothing called "${raw}" to agree to.`, {
-            exitCode: 2,
-            nextStep: `One of: ${CONSENT_KEYS.join(" · ")}`,
-        });
-    }
-    return raw;
-}
-export function consent(action, target, options = {}) {
-    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
-    const now = options.now ?? (() => new Date());
-    if (action === undefined || action === "" || action === "list") {
-        if (options.json) {
-            say(JSON.stringify(CONSENT_KEYS.map((key) => ({
-                key,
-                granted: grantedAt(key) !== null,
-                grantedAt: grantedAt(key),
-                what: CONSENTS[key].what,
-                risk: CONSENTS[key].risk,
-            }))));
-            return 0;
-        }
-        for (const key of CONSENT_KEYS) {
-            const at = grantedAt(key);
-            say(`${at === null ? "  not agreed" : "  agreed    "}  ${key}`);
-            say(`                ${CONSENTS[key].what}`);
-            if (at !== null)
-                say(`                agreed on this machine ${at}`);
-            say(``);
-        }
-        say(`  ${BINARY_NAME} consent grant <name>    agree, on this machine, once`);
-        say(`  ${BINARY_NAME} consent revoke <name>   take it back`);
-        say(``);
-        say(`  Agreeing here does not change what the published Terms say. NMTS is not responsible`);
-        say(`  for what any program on this machine does with this account, an AI agent included.`);
-        say(`  Something wrong or confusing? ${SUPPORT_EMAIL}`);
-        return 0;
-    }
-    if (action === "grant") {
-        const key = keyOrFail(target);
-        grant(key, VERSION, now());
-        say(`agreed: ${key}`);
-        say(`  ${CONSENTS[key].what}`);
-        say(`  ${CONSENTS[key].limit}`);
-        return 0;
-    }
-    if (action === "revoke") {
-        const key = keyOrFail(target);
-        revoke(key);
-        say(`taken back: ${key}`);
-        return 0;
-    }
-    throw new NmtsError(`Unknown: ${BINARY_NAME} consent ${action}`, {
-        exitCode: 2,
-        nextStep: `Try \`${BINARY_NAME} consent\`, \`${BINARY_NAME} consent grant <name>\`, or \`${BINARY_NAME} consent revoke <name>\`.`,
-    });
-}