@needmoretruth/nmts-cli 0.34.3 → 0.35.0

package/dist/commands/wallet-list.js

@@ -0,0 +1,116 @@
+// `nmts wallet list` — every wallet this NMTS key has, what is in it, and which one pays.
+//
+// ⛔ IT READS. Nothing here signs, and nothing here writes the account's choice: `wallet use N`
+//    does that. Running this repeatedly costs nothing but questions to a public node.
+//
+// ⛔ WHICH WALLETS EXIST IS NOT A LIST ANYBODY KEEPS. One key derives a wallet at every index
+//    (NCF-3 §1.3), so "how many do I have" is answered by WALKING — ask about a number, then the
+//    next, and stop after twenty unused ones in a row. That rule is the browser's own, copied
+//    byte-for-byte (`shared/lib/wallet/discover.ts`), so the same key shows the same wallets in
+//    both programs. ⚠ A wallet funded further out than the gap is not found by the walk; it is not
+//    lost — `--wallet N` and `wallet use N` reach any number directly.
+//
+// ⛔ A BALANCE THAT COULD NOT BE READ IS PRINTED AS THAT, NEVER AS ZERO, and the run exits
+//    non-zero — the same rule as `nmts wallet`, for the same reason: an empty wallet and an
+//    unanswered question look identical on a screen, and one of them is a reason to stop.
+import { requireAccountCode } from "../code-access.js";
+import { readCredentialsFile } from "../credentials.js";
+import { readFileList } from "../manifest.js";
+import { resolveNetwork } from "../network.js";
+import { BINARY_NAME } from "../product.js";
+import { resolveServer } from "../server.js";
+import { openSession } from "../session.js";
+import { activeWalletOf, walletCountOf } from "../shared/lib/drive/manifest-settings.js";
+import { discoverWallets } from "../shared/lib/wallet/discover.js";
+import { coinAmount, readBalances, walCoinType, walletAddress, SUI_COIN_TYPE, } from "../wallet.js";
+/** The table's column widths. A Sui address is 66 characters and gets two spaces after it. */
+const NUMBER_W = 8;
+const ADDRESS_W = 68;
+const AMOUNT_W = 21;
+export async function walletList(options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    const resolved = await requireAccountCode();
+    const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
+    const server = resolveServer(options.server ?? stored?.server);
+    const network = resolveNetwork(server, options.network ?? stored?.network);
+    const walType = walCoinType(network);
+    const settings = await (options.readWalletSettings ?? (() => walletSettings(options)))();
+    const open = options.openChain ??
+        (async (net, addr) => (await import("../wallet-chain.js")).chainReader(net, addr));
+    const history = options.hasHistory ??
+        (async (net, addr) => (await import("../wallet-list-chain.js")).hasHistory(net, addr));
+    // Every number the walk asked about, so nothing is derived or read twice.
+    const seen = new Map();
+    const scan = await discoverWallets(async (index) => {
+        const address = await walletAddress(resolved.code, index);
+        const balances = await readBalances(await open(network, address), walType);
+        seen.set(index, { index, address, balances });
+        const held = (b) => b.read && b.baseUnits > 0n;
+        if (held(balances.sui) || held(balances.wal))
+            return true;
+        return history(network, address);
+    }, { count: settings.count });
+    // What is printed: the wallets this account has made, plus any the walk found beyond them. The
+    // rest of the walk is the gap — empty wallets nobody has asked for.
+    const rows = [...seen.values()]
+        .filter((row) => row.index < settings.count || scan.used.includes(row.index))
+        .sort((a, b) => a.index - b.index);
+    const unread = rows.some((row) => !row.balances.sui.read || !row.balances.wal.read);
+    if (options.json === true) {
+        say(JSON.stringify({
+            network,
+            active: settings.active,
+            scanned: scan.scanned,
+            wallets: rows.map((row) => ({
+                index: row.index,
+                address: row.address,
+                pays: row.index === settings.active,
+                sui: asJson(row.balances.sui, SUI_COIN_TYPE),
+                wal: asJson(row.balances.wal, walType),
+            })),
+        }));
+        return unread ? 1 : 0;
+    }
+    // ⚠ The columns are laid out with the same widths the rows use, from the same constants — a
+    //   header written out by hand drifts one space at a time until nothing lines up.
+    say(`${"Wallet".padEnd(NUMBER_W)}${"Address".padEnd(ADDRESS_W)}${"SUI".padEnd(AMOUNT_W)}WAL`);
+    for (const row of rows) {
+        const pays = row.index === settings.active ? "  pays" : "";
+        say(`${String(row.index).padEnd(NUMBER_W)}${row.address.padEnd(ADDRESS_W)}` +
+            `${inWords(row.balances.sui).padEnd(AMOUNT_W)}${inWords(row.balances.wal)}${pays}`);
+    }
+    say(``);
+    say(`  Every wallet above comes from this NMTS key, at the number in the first column. The one`);
+    say(`  marked "pays" is the one storage is paid from — \`${BINARY_NAME} wallet use <number>\` moves it,`);
+    say(`  on this account rather than on this machine. Numbers come from the key, so a wallet`);
+    say(`  cannot be deleted.`);
+    say(`  The list stops after twenty unused wallets in a row; a wallet further out than that is`);
+    say(`  reached by its number.`);
+    if (unread) {
+        say(`  A balance that could not be read is printed as that and never as zero, and this command`);
+        say(`  exits non-zero when it happens.`);
+    }
+    return unread ? 1 : 0;
+}
+/** The account's own numbers, read out of the sealed file list. */
+async function walletSettings(options) {
+    const session = await openSession({ server: options.server, network: options.network });
+    const list = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+    const settings = list.manifest?.settings;
+    return { active: activeWalletOf(settings), count: walletCountOf(settings) };
+}
+/** One balance, for a person. The same two sentences `nmts wallet` prints. */
+function inWords(balance) {
+    return balance.read ? coinAmount(balance.baseUnits) : `⛔ could not be read`;
+}
+/** One balance, for a program. `baseUnits` is a string: a balance outruns a JSON number. */
+function asJson(balance, coinType) {
+    if (!balance.read)
+        return { coinType, read: false, error: balance.why };
+    return {
+        coinType,
+        read: true,
+        baseUnits: balance.baseUnits.toString(),
+        amount: coinAmount(balance.baseUnits),
+    };
+}

package/dist/commands/wallet-send.d.ts

@@ -12,6 +12,10 @@ export interface WalletSendOptions {
     dryRun?: boolean;
     /** A ceiling on the fee, in SUI ("0.01"). Clamped to the usable range, never refused. */
     feeCap?: string | undefined;
+    /** `--wallet N`: which wallet pays, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
+    /** ⚠ A SEAM, NOT AN OPTION — where that number is read from (`wallet-pay-index.ts`). */
+    readActiveWallet?: () => Promise<number>;
     /** The instant to measure the wallet agreement against. */
     now?: number;
     /** ⚠ A SEAM, NOT AN OPTION — no flag reaches it. */

package/dist/commands/wallet-send.js

@@ -21,6 +21,7 @@ import { resolveServer } from "../server.js";
 import { explorerTxUrl } from "../shared/lib/wallet/activity.js";
 import { clampGasBudgetMist, maxSendableBaseUnits, parseTokenAmountToBaseUnits, validateSendForm, } from "../shared/lib/wallet/send-rules.js";
 import { coinAmount, walCoinType, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 import { recordWalletSpend, requireWalletGrant } from "../wallet-grant.js";
 const COIN_WORDS = {
     invalidAddress: "That is not a Sui address: it is 0x followed by 64 hexadecimal characters.",
@@ -48,7 +49,10 @@ export async function walletSend(operands, options = {}) {
         });
     }
     const resolved = await requireAccountCode();
-    const address = await walletAddress(resolved.code);
+    // ⛔ WHICH WALLET PAYS, FIRST — everything below is about one address: the balances that are
+    //    read, the fee that is measured, the line the review prints, and the key that signs.
+    const wallet = await payingWalletIndex(options);
+    const address = await walletAddress(resolved.code, wallet);
     const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
     const server = resolveServer(options.server ?? stored?.server);
     const network = resolveNetwork(server, options.network ?? stored?.network);
@@ -140,7 +144,7 @@ export async function walletSend(operands, options = {}) {
     requireWalletGrant("send", spend, new Date(options.now ?? Date.now()));
     // ⑦ The signature.
     const sign = options.sign ?? (await import("../wallet-sign.js")).signTransfer;
-    const digest = await sign({ network, code: resolved.code, shape });
+    const digest = await sign({ network, code: resolved.code, wallet, shape });
     recordWalletSpend(spend);
     if (options.json) {
         say(JSON.stringify({ ...facts, signed: true, digest, explorerUrl: explorerTxUrl(digest, network) }));

package/dist/commands/wallet-use.d.ts

@@ -0,0 +1,7 @@
+export interface WalletUseOptions {
+    server?: string | undefined;
+    network?: string | undefined;
+    json?: boolean;
+    write?: (line: string) => void;
+}
+export declare function walletUse(said: string | undefined, options?: WalletUseOptions): Promise<number>;

package/dist/commands/wallet-use.js

@@ -0,0 +1,55 @@
+// `nmts wallet use <number>` — which of this key's wallets pays for storage from now on.
+//
+// ⛔ IT WRITES THE ACCOUNT'S CHOICE, NOT THIS MACHINE'S. The number lives inside the sealed file
+//    list (`activeWallet`), where the server cannot read it and where a phone, a laptop and this
+//    tool all find the same answer. That is the whole point: money leaving from one address on one
+//    device and another address on another is how a balance goes missing without anything failing.
+//
+// ⛔ THE LIST IS WHERE THE SETTING LIVES, so an account with no list has nowhere to put it — the
+//    same refusal `nmts padding` gives, for the same reason, and the same way out: upload once.
+//
+// ⛔ NOTHING IS DELETED AND NOTHING IS CREATED. Every number a key can derive already exists
+//    (NCF-3 §1.3); this says which of them the next payment comes out of, and takes the count up
+//    with it so every screen lists the wallet it just named.
+import { NmtsError } from "../errors.js";
+import { readFileList } from "../manifest.js";
+import { applyManyToList } from "../manifest-write.js";
+import { BINARY_NAME } from "../product.js";
+import { openSession } from "../session.js";
+import { walletIndexOf } from "../wallet-pay-index.js";
+import { walletAddress } from "../wallet.js";
+export async function walletUse(said, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    if (said === undefined || said === "") {
+        throw new NmtsError(`Say which wallet: \`${BINARY_NAME} wallet use <number>\`.`, {
+            exitCode: 2,
+            nextStep: `\`${BINARY_NAME} wallet list\` shows this key's wallets and which one pays now.`,
+        });
+    }
+    // ⛔ BEFORE THE NETWORK. A misspelled number is a command line to fix, not a question to ask the
+    //    server, and a run that opened a session first would refuse for the wrong reason.
+    const index = walletIndexOf(said);
+    const session = await openSession({ server: options.server, network: options.network });
+    const before = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+    if (before.manifest === null) {
+        throw new NmtsError(`This account has no file list yet; which wallet pays lives in the list, and there is nothing to write it into.`, { exitCode: 4, nextStep: `Upload once (\`${BINARY_NAME} put\`) and set it after.` });
+    }
+    const result = await applyManyToList(session, () => [], { activeWallet: index });
+    const address = await walletAddress(session.code, index);
+    if (options.json === true) {
+        say(JSON.stringify({ wallet: index, address, changed: result.changed }));
+        return 0;
+    }
+    if (!result.changed) {
+        say(`Wallet ${index} was already the one that pays. Nothing changed.`);
+        say(`Address  ${address}`);
+        return 0;
+    }
+    say(`Wallet ${index} pays from now on.`);
+    say(`Address  ${address}`);
+    say(``);
+    say(`  Storage paid from this account's wallet now leaves this address, on every device — the`);
+    say(`  number rides in the sealed file list, not on this machine. What is already stored is`);
+    say(`  unaffected, and the wallets you were using keep whatever is in them.`);
+    return 0;
+}

package/dist/commands/wallet.d.ts

@@ -7,6 +7,10 @@ export interface WalletOptions {
     write?: (line: string) => void;
     /** `wallet address --qr`: the address as a code a phone can scan, drawn in the terminal. */
     qr?: boolean;
+    /** `wallet address --index N`: which of this key's wallets to print. Absent = the first one. */
+    index?: string | undefined;
+    /** `wallet send`/`donate --wallet N`: which wallet pays, this run only (`wallet-pay-index.ts`). */
+    wallet?: string | undefined;
     /** `wallet send`: the operands after "send", and its flags (`wallet-send.ts`). */
     rest?: readonly string[];
     yes?: boolean;

package/dist/commands/wallet.js

@@ -22,9 +22,10 @@ import { NmtsError } from "../errors.js";
 import { resolveNetwork } from "../network.js";
 import { BINARY_NAME } from "../product.js";
 import { resolveServer } from "../server.js";
-import { coinAmount, readBalances, walCoinType, walletAddress, SUI_COIN_TYPE, } from "../wallet.js";
+import { walletIndexOf } from "../wallet-pay-index.js";
+import { BUILT_IN_WALLET_INDEX, coinAmount, readBalances, walCoinType, walletAddress, SUI_COIN_TYPE, } from "../wallet.js";
 /** What the operand may say. Anything else is a command line to correct, not a guess to act on. */
-const MODES = ["address", "balance", "activity", "storage", "send", "donate", "swap", "hall"];
+const MODES = ["address", "balance", "list", "use", "activity", "storage", "send", "donate", "swap", "hall"];
 function modeOf(what) {
     if (what === undefined)
         return "balance";
@@ -33,7 +34,9 @@ function modeOf(what) {
         return found;
     throw new NmtsError(`\`${BINARY_NAME} wallet ${what}\` is not something this command does.`, {
         exitCode: 2,
-        nextStep: `\`${BINARY_NAME} wallet\` shows the address and the balances; \`${BINARY_NAME} wallet address\` ` +
+        nextStep: `\`${BINARY_NAME} wallet\` shows the address and the balances; \`${BINARY_NAME} wallet list\` ` +
+            `shows every wallet this key has and which one pays, and \`${BINARY_NAME} wallet use <number>\` ` +
+            `moves that. \`${BINARY_NAME} wallet address\` ` +
             `shows the address alone, without touching a network (add --qr for a code to scan); ` +
             `\`${BINARY_NAME} wallet activity\` lists the recent transactions; \`${BINARY_NAME} wallet storage\` ` +
             `lists the storage resources it holds. None of those signs. \`${BINARY_NAME} wallet send <SUI|WAL> ` +
@@ -48,6 +51,11 @@ export async function wallet(what, options = {}) {
     // The two lists live in files of their own; each reads through a seam of its own.
     if (mode === "activity")
         return (await import("./wallet-activity.js")).walletActivity(options);
+    // Every wallet of this key and which one pays: listing reads, choosing writes one line of the list.
+    if (mode === "list")
+        return (await import("./wallet-list.js")).walletList(options);
+    if (mode === "use")
+        return (await import("./wallet-use.js")).walletUse(options.rest?.[0], options);
     if (mode === "storage") {
         const [sub, ...more] = options.rest ?? [];
         if (sub === "split" || sub === "merge" || sub === "transfer") {
@@ -70,13 +78,17 @@ export async function wallet(what, options = {}) {
     if (mode === "hall")
         return (await import("./wallet-hall.js")).walletHall(options);
     const resolved = await requireAccountCode();
-    const address = await walletAddress(resolved.code);
+    // ⛔ `wallet address --index N` IS OFFLINE — the person named the number, so there is no list to
+    //    read; without a number it is the first wallet. "Which one pays" is a question the list
+    //    answers, and `wallet list` is where it is asked.
+    const index = options.index === undefined || options.index === "" ? BUILT_IN_WALLET_INDEX : walletIndexOf(options.index);
+    const address = await walletAddress(resolved.code, index);
     if (mode === "address") {
         if (options.json) {
-            // ⛔ NO `network` FIELD. There is no network in this answer — an account has one wallet and
-            //    it is called the same thing on every chain — and a field naming one would invite a
-            //    reader to believe this address was looked up somewhere.
-            say(JSON.stringify({ address }));
+            // ⛔ NO `network` FIELD. There is no network in this answer — a wallet is the same wallet on
+            //    every chain — and a field naming one would invite a reader to believe this address was
+            //    looked up somewhere. The NUMBER is here, because it is what the address came from.
+            say(JSON.stringify({ address, index }));
             return 0;
         }
         say(`Address  ${address}`);

package/dist/extend-plan.d.ts

@@ -143,6 +143,8 @@ export type SignExtension = (input: {
     network: string;
     /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
     code: string;
+    /** Which of this key's wallets pays — the account's own number (`wallet-pay-index.ts`). */
+    wallet: number;
     objectIds: readonly string[];
     epochs: number;
 }) => Promise<string>;

package/dist/help.js

@@ -52,7 +52,9 @@ export function helpText(version) {
         `                        refused in mode auto. Read first: terms · privacy · notices`,
         `  wallet                Show the account's wallet address, and its SUI and WAL balances`,
         `  wallet address        Just the address, derived on this machine — no network call.`,
-        `                        \`--qr\` draws it as a code a phone can scan`,
+        `                        \`--qr\` draws it as a code a phone can scan; \`--index N\` another wallet`,
+        `  wallet list           Every wallet this key has, with balances, and which one pays`,
+        `  wallet use <number>   Pay from that wallet from now on — on the account, not this machine`,
         `  wallet activity       The wallet's recent transactions, named where the chain proves it`,
         `  wallet storage        The storage resources (size × time) the wallet holds, unbound`,
         `  wallet storage split <id> --size <n>|--epochs <n> · merge <id> <id> · transfer <id> <address>`,

package/dist/index.d.ts

@@ -28,15 +28,24 @@ export type { BlobProtocol, UploadApi, UploadResult, UploadStep } from "./upload
 export type { PaddingRule } from "./shared/lib/crypto/size-padding.ts";
 export { DEFAULT_PART_BYTES } from "./seal.ts";
 export { createBlobProtocol, readCurrentEpoch } from "./walrus-write.ts";
+export { walletPut } from "./upload-wallet-put.ts";
+export type { WalletPutContext, WalletPutFile, WalletPutOutcome, WalletPutReview, WalletPutSeams, } from "./upload-wallet-put.ts";
+export { DEFAULT_UPLOAD_EPOCHS } from "./upload-wallet-plan.ts";
+export type { PartQuote, StorageChoice, UploadBudget, WalletUploadReads } from "./upload-wallet-plan.ts";
+export type { Spend } from "./wallet-grant.ts";
 export { fetchFile, fetchWithKey } from "./download.ts";
 export type { FetchedFile, FetchInput } from "./download.ts";
 export { fileSink } from "./download-sink.ts";
 export type { PlaintextSink } from "./download-sink.ts";
 export { AGGREGATOR_ENV_VAR, readBlob, RELAY_ENV_VAR, SUI_RPC_ENV_VAR } from "./walrus.ts";
 export type { ReadOptions } from "./walrus.ts";
-export { coinAmount, readBalances, walletAddress } from "./wallet.ts";
+export { coinAmount, readBalances, walCoinType, walletAddress } from "./wallet.ts";
 export type { ChainReader, CoinBalance, WalletBalances } from "./wallet.ts";
 export { chainReader } from "./wallet-chain.ts";
 export { signerAddress, signExtension, signTransfer } from "./wallet-sign.ts";
 export type { SignTransfer } from "./wallet-sign.ts";
+export { activeWalletOf, walletCountOf, WALLET_INDEX_LIMIT } from "./shared/lib/drive/manifest-settings.ts";
+export { discoverWallets, WALLET_SCAN_GAP } from "./shared/lib/wallet/discover.ts";
+export type { WalletProbe, WalletScan } from "./shared/lib/wallet/discover.ts";
+export { hasHistory } from "./wallet-list-chain.ts";
 export { HOME_URL, PRODUCT_NAME, SOURCE_URL, SUPPORT_EMAIL, VERSION } from "./product.ts";

package/dist/index.js

@@ -37,13 +37,26 @@ export { clearItemRecord, clearReservation } from "./upload-store.js";
 export { UploadError } from "./upload-wire.js";
 export { DEFAULT_PART_BYTES } from "./seal.js";
 export { createBlobProtocol, readCurrentEpoch } from "./walrus-write.js";
+// Uploading paid by the account's OWN WALLET instead of credits: the same seal-buy-push-record
+// path, priced and refused before anything is signed. `nmts put --pay wallet` is this plus a
+// terminal; the spending ledger and the standing gift are the command's and are not here.
+export { walletPut } from "./upload-wallet-put.js";
+export { DEFAULT_UPLOAD_EPOCHS } from "./upload-wallet-plan.js";
 // Downloading: fetching sealed parts from the storage network and opening them here.
 export { fetchFile, fetchWithKey } from "./download.js";
 export { fileSink } from "./download-sink.js";
 export { AGGREGATOR_ENV_VAR, readBlob, RELAY_ENV_VAR, SUI_RPC_ENV_VAR } from "./walrus.js";
 // The wallet the NMTS key derives: reading it, and signing with it.
-export { coinAmount, readBalances, walletAddress } from "./wallet.js";
+export { coinAmount, readBalances, walCoinType, walletAddress } from "./wallet.js";
 export { chainReader } from "./wallet-chain.js";
 export { signerAddress, signExtension, signTransfer } from "./wallet-sign.js";
+// WHICH of this key's wallets, and which of them have been used. One key derives a wallet at every
+// index (NCF-3 §1.3), so the account's own number is read out of the sealed list and the rest is a
+// walk. Both are here so that a library built on this package finds the SAME wallets under the same
+// numbers as `nmts wallet list` — a second walk, or a second reading of the setting, would be a
+// second answer to a question that has to have exactly one.
+export { activeWalletOf, walletCountOf, WALLET_INDEX_LIMIT } from "./shared/lib/drive/manifest-settings.js";
+export { discoverWallets, WALLET_SCAN_GAP } from "./shared/lib/wallet/discover.js";
+export { hasHistory } from "./wallet-list-chain.js";
 // What this package is.
 export { HOME_URL, PRODUCT_NAME, SOURCE_URL, SUPPORT_EMAIL, VERSION } from "./product.js";

package/dist/main.js

@@ -124,7 +124,7 @@ export async function run(argv) {
             return await wallet(args.operands[0], {
                 server: args.server, network: args.network, json: args.json, qr: args.qr,
                 rest: args.operands.slice(1), yes: args.yes, dryRun: args.dryRun, feeCap: args.feeCap,
-                to: args.to, venue: args.venue, slippageBps: args.slippageBps, acceptExtremes: args.acceptExtremes, size: args.size, epochs: args.epochs, name: args.name, remove: args.remove,
+                to: args.to, venue: args.venue, slippageBps: args.slippageBps, acceptExtremes: args.acceptExtremes, size: args.size, epochs: args.epochs, name: args.name, remove: args.remove, index: args.index, wallet: args.wallet,
             });
         }
         case "expiring": {
@@ -149,7 +149,7 @@ export async function run(argv) {
                 epochs: args.epochs,
                 dryRun: args.dryRun,
                 yes: args.yes,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "create": {
@@ -191,7 +191,7 @@ export async function run(argv) {
                 pay: args.pay,
                 epochs: args.epochs,
                 storage: args.storage,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "push": {
@@ -208,7 +208,7 @@ export async function run(argv) {
                 pay: args.pay,
                 epochs: args.epochs,
                 storage: args.storage,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "rm": {

package/dist/product.d.ts

@@ -9,7 +9,7 @@ export declare const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export declare const VERSION = "0.34.3";
+export declare const VERSION = "0.35.0";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export declare const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/product.js

@@ -18,7 +18,7 @@ export const BINARY_NAME = "nmts";
  *    beside it. Here rather than in `main.ts` because the MCP server has to say it too, and a
  *    command importing the entry point is a cycle waiting to bite.
  */
-export const VERSION = "0.34.3";
+export const VERSION = "0.35.0";
 /** Where the product lives, for messages that need to send somebody somewhere real. */
 export const HOME_URL = "https://nmts.me";
 /** The source, so a person holding only the built program can find what it was built from. */

package/dist/risk.d.ts

@@ -344,6 +344,10 @@ export declare const ACTS: {
         readonly what: "Send a gift to the developer from the wallet.";
         readonly asksItself: true;
     };
+    readonly "wallet.use": {
+        readonly tier: "low";
+        readonly what: "Change which of this key's wallets pays for storage.";
+    };
     readonly "wallet.hall": {
         readonly tier: "none";
     };

package/dist/risk.js

@@ -125,6 +125,10 @@ export const ACTS = {
     // ⛔ READING THE HALL IS `none` AND LISTING A NAME IS `medium`. The read signs nothing and asks
     //    nobody's wallet a question; setting a name PUBLISHES a name beside an address on a public
     //    page, which is undone by one more run of the same command but cannot be unseen.
+    // ⛔ `list` READS; `use` WRITES — it changes which address every later payment leaves from, on
+    //    every device. Low rather than high because it signs nothing and moves nothing, and running
+    //    it again puts the old number back.
+    "wallet.use": { tier: "low", what: "Change which of this key's wallets pays for storage." },
     "wallet.hall": { tier: "none" },
     "wallet.hall.set": { tier: "medium", what: "Publish this name beside your wallet's address in the gift hall of fame." },
     "wallet.storage.reshape": { tier: "high", lock: "wallet", what: "Cut or join a storage resource the wallet holds — a signed transaction.", asksItself: true },
@@ -156,6 +160,8 @@ export function actOf(args) {
             //    both land on the act that publishes; the bare command is a read like `wallet` itself.
             if (sub === "hall")
                 return args.name !== undefined || args.remove ? "wallet.hall.set" : "wallet.hall";
+            if (sub === "use")
+                return "wallet.use";
             return sub === "send" ? "wallet.send" : sub === "swap" ? "wallet.swap" : sub === "donate" ? "wallet.donate" : "wallet";
         case "put":
             return args.pay === "wallet" ? "put.wallet" : "put";

package/dist/shared/lib/drive/manifest-ops.d.ts

@@ -1,4 +1,4 @@
-import type { AccountSettings, ManifestEntry } from "./manifest-codec.ts";
+import type { ManifestEntry } from "./manifest-codec.ts";
 /** One drive edit, in a form that can be replayed onto a newer list. */
 export type ManifestIntent = 
 /** Insert or replace by id. Upload-commit and folder-create both land here. */
@@ -115,37 +115,15 @@ export type ManifestIntent =
  */
 export declare function applyIntent(entries: readonly ManifestEntry[], intent: ManifestIntent): readonly ManifestEntry[];
 /**
- * Which size-padding rule an account seals its next upload under.
+ * The account settings' own vocabulary — the padding rule, one settings edit, and how an edit
+ * lands — comes back out of `manifest-settings-patch.ts`, beside the fields it names.
  *
- * ⛔ DECLARED BESIDE THE PATCH THAT CARRIES IT, not in `lib/crypto/padding.ts` where the padding
- *    itself lives. `padding.ts` imports it from here. The direction matters: this file is copied
- *    byte-for-byte into the `nmts` command-line package, and a type reaching out of it into the
- *    crypto tree would drag that whole tree along with it for the sake of two string literals.
+ * ⛔ RE-EXPORTED RATHER THAN MOVED AWAY. Every caller in both packages spells it `manifest-ops`,
+ *    and a settings patch IS one of this file's intents as far as they are concerned. It moved
+ *    because the settings write path had grown into the file's ceiling (`check:size`), and
+ *    splitting it puts each rule beside the field it is about.
  */
-export type PaddingMode = "padme" | "pow2" | "none";
-/**
- * One account-settings edit, as DESIRED STATE per field — never "toggle", so replaying it onto a
- * list another device wrote lands the same answer. A default value means absence in the codec.
- */
-export interface SettingsPatch {
-    developerMode?: boolean;
-    textScalePct?: number;
-    /** Which rule seals future uploads: `"padme"` = the default, `"none"` = the file's exact length. */
-    paddingMode?: PaddingMode;
-    /** Credits held back with each credit-paid upload, 0 to `DEPOSIT_MAX_CREDITS`. */
-    depositDefault?: number;
-    /** The standing tip in tenths of a percent (0 = none) and the instant its terms were agreed to (0 clears). */
-    tipTenths?: number;
-    tipConsentAt?: number;
-}
-/**
- * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
- * changed, so callers can skip a save (a version bump every other device must download).
- *
- * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
- * the slider or the typed field lets through never reaches the wire out of range.
- */
-export declare function applySettingsPatch(settings: AccountSettings, patch: SettingsPatch): AccountSettings;
+export { applySettingsPatch, type PaddingMode, type SettingsPatch, } from "./manifest-settings-patch.ts";
 /** Replay a whole queue in order. Used to rebuild after a version conflict. */
 export declare function applyIntents(entries: readonly ManifestEntry[], intents: readonly ManifestIntent[]): readonly ManifestEntry[];
 /**

package/dist/shared/lib/drive/manifest-ops.js

@@ -1,6 +1,3 @@
-// Runtime import (relative + .ts — the header's node --test rule) for the bounds the patch obeys.
-import { TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT, } from "./manifest-codec.js";
-import { applyDepositPatch, applyTipPatch } from "./manifest-settings.js";
 /**
  * Apply one intent, returning a new list. The input is never mutated: the store keeps the
  * pre-save snapshot around to rebuild from after a version conflict.
@@ -160,44 +157,15 @@ function withShares(e, shares, at) {
     return { ...e, shares, updatedAt: at };
 }
 /**
- * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
- * changed, so callers can skip a save (a version bump every other device must download).
+ * The account settings' own vocabulary — the padding rule, one settings edit, and how an edit
+ * lands — comes back out of `manifest-settings-patch.ts`, beside the fields it names.
  *
- * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
- * the slider or the typed field lets through never reaches the wire out of range.
+ * ⛔ RE-EXPORTED RATHER THAN MOVED AWAY. Every caller in both packages spells it `manifest-ops`,
+ *    and a settings patch IS one of this file's intents as far as they are concerned. It moved
+ *    because the settings write path had grown into the file's ceiling (`check:size`), and
+ *    splitting it puts each rule beside the field it is about.
  */
-export function applySettingsPatch(settings, patch) {
-    const next = { ...settings };
-    if (patch.developerMode !== undefined) {
-        if (patch.developerMode)
-            next.developerMode = true;
-        else
-            delete next.developerMode;
-    }
-    if (patch.paddingMode !== undefined) {
-        // The default is spelled as absence, like every other field here — so two devices that both
-        // "choose the default" write the same bytes and neither bumps the list's version.
-        if (patch.paddingMode === "pow2" || patch.paddingMode === "none")
-            next.paddingMode = patch.paddingMode;
-        else
-            delete next.paddingMode;
-    }
-    if (patch.textScalePct !== undefined && Number.isFinite(patch.textScalePct)) {
-        const pct = Math.round(Math.min(TEXT_SCALE_MAX_PCT, Math.max(TEXT_SCALE_MIN_PCT, patch.textScalePct)));
-        if (pct === TEXT_SCALE_DEFAULT_PCT)
-            delete next.textScalePct;
-        else
-            next.textScalePct = pct;
-    }
-    applyDepositPatch(next, patch.depositDefault);
-    applyTipPatch(next, patch.tipTenths, patch.tipConsentAt);
-    const same = (next.developerMode === true) === (settings.developerMode === true) &&
-        next.paddingMode === settings.paddingMode && next.depositDefault === settings.depositDefault &&
-        next.textScalePct === settings.textScalePct &&
-        next.tipTenths === settings.tipTenths &&
-        next.tipConsentAt === settings.tipConsentAt;
-    return same ? settings : next;
-}
+export { applySettingsPatch, } from "./manifest-settings-patch.js";
 /** Replay a whole queue in order. Used to rebuild after a version conflict. */
 export function applyIntents(entries, intents) {
     return intents.reduce(applyIntent, entries);

package/dist/shared/lib/drive/manifest-settings-patch.d.ts

@@ -0,0 +1,52 @@
+import { type AccountSettings } from "./manifest-settings.ts";
+/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
+export declare function applyDepositPatch(next: AccountSettings, depositDefault?: number): void;
+/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
+export declare function applyTipPatch(next: AccountSettings, tipTenths?: number, tipConsentAt?: number): void;
+/**
+ * Folds a wallet patch into a settings copy: out-of-range is clamped, wallet 0 and a list of one
+ * clear, and the count is left holding the paying wallet.
+ *
+ * ⛔ THE COUNT FOLLOWS THE NUMBER, in this one write path. `wallet use 7` on a list of three
+ *    wallets means the person is paying from a wallet the screen would not have drawn; raising the
+ *    count here is what makes the two facts agree on every device at once, rather than in whichever
+ *    screen happens to notice.
+ */
+export declare function applyWalletPatch(next: AccountSettings, activeWallet?: number, walletCount?: number): void;
+/**
+ * Which size-padding rule an account seals its next upload under.
+ *
+ * ⛔ DECLARED BESIDE THE FIELD THAT CARRIES IT, not in `lib/crypto/padding.ts` where the padding
+ *    itself lives — `padding.ts` imports it through `manifest-ops.ts`, which re-exports it. The
+ *    direction matters: this file is copied byte-for-byte into the `nmts` command-line package,
+ *    and a type reaching out of it into the crypto tree would drag that whole tree along with it
+ *    for the sake of two string literals.
+ */
+export type PaddingMode = "padme" | "pow2" | "none";
+/**
+ * One account-settings edit, as DESIRED STATE per field — never "toggle", so replaying it onto a
+ * list another device wrote lands the same answer. A default value means absence in the codec.
+ */
+export interface SettingsPatch {
+    developerMode?: boolean;
+    textScalePct?: number;
+    /** Which rule seals future uploads: `"padme"` = the default, `"none"` = the file's exact length. */
+    paddingMode?: PaddingMode;
+    /** Credits held back with each credit-paid upload, 0 to `DEPOSIT_MAX_CREDITS`. */
+    depositDefault?: number;
+    /** The standing tip in tenths of a percent (0 = none) and the instant its terms were agreed to (0 clears). */
+    tipTenths?: number;
+    tipConsentAt?: number;
+    /** Which wallet pays, by index (0 = the wallet every account starts with). */
+    activeWallet?: number;
+    /** How many wallets this account's list holds. Raised to hold `activeWallet`, never lowered. */
+    walletCount?: number;
+}
+/**
+ * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
+ * changed, so callers can skip a save (a version bump every other device must download).
+ *
+ * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
+ * the slider or the typed field lets through never reaches the wire out of range.
+ */
+export declare function applySettingsPatch(settings: AccountSettings, patch: SettingsPatch): AccountSettings;