@needmoretruth/nmts-cli 0.34.2 → 0.34.4

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 Each version's entry is what changed for the person or the program using `nmts`. The product's own
 update history, which covers the site and the server too, is at https://nmts.me/updates.
 
+## 0.34.4 — 2026-09-07
+
+- The advice for `SPONSORED_IDEM_MISMATCH`: the server now refuses a credit reservation repeated
+  under the same key with a different blob (the piece was re-encrypted after it was reserved).
+  Repeating the call cannot work; the advice says to start the upload again so new keys are
+  derived, and that nothing was charged for the refused call.
+
+## 0.34.3 — 2026-09-07
+
+- Security. `nmts wallet swap` on Bluefin now calls only the contract package pinned in this
+  release. Before, it read the "current" package from a public Sui node and preferred that answer,
+  so a node giving a false answer could have sent the swap into someone else's code with your coin
+  as the argument. The pinned package is still checked against the chain before a quote is shown;
+  if that check refuses it, the Bluefin venue is unavailable until a release bumps the pin. DeepBook
+  was never affected. No such node was observed and no loss is known.
+
 ## 0.34.2 — 2026-09-07
 
 - The README and the agent document open with what the name stands for — NMTS is

package/README.ko.md

@@ -51,7 +51,7 @@ nmts --help
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # 기본 브랜치
-npm install -g github:needmoretruth/nmts-cli#v0.34.2    # 버전을 고정할 때
+npm install -g github:needmoretruth/nmts-cli#v0.34.4    # 버전을 고정할 때
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 

package/README.md

@@ -53,7 +53,7 @@ default branch, from a pinned version, or from the tarball attached to the
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # the default branch
-npm install -g github:needmoretruth/nmts-cli#v0.34.2    # a pinned version
+npm install -g github:needmoretruth/nmts-cli#v0.34.4    # a pinned version
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 

package/dist/api-advice.js

@@ -168,6 +168,10 @@ export function adviseFor(code) {
         case "RELEASE_NOT_SPONSORED":
             return ("This file's storage was not paid for with credits, so it is not the server's to release. " +
                 "Storage bought from a wallet is released by that wallet.");
+        case "SPONSORED_IDEM_MISMATCH":
+            return ("This reservation key already names a different blob: the piece was re-encrypted after it " +
+                "was reserved. Repeating the call under this key cannot work. Start the upload again so it " +
+                "derives new keys; nothing was charged for this call.");
         case "SPONSORED_STATE":
             return ("The upload is not at the step that call belongs to — the steps have an order and one was " +
                 "skipped or already done. Start the upload again rather than repeating this call.");

package/dist/artifact-about.d.ts

@@ -11,7 +11,7 @@ export declare const CRYPTO_SPEC_URL = "https://github.com/needmoretruth/nmts-re
  *   is the field's own contract — what the writer says about itself — and a person holding two
  *   copies of one account's artefacts can then tell which program made each.
  */
-export declare const WRITTEN_BY = "nmts-cli 0.34.2";
+export declare const WRITTEN_BY = "nmts-cli 0.34.4";
 /** Which of the three artefacts a wrapper is. A reader holding several can sort them. */
 export type ArtifactKind = "recovery-list" | "file-list" | "recovery-kit";
 /**

package/dist/product.d.ts

@@ -9,7 +9,7 @@ export declare const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export declare const VERSION = "0.34.2";
+export declare const VERSION = "0.34.4";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export declare const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/product.js

@@ -18,7 +18,7 @@ export const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export const VERSION = "0.34.2";
+export const VERSION = "0.34.4";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/wallet-swap-chain.d.ts

@@ -5,7 +5,7 @@ import { type WalletBalances } from "./wallet.ts";
 import { type VenueQuote } from "./wallet-swap-quote.ts";
 /** Where a swap runs: one of the two mainnet venues, or the official testnet facility. */
 export type SwapRail = SwapVenue | "exchange";
-/** Bluefin's addresses, with the package RESOLVED and version-checked on chain, never assumed. */
+/** Bluefin's addresses: the package PINNED in this release, confirmed on chain before it is used. */
 export interface BluefinBinding {
     packageId: string;
     globalConfigId: string;
@@ -40,7 +40,7 @@ export declare function swapTransaction(input: SwapShape & {
 /** What `commands/wallet-swap.ts` reads before it prints a review. */
 export interface SwapReads {
     readWallet(address: string): Promise<WalletBalances>;
-    /** Bluefin's current package, version-checked. Throws when no known package passes. */
+    /** Bluefin's pinned package, version-checked. Throws when the chain refuses that package. */
     resolveBluefin(): Promise<BluefinBinding>;
     /** The testnet facility and its rate. Throws off testnet, or when the object cannot be read. */
     readExchange(): Promise<ExchangeFacility>;
@@ -49,4 +49,18 @@ export interface SwapReads {
     /** The fee in MIST measured by dry-running this exact swap, or null when it could not be. */
     estimateFee(shape: SwapShape, sender: string): Promise<bigint | null>;
 }
+/** All this path uses of an RPC: one devInspect and its `error`. Narrow on purpose — the type itself
+ *  has no place for a chain-supplied ADDRESS to enter, and a test can hand it a fake. */
+export interface BluefinVersionRpc {
+    devInspectTransactionBlock(input: {
+        sender: string;
+        transactionBlock: Transaction;
+    }): Promise<{
+        error?: string | null;
+    }>;
+}
+/** The pinned addresses, returned only once the chain confirms the pinned package still verifies.
+ *  A refusal ends it: this function has no other address to return. Exported so the test can hold an
+ *  RPC that names a different package and watch it change nothing. */
+export declare function checkedBluefinBinding(pinned: BluefinBinding, rpc: BluefinVersionRpc): Promise<BluefinBinding>;
 export declare function swapReads(network: Network): SwapReads;

package/dist/wallet-swap-chain.js

@@ -1,6 +1,7 @@
-// The swap transaction and its live reads: the wallet's balances, Bluefin's current package, the
-// testnet facility's rate, and the fee a dry run measures. The quotes live next door in
-// `wallet-swap-quote.ts`; both files read, and only `wallet-sign.ts` signs.
+// The swap transaction and its live reads: the wallet's balances, the version check on Bluefin's
+// PINNED package, the testnet facility's rate, and the fee a dry run measures. Bluefin's package id
+// itself is NOT a live read — see the block above `checkedBluefinBinding`. The quotes live next door
+// in `wallet-swap-quote.ts`; both files read, and only `wallet-sign.ts` signs.
 //
 // ⛔ ONE BUILDER FOR THE FEE AND THE SIGNATURE. `estimateFee` and `wallet-sign.ts` both call
 //    `swapTransaction`, so the fee printed is the fee of the transaction that is then signed.
@@ -20,7 +21,7 @@ import { coinWithBalance, Transaction } from "@mysten/sui/transactions";
 import { TESTNET_WALRUS_PACKAGE_CONFIG } from "@mysten/walrus";
 import { walrusClient, netGasFee } from "./extend-chain.js";
 import { isRecord } from "./guards.js";
-import { BLUEFIN_GLOBAL_CONFIG_IDS, BLUEFIN_MAX_SQRT_PRICE, BLUEFIN_MIN_SQRT_PRICE, BLUEFIN_PACKAGE_IDS, BLUEFIN_UPGRADE_CAP_IDS, BLUEFIN_WAL_SUI_POOLS, DEEP_COIN_TYPES, DEEPBOOK_PACKAGE_IDS, DEEPBOOK_WAL_SUI_POOLS, } from "./shared/lib/wallet/venue-ids.js";
+import { BLUEFIN_GLOBAL_CONFIG_IDS, BLUEFIN_MAX_SQRT_PRICE, BLUEFIN_MIN_SQRT_PRICE, BLUEFIN_PACKAGE_IDS, BLUEFIN_WAL_SUI_POOLS, DEEP_COIN_TYPES, DEEPBOOK_PACKAGE_IDS, DEEPBOOK_WAL_SUI_POOLS, } from "./shared/lib/wallet/venue-ids.js";
 import { readBalances, SUI_COIN_TYPE, walCoinType } from "./wallet.js";
 import { chainReader } from "./wallet-chain.js";
 import { quoteVenue, QUOTE_SENDER } from "./wallet-swap-quote.js";
@@ -86,38 +87,36 @@ export function swapTransaction(input) {
         tx.setGasBudget(input.gasBudgetMist);
     return tx;
 }
-const FULL_ADDRESS = /^0x[0-9a-f]{64}$/;
 /** `fields.<name>` of a Move object's content, as a string, or null when the shape differs. */
 function fieldOf(content, name) {
     const fields = isRecord(content) ? content["fields"] : undefined;
     return isRecord(fields) ? fields[name] : undefined;
 }
+/** Does the chain still accept this package? `config::verify_version` under devInspect: no signature,
+ *  no gas. False when the chain refuses AND when the RPC cannot answer — both mean "no Bluefin". */
+async function versionPasses(rpc, packageId, globalConfigId) {
+    try {
+        const tx = new Transaction();
+        tx.moveCall({ target: `${packageId}::config::verify_version`, arguments: [tx.object(globalConfigId)] });
+        const res = await rpc.devInspectTransactionBlock({ sender: QUOTE_SENDER, transactionBlock: tx });
+        return !res.error;
+    }
+    catch {
+        return false;
+    }
+}
+/** The pinned addresses, returned only once the chain confirms the pinned package still verifies.
+ *  A refusal ends it: this function has no other address to return. Exported so the test can hold an
+ *  RPC that names a different package and watch it change nothing. */
+export async function checkedBluefinBinding(pinned, rpc) {
+    if (!(await versionPasses(rpc, pinned.packageId, pinned.globalConfigId))) {
+        throw new Error("Bluefin's on-chain version check refused the package address this tool pins.");
+    }
+    return pinned;
+}
 export function swapReads(network) {
     const client = walrusClient(network);
     let bluefin = null;
-    async function livePackage(upgradeCapId) {
-        try {
-            const obj = await client.getObject({ id: upgradeCapId, options: { showContent: true, showType: true } });
-            if (obj.data?.type !== "0x2::package::UpgradeCap")
-                return null;
-            const pkg = fieldOf(obj.data.content, "package");
-            return typeof pkg === "string" && FULL_ADDRESS.test(pkg) ? pkg : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    async function versionPasses(packageId, globalConfigId) {
-        try {
-            const tx = new Transaction();
-            tx.moveCall({ target: `${packageId}::config::verify_version`, arguments: [tx.object(globalConfigId)] });
-            const res = await client.devInspectTransactionBlock({ sender: QUOTE_SENDER, transactionBlock: tx });
-            return !res.error;
-        }
-        catch {
-            return false;
-        }
-    }
     return {
         async readWallet(address) {
             return readBalances(chainReader(network, address), walCoinType(network));
@@ -127,19 +126,13 @@ export function swapReads(network) {
             if (bluefin !== null)
                 return bluefin;
             const pending = (async () => {
-                const pinned = BLUEFIN_PACKAGE_IDS[network];
-                const capId = BLUEFIN_UPGRADE_CAP_IDS[network];
+                const packageId = BLUEFIN_PACKAGE_IDS[network];
                 const globalConfigId = BLUEFIN_GLOBAL_CONFIG_IDS[network];
                 const poolId = BLUEFIN_WAL_SUI_POOLS[network];
-                if (pinned === null || capId === null || globalConfigId === null || poolId === null) {
+                if (packageId === null || globalConfigId === null || poolId === null) {
                     throw new Error(`This tool knows no Bluefin WAL/SUI pool on ${network}.`);
                 }
-                const live = await livePackage(capId);
-                for (const packageId of live === null ? [pinned] : [live, pinned]) {
-                    if (await versionPasses(packageId, globalConfigId))
-                        return { packageId, globalConfigId, poolId };
-                }
-                throw new Error("Bluefin's on-chain version check refused every package address this tool knows.");
+                return checkedBluefinBinding({ packageId, globalConfigId, poolId }, client);
             })();
             bluefin = pending;
             pending.catch(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@needmoretruth/nmts-cli",
-  "version": "0.34.2",
+  "version": "0.34.4",
   "description": "Command-line and MCP access to NMTS (NeedMoreTruthStorage, https://nmts.me): open-source, end-to-end encrypted storage on the Walrus network. No fee to NMTS; you pay the network from your own wallet. For people and for their agents.",
   "license": "Apache-2.0",
   "publishConfig": {