@needmoretruth/nmts-cli 0.34.4 → 0.35.0

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 Each version's entry is what changed for the person or the program using `nmts`. The product's own
 update history, which covers the site and the server too, is at https://nmts.me/updates.
 
+## 0.35.0 — 2026-09-16
+
+- Many wallets from one NMTS key. The key derives a wallet at every number from 0 upwards, and one
+  of them pays. `wallet list` scans the numbers in order, shows each wallet's address and balances,
+  marks the one that pays, and stops after twenty unused wallets in a row. `wallet use <number>`
+  moves which one pays; the number is kept inside your sealed file list, so the browser, this tool
+  and every other device agree on it. `wallet address --index <number>` derives any of them offline.
+- Paying commands (`put --pay wallet`, `push --pay wallet`, `wallet send`, `extend`, `wallet donate`)
+  sign from the wallet that pays, and `--wallet <number>` pays from another one for that run only.
+  If the file list cannot be read they refuse rather than falling back to wallet 0.
+- Library: `walletPut` — the wallet-paid upload without the terminal (plan, quote, dry-run the fee,
+  read both balances, refuse a shortfall before any signature, sign, upload, record) — plus
+  `discoverWallets`, `activeWalletOf`, `walletCountOf`, `hasHistory` and `walCoinType`, for the SDK
+  and other programs built on this package.
+- Not yet on the paying wallet: `wallet swap`, `wallet storage split|merge|transfer` and `wallet hall`
+  still sign from wallet 0; a later version moves them together with the review they print.
+
 ## 0.34.4 — 2026-09-07
 
 - The advice for `SPONSORED_IDEM_MISMATCH`: the server now refuses a credit reservation repeated

package/README.ko.md

@@ -16,7 +16,7 @@
 
 ## NMTS가 무엇인가
 
-**암호화가 내 기계에서 일어나고 열쇠가 기기 밖으로 나가지 않는** 저장소입니다. 서버는 암호화된
+**암호화가 내 기계에서 일어나고 키가 기기 밖으로 나가지 않는** 저장소입니다. 서버는 암호화된
 바이트를 받을 뿐 열지 못합니다. 파일 내용도, 이름도, 폴더도 전부 NMTS 키만이 여는 암호화된
 목록 안에 있습니다.
 
@@ -51,7 +51,7 @@ nmts --help
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # 기본 브랜치
-npm install -g github:needmoretruth/nmts-cli#v0.34.4    # 버전을 고정할 때
+npm install -g github:needmoretruth/nmts-cli#v0.35.0    # 버전을 고정할 때
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 
@@ -92,7 +92,7 @@ nmts get x     # 파일 하나 다운로드
 
 | | 하는 일 | 건네는 법 |
 |---|---|---|
-| **NMTS 키** | 파일을 엽니다. 계정의 모든 열쇠가 여기서 나옵니다. 서버로 가지 않습니다. | `NMTS_ACCOUNT_CODE_FILE=/path`(권장) · `nmts login` · `NMTS_ACCOUNT_CODE` |
+| **NMTS 키** | 파일을 엽니다. 계정의 모든 키가 여기서 나옵니다. 서버로 가지 않습니다. | `NMTS_ACCOUNT_CODE_FILE=/path`(권장) · `nmts login` · `NMTS_ACCOUNT_CODE` |
 | **API 키** | 서버가 답하게 합니다. nmts.me의 계정 화면에서 만듭니다. 파일은 열지 못합니다. | `NMTS_API_KEY_FILE=/path`(권장) · `NMTS_API_KEY` · `nmts login` |
 
 `nmts ls`는 둘 다 필요합니다 — 서버가 답하게 하는 API 키와, 그 답을 열 수 있게 하는 NMTS 키.
@@ -101,14 +101,14 @@ nmts get x     # 파일 하나 다운로드
 변수(`NMTS_ACCOUNT_CODE`·`NMTS_ACCOUNT_CODE_FILE`), 설정 키, MCP 도구와 인자 이름, 오류 코드,
 파일 형식은 모두 쓰던 이름 그대로입니다. 이미 짜 두신 스크립트는 그대로 돕니다.
 
-`nmts login`은 API 키를 적어 두기 전에 서버에 확인하고, 그 키의 공개된 손잡이만 찍고 키 자체는
+`nmts login`은 API 키를 적어 두기 전에 서버에 확인하고, 그 키의 공개된 핸들만 찍고 키 자체는
 찍지 않으며, 그렇게 하라고 하지 않은 실행은 이미 저장된 API 키를 덮어쓰지 않습니다. `nmts logout`이 저장된
 것을 지웁니다.
 
 `nmts whoami --reveal`은 NMTS 키 자체를 찍습니다. `nmts unlock reveal`로 한 번 열기 전에는 잠겨
 있고 실행마다 다시 묻습니다. 터미널을 기록하는 무엇이든 그때부터 NMTS 키를 갖게 됩니다.
 
-**어느 자격도 명령줄 인자로는 받지 않습니다.** 어떤 프로세스든 다른 프로세스의 명령줄을 읽을 수
+**어느 자격도 명령행 인자로는 받지 않습니다.** 어떤 프로세스든 다른 프로세스의 명령행 인자를 읽을 수
 있고, 셸은 그것을 기록에 남깁니다. 둘 다 그런 옵션이 없습니다.
 
 ### NMTS 키를 둘 수 있는 자리
@@ -158,7 +158,7 @@ NMTS 키는 한 번에 전부입니다. 그것을 가진 프로그램은 모든
 | `nmts rm <paths>` | 휴지통으로 옮깁니다 — 30일 동안 되살릴 수 있습니다 |
 | `nmts restore <paths>` | 휴지통에서 도로 꺼냅니다 |
 | `nmts sweep` | 30일이 지난 휴지통 항목을 버립니다. **되돌릴 수 없어** 실행마다 묻습니다 |
-| `nmts erase <paths>` | 파일을 완전히 지웁니다 — 서버 기록과 이 계정의 열쇠, 휴지통 안팎 가리지 않고. 문장 입력, API 키 옆에 NMTS 키 증명. `--release-storage`는 크레딧으로 산 저장까지 파기(`nmts unlock release-storage`로 열기 전에는 잠김) |
+| `nmts erase <paths>` | 파일을 완전히 지웁니다 — 서버 기록과 이 계정의 키, 휴지통 안팎 가리지 않고. 문장 입력, API 키 옆에 NMTS 키 증명. `--release-storage`는 크레딧으로 산 저장까지 파기(`nmts unlock release-storage`로 열기 전에는 잠김) |
 | `nmts mkdir <path>` | 폴더를 만듭니다. 위에 없는 폴더도 함께 |
 | `nmts mv <paths> <folder>` | 폴더로 옮깁니다. `/`는 드라이브의 맨 위입니다 |
 | `nmts rename <path> <name>` | 하나에 새 이름을 줍니다 |
@@ -193,11 +193,11 @@ NMTS 키는 한 번에 전부입니다. 그것을 가진 프로그램은 모든
 | `nmts listfile` | 이 기계가 가진 암호화된 파일 목록을 파일로 씁니다 |
 | `nmts recovery-list` | NMTS 없이 이 계정의 바이트를 찾아내는 파일을 씁니다 |
 | `nmts kit` | 복구 키트: 그 목록**과 NMTS 키**를 한 파일에 |
-| `nmts recovery` | NMTS 없이 파일을 되읽는 독립 프로그램을 내려받습니다 |
+| `nmts recovery` | NMTS 없이 파일을 되읽는 독립 프로그램을 다운로드합니다 |
 | `nmts unlock` / `nmts lock` | 이 기계가 무엇을 열어 두었는지. `unlock <열쇠>`가 하나를 엽니다(사람이, 터미널에서), `lock <열쇠>`가 닫습니다. `consent`는 옛 이름 |
 | `nmts mode` | 이 도구를 모는 에이전트가 묻지 않고 얼마나 정할 수 있는가 |
 | `nmts support send` | 개발자에게 제보를 보냅니다 — 버그·오류·아이디어·질문. `--attach-log`는 최근 실행 기록을 가려서 붙입니다 |
-| `nmts support list` / `show <코드>` / `reply <코드>` | 답장을 읽고, 같은 글타래에 다시 씁니다 |
+| `nmts support list` / `show <코드>` / `reply <코드>` | 답장을 읽고, 같은 스레드에 다시 씁니다 |
 | `nmts update` | 이 도구의 가장 새 릴리스를 설치합니다 |
 | `nmts notices` | NMTS가 올린 공지 — 중단·장애·새 약관이 시행되기 전의 예고. `notices <id>`는 하나를 찍고, `--save <id>`는 날짜 붙은 파일로 보관합니다 |
 | `nmts terms` | 지금 시행 중인 이용약관. `--lang ko`는 한국어, `--board`는 게시판 약관, `--save`는 사본 보관 |
@@ -303,7 +303,7 @@ nmts restore photos/2026
 `extend`는 저장된 파일의 기간을 **NMTS 키가 만드는 지갑에서** 공개 체인 위에서 더 삽니다.
 `wallet` 잠금을 열 때 범위(`storage`, 또는 교환·보내기까지 `all`)와 기한(최대 30일), 원하면 이 도구가 서명해
 내보낼 수 있는 상한을 함께 정합니다 — `nmts unlock wallet --days 7 [--scope all] [--cap-wal 10
---cap-sui 0.1]`. `--dry-run`을 받으며 그때는 열쇠를 건드리지 않습니다.
+--cap-sui 0.1]`. `--dry-run`을 받으며 그때는 키를 건드리지 않습니다.
 동의를 묻기 전에 지갑을 읽고 그 거래를 체인에 미리 돌려 봅니다: 값, 체인 수수료(SUI), 두 잔액이
 찍히고, 모자란 것이 확인된 지갑은 서명 대신 두 수를 말하며 거절됩니다.
 `wallet`은 읽기만 합니다. 주소는 이 기계에서 만들고, 못 읽은 잔액은 0이 아니라 「못 읽음」으로
@@ -350,9 +350,9 @@ nmts restore photos/2026
 
 `recovery-list`는 저장 네트워크에서 내 바이트가 어디 있는지 찾아내는 암호화된 파일을 씁니다.
 NMTS 키는 들어 있지 않습니다. `kit`은 그 목록과 NMTS 키를 한 파일에 쓰므로, 키트를 가진
-사람이 계정을 가집니다. `recovery`는 이 기계에 맞는 독립 복구 프로그램을 내려받아 릴리스의
+사람이 계정을 가집니다. `recovery`는 이 기계에 맞는 독립 복구 프로그램을 다운로드해 릴리스의
 체크섬 파일과 대조한 뒤에야 실행 가능하게 만들고, PATH에는 아무것도 넣지 않습니다. `rebuild`는
-목록을 잃은 계정의 파일 목록을 서버의 줄로 다시 짓습니다. 열쇠·해시·날짜·크기는 돌아오고 이름과
+목록을 잃은 계정의 파일 목록을 서버의 줄로 다시 짓습니다. 키·해시·날짜·크기는 돌아오고 이름과
 폴더는 돌아오지 않습니다.
 
 `nmts rollback`은 파일 목록의 이전 버전을 현재 버전으로 되돌립니다 — 현재 목록이 열리지 않을
@@ -382,7 +382,7 @@ nmts verify            # 계정 주인이 nmts.me에 칠 짧은 코드를 찍고
 **medium**(업로드·공개 코드 게시·새 키)은 실행마다 한 번 묻습니다 — 터미널에서 y/N, 또는 `--yes`. **high**
 (지갑 서명·다른 계정에 파일 주기·NMTS 키 노출·잠그지 않은 저장)는 이 기계에서 `nmts unlock <열쇠>`로 한 번 열기
 전에는 잠겨 있고, 연 뒤에도 실행마다 묻습니다. **ultra-high**(계정 삭제)는 문장을 입력합니다. `nmts unlock`이
-열쇠 목록을 보여 주고, 각 열쇠는 묻기 전에 무엇을 여는지, 무엇이 잘못될 수 있는지, 무엇을 덮지 않는지를
+키 목록을 보여 주고, 각 키는 묻기 전에 무엇을 여는지, 무엇이 잘못될 수 있는지, 무엇을 덮지 않는지를
 찍습니다. `nmts help <명령>`이 어느 명령이든 그 문서를 등급과 함께 찍습니다.
 
 ## 컨테이너
@@ -420,7 +420,7 @@ docker run --rm \
 ## S3 도구에 드라이브 내주기
 
 `nmts s3`는 이 기계에서 S3 프로토콜을 말하는 서버를 띄웁니다. rclone, AWS CLI, S3를 아는 어떤
-백업 프로그램이든 이 계정의 파일을 목록으로 보고 내려받을 수 있습니다.
+백업 프로그램이든 이 계정의 파일을 목록으로 보고 다운로드할 수 있습니다.
 
 ```
 $ nmts s3
@@ -457,7 +457,7 @@ $ rclone copy --size-only ./somewhere drive:drive
 
 ## MCP를 말하는 에이전트에게
 
-`nmts mcp`는 stdin과 stdout 위의 로컬 MCP 서버입니다. 먼저 로그인하십시오(`nmts login`). 명령줄로
+`nmts mcp`는 stdin과 stdout 위의 로컬 MCP 서버입니다. 먼저 로그인하십시오(`nmts login`). CLI로
 NMTS 키를 받지 않고, 묻지도 않으므로, 잠가 둔 NMTS 키에 `NMTS_PASSPHRASE`가 없으면 시작하자마자 종료
 코드 3으로 끝납니다.
 
@@ -520,7 +520,7 @@ auto 모드 둘에서 거절됩니다. 모드가 켜져 있는 동안 모든 명
 ## 뭔가 잘못됐다면
 
 도구에서 바로 보내십시오: `nmts support send --category bug --message "…" --attach-log`. NMTS를
-만드는 한 사람에게 앱의 문의함과 같은 곳으로 닿고, 답장은 같은 글타래로 옵니다(`nmts support list`,
+만드는 한 사람에게 앱의 문의함과 같은 곳으로 닿고, 답장은 같은 스레드로 옵니다(`nmts support list`,
 그다음 `nmts support show <코드>`). 보내기 전에 무엇이 갈지 그대로 보여 주고, NMTS 키·API 키·
 암호 구절·파일 내용은 이 기계에서 먼저 지우며, `--omit <글자>`로 무엇이든 더 지울 수 있습니다.
 영어를 권하지만 한국어도 읽습니다. 아이디어도 고장만큼 값어치가 있고, 확신이 없는 것도 그렇습니다.

package/README.md

@@ -53,7 +53,7 @@ default branch, from a pinned version, or from the tarball attached to the
 
 ```sh
 npm install -g github:needmoretruth/nmts-cli            # the default branch
-npm install -g github:needmoretruth/nmts-cli#v0.34.4    # a pinned version
+npm install -g github:needmoretruth/nmts-cli#v0.35.0    # a pinned version
 npm install -g https://github.com/needmoretruth/nmts-cli/releases/latest/download/nmts.tgz
 ```
 

package/dist/arg-options.d.ts

@@ -0,0 +1,167 @@
+export interface ParsedArgs {
+    command: string | null;
+    /** Positional arguments after the command. */
+    operands: string[];
+    server?: string;
+    network?: string;
+    help: boolean;
+    version: boolean;
+    /** Machine-readable output where a command has one. */
+    json: boolean;
+    /** Include what is in the trash. */
+    all: boolean;
+    /** Where to write a fetched file. */
+    out?: string;
+    /** Replace a file that is already there. */
+    force: boolean;
+    /** The name an uploaded file gets in the drive. */
+    name?: string;
+    /** The destination folder for an upload. */
+    to?: string;
+    /** Say what an upload would cost and stop. */
+    dryRun: boolean;
+    /** `put`: how much of a file goes into one part. A byte count, optionally with a unit. */
+    partSize?: string;
+    /** `put`/`push`: what THIS run does about a name already in use. Absent = this machine's setting. */
+    onCollision?: string;
+    /** `put`/`push`: credits THIS upload sets aside per file, 0 to 64. Absent = the account's default. */
+    deposit?: string;
+    /** Answer yes to a warning this run would otherwise stop on. */
+    yes: boolean;
+    /** `public-code`: publish this account's public code on the server. Permanent. */
+    publish: boolean;
+    /** `login`: store the NMTS key unsealed rather than under a passphrase. */
+    plain: boolean;
+    /** `login`: store nothing; print the environment variable to set. */
+    env: boolean;
+    /** `verify`: report whether the human check is live and stop, asking for no new code. */
+    status: boolean;
+    /** `create`: print the registration address and stop, rather than waiting for a person. */
+    noWait?: boolean;
+    /** `ls`: keep only files whose name contains this text, case-insensitively. */
+    find?: string;
+    /** `ls`: which order to list in — `name`, `size` or `date`. Absent = the path order. */
+    sort?: string;
+    /** `ls`: reverse whichever order is in effect. */
+    desc: boolean;
+    /** `push`: include entries whose name begins with a dot. */
+    hidden: boolean;
+    /** `extend`: how many of the storage network's epochs to add; `put`/`push --pay wallet`: how many to buy. */
+    epochs?: string;
+    /** `put`/`push`: who pays for the storage — `credits` (the default) or `wallet`. */
+    pay?: string;
+    /** `put --pay wallet`: `fit`, `whole`, or a held storage resource's object id. */
+    storage?: string;
+    /** `consent grant wallet`: how long the grant lasts (days, at most 30), or until a date.
+     *  `key new`: how many days the new API key lasts. The server clamps at its own ceiling. */
+    days?: string;
+    until?: string;
+    /** `consent grant wallet`: `storage` or `all`. */
+    scope?: string;
+    /** `key new`: which permissions the key carries — `read`, `write`, `spend`, comma-separated. */
+    scopes?: string;
+    /** `consent grant wallet`: ceilings in coins. */
+    capWal?: string;
+    capSui?: string;
+    /** `wallet send` · `wallet swap`: a ceiling on the chain fee, in SUI. */
+    feeCap?: string;
+    /** `wallet swap`: which venue, deepbook or bluefin. Without it both are quoted and the run stops. */
+    venue?: string;
+    /** `wallet swap`: the slippage allowance in whole bps (1 bps = 0.01%). */
+    slippageBps?: string;
+    /** `wallet swap`: a person's say past the extremes gate. Refused while a mode is on. */
+    acceptExtremes: boolean;
+    /** `wallet address`: which of this key's wallets to print. Absent = the first one, offline. */
+    index?: string;
+    /**
+     * `put`/`push`/`extend`/`wallet send`/`wallet donate`: which wallet pays, THIS RUN ONLY.
+     *
+     * ⛔ IT DOES NOT SAVE. Which wallet pays is the account's own setting (`nmts wallet use N`), read
+     *    from the sealed file list so every device agrees; a flag that quietly rewrote it would make
+     *    one hurried command change where the money comes from for every later one, everywhere.
+     */
+    wallet?: string;
+    /** `s3`: which loopback port the gateway listens on. */
+    port?: string;
+    /**
+     * `create`: the version of the Terms of Service a PERSON read and accepts for the new account.
+     *
+     * ⛔ IT IS A VALUE AND NOT A FLAG, so that what was accepted is on the command line rather than
+     *    implied by it. A tool that could accept "whatever is current" would be agreeing on behalf
+     *    of somebody who never saw a version number.
+     */
+    acceptTerms?: string;
+    /** `create`: the version of the Privacy Policy accepted in the same act. */
+    acceptPrivacy?: string;
+    /** `losses`: ask the chain about ONE listed storage object now, instead of listing. */
+    recheck?: string;
+    /** `losses`: take ONE line off this account's own drive, instead of listing. ⛔ A VALUE AND NOT
+     *  A FLAG, so the line put down is named on the command line: a person reads one and puts it down. */
+    dismiss?: string;
+    /** `shares`: who ONE file was shared with, instead of what was shared with this account. */
+    sent?: string;
+    /** ultra-high acts under skip-permissions: why this is right to do now. Kept in the run log. */
+    reason?: string;
+    releaseStorage: boolean;
+    size?: string;
+    /** `devices`: sign ONE device out by id, or `all` — a person's act, proved by the NMTS key. */
+    signOut?: string;
+    /**
+     * `label`: the label to rename. The NEW name follows as the operand.
+     *
+     * ⛔ ONE VALUE, NOT TWO, because the table above gives every option exactly one — and a second
+     *    spelling of "how many values does this take" is how an option ends up parsed one way and
+     *    tested another. What a person types is still `label --rename <old> <new>`: the new name is
+     *    read from the operands, which is where `label <name> <files>` already reads a name from.
+     */
+    rename?: string;
+    /** `support send`: what the report is about, and optionally which part of that. */
+    category?: string;
+    sub?: string;
+    /** `support`: the message itself, or the file holding it. */
+    message?: string;
+    messageFile?: string;
+    /**
+     * `support send`: attach the run log, and how many runs of it.
+     * ⛔ THE EMPTY STRING IS "GIVEN WITH NO NUMBER", which is different from absent. A boolean
+     *    beside a count would be two fields answering one question, and the pair can disagree.
+     */
+    attachLog?: string;
+    /**
+     * `support`: values that must not travel, replaced wherever they appear.
+     *
+     * ⛔ THE ONLY REPEATABLE OPTION, and it is repeatable because what it names is one value at a
+     *    time. A comma-separated list would make a comma impossible to omit.
+     */
+    omit?: string[];
+    /**
+     * `whoami`: print the NMTS key itself.
+     *
+     * ⛔ A FLAG AND NOT A VALUE — it names no secret, it asks for the one this machine already
+     *    holds. The option table is checked for names that look like credentials; this one carries
+     *    nothing and says what it does.
+     */
+    reveal: boolean;
+    /**
+     * `key new`: put the new key on the screen once, as well as storing it. A flag and not a value
+     * for the reason above: it names no secret, it asks for the one this run was just handed.
+     */
+    print: boolean;
+    /** `nmts wallet address --qr` — the address as a QR code in the terminal as well. */
+    qr: boolean;
+    /** `wallet hall --remove`: be listed by a shortened address again. Never with `--name`. */
+    remove: boolean;
+    /** `terms`/`privacy`: which language to fetch — `en` or `ko`. Absent = English. */
+    lang?: string;
+    /** `terms`: the message board's terms rather than the service's. */
+    board: boolean;
+    /**
+     * `notices`/`terms`/`privacy`: keep the document as a file instead of printing it.
+     *
+     * ⛔ A FLAG, AND THE NOTICE'S ID IS STILL THE OPERAND. `notices --save <id>` reads exactly like
+     *    `notices <id>`, which is the point: one way to name a notice, whichever of the two things
+     *    is being done with it. The file's NAME is never an option — it is the server's, so that a
+     *    copy kept here and a copy kept from the browser are the same file.
+     */
+    save: boolean;
+}

package/dist/arg-options.js

@@ -0,0 +1,10 @@
+// What a command line can say — every option this tool accepts, in one place.
+//
+// ⛔ THE FIELDS ARE THE VOCABULARY, and the parser beside them (`args.ts`) is the only thing that
+//    fills them. They moved out of that file on 2026-09-16 because the two are different jobs and
+//    the parser's file had a ceiling: this is what the options MEAN, that is how a line is read.
+//
+// ⛔ NO SECRET IS EVER AN OPTION. There is no --code and no --api-key: on Linux any process can
+//    read another's command line, and the shell records it. A test asserts no option name looks
+//    like one.
+export {};

package/dist/args.d.ts

@@ -1,160 +1,5 @@
-export interface ParsedArgs {
-    command: string | null;
-    /** Positional arguments after the command. */
-    operands: string[];
-    server?: string;
-    network?: string;
-    help: boolean;
-    version: boolean;
-    /** Machine-readable output where a command has one. */
-    json: boolean;
-    /** Include what is in the trash. */
-    all: boolean;
-    /** Where to write a fetched file. */
-    out?: string;
-    /** Replace a file that is already there. */
-    force: boolean;
-    /** The name an uploaded file gets in the drive. */
-    name?: string;
-    /** The destination folder for an upload. */
-    to?: string;
-    /** Say what an upload would cost and stop. */
-    dryRun: boolean;
-    /** `put`: how much of a file goes into one part. A byte count, optionally with a unit. */
-    partSize?: string;
-    /** `put`/`push`: what THIS run does about a name already in use. Absent = this machine's setting. */
-    onCollision?: string;
-    /** `put`/`push`: credits THIS upload sets aside per file, 0 to 64. Absent = the account's default. */
-    deposit?: string;
-    /** Answer yes to a warning this run would otherwise stop on. */
-    yes: boolean;
-    /** `public-code`: publish this account's public code on the server. Permanent. */
-    publish: boolean;
-    /** `login`: store the NMTS key unsealed rather than under a passphrase. */
-    plain: boolean;
-    /** `login`: store nothing; print the environment variable to set. */
-    env: boolean;
-    /** `verify`: report whether the human check is live and stop, asking for no new code. */
-    status: boolean;
-    /** `create`: print the registration address and stop, rather than waiting for a person. */
-    noWait?: boolean;
-    /** `ls`: keep only files whose name contains this text, case-insensitively. */
-    find?: string;
-    /** `ls`: which order to list in — `name`, `size` or `date`. Absent = the path order. */
-    sort?: string;
-    /** `ls`: reverse whichever order is in effect. */
-    desc: boolean;
-    /** `push`: include entries whose name begins with a dot. */
-    hidden: boolean;
-    /** `extend`: how many of the storage network's epochs to add; `put`/`push --pay wallet`: how many to buy. */
-    epochs?: string;
-    /** `put`/`push`: who pays for the storage — `credits` (the default) or `wallet`. */
-    pay?: string;
-    /** `put --pay wallet`: `fit`, `whole`, or a held storage resource's object id. */
-    storage?: string;
-    /** `consent grant wallet`: how long the grant lasts (days, at most 30), or until a date.
-     *  `key new`: how many days the new API key lasts. The server clamps at its own ceiling. */
-    days?: string;
-    until?: string;
-    /** `consent grant wallet`: `storage` or `all`. */
-    scope?: string;
-    /** `key new`: which permissions the key carries — `read`, `write`, `spend`, comma-separated. */
-    scopes?: string;
-    /** `consent grant wallet`: ceilings in coins. */
-    capWal?: string;
-    capSui?: string;
-    /** `wallet send` · `wallet swap`: a ceiling on the chain fee, in SUI. */
-    feeCap?: string;
-    /** `wallet swap`: which venue, deepbook or bluefin. Without it both are quoted and the run stops. */
-    venue?: string;
-    /** `wallet swap`: the slippage allowance in whole bps (1 bps = 0.01%). */
-    slippageBps?: string;
-    /** `wallet swap`: a person's say past the extremes gate. Refused while a mode is on. */
-    acceptExtremes: boolean;
-    /** `s3`: which loopback port the gateway listens on. */
-    port?: string;
-    /**
-     * `create`: the version of the Terms of Service a PERSON read and accepts for the new account.
-     *
-     * ⛔ IT IS A VALUE AND NOT A FLAG, so that what was accepted is on the command line rather than
-     *    implied by it. A tool that could accept "whatever is current" would be agreeing on behalf
-     *    of somebody who never saw a version number.
-     */
-    acceptTerms?: string;
-    /** `create`: the version of the Privacy Policy accepted in the same act. */
-    acceptPrivacy?: string;
-    /** `losses`: ask the chain about ONE listed storage object now, instead of listing. */
-    recheck?: string;
-    /** `losses`: take ONE line off this account's own drive, instead of listing. ⛔ A VALUE AND NOT
-     *  A FLAG, so the line put down is named on the command line: a person reads one and puts it down. */
-    dismiss?: string;
-    /** `shares`: who ONE file was shared with, instead of what was shared with this account. */
-    sent?: string;
-    /** ultra-high acts under skip-permissions: why this is right to do now. Kept in the run log. */
-    reason?: string;
-    releaseStorage: boolean;
-    size?: string;
-    /** `devices`: sign ONE device out by id, or `all` — a person's act, proved by the NMTS key. */
-    signOut?: string;
-    /**
-     * `label`: the label to rename. The NEW name follows as the operand.
-     *
-     * ⛔ ONE VALUE, NOT TWO, because the table above gives every option exactly one — and a second
-     *    spelling of "how many values does this take" is how an option ends up parsed one way and
-     *    tested another. What a person types is still `label --rename <old> <new>`: the new name is
-     *    read from the operands, which is where `label <name> <files>` already reads a name from.
-     */
-    rename?: string;
-    /** `support send`: what the report is about, and optionally which part of that. */
-    category?: string;
-    sub?: string;
-    /** `support`: the message itself, or the file holding it. */
-    message?: string;
-    messageFile?: string;
-    /**
-     * `support send`: attach the run log, and how many runs of it.
-     * ⛔ THE EMPTY STRING IS "GIVEN WITH NO NUMBER", which is different from absent. A boolean
-     *    beside a count would be two fields answering one question, and the pair can disagree.
-     */
-    attachLog?: string;
-    /**
-     * `support`: values that must not travel, replaced wherever they appear.
-     *
-     * ⛔ THE ONLY REPEATABLE OPTION, and it is repeatable because what it names is one value at a
-     *    time. A comma-separated list would make a comma impossible to omit.
-     */
-    omit?: string[];
-    /**
-     * `whoami`: print the NMTS key itself.
-     *
-     * ⛔ A FLAG AND NOT A VALUE — it names no secret, it asks for the one this machine already
-     *    holds. The option table is checked for names that look like credentials; this one carries
-     *    nothing and says what it does.
-     */
-    reveal: boolean;
-    /**
-     * `key new`: put the new key on the screen once, as well as storing it. A flag and not a value
-     * for the reason above: it names no secret, it asks for the one this run was just handed.
-     */
-    print: boolean;
-    /** `nmts wallet address --qr` — the address as a QR code in the terminal as well. */
-    qr: boolean;
-    /** `wallet hall --remove`: be listed by a shortened address again. Never with `--name`. */
-    remove: boolean;
-    /** `terms`/`privacy`: which language to fetch — `en` or `ko`. Absent = English. */
-    lang?: string;
-    /** `terms`: the message board's terms rather than the service's. */
-    board: boolean;
-    /**
-     * `notices`/`terms`/`privacy`: keep the document as a file instead of printing it.
-     *
-     * ⛔ A FLAG, AND THE NOTICE'S ID IS STILL THE OPERAND. `notices --save <id>` reads exactly like
-     *    `notices <id>`, which is the point: one way to name a notice, whichever of the two things
-     *    is being done with it. The file's NAME is never an option — it is the server's, so that a
-     *    copy kept here and a copy kept from the browser are the same file.
-     */
-    save: boolean;
-}
+import type { ParsedArgs } from "./arg-options.ts";
+export type { ParsedArgs } from "./arg-options.ts";
 export declare const OPTIONS_TAKING_A_VALUE: string[];
 export declare const FLAGS: string[];
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/args.js

@@ -32,6 +32,8 @@ const VALUE_OPTIONS = {
     "--fee-cap": "feeCap",
     "--venue": "venue",
     "--slippage-bps": "slippageBps",
+    "--index": "index",
+    "--wallet": "wallet",
     "--port": "port",
     "--accept-terms": "acceptTerms",
     "--accept-privacy": "acceptPrivacy",

package/dist/artifact-about.d.ts

@@ -11,7 +11,7 @@ export declare const CRYPTO_SPEC_URL = "https://github.com/needmoretruth/nmts-re
  *   is the field's own contract — what the writer says about itself — and a person holding two
  *   copies of one account's artefacts can then tell which program made each.
  */
-export declare const WRITTEN_BY = "nmts-cli 0.34.4";
+export declare const WRITTEN_BY = "nmts-cli 0.35.0";
 /** Which of the three artefacts a wrapper is. A reader holding several can sort them. */
 export type ArtifactKind = "recovery-list" | "file-list" | "recovery-kit";
 /**

package/dist/commands/extend.d.ts

@@ -29,5 +29,7 @@ export interface ExtendOptions {
     now?: number;
     /** ⚠ SEAMS, NOT OPTIONS — the standing tip's own read and signature. No flag reaches them. */
     tip?: Pick<StandingTipInput, "readDonation" | "sign">;
+    /** `--wallet N`: which wallet pays, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
 }
 export declare function extend(target: string | undefined, options?: ExtendOptions): Promise<number>;

package/dist/commands/extend.js

@@ -31,6 +31,8 @@ import { resolveNetwork } from "../network.js";
 import { BINARY_NAME } from "../product.js";
 import { openSession } from "../session.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
+import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { budgetFacts, describeBudget, readBudget, shortfallNextStep } from "../extend-budget.js";
 export async function extend(target, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
@@ -110,7 +112,10 @@ export async function extend(target, options = {}) {
     const cohort = Math.max(0, ...preview.targets.map((t) => t.sharedItems));
     const unreachable = preview.treasuryParts + preview.untrackedParts;
     // What the wallet holds and what the chain would charge — read, never assumed (`extend-budget.ts`).
-    const address = await walletAddress(session.code);
+    // ⛔ WHICH WALLET PAYS comes out of the list this run already read, before the price is measured
+    //    against a balance: the address below is the one that will sign (`wallet-pay-index.ts`).
+    const wallet = await payingWalletIndex({ ...options, readActiveWallet: async () => activeWalletOf(settings) });
+    const address = await walletAddress(session.code, wallet);
     const budget = await readBudget(reads, {
         address,
         objectIds: preview.targets.map((t) => t.objectId),
@@ -182,6 +187,7 @@ export async function extend(target, options = {}) {
     const digest = await sign({
         network: session.network,
         code: session.code,
+        wallet,
         objectIds: preview.targets.map((t) => t.objectId),
         epochs,
     });
@@ -227,6 +233,7 @@ export async function extend(target, options = {}) {
         network: resolveNetwork(session.server, session.network),
         code: session.code,
         settings,
+        wallet,
         paidWalFrost: frost,
         say: options.json === true ? (line) => void process.stderr.write(`${line}\n`) : say,
         ...(options.tip ?? {}),

package/dist/commands/push-wallet.js

@@ -3,6 +3,8 @@
 //
 // ⛔ SPLIT OUT OF `push.ts` FOR THE LENGTH GATE, and along the one seam that was already there:
 //    `push.ts` decides WHICH files go and where; this decides how the wallet pays for each.
+import { payingWalletIndex } from "../wallet-pay-index.js";
+import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { loadCrypto } from "../crypto.js";
 import { NmtsError } from "../errors.js";
 import { resolveNetwork } from "../network.js";
@@ -24,6 +26,10 @@ export async function pushWithWallet(session, options, run) {
         rule: run.rule,
         onCollision: run.asked,
         settings: run.settings,
+        wallet: await payingWalletIndex({
+            ...options,
+            readActiveWallet: async () => activeWalletOf(run.settings),
+        }),
         progress: new Progress(options.json === true ? silentSink() : stderrSink(), "uploading"),
         say,
         json: options.json === true,

package/dist/commands/push.d.ts

@@ -19,6 +19,8 @@ export interface PushOptions {
     epochs?: string | number | undefined;
     /** ⛔ Refused here: a held resource holds ONE blob, and a directory is many. */
     storage?: string | undefined;
+    /** `--pay wallet`: which of this key's wallets pays, this run only. Absent = the account's own. */
+    wallet?: string | undefined;
     json?: boolean;
     write?: (line: string) => void;
     /**

package/dist/commands/put-payer.d.ts

@@ -0,0 +1,8 @@
+/** Who pays, or a refusal for a payer this tool does not know. */
+export declare function payerOf(pay: string | undefined): "credits" | "wallet";
+/** The two options that only mean something when the wallet pays, refused when it does not. */
+export declare function refuseWalletOnlyOptions(options: {
+    epochs?: string | number | undefined;
+    storage?: string | undefined;
+    wallet?: string | undefined;
+}): void;

package/dist/commands/put-payer.js

@@ -0,0 +1,41 @@
+// WHO PAYS FOR AN UPLOAD, and which options mean anything once that is answered.
+//
+// ⛔ THE OPTIONS ARE REFUSED, NOT IGNORED. `--epochs 12 --pay credits` is somebody asking for a
+//    term credits do not sell; accepting it silently would upload for a different length than the
+//    person typed and charge them for it. Every refusal here happens before a file is measured.
+//
+// ⚠ They moved out of `put.ts` on 2026-09-16 (`--wallet` joined them and that file has a ceiling).
+//   `put.ts` re-exports them, so `push.ts` and the tests spell the same path they always did.
+import { NmtsError } from "../errors.js";
+/** Who pays, or a refusal for a payer this tool does not know. */
+export function payerOf(pay) {
+    if (pay === undefined || pay === "credits")
+        return "credits";
+    if (pay === "wallet")
+        return "wallet";
+    throw new NmtsError(`--pay takes credits or wallet, not "${pay}".`, {
+        exitCode: 2,
+        nextStep: `Nothing was sent. --pay wallet buys the storage from the wallet this NMTS key derives; without it credits pay.`,
+    });
+}
+/** The two options that only mean something when the wallet pays, refused when it does not. */
+export function refuseWalletOnlyOptions(options) {
+    if (options.wallet !== undefined) {
+        throw new NmtsError("--wallet only applies with --pay wallet: credits are not held in a wallet.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to pay from one of this key's wallets.`,
+        });
+    }
+    if (options.epochs !== undefined) {
+        throw new NmtsError("--epochs only applies with --pay wallet: one credit buys a fixed term.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to choose the term, or leave --epochs off to pay with credits.`,
+        });
+    }
+    if (options.storage !== undefined) {
+        throw new NmtsError("--storage only applies with --pay wallet: credits buy storage from the treasury.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to use a storage resource this wallet holds.`,
+        });
+    }
+}