@needmoretruth/nmts-cli 0.17.2

package/dist/safe-path.js

@@ -0,0 +1,89 @@
+// Where a name that came from somewhere else is allowed to land on this disk.
+//
+// ⛔ IT LIVES ON ITS OWN BECAUSE MORE THAN ONE CALLER NEEDS IT. It began inside the agent server,
+//    which is where a model's chosen path must be contained; the same containment is needed the
+//    moment anything else writes a file under a name this program did not choose — a share opened
+//    with the sender's name, for instance. Two copies of a containment check is one copy that goes
+//    stale, and the stale one is the one that lets something out.
+import { basename, resolve, sep } from "node:path";
+import { NmtsError } from "./errors.js";
+/**
+ * Resolve where one fetched file goes, refusing anything that leaves the chosen directory.
+ *
+ * ⛔ It takes only the LAST segment of the account path. A file called `../../etc/passwd` in
+ *    somebody's drive is a legal name for a file; it must not become a path on this disk. The
+ *    containment check that follows is belt as well as braces — `basename` already strips the
+ *    separators, and the check catches the day some platform disagrees about what a separator is.
+ *
+ * ⛔ IT IS ALSO WHAT KEEPS `-` FROM MEANING stdout ON THIS SERVER. `get` reads an `out` of exactly
+ *    `-` as "hand the file to whatever is reading stdout", and here that reader is the client's
+ *    protocol connection. Every answer this function gives has been through `resolve`, so it is
+ *    always an absolute path and never the bare `-`: a model asking for a file named `-` gets a
+ *    file named `-` inside the chosen directory, and the streaming branch is unreachable from
+ *    this server rather than merely unused by it.
+ */
+export function destinationFor(outDir, accountPath) {
+    const name = basename(accountPath);
+    if (name === "" || name === "." || name === "..") {
+        throw new NmtsError(`"${accountPath}" does not name a file that can be written here.`);
+    }
+    refuseUnwritableName(name);
+    const root = resolve(outDir);
+    const full = resolve(root, name);
+    if (full !== root && !full.startsWith(root + sep)) {
+        throw new NmtsError(`"${accountPath}" would be written outside ${root}.`);
+    }
+    return full;
+}
+/**
+ * Windows keeps a handful of names for devices, and writing to one succeeds while storing nothing.
+ *
+ * ⛔ THE FAILURE IS SILENT, WHICH IS WHY IT IS WORTH CODE. A drive holding a file called `NUL`
+ *    pulled onto Windows opens the null device: every byte is accepted, nothing is kept, and the
+ *    tool says it wrote the file. A name containing a colon is worse than silent — it writes an
+ *    alternate data stream on a DIFFERENT file, where nothing lists it. And a name ending in a dot
+ *    or a space is not the name it looks like: Win32 strips those before opening, so two files can
+ *    quietly become one.
+ *
+ * ⚠ The check is per PLATFORM, not universal. `NUL` is an ordinary, legal file name on Linux and
+ *   macOS, and refusing it there would take a file away from somebody who can hold it perfectly
+ *   well. The platform is a parameter so a test on any machine can ask the Windows question.
+ *
+ * Returns the reason it cannot be written, or null when it can.
+ */
+export function unwritableOn(name, platform) {
+    if (platform !== "win32")
+        return null;
+    // ⚠ THE EXTENSION DOES NOT SAVE IT. `NUL.txt` and `AUX.iliary` open the device just as `NUL`
+    //   does — Windows reads the part before the first dot. Judging the whole name instead would
+    //   let every one of these through.
+    const stem = (name.split(".")[0] ?? "").trim();
+    if (/^(con|prn|aux|nul|com[0-9]|lpt[0-9])$/i.test(stem)) {
+        return `Windows keeps "${stem}" for a device, so writing this name would store nothing`;
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[<>:"|?*\u0000-\u001f]/.test(name)) {
+        return `Windows does not allow < > : " | ? * in a file name, and a colon writes a hidden stream instead`;
+    }
+    if (/[. ]$/.test(name)) {
+        return "Windows drops a dot or a space at the end of a name, so this file would not keep its name";
+    }
+    return null;
+}
+/**
+ * Refuse a name that this platform cannot hold, saying what to do about it.
+ *
+ * ⛔ A REFUSAL, NOT A RENAME. Renaming quietly would hand somebody a file under a name they did not
+ *    choose and cannot predict, and the one thing worse than not getting a file is thinking you got
+ *    it. The person can rename it in the drive, or name it themselves on the way out.
+ */
+export function refuseUnwritableName(name, platform = process.platform) {
+    const why = unwritableOn(name, platform);
+    if (why === null)
+        return;
+    throw new NmtsError(`"${name}" cannot be written on this system: ${why}.`, {
+        exitCode: 4,
+        nextStep: "Nothing was written. Rename it in the drive, or fetch this one file on its own and choose " +
+            "the name it lands under.",
+    });
+}

package/dist/seal.js

@@ -0,0 +1,206 @@
+// Turning a local file into the three things an upload needs: sealed bytes, a wrapped key, and a
+// hash the account can check the bytes against later.
+//
+// ⛔ NOTHING HERE TOUCHES THE NETWORK OR THE CLOCK. It is a pure function of (plaintext, data key)
+//    plus the one random file key the engine makes, which is what lets the tests drive it with
+//    fixed inputs and compare against what `get` recovers.
+//
+// ⛔ THE PLAINTEXT NEVER LEAVES THIS PROCESS. What goes out is the NCF-3 stream; what the server
+//    is told is its LENGTH. The name, the folder and the real size are written into the account's
+//    sealed file list, which the server cannot open.
+import { createHash } from "node:crypto";
+import { AAD } from "./crypto.js";
+import { NmtsError } from "./errors.js";
+import { chunkCount, sealedLenFor as sealedLength, } from "./shared/lib/crypto/size-padding.js";
+/**
+ * How much of a file goes into ONE part, unless the caller says otherwise.
+ *
+ * ⛔ IT IS A MEMORY BOUND, NOT A PRODUCT LIMIT. Sealing holds a part's ciphertext, and the storage
+ *    network's erasure coding then expands it about fivefold while it computes the blob id — so a
+ *    part costs several times its own size in memory before a single byte is sent. The file itself
+ *    is never held: it is read a slice at a time.
+ *
+ * ⚠ THIS NUMBER USED TO BE THE WHOLE FILE'S CEILING, and keeping it as the part size is deliberate.
+ *   It means growing past one part cannot make an upload that worked yesterday run out of memory
+ *   today — the most memory this tool asks for is the same as it always was.
+ *
+ * Bigger parts mean fewer reservations, and every reservation counts against the account's daily
+ * spending allowance; smaller parts mean less memory and a shorter piece of work to lose when
+ * something goes wrong. `put --part-size` is how somebody picks a different trade.
+ */
+export const DEFAULT_PART_BYTES = 64 * 2 ** 20;
+/**
+ * What NCF-3 adds to a part's plaintext: a fixed header, and one tag per chunk.
+ *
+ * ⛔ NOT MEASURED, BECAUSE THE ONE CALLER NEEDS IT BEFORE SEALING: the price is quoted, and
+ *    `--dry-run` answers, without a very large file ever being read. A test seals real plaintexts
+ *    with the real engine and compares, so this is held against the format rather than against a
+ *    copy of these numbers.
+ */
+export const NCF3_SHAPE = {
+    headerLen: 72,
+    tagLen: 16,
+    chunkSize: 4 * 2 ** 20,
+};
+/** How many bytes one sealed part of this plaintext length occupies. */
+export function sealedLenFor(plaintextLen) {
+    if (!Number.isSafeInteger(plaintextLen) || plaintextLen < 0) {
+        throw new NmtsError(`A plaintext length must be a non-negative whole number: ${plaintextLen}.`);
+    }
+    return sealedLength(plaintextLen, NCF3_SHAPE);
+}
+/**
+ * The plaintext length a sealed part of this size was sealed FROM.
+ *
+ * ⛔ WHY THE INVERSE EXISTS. The server is told what a part OCCUPIES and nothing about the file
+ *    behind it, and it is the only number it can serve back. A recovery list records the length
+ *    the stored stream DECLARES, because that is what a reader checks the fetched header against —
+ *    so somewhere the one number has to become the other, and this is that place. It sits beside
+ *    the forward arithmetic rather than in a module of its own so that the two can never be
+ *    changed apart.
+ *
+ * ⛔ IT REFUSES RATHER THAN ROUNDS. Every reachable sealed length has exactly one plaintext length
+ *    behind it, and the lengths between them are not reachable at all — a stream of n chunks ends
+ *    where the next one's first tag would begin. The one caller that matters is the recovery
+ *    list's own integrity check, where a lenient answer would be the failure it exists to catch.
+ *
+ * ⚠ RESTATED FROM `web/src/lib/crypto/sealed-size.ts::plaintextLenFromSealed`, which this package
+ *   cannot import (zero imports across the two trees). Only the SEARCH is restated: each candidate
+ *   is confirmed with `chunkCount` from the shared byte-for-byte copy, so the formula itself still
+ *   lives in one file.
+ */
+export function plaintextLenFromSealed(sealedLen) {
+    if (!Number.isSafeInteger(sealedLen)) {
+        throw new NmtsError(`A sealed length must be a whole number: ${sealedLen}.`);
+    }
+    const body = sealedLen - NCF3_SHAPE.headerLen;
+    const per = NCF3_SHAPE.chunkSize + NCF3_SHAPE.tagLen;
+    // Chunk counts grow with the length, so the right one is within a step of this estimate; each
+    // candidate is checked against the forward formula rather than trusted.
+    const estimate = Math.max(1, Math.ceil((body - NCF3_SHAPE.tagLen) / per));
+    for (const chunks of [estimate - 1, estimate, estimate + 1]) {
+        if (chunks < 1)
+            continue;
+        const plaintext = body - NCF3_SHAPE.tagLen * chunks;
+        if (plaintext >= 0 && chunkCount(plaintext, NCF3_SHAPE) === chunks)
+            return plaintext;
+    }
+    throw new NmtsError(`${sealedLen} is not a length any NCF-3 stream can have.`);
+}
+const encoder = new TextEncoder();
+/**
+ * Make a file's key and seal the hash of its contents.
+ *
+ * ⛔ THE HASH IS OF THE PLAINTEXT, AND IT IS SEALED RATHER THAN STORED BARE. A bare content hash
+ *    identifies the file itself: it is the same number for everyone who holds that file, and it is
+ *    matchable against published hash sets. Sealed, it is checkable only by the account that wrote
+ *    it — which is the only party that needs to check it.
+ *
+ * `contentDigest` is the SHA-256 of the whole plaintext, which the caller computes while reading
+ * the file. Passing it in rather than the file is what lets this work for a file too large to hold.
+ */
+export function fileSecrets(crypt, dataKey, contentDigest) {
+    if (contentDigest.length !== 32) {
+        throw new NmtsError(`A content digest must be 32 bytes, got ${contentDigest.length}.`);
+    }
+    const dek = crypt.generate_dek();
+    const dekWrapped = crypt.envelope_seal(dataKey, encoder.encode(AAD.dekWrap), dek);
+    const contentHashCt = crypt.envelope_seal(dataKey, encoder.encode(AAD.contentHash), contentDigest);
+    return {
+        dek,
+        dekWrapped: Buffer.from(dekWrapped).toString("base64url"),
+        contentHashCt: Buffer.from(contentHashCt).toString("base64url"),
+    };
+}
+/**
+ * Seal ONE part of a file, reading its plaintext as it goes.
+ *
+ * ⛔ A FRESH SESSION, AND THEREFORE A FRESH NONCE, EVERY TIME. The format requires each part to be
+ *    its own stream under its own nonce prefix; the engine allocates one inside the session and
+ *    there is no way from here to reuse one. That is the property that makes a re-sealed part a
+ *    DIFFERENT blob — which is exactly why a resumed upload pushes the bytes it wrote down rather
+ *    than sealing again.
+ *
+ * ⛔ THE DECLARED LENGTH IS CHECKED AGAINST WHAT ARRIVES. The engine refuses to finish a stream
+ *    that was fed too little; too much is caught here. A part whose header declares a length its
+ *    bytes do not match is a file that reassembles wrong, and the reader would not find out until
+ *    the download.
+ */
+export async function sealPart(crypt, dek, chunks, placement) {
+    const { index, total, plaintextLen } = placement;
+    if (plaintextLen <= 0) {
+        throw new NmtsError("An empty part cannot be sealed.", {
+            nextStep: "The storage network has nothing to store and would refuse the reservation.",
+        });
+    }
+    const sealer = new crypt.StreamEncryptor(dek, plaintextLen, index, total);
+    try {
+        const out = [sealer.header()];
+        let seen = 0;
+        for await (const chunk of chunks) {
+            seen += chunk.length;
+            if (seen > plaintextLen) {
+                throw new NmtsError(`Part ${index + 1} of ${total} was given more bytes than it declared (${plaintextLen}).`, { nextStep: "Nothing was sent. The file changed while it was being read." });
+            }
+            out.push(sealer.push(chunk));
+        }
+        if (seen !== plaintextLen) {
+            throw new NmtsError(`Part ${index + 1} of ${total} declared ${plaintextLen} bytes and read ${seen}.`, { nextStep: "Nothing was sent. The file changed while it was being read." });
+        }
+        out.push(sealer.finish());
+        return concat(out);
+    }
+    finally {
+        // ⛔ THE ENGINE HOLDS THE KEY UNTIL THIS RUNS, including on the way out of a failed read.
+        sealer.free();
+    }
+}
+function concat(pieces) {
+    let total = 0;
+    for (const piece of pieces)
+        total += piece.length;
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const piece of pieces) {
+        out.set(piece, at);
+        at += piece.length;
+    }
+    return out;
+}
+/**
+ * Seal a whole file held in memory, as one part.
+ *
+ * ⛔ THE DATA KEY IS BORROWED, NOT KEPT. The caller derived it and the caller wipes it; this
+ *    function does not hold a reference past its own return. The file key it makes IS wiped here,
+ *    because nothing outside needs it — the wrapped copy is what travels.
+ */
+export async function sealFile(crypt, dataKey, plaintext) {
+    if (plaintext.length === 0) {
+        throw new NmtsError("An empty file cannot be uploaded.", {
+            nextStep: "The storage network has nothing to store and would refuse the reservation.",
+        });
+    }
+    const digest = new Uint8Array(createHash("sha256").update(plaintext).digest());
+    const secrets = fileSecrets(crypt, dataKey, digest);
+    digest.fill(0);
+    try {
+        const sealed = await sealPart(crypt, secrets.dek, oneChunk(plaintext), {
+            index: 0,
+            total: 1,
+            plaintextLen: plaintext.length,
+        });
+        return {
+            sealed,
+            dekWrapped: secrets.dekWrapped,
+            contentHashCt: secrets.contentHashCt,
+            plaintextLen: plaintext.length,
+            sealedLen: sealed.length,
+        };
+    }
+    finally {
+        secrets.dek.fill(0);
+    }
+}
+async function* oneChunk(bytes) {
+    yield bytes;
+}

package/dist/secret-reader.js

@@ -0,0 +1,112 @@
+// The keystroke rules for typing a secret, with no terminal attached.
+//
+// ⛔ WHY THIS IS ITS OWN FILE. The first version of this logic zeroed the buffer inside the same
+//    branch that then read it, so the answer came back as a run of NUL bytes — a defect that a
+//    terminal-attached function cannot be tested for without a terminal. Split out, the rules are
+//    a pure function over bytes and every rule below has a test that goes red on its own.
+const CTRL_C = 0x03;
+const CTRL_D = 0x04;
+const BACKSPACE = 0x7f;
+const BACKSPACE_ALT = 0x08;
+const CARRIAGE_RETURN = 0x0d;
+const LINE_FEED = 0x0a;
+const ESCAPE = 0x1b;
+const CSI = 0x5b;
+/**
+ * Accumulates typed bytes into a secret.
+ *
+ * ⛔ `wipe()` is separate from `take()` on purpose: the caller reads the value and only then
+ *    clears the buffer. Doing both in one step is what produced the NUL-run defect this file
+ *    exists to make impossible.
+ */
+export class SecretReader {
+    #bytes = [];
+    // ⛔ AN ARROW KEY IS THREE BYTES, NOT ONE. A terminal sends ESC [ A; dropping only the ESC (it
+    //    is a control byte) leaves `[A` sitting in the middle of the secret, and the person sees
+    //    nothing because nothing is echoed. They then get a wrong-code error they cannot explain.
+    //    So the whole sequence is consumed: after ESC [, bytes are swallowed until the final byte
+    //    of a CSI sequence (0x40–0x7e), which is where the terminal protocol says it ends.
+    #escape = "none";
+    /**
+     * Whatever followed the newline in the chunk that finished the last answer.
+     *
+     * ⚠ It is bytes a person typed at a prompt that is now closed — which is the NEXT prompt's
+     *   input. It never contains anything the caller did not send here.
+     */
+    #leftover = new Uint8Array(0);
+    /** Bytes that arrived after the answer ended, for the prompt that comes next. */
+    takeLeftover() {
+        const out = this.#leftover;
+        this.#leftover = new Uint8Array(0);
+        return out;
+    }
+    /** Feed one chunk. Returns what the caller should do next. */
+    push(chunk) {
+        let index = -1;
+        for (const byte of chunk) {
+            index += 1;
+            if (this.#escape !== "none") {
+                this.#consumeEscape(byte);
+                continue;
+            }
+            if (byte === ESCAPE) {
+                this.#escape = "saw-escape";
+                continue;
+            }
+            if (byte === CTRL_C)
+                return { kind: "cancelled" };
+            if (byte === CTRL_D && this.#bytes.length === 0)
+                return { kind: "cancelled" };
+            if (byte === CARRIAGE_RETURN || byte === LINE_FEED) {
+                // ⛔ WHAT CAME AFTER THE NEWLINE IS KEPT, NOT DROPPED. A person answering three prompts by
+                //    pasting three lines sends all of them in ONE chunk; a reader that stopped at the
+                //    first newline and threw the rest away lost the next two answers, and the run ended
+                //    in "Cancelled" — which reads as something the person did.
+                // ⛔ COPIED, NOT A VIEW. `chunk` is the stream's own buffer and Node reuses it for the
+                //    next read; `Buffer.prototype.slice` returns a window onto that same memory, so what
+                //    was kept here would be overwritten — or zeroed by the caller wiping the chunk it was
+                //    handed. Measured: the next prompt read an empty buffer and the run ended in
+                //    "Cancelled". The constructor copies; `slice` on a Buffer does not.
+                this.#leftover = new Uint8Array(chunk.subarray(index + 1));
+                return { kind: "done", value: this.take() };
+            }
+            if (byte === BACKSPACE || byte === BACKSPACE_ALT) {
+                this.#bytes.pop();
+                continue;
+            }
+            // Any other control byte is not part of a secret.
+            if (byte < 0x20)
+                continue;
+            this.#bytes.push(byte);
+        }
+        return { kind: "more" };
+    }
+    /** Swallow one byte of a terminal escape sequence. */
+    #consumeEscape(byte) {
+        if (this.#escape === "saw-escape") {
+            // ESC followed by [ opens a CSI sequence; ESC followed by anything else is a two-byte
+            // sequence that ends right here.
+            this.#escape = byte === CSI ? "in-csi" : "none";
+            return;
+        }
+        // In a CSI sequence the final byte is in 0x40–0x7e; everything before it is a parameter.
+        if (byte >= 0x40 && byte <= 0x7e)
+            this.#escape = "none";
+    }
+    /** The value typed so far, with surrounding spaces removed. Clears the buffer. */
+    take() {
+        const value = Buffer.from(this.#bytes).toString("utf8").trim();
+        this.wipe();
+        return value;
+    }
+    /** Drop the bytes without reading them. */
+    wipe() {
+        this.#bytes.fill(0);
+        this.#bytes.length = 0;
+        this.#escape = "none";
+    }
+    /** How many bytes are held. For tests; never printed. */
+    get length() {
+        return this.#bytes.length;
+    }
+}

package/dist/server.js

@@ -0,0 +1,33 @@
+// Which NMTS server this run talks to.
+//
+// ⚠ THERE IS ONE REAL SERVER AND IT IS NOT A SETTING PEOPLE SHOULD NEED. The override exists for
+//    development against a local stack, not as a knob to tune. It is read from an argument or the
+//    environment rather than stored, so a credentials file cannot silently point a later run
+//    somewhere else than the run that wrote it.
+import { NmtsError } from "./errors.js";
+export const DEFAULT_SERVER = "https://nmts.me";
+export const SERVER_ENV_VAR = "NMTS_SERVER";
+/**
+ * Resolve the server for this run: an explicit argument, then the environment, then the default.
+ *
+ * ⛔ Refuses anything that is not http(s). A credential is sent to whatever this returns, so a
+ *    typo that lands on another scheme must stop here rather than somewhere further in.
+ */
+export function resolveServer(explicit) {
+    const raw = explicit ?? process.env[SERVER_ENV_VAR] ?? DEFAULT_SERVER;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new NmtsError(`Not a URL: ${raw}`, {
+            exitCode: 2,
+            nextStep: `Pass --server https://host, or unset ${SERVER_ENV_VAR}.`,
+        });
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new NmtsError(`A server must be http or https, not ${url.protocol}`, { exitCode: 2 });
+    }
+    // Trailing slashes make every later join ambiguous; normalise once, here.
+    return url.origin + url.pathname.replace(/\/+$/, "");
+}

package/dist/session.js

@@ -0,0 +1,49 @@
+// The four things every command that talks to the server needs, resolved once.
+//
+// ⛔ IT IS ONE FUNCTION SO THE REFUSALS ARE ONE TEXT. Each command used to resolve the code, the
+//    key, the server and the network for itself, which is four chances for one of them to word
+//    the "you have no API key" refusal differently — and that refusal is the single most likely
+//    thing a new user of this tool will see.
+import { requireAccountCode } from "./code-access.js";
+import { identityOf } from "./account.js";
+import { API_KEY_ENV_VAR, readCredentialsFile, resolveApiKey, } from "./credentials.js";
+import { NmtsError } from "./errors.js";
+import { resolveNetwork } from "./network.js";
+import { BINARY_NAME } from "./product.js";
+import { resolveServer } from "./server.js";
+/**
+ * The API key, or the one refusal for not having one.
+ *
+ * ⛔ IT IS ITS OWN FUNCTION BECAUSE ONE COMMAND NEEDS THE KEY AND NOT THE CODE. `verify` asks the
+ *    server about the account and opens no file, so making it resolve an account code would refuse
+ *    a run over a credential it never uses — and wording that refusal a second time is exactly how
+ *    two texts for one problem start.
+ */
+export function requireApiKey() {
+    const key = resolveApiKey();
+    if (key === null) {
+        throw new NmtsError("This account has no API key on this machine, and the server needs one.", {
+            exitCode: 3,
+            nextStep: `Make a key on the account screen at nmts.me and put it in ${API_KEY_ENV_VAR}, or store ` +
+                `it with \`${BINARY_NAME} login\`. The key is what lets a program act without passing the ` +
+                `human check that a browser sign-in does.`,
+        });
+    }
+    return key.key;
+}
+export async function openSession(options) {
+    const resolved = await requireAccountCode();
+    const apiKey = requireApiKey();
+    const stored = readCredentialsFile();
+    const server = resolveServer(options.server ?? stored?.server);
+    const network = resolveNetwork(server, options.network ?? stored?.network);
+    const identity = await identityOf(resolved.code);
+    return {
+        code: resolved.code,
+        source: resolved.source,
+        apiKey,
+        server,
+        network,
+        accountId: identity.accountId,
+    };
+}

package/dist/setup-questions.js

@@ -0,0 +1,31 @@
+// What signing in asks once, beyond the code itself.
+//
+// ⛔ ASKED AT SETUP BECAUSE THERE IS NOBODY TO ASK LATER (owner 2026-08-25: a backup program has to
+//    settle at the start what to do about a name that is already in use). A question in the middle
+//    of an upload is a question an unattended job never answers, and a job that waits has stopped.
+//
+// ⛔ IT LIVES OUTSIDE `login` SO THE ANSWER-READING IS TESTABLE AND THE COMMAND STAYS ONE THING.
+//    What counts as which answer is in `collision.ts`, which a test can reach without a terminal.
+//
+// ⚠ Silent when nobody is there. A scripted setup gets no question and records no answer, which
+//   reads as the default — rename, which destroys nothing.
+import { ANSWER_NUMBER, COLLISION_MEANS, hasChosen, readAnswer, setChoice } from "./collision.js";
+import { BINARY_NAME, VERSION } from "./product.js";
+import { promptLine, stdinIsATerminal } from "./prompt.js";
+/**
+ * The one question setup asks about uploads.
+ *
+ * ⛔ CALL THIS OUTSIDE `holdTerminal`. Inside it the terminal is in raw mode, where a line prompt
+ *    never sees a line.
+ */
+export async function askAboutCollisions(say) {
+    if (hasChosen() || !stdinIsATerminal())
+        return;
+    say(``);
+    say(`When a file with that name is already in the drive:`);
+    say(`  ${ANSWER_NUMBER.rename}  ${COLLISION_MEANS.rename}`);
+    say(`  ${ANSWER_NUMBER.overwrite}  ${COLLISION_MEANS.overwrite}`);
+    const choice = readAnswer(await promptLine(`[${ANSWER_NUMBER.rename}] `));
+    setChoice(choice, VERSION, new Date());
+    say(`${choice} — ${COLLISION_MEANS[choice]}  Change it: ${BINARY_NAME} on-collision <rename|overwrite>`);
+}