@needmoretruth/nmts-cli 0.17.2

package/dist/code-vault.js

@@ -0,0 +1,233 @@
+// Locking the account code with a passphrase, so what is on disk is not the code.
+//
+// WHY THIS EXISTS. `nmts login` used to write the account code in the clear at mode 600, which is
+//   what `gh`, `aws` and `docker login` do. Mode 600 answers exactly one question — "can another
+//   user on this machine read it" — and answers nothing about a backup, a copied home directory,
+//   a synced folder, a container image layer, or a disk pulled out of a laptop. A passphrase
+//   answers those, and only those.
+//
+// ⛔ WHAT IT DOES NOT DO, SAID FIRST. It does not protect the code from anything running AS YOU
+//    while you are using the tool: whatever supplies the passphrase can be read the same way the
+//    passphrase is. On a machine where an unattended agent runs, the passphrase has to come from
+//    somewhere the agent can reach, and at that point this is a lock whose key is taped beside it.
+//    That is not a reason to leave it out — it is the reason the tool ALSO offers a secret file,
+//    which is the right answer for an unattended agent — but it is the reason nothing here claims
+//    the code is "safe".
+//
+// ⛔ NODE BUILT-INS ONLY. `scrypt` and AES-256-GCM are in `node:crypto`; a password-hashing
+//    dependency would put somebody else's code on the path the account code travels, for a
+//    function the platform already ships. This is local storage, not the NMTS crypto format —
+//    NCF-3 governs what leaves this machine, and nothing here does.
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual, } from "node:crypto";
+import { NmtsError } from "./errors.js";
+/**
+ * scrypt's cost: N=2^16, r=8, p=2 — one of the sets OWASP's Password Storage Cheat Sheet gives as
+ * equivalent to its headline N=2^17, r=8, p=1.
+ *
+ * ⛔ THE EQUIVALENT SET WAS CHOSEN FOR ITS MEMORY, NOT ITS SPEED. Work is proportional to N·r·p,
+ *    so these two cost the same processor time; peak memory is proportional to N·r, so this one
+ *    needs 64 MiB where the other needs 128 MiB. This tool is meant to run inside containers, and
+ *    a container with a 128 MiB limit would have the whole process killed — which arrives as a
+ *    dead command with no message rather than as a wrong passphrase.
+ *
+ * ⚠ Measured on the machine this was written on: about a third of a second per unlock. It is paid
+ *   once per command that needs the code, and the tool says so during `login` rather than letting
+ *   somebody discover it on their fiftieth upload. Both halves of the cost are the point — memory
+ *   is what stops a GPU being better at this than a laptop.
+ */
+const N = 1 << 16;
+const R = 8;
+const P = 2;
+/**
+ * ⛔ SCRYPT'S OWN MEMORY CEILING HAS TO BE RAISED BY HAND. Node's default `maxmem` is 32 MiB and
+ *    these parameters need `128 × N × r` = 64 MiB, so the call throws "Invalid scrypt param"
+ *    without this — a failure that looks like a bug in the passphrase rather than a limit.
+ */
+const MAXMEM = 96 * 1024 * 1024;
+/**
+ * ⛔ A STORED FILE MAY NOT ASK FOR MORE THAN THIS VERSION ITSELF WRITES.
+ *
+ * The parameters travel in the file so an old file still opens after the cost is raised — but a
+ * file is something an attacker can edit, and every one of the three is a lever on how long this
+ * process spends before the tag is checked and the guess is rejected. An adversarial review
+ * measured it: `n` alone was bounded, and an edited `p` of 81,918 — the largest OpenSSL would
+ * accept — made every command grind for **39 minutes** before answering "wrong passphrase".
+ *
+ * So the ceiling is what THIS version would produce, on both axes that matter:
+ *   · memory  ∝ n·r      — capped at exactly ours, so a file cannot make a small container
+ *                          OOM-kill the process, which arrives as a command that died saying
+ *                          nothing rather than as a refusal;
+ *   · work    ∝ n·r·p    — capped at exactly ours, so the worst a hostile file can buy is the
+ *                          same fraction of a second an honest one costs.
+ *
+ * ⚠ THE PRICE IS FORWARD COMPATIBILITY, AND IT IS PAID ON PURPOSE. A future version that raises
+ *   the cost writes files this one refuses. That is what the `v` field is for: raising the cost
+ *   is a code change AND a version bump, not a number somebody edits in a file.
+ *
+ * The floor matters for the opposite reason: a file rewritten with n=2 would unlock in
+ * microseconds if the passphrase were guessed, so we would have done the guessing cheaply on the
+ * attacker's behalf.
+ */
+const MIN_N = 1 << 14;
+const MAX_MEMORY_UNITS = N * R;
+const MAX_WORK_UNITS = N * R * P;
+const SALT_BYTES = 16;
+const NONCE_BYTES = 12;
+const KEY_BYTES = 32;
+const TAG_BYTES = 16;
+/** Thrown when the passphrase does not open the file. ⛔ Never says how close it was. */
+export class WrongPassphraseError extends NmtsError {
+    constructor() {
+        super("That passphrase does not open the stored account code.", {
+            exitCode: 3,
+            nextStep: "Try again. If the passphrase is lost, the stored copy cannot be recovered — sign in " +
+                "again with the account code itself.",
+        });
+        this.name = "WrongPassphraseError";
+    }
+}
+/**
+ * Bind the parameters to the ciphertext.
+ *
+ * Editing `n` in the file then changes what the tag is checked against, so a tampered parameter
+ * fails as a wrong passphrase rather than as a successful decryption of something else. It costs
+ * one string and removes a whole class of question about what an edited file can do.
+ */
+function aad(locked) {
+    return Buffer.from(`nmts-cli/code-vault/${locked.v}/${locked.kdf}/${locked.n}/${locked.r}/${locked.p}`, "utf8");
+}
+/**
+ * ⛔ CHECKED BEFORE ONE BYTE OF WORK IS DONE. Every branch here is reached in microseconds; the
+ *    tag that would reject a tampered file is checked at the END of the derivation, so a bound
+ *    applied afterwards is not a bound at all.
+ */
+function refuseCost(locked) {
+    const { n, r, p } = locked;
+    const whole = (v) => Number.isInteger(v) && v >= 1;
+    const refuse = () => {
+        throw new NmtsError("The stored account code names a key-derivation cost this version refuses.", {
+            exitCode: 1,
+            nextStep: "The file has been edited, or was written by a newer version of this tool. Sign in again " +
+                "with the account code itself.",
+        });
+    };
+    if (!whole(n) || !whole(r) || !whole(p))
+        refuse();
+    // scrypt's own requirement, and the reason a non-power-of-two is refused rather than rounded.
+    if ((n & (n - 1)) !== 0 || n < MIN_N)
+        refuse();
+    // ⛔ SCRYPT'S OWN CONSTRAINT, CHECKED HERE SO THE REFUSAL IS OURS. RFC 7914 requires
+    //    `N < 2^(128·r/8)`, so a file naming r=1 beside our n=2^16 is not merely expensive — it is
+    //    invalid, and OpenSSL's own message for it ("Invalid scrypt param") says nothing a person
+    //    could act on. Found by a test that expected r=1 to be a CHEAPER file and got a different
+    //    error than the one it was written to see.
+    if (n >= 2 ** (16 * r))
+        refuse();
+    if (n * r > MAX_MEMORY_UNITS)
+        refuse();
+    // ⛔ Multiplied in this order and compared against a constant this process can hold: the three
+    //    are already bounded above by the memory check and by each other, so no product here can
+    //    leave the safe-integer range before it is compared.
+    if (n * r * p > MAX_WORK_UNITS)
+        refuse();
+}
+function deriveKey(passphrase, salt, n, r, p) {
+    try {
+        return scryptSync(Buffer.from(passphrase, "utf8"), salt, KEY_BYTES, { N: n, r, p, maxmem: MAXMEM });
+    }
+    catch (error) {
+        throw new NmtsError("The stored account code asks for a key derivation this machine refused.", {
+            exitCode: 1,
+            nextStep: `Cause: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}
+/** Seal the code under a passphrase. The result is safe to write to a file. */
+export function lockCode(code, passphrase) {
+    if (passphrase.length === 0)
+        throw new NmtsError("An empty passphrase locks nothing.", { exitCode: 2 });
+    const salt = randomBytes(SALT_BYTES);
+    const nonce = randomBytes(NONCE_BYTES);
+    const key = deriveKey(passphrase, salt, N, R, P);
+    const head = { v: 1, kdf: "scrypt", n: N, r: R, p: P };
+    try {
+        const cipher = createCipheriv("aes-256-gcm", key, nonce);
+        cipher.setAAD(aad(head));
+        const body = Buffer.concat([cipher.update(Buffer.from(code, "utf8")), cipher.final()]);
+        return {
+            ...head,
+            salt: salt.toString("base64"),
+            nonce: nonce.toString("base64"),
+            ct: Buffer.concat([body, cipher.getAuthTag()]).toString("base64"),
+        };
+    }
+    finally {
+        key.fill(0);
+    }
+}
+/**
+ * Open a sealed code.
+ *
+ * ⛔ The tag is checked before a single byte is returned — that is what `final()` does for GCM, and
+ *    it is why a wrong passphrase cannot yield a plausible-looking wrong code.
+ */
+export function unlockCode(locked, passphrase) {
+    refuseCost(locked);
+    const n = locked.n;
+    const salt = Buffer.from(locked.salt, "base64");
+    const nonce = Buffer.from(locked.nonce, "base64");
+    const whole = Buffer.from(locked.ct, "base64");
+    if (salt.length !== SALT_BYTES || nonce.length !== NONCE_BYTES || whole.length <= TAG_BYTES) {
+        throw new WrongPassphraseError();
+    }
+    const body = whole.subarray(0, whole.length - TAG_BYTES);
+    const tag = whole.subarray(whole.length - TAG_BYTES);
+    const key = deriveKey(passphrase, salt, n, locked.r, locked.p);
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+        decipher.setAAD(aad(locked));
+        decipher.setAuthTag(tag);
+        const plain = Buffer.concat([decipher.update(body), decipher.final()]);
+        try {
+            return plain.toString("utf8");
+        }
+        finally {
+            plain.fill(0);
+        }
+    }
+    catch (error) {
+        if (error instanceof NmtsError)
+            throw error;
+        throw new WrongPassphraseError();
+    }
+    finally {
+        key.fill(0);
+    }
+}
+/** Shape check for something read off disk. ⛔ A parser, not an assertion: the file is input. */
+export function isLockedCode(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    return (v["v"] === 1 &&
+        v["kdf"] === "scrypt" &&
+        typeof v["n"] === "number" &&
+        typeof v["r"] === "number" &&
+        typeof v["p"] === "number" &&
+        typeof v["salt"] === "string" &&
+        typeof v["nonce"] === "string" &&
+        typeof v["ct"] === "string");
+}
+/**
+ * Are these two passphrases the same? Used only to catch a typo when one is being set.
+ *
+ * ⚠ Constant-time because it costs nothing to be. Neither value is secret to this process, but a
+ *   comparison that short-circuits is a habit worth not having near a passphrase.
+ */
+export function samePassphrase(a, b) {
+    const x = Buffer.from(a, "utf8");
+    const y = Buffer.from(b, "utf8");
+    if (x.length !== y.length)
+        return false;
+    return timingSafeEqual(x, y);
+}

package/dist/collision.js

@@ -0,0 +1,133 @@
+// What this machine does when an upload's name is already in use.
+//
+// ⛔ ASKED ONCE, AT SETUP, BECAUSE THERE IS NOBODY TO ASK LATER. This tool is run by backup jobs
+//    and by agents; a prompt in the middle of one is a prompt nobody sees, and a job that stops to
+//    wait for an answer has stopped. So the question is put where a person is definitely present
+//    -- signing in -- and the answer is kept.
+//
+// ⛔ THE DEFAULT IS TO RENAME, AND IT IS THE DEFAULT ON PURPOSE. Renaming loses nothing: the old
+//    file stays and the new one arrives beside it. Overwriting takes a file away from where the
+//    person put it, so the direction chosen when nobody has chosen is the one that moves nothing.
+//
+// ⚠ AND OVERWRITING MEANS SOMETHING WEAKER HERE THAN IN THE BROWSER. There it is final: NMTS keeps
+//   no previous versions, and the browser can destroy the stored row. This tool cannot -- the
+//   endpoint that does is closed to an API key on purpose -- so what it can do is put the old file
+//   in the trash, which `nmts restore` undoes for thirty days. ⛔ Every line this tool prints about
+//   overwriting has to say that, and none of them may say "gone" or "cannot be brought back".
+//
+// ⛔ AN AGENT MAY NOT PICK OVERWRITE UNLESS A MODE SAYS IT MAY (owner, 2026-08-25: unless YOLO or
+//    auto mode is on, the agent picks rename; with one on it decides for itself). That rule is
+//    enforced here rather than written down in the instructions and hoped for: `chosenBy` refuses
+//    to return `overwrite` for an agent while autonomy is off.
+//
+// ⚠ WHAT THIS CANNOT DO is tell an agent from a person. Nothing on a command line can. What it can
+//   do is make the destructive answer require a setting that was turned on deliberately, and say
+//   which setting decided.
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { currentMode } from "./autonomy.js";
+import { NmtsError } from "./errors.js";
+import { BINARY_NAME } from "./product.js";
+import { configDir, modesAreEnforced } from "./credentials.js";
+export const COLLISION_CHOICES = ["rename", "overwrite"];
+/** What each choice does, in the words the tool prints. One line each. */
+export const COLLISION_MEANS = {
+    rename: "Store it beside the old one as `name (2).ext`. Nothing is lost. This is the default.",
+    overwrite: "Store this one and put the file that is there in the trash, restorable for 30 days.",
+};
+/**
+ * What a run asked for on the command line, or undefined for "use this machine's setting".
+ *
+ * ⛔ AN UNKNOWN WORD IS REFUSED, NOT ROUNDED DOWN. Silently reading `--on-collision overwite` as
+ *    the safe answer would look like it worked, and the person would find out from the drive.
+ */
+export function parseAsked(typed) {
+    if (typed === undefined)
+        return undefined;
+    const word = typed.trim().toLowerCase();
+    if (isChoice(word))
+        return word;
+    throw new NmtsError(`\`--on-collision\` takes ${COLLISION_CHOICES.join(" or ")}, not "${typed}".`, {
+        nextStep: `Leave it out to use what this machine is set to: ${BINARY_NAME} on-collision`,
+    });
+}
+/** What is written down when nobody has chosen. */
+export const DEFAULT_COLLISION = "rename";
+function path() {
+    return join(configDir(), "collision.json");
+}
+function isChoice(value) {
+    return typeof value === "string" && COLLISION_CHOICES.includes(value);
+}
+/**
+ * What this machine is set to.
+ *
+ * ⛔ Unreadable counts as `rename`, for the same reason autonomy unreadable counts as off: the
+ *    fail-safe direction for "I do not know" is the one that destroys nothing.
+ */
+export function currentChoice() {
+    try {
+        const parsed = JSON.parse(readFileSync(path(), "utf8"));
+        if (typeof parsed !== "object" || parsed === null)
+            return DEFAULT_COLLISION;
+        const choice = Reflect.get(parsed, "onCollision");
+        return isChoice(choice) ? choice : DEFAULT_COLLISION;
+    }
+    catch {
+        return DEFAULT_COLLISION;
+    }
+}
+/** Has anybody answered on this machine? Used to know whether setup still has to ask. */
+export function hasChosen() {
+    return existsSync(path());
+}
+/** Write the choice down, with the date and the version that asked. */
+export function setChoice(choice, version, now) {
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    const body = { onCollision: choice, setAt: now.toISOString(), byVersion: version };
+    writeFileSync(path(), `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
+    if (modesAreEnforced())
+        chmodSync(path(), 0o600);
+}
+/** Forget the answer, so setup asks again. */
+export function forgetChoice() {
+    if (existsSync(path()))
+        rmSync(path(), { force: true });
+}
+/**
+ * What to do with this collision, and what settled it.
+ *
+ * ⛔ A STORED ANSWER IS A PERSON'S ANSWER AND IS NOT SECOND-GUESSED. Setup asks while somebody is
+ *    definitely there; overriding that later because autonomy happens to be off would mean the
+ *    tool ignoring the one answer it actually has from a person.
+ *
+ * ⛔ WHAT THE MODES GATE IS THE OTHER THING: an agent deciding, for THIS run, to overwrite when
+ *    nobody said so. That is the case the owner ruled on -- without a mode the agent picks rename
+ *    -- and it is enforced here rather than written in the instructions and hoped for.
+ *
+ * ⛔ THE OVERRIDE IS ONE-WAY. A mode can let `overwrite` through; nothing here turns a `rename`
+ *    into an `overwrite`.
+ */
+export function decide(
+/** What this run asked for, if anything. `undefined` means "use what this machine is set to". */
+askedFor, setting = currentChoice(), mode = currentMode()) {
+    if (askedFor === undefined)
+        return { choice: setting, by: "setting" };
+    if (askedFor === "rename")
+        return { choice: "rename", by: "asked-for" };
+    if (mode === "off")
+        return { choice: "rename", by: "agent-refused" };
+    return { choice: "overwrite", by: "asked-for" };
+}
+/** How the two answers are numbered where setup asks. Kept here so the question and the reading agree. */
+export const ANSWER_NUMBER = { rename: "1", overwrite: "2" };
+/**
+ * What somebody typed at the setup question.
+ *
+ * ⛔ ONLY THE EXACT NUMBER FOR OVERWRITE COUNTS, and everything else is the safe answer. A typo, an
+ *    empty line, a closed pipe, a stray space, `y`, `yes` — none of them mean "delete my files".
+ *    The answer that destroys something has to be typed on purpose.
+ */
+export function readAnswer(typed) {
+    return typed.trim() === ANSWER_NUMBER.overwrite ? "overwrite" : "rename";
+}

package/dist/commands/balance.js

@@ -0,0 +1,93 @@
+// `nmts balance` — what this account can still pay for.
+//
+// ⛔ WHY IT EXISTS AT ALL. Until 2026-08-24 this tool could quote the price of an upload and then
+//    spend, and had no way to say "you have one credit left". The only route that reported a
+//    balance also carried the verb that erases the account, so a key could not reach the number
+//    without being able to reach that — and it correctly could not. The answer was a route that
+//    reads and can do nothing else; this is the command that calls it.
+//
+// ⚠ IT ASKS THE SERVER, UNLIKE `usage`. `usage` adds up the sealed file list, which is the
+//   account's own record of what exists. This is the ledger, which only the server holds. They
+//   answer different questions and neither substitutes for the other: one is "what do I have",
+//   the other is "what can I still buy".
+//
+// ⛔ IT DOES NOT READ THE CHAIN, so it does not say when stored files expire — it reports the
+//    number the server holds and names the command that does read the clock. Two commands
+//    printing a storage deadline from two different sources is how they come to disagree.
+import { request } from "../api.js";
+import { isRecord } from "../guards.js";
+import { NmtsError } from "../errors.js";
+import { BINARY_NAME } from "../product.js";
+import { openSession } from "../session.js";
+import { humanSize } from "../units.js";
+function num(value, field) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new NmtsError(`The server's answer had no usable \`${field}\`.`, {
+            nextStep: "Update this tool, or read the account screen in a browser.",
+        });
+    }
+    return value;
+}
+function asSummary(value) {
+    if (!isRecord(value))
+        throw new NmtsError("The server's answer was not an object.");
+    const credits = value["credits"];
+    const quota = value["quota"];
+    const storage = value["storage"];
+    const terms = value["terms"];
+    if (!isRecord(credits) || !isRecord(quota) || !isRecord(storage)) {
+        throw new NmtsError("The server described this account in a shape this version cannot read.", {
+            nextStep: `Update this tool — \`npm install -g ${BINARY_NAME}\` — or read it in a browser.`,
+        });
+    }
+    const expiry = credits["soonest_expiry"];
+    const epoch = storage["earliest_expiry_epoch"];
+    return {
+        credits: {
+            remaining: num(credits["remaining"], "credits.remaining"),
+            soonest_expiry: typeof expiry === "string" ? expiry : null,
+            file_cap: num(credits["file_cap"], "credits.file_cap"),
+            daily_cap: num(credits["daily_cap"], "credits.daily_cap"),
+        },
+        quota: { granted: num(quota["granted"], "quota.granted"), used: num(quota["used"], "quota.used") },
+        storage: {
+            parts: num(storage["parts"], "storage.parts"),
+            earliest_expiry_epoch: typeof epoch === "number" ? epoch : null,
+        },
+        terms: { acceptance_required: isRecord(terms) && terms["acceptance_required"] === true },
+    };
+}
+function plural(n, one, many) {
+    return `${n} ${n === 1 ? one : many}`;
+}
+export async function balance(options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const session = await openSession({ server: options.server, network: options.network });
+    const summary = asSummary(await request(session.server, "/v1/account/summary", { token: session.apiKey }));
+    if (options.json === true) {
+        say(JSON.stringify(summary));
+        return 0;
+    }
+    const { credits, quota, storage } = summary;
+    say(`credits    ${plural(credits.remaining, "credit", "credits")}`);
+    // ⛔ SAID AS BYTES TOO, because "one credit" means nothing until you know what it buys. It is the
+    //    same number, not a second one — the server derives it from the same ledger read.
+    say(`           = about ${humanSize(quota.granted)} for one lease period`);
+    if (credits.soonest_expiry !== null) {
+        // ⚠ THIS IS THE CREDITS EXPIRING, NOT THE FILES. A granted credit has its own life; storage
+        //   already bought is not touched when one lapses.
+        say(`           soonest to lapse unused: ${credits.soonest_expiry}`);
+    }
+    say(`ceilings   ${credits.file_cap} per file · ${credits.daily_cap} per day`);
+    say(`holding    ${humanSize(quota.used)} across ${plural(storage.parts, "stored piece", "stored pieces")}`);
+    if (storage.earliest_expiry_epoch !== null) {
+        say(`           the earliest lease ends at storage period ${storage.earliest_expiry_epoch} — ` +
+            `\`${BINARY_NAME} expiring\` reads the clock and says when that is`);
+    }
+    if (summary.terms.acceptance_required) {
+        say(``);
+        say(`⛔ New terms are in force and this account has not accepted them.`);
+        say(`   A person has to read and accept them in a browser; nothing here can do it.`);
+    }
+    return 0;
+}

package/dist/commands/consent.js

@@ -0,0 +1,77 @@
+// `nmts consent` — see what this machine has agreed to, and change it.
+//
+// ⛔ IT IS A COMMAND AND NOT A PROMPT. A yes/no question in the middle of another command cannot
+//    be answered by anything that is not a terminal, which is most of the places this tool runs:
+//    a container, a build step, an agent's subprocess. Making agreement its own command means the
+//    same answer works everywhere, is recorded with a date, and can be looked at afterwards —
+//    none of which is true of a keystroke.
+import { CONSENTS, CONSENT_KEYS, grant, grantedAt, revoke } from "../consent.js";
+import { NmtsError } from "../errors.js";
+import { BINARY_NAME, SUPPORT_EMAIL, VERSION } from "../product.js";
+function isKey(value) {
+    return CONSENT_KEYS.includes(value);
+}
+function keyOrFail(raw) {
+    if (raw === undefined || raw === "") {
+        throw new NmtsError("Say which one.", {
+            exitCode: 2,
+            nextStep: `One of: ${CONSENT_KEYS.join(" · ")}`,
+        });
+    }
+    if (!isKey(raw)) {
+        throw new NmtsError(`There is nothing called "${raw}" to agree to.`, {
+            exitCode: 2,
+            nextStep: `One of: ${CONSENT_KEYS.join(" · ")}`,
+        });
+    }
+    return raw;
+}
+export function consent(action, target, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const now = options.now ?? (() => new Date());
+    if (action === undefined || action === "" || action === "list") {
+        if (options.json) {
+            say(JSON.stringify(CONSENT_KEYS.map((key) => ({
+                key,
+                granted: grantedAt(key) !== null,
+                grantedAt: grantedAt(key),
+                what: CONSENTS[key].what,
+                risk: CONSENTS[key].risk,
+            }))));
+            return 0;
+        }
+        for (const key of CONSENT_KEYS) {
+            const at = grantedAt(key);
+            say(`${at === null ? "  not agreed" : "  agreed    "}  ${key}`);
+            say(`                ${CONSENTS[key].what}`);
+            if (at !== null)
+                say(`                agreed on this machine ${at}`);
+            say(``);
+        }
+        say(`  ${BINARY_NAME} consent grant <name>    agree, on this machine, once`);
+        say(`  ${BINARY_NAME} consent revoke <name>   take it back`);
+        say(``);
+        say(`  Agreeing here does not change what the published Terms say. NMTS is not responsible`);
+        say(`  for what any program on this machine does with this account, an AI agent included.`);
+        say(`  Something wrong or confusing? ${SUPPORT_EMAIL}`);
+        return 0;
+    }
+    if (action === "grant") {
+        const key = keyOrFail(target);
+        grant(key, VERSION, now());
+        say(`agreed: ${key}`);
+        say(`  ${CONSENTS[key].what}`);
+        say(`  ${CONSENTS[key].limit}`);
+        return 0;
+    }
+    if (action === "revoke") {
+        const key = keyOrFail(target);
+        revoke(key);
+        say(`taken back: ${key}`);
+        return 0;
+    }
+    throw new NmtsError(`Unknown: ${BINARY_NAME} consent ${action}`, {
+        exitCode: 2,
+        nextStep: `Try \`${BINARY_NAME} consent\`, \`${BINARY_NAME} consent grant <name>\`, or \`${BINARY_NAME} consent revoke <name>\`.`,
+    });
+}