@needmoretruth/nmts-cli 0.34.4 → 0.35.0

package/dist/upload-wallet-put.js

@@ -0,0 +1,221 @@
+// A WALLET-PAID upload with no terminal in it: one file sealed here, its storage bought by the
+// wallet the NMTS key derives instead of by credits, the sealed bytes pushed, the file named in
+// the account's sealed list.
+//
+// ⛔ WHY THIS IS NOT IN `commands/`. Paying for storage from somebody's own coins existed only as
+//    `nmts put --pay wallet`, and a command cannot be called from a library: it parses arguments,
+//    prints, asks a person and exits. Everything below takes its inputs as values and reports
+//    through a return value and thrown `NmtsError`s, which is what lets the SDK — and somebody's
+//    own server — pay for an upload from their own coins without inheriting a terminal.
+//
+// ⛔ IT PRICES BEFORE IT SIGNS, ALWAYS, in the order `extend` set: the parts are planned, the chain
+//    quotes each part in WAL and the relay's tip in SUI, the register transaction is dry-run for
+//    its fee, both balances are read — and only then is `onReview` told the numbers, a known
+//    shortfall refused, and `agree` given its say. A dry run stops at the review and never loads
+//    the signing module.
+//
+// ⛔ `agree` IS THE ONE GATE BETWEEN A PROGRAM AND SOMEBODY'S WALLET, and it is a parameter
+//    because who may say yes differs: the command holds the review against this machine's wallet
+//    agreement, and a library call IS the agreement, made by the caller who wrote the call.
+//    Everything before it is a read.
+//
+// ⛔ THE SERVER IS TOLD THE STORAGE IS THE PERSON'S BY SAYING NOTHING ELSE. `POST /v1/items` forces
+//    treasury ownership only on a part that names a certified reservation; a wallet-paid part names
+//    none and carries the blob object and the end epoch instead, exactly as the browser's own
+//    wallet-paid commit does (`upload-steps.ts`).
+//
+// ⛔ A HELD RESOURCE IS OFFERED, NEVER CHOSEN FOR THE CALLER — the owner's rule for storage
+//    resources. Without `storage` this buys new storage and the review counts the free resources
+//    the wallet holds; with it the review says in bytes what is cut free or bound with the file.
+//
+// ⚠ NO SPENDING LEDGER AND NO GIFT LIVE HERE. Both are the command's: the ledger counts what one
+//   machine signed under one agreement, and a standing gift is a choice a person made in their own
+//   account. A library that kept either would be deciding for a caller who never asked it to.
+import { DERIVED } from "./crypto.js";
+import { NmtsError } from "./errors.js";
+import { setTrashed } from "./item-trash.js";
+import { addEntry } from "./manifest-write.js";
+import { sealedLenFor } from "./seal.js";
+import { statusOf } from "./shared/lib/storage-control/plan.js";
+import { createUploadApi } from "./upload-api.js";
+import { partKeysOf, uploadFile } from "./upload-file.js";
+import { CREDIT_BYTES, planAndPrice } from "./upload-price.js";
+import { clearItemRecord, clearReservation } from "./upload-store.js";
+import { walletRail } from "./upload-wallet.js";
+import { chooseUploadEpochs, daysOf, parseStorageAsk, pickResource, uploadBudget, uploadShortfallNextStep, } from "./upload-wallet-plan.js";
+import { walletAddress } from "./wallet.js";
+import { createBlobProtocol } from "./walrus-write.js";
+/**
+ * Price, agree, sign, upload and record ONE file, paid from the wallet the NMTS key derives.
+ *
+ * ⛔ THE SIGNING MODULE IS LOADED ONLY AFTER `agree` HAS RETURNED. A dry run and a refusal never
+ *    bring the code that can spend into memory.
+ */
+export async function walletPut(ctx, file, seams = {}) {
+    const { plan, sealedBytes, sealFor } = planAndPrice(file.source.size, ctx.partSize, ctx.rule);
+    const sealedLens = plan.map((range) => sealedLenFor(sealFor(range)));
+    const storageAsk = parseStorageAsk(seams.storage);
+    if (storageAsk !== null && plan.length > 1) {
+        throw new NmtsError(`A held storage resource holds one blob, and this file is ${plan.length} parts.`, {
+            exitCode: 4,
+            nextStep: `Nothing was signed. Leave the storage resource off, or raise the part size so the file is one part.`,
+        });
+    }
+    const protocol = (seams.protocol ?? createBlobProtocol)(ctx.network, sealedBytes, (sent, total) => seams.onProgress?.(sent, total));
+    const reads = await (seams.readChain ?? defaultReads)(ctx.network, protocol.relayUrl);
+    const window = await reads.readWindow();
+    if (window === null) {
+        throw new NmtsError(`The ${ctx.network} storage network could not be read.`, {
+            exitCode: 1,
+            nextStep: `Nothing was signed and nothing was sent. Which epoch the network is in, and how far ahead it will sell, are facts only the chain has — this will not spend against a guess.`,
+        });
+    }
+    const epochs = chooseUploadEpochs(seams.epochs, window);
+    const endEpoch = window.clock.current + epochs;
+    const quotes = await reads.quoteParts(sealedLens, epochs);
+    // ⛔ THE ADDRESS THAT IS PRICED IS THE ADDRESS THAT SIGNS — the same number the rail carries.
+    const address = await walletAddress(ctx.code, ctx.wallet);
+    let storage = { kind: "buy" };
+    let heldResources = null;
+    if (storageAsk !== null) {
+        const firstQuote = quotes[0];
+        const firstLen = sealedLens[0];
+        if (firstQuote === undefined || firstLen === undefined)
+            throw new NmtsError("unreachable: a plan with no part");
+        let resources;
+        try {
+            resources = await reads.readStorage(address);
+        }
+        catch (error) {
+            throw new NmtsError("The storage resources this wallet holds could not be read.", {
+                exitCode: 1,
+                nextStep: `Nothing was signed. That is not the same as holding none. Cause: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        const encoded = await reads.encodedLength(address, firstLen);
+        storage = pickResource(storageAsk, resources, encoded, window.clock.current, endEpoch, firstQuote.writeFrost);
+    }
+    else {
+        // ⚠ A read that fails is null, not zero: this number only offers a choice, and losing it must
+        //   not lose the upload.
+        heldResources = await reads.readStorage(address).then((rows) => rows.filter((r) => statusOf(r, window.clock.current) === "usable").length, () => null);
+    }
+    const [purse, feeMist] = await Promise.all([
+        reads.readWallet(address),
+        reads.estimateRegisterGas({
+            sender: address,
+            sealedLen: Math.max(...sealedLens),
+            epochs,
+            storage: storage.kind === "buy"
+                ? storage
+                : { kind: "reuse", objectId: storage.objectId, cutToBytes: storage.cutToBytes, writeFrost: storage.writeFrost },
+        }),
+    ]);
+    const budget = uploadBudget({ address, purse, feeMist, quotes, storage });
+    const review = {
+        name: file.name,
+        bytes: file.source.size,
+        sealedBytes,
+        parts: plan.length,
+        epochs,
+        days: daysOf(window, epochs),
+        endEpoch,
+        tipMist: quotes.reduce((sum, q) => sum + q.tipMist, 0n),
+        storage,
+        heldResources,
+        budget,
+    };
+    seams.onReview?.(review);
+    if (seams.dryRun === true)
+        return { kind: "review", review };
+    // ⛔ A WALLET KNOWN TO BE SHORT IS REFUSED BEFORE THE AGREEMENT IS ASKED FOR (`extend-budget.ts`).
+    if (budget.shortfall !== null) {
+        throw new NmtsError(budget.shortfall, { exitCode: 4, nextStep: uploadShortfallNextStep(budget) });
+    }
+    seams.agree?.(review);
+    const sign = seams.sign ?? (await signers());
+    const onSpend = seams.onSpend ?? (() => undefined);
+    const derived = ctx.crypt.kdf_derive(ctx.crypt.account_code_parse(ctx.code));
+    const dataKey = derived.slice(DERIVED.dataKey[0], DERIVED.dataKey[1]);
+    derived.fill(0);
+    let result;
+    try {
+        result = await uploadFile({
+            api: seams.api ?? createUploadApi(ctx.server, ctx.apiKey),
+            protocol,
+            crypt: ctx.crypt,
+            dataKey,
+            source: file.source,
+            name: file.name,
+            parentId: file.parentId,
+            destination: file.destination,
+            relayUrl: protocol.relayUrl,
+            epochs,
+            currentEpoch: window.clock.current,
+            partSize: ctx.partSize,
+            padding: { rule: ctx.rule, unitBytes: CREDIT_BYTES },
+            ...(seams.onStep === undefined ? {} : { onStep: seams.onStep }),
+            buy: walletRail({
+                network: ctx.network,
+                code: ctx.code,
+                wallet: ctx.wallet,
+                relayUrl: protocol.relayUrl,
+                epochs,
+                storage,
+                quotes,
+                feeMist,
+                signRegister: sign.register,
+                signCertify: sign.certify,
+                onSpend,
+            }),
+        });
+    }
+    finally {
+        dataKey.fill(0);
+    }
+    const now = Date.now();
+    // ⛔ FROM `result.entry`, NOT FROM THIS CALL. The key that opens the stored bytes is the key they
+    //    were sealed with, which on a resume belongs to the call that sealed them.
+    const added = await addEntry({
+        server: ctx.server,
+        apiKey: ctx.apiKey,
+        code: ctx.code,
+        accountId: ctx.accountId,
+        ...(ctx.onCollision !== undefined ? { onCollision: ctx.onCollision } : {}),
+        entry: {
+            id: result.itemId,
+            parentId: file.parentId,
+            kind: 1,
+            name: result.entry.name,
+            size: result.entry.plaintextLen,
+            createdAt: now,
+            updatedAt: now,
+            dekWrapped: result.entry.dekWrapped,
+            contentHashCt: result.entry.contentHashCt,
+        },
+    });
+    // ⛔ ONLY NOW, AND EVERY PART — the same order the credit rail keeps and for the same reason: a
+    //    paid-for file the list does not name is invisible, and the records are what let a second
+    //    call finish the job without signing again.
+    clearItemRecord(result.fileKey);
+    for (const record of partKeysOf(result.fileKey, result.parts))
+        clearReservation(record);
+    if (added.replaced)
+        await setTrashed(ctx.server, ctx.apiKey, added.replaced.id, true);
+    return {
+        kind: "uploaded",
+        review,
+        itemId: result.itemId,
+        savedAs: added.name,
+        replaced: added.replaced?.id ?? null,
+        fileListVersion: added.seq,
+        resumed: result.resumed,
+    };
+}
+async function defaultReads(network, relayUrl) {
+    return (await import("./upload-wallet-chain.js")).walletUploadReads(network, relayUrl);
+}
+async function signers() {
+    const signing = await import("./wallet-sign.js");
+    return { register: signing.signBlobRegister, certify: signing.signBlobCertify };
+}

package/dist/upload-wallet.d.ts

@@ -7,6 +7,9 @@ export interface WalletRailContext {
     network: Network;
     /** ⛔ The NMTS key. Held for the signatures and never written anywhere. */
     code: string;
+    /** Which of this key's wallets pays — the account's own number, resolved before anything was
+     *  priced (`wallet-pay-index.ts`), so the address in the review is the address that signs. */
+    wallet: number;
     relayUrl: string;
     epochs: number;
     /** Where the storage comes from. A held resource serves one blob, so it applies to a one-part file. */

package/dist/upload-wallet.js

@@ -108,6 +108,7 @@ async function buyAndPushPartWithWallet(ctx, input) {
         registered = await ctx.signRegister({
             network: ctx.network,
             code: ctx.code,
+            wallet: ctx.wallet,
             relayUrl: input.relayUrl,
             epochs: ctx.epochs,
             storage: ctx.storage.kind === "buy" ? { kind: "buy" } : ctx.storage,
@@ -173,6 +174,7 @@ async function certify(ctx, input, key, record, certificate) {
         digest = await ctx.signCertify({
             network: ctx.network,
             code: ctx.code,
+            wallet: ctx.wallet,
             relayUrl: record.relayUrl,
             blobId: record.blobId,
             blobObjectId: record.blobObjectId,

package/dist/wallet-list-chain.d.ts

@@ -0,0 +1,4 @@
+import type { Network } from "./network.ts";
+/** How long the two questions get together. A read that stalls is a read that failed. */
+export declare const HISTORY_TIMEOUT_MS = 20000;
+export declare function hasHistory(network: Network, address: string): Promise<boolean>;

package/dist/wallet-list-chain.js

@@ -0,0 +1,21 @@
+// The live read behind `nmts wallet list`'s walk: has this address ever been in a transaction?
+//
+// ⛔ READ ONLY, and one question in each direction. The RPC filter has no OR, so "from" and "to"
+//    are asked separately — a wallet that only ever RECEIVED is in use too, and a walk that asked
+//    about balances alone would report a wallet somebody emptied as one that does not exist.
+//
+// ⚠ ONE transaction is enough to answer, so one is what is asked for. This runs once per wallet
+//   the walk looks at, which is why it asks for as little as the chain will sell.
+import { SuiJsonRpcClient } from "@mysten/sui/jsonRpc";
+import { suiRpcTransport } from "./sui-rpc.js";
+/** How long the two questions get together. A read that stalls is a read that failed. */
+export const HISTORY_TIMEOUT_MS = 20_000;
+export async function hasHistory(network, address) {
+    const client = new SuiJsonRpcClient({ network, transport: suiRpcTransport(network) });
+    const signal = AbortSignal.timeout(HISTORY_TIMEOUT_MS);
+    const sent = await client.queryTransactionBlocks({ filter: { FromAddress: address }, limit: 1, signal });
+    if (sent.data.length > 0)
+        return true;
+    const received = await client.queryTransactionBlocks({ filter: { ToAddress: address }, limit: 1, signal });
+    return received.data.length > 0;
+}

package/dist/wallet-pay-index.d.ts

@@ -0,0 +1,21 @@
+export interface PayingWalletInput {
+    server?: string | undefined;
+    network?: string | undefined;
+    /** `--wallet N` — this run only, and it never writes the account's choice. */
+    wallet?: string | undefined;
+    /**
+     * ⚠ A SEAM, NOT AN OPTION: how the account's number is read. No flag reaches it. It exists
+     *   because the alternative is a test that signs in and reads a live file list to check that a
+     *   review was printed.
+     */
+    readActiveWallet?: () => Promise<number>;
+}
+/**
+ * A wallet number as a person typed it.
+ *
+ * ⛔ REFUSED, NEVER ROUNDED. `--wallet 1.5` and `--wallet -1` are command lines to correct; taking
+ *    either of them to a neighbouring wallet would spend from an address nobody named.
+ */
+export declare function walletIndexOf(raw: string): number;
+/** Which wallet this run pays from: the flag if it was given, otherwise the account's own number. */
+export declare function payingWalletIndex(input: PayingWalletInput): Promise<number>;

package/dist/wallet-pay-index.js

@@ -0,0 +1,68 @@
+// WHICH WALLET PAYS — the number this account keeps in its sealed file list, and the one flag that
+// overrides it for a single run.
+//
+// ⛔ WHY IT IS NOT A CONSTANT ANY MORE (2026-09-16). One NMTS key derives a wallet at
+//    every index (NCF-3 §1.3) and the account chooses which of them pays, so that a phone, a
+//    laptop and this tool all spend from the same address. That choice lives where no server can
+//    read it: inside the sealed list, beside the padding rule.
+//
+// ⛔ AND IT REFUSES RATHER THAN GUESSING. If the list cannot be read, this tool does not fall back
+//    to the first wallet: that would sign with a wallet the person may not have funded, print a
+//    review naming an address nobody chose, and — with `--yes` — spend from it. "I do not know
+//    which wallet should pay" is an answer; wallet 0 is not.
+//
+// ⚠ THE NUMBER IS RESOLVED BEFORE ANYTHING IS PRICED. Every command that spends prints a review
+//   with the paying address in it, so the address that is read, priced and shown has to be the
+//   address that signs. Asking for the number at signing time would let those two differ.
+import { NmtsError } from "./errors.js";
+import { readFileList } from "./manifest.js";
+import { BINARY_NAME } from "./product.js";
+import { openSession } from "./session.js";
+import { activeWalletOf, WALLET_INDEX_LIMIT } from "./shared/lib/drive/manifest-settings.js";
+/**
+ * A wallet number as a person typed it.
+ *
+ * ⛔ REFUSED, NEVER ROUNDED. `--wallet 1.5` and `--wallet -1` are command lines to correct; taking
+ *    either of them to a neighbouring wallet would spend from an address nobody named.
+ */
+export function walletIndexOf(raw) {
+    const text = raw.trim();
+    const value = Number(text);
+    if (!/^[0-9]+$/u.test(text) || !Number.isSafeInteger(value) || value >= WALLET_INDEX_LIMIT) {
+        throw new NmtsError(`A wallet number is a whole number from 0 to ${WALLET_INDEX_LIMIT - 1}, not "${raw}".`, {
+            exitCode: 2,
+            nextStep: `\`${BINARY_NAME} wallet list\` shows this key's wallets and their numbers.`,
+        });
+    }
+    return value;
+}
+/** Which wallet this run pays from: the flag if it was given, otherwise the account's own number. */
+export async function payingWalletIndex(input) {
+    const said = input.wallet;
+    if (said !== undefined && said !== "")
+        return walletIndexOf(said);
+    const read = input.readActiveWallet ?? (() => fromSealedList(input));
+    try {
+        return await read();
+    }
+    catch (error) {
+        // ⛔ A refusal this tool already worded (no API key, a locked code) is passed on as it stands —
+        //    it names the thing to fix, and wrapping it would bury that under a second sentence.
+        if (error instanceof NmtsError)
+            throw error;
+        throw new NmtsError(`Which wallet should pay is written in this account's file list, and it could not be read: ` +
+            `${error instanceof Error ? error.message : String(error)}`, {
+            exitCode: 1,
+            nextStep: `Nothing was signed. Try again when the list can be read, or name the wallet for this ` +
+                `one run with \`--wallet N\` — \`${BINARY_NAME} wallet list\` shows the numbers.`,
+        });
+    }
+}
+/** The account's own number, out of the sealed file list. One request, and no flag reaches it. */
+async function fromSealedList(input) {
+    const session = await openSession({ server: input.server, network: input.network });
+    const list = await readFileList(session.server, session.apiKey, session.code, session.accountId);
+    // An account that has never written a setting pays from the first wallet — that is a READ
+    // answer, not a fallback: the list opened, and it said nothing about a wallet.
+    return activeWalletOf(list.manifest?.settings);
+}

package/dist/wallet-sign-seams.d.ts

@@ -0,0 +1,57 @@
+import type { StorageOpShape } from "./storage-control-chain.ts";
+import type { SwapShape } from "./wallet-swap-chain.ts";
+import type { TransferShape } from "./wallet-send-chain.ts";
+import type { RegisterShape } from "./upload-wallet-plan.ts";
+import type { Certificate } from "./upload-wire.ts";
+import type { Network } from "./network.ts";
+/** The seam `commands/wallet-hall.ts` signs through. Returns the base64 signature, nothing else. */
+export type SignMessage = (input: {
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    message: string;
+}) => Promise<string>;
+/** The seam `commands/wallet-send.ts` signs through. Returns the transaction digest. */
+export type SignTransfer = (input: {
+    network: string;
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    /** Which of this key's wallets pays — the account's own number (`wallet-pay-index.ts`). */
+    wallet: number;
+    shape: TransferShape;
+}) => Promise<string>;
+/** The seam `commands/wallet-swap.ts` signs through. Returns the transaction digest. */
+export type SignSwap = (input: {
+    network: Network;
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    shape: SwapShape;
+}) => Promise<string>;
+/** The seam the wallet rail registers through. */
+export type SignBlobRegister = (input: {
+    network: Network;
+    code: string;
+    wallet: number;
+    relayUrl: string;
+} & RegisterShape) => Promise<{
+    digest: string;
+    blobObjectId: string;
+    endEpoch: number;
+}>;
+/** The seam the wallet rail certifies through. Returns the transaction digest. */
+export type SignBlobCertify = (input: {
+    network: Network;
+    code: string;
+    /** The same wallet that registered the part — it is the one that owns the blob object. */
+    wallet: number;
+    relayUrl: string;
+    blobId: string;
+    blobObjectId: string;
+    certificate: Certificate;
+}) => Promise<string>;
+/** How a storage-resource operation is signed; the shape carries what the review priced. */
+export type SignStorageOp = (input: {
+    network: Network;
+    code: string;
+    shape: StorageOpShape;
+    walrusPackageId: string;
+}) => Promise<string>;

package/dist/wallet-sign-seams.js

@@ -0,0 +1,16 @@
+// The shapes the signing module is reached through — one per thing this tool can sign.
+//
+// ⛔ THEY ARE SEAMS BECAUSE A TEST MUST BE ABLE TO PROVE THAT NOTHING SIGNED. Every command that
+//    spends prints a review first and stops there without `--yes`; handing it a function that
+//    fails the test if it is ever called is the only way to hold that promise, and a signature
+//    that reached a chain in a test would cost money every time the suite ran.
+//
+// ⛔ EACH ONE CARRIES **WHICH WALLET** WHERE THE MONEY COMES FROM IT (2026-09-16). One
+//    NMTS key opens a wallet at every index and the account says which one pays (`activeWallet`
+//    in the sealed file list); the command resolves that number BEFORE it prices anything, so the
+//    address in the review is the address that signs. A seam that let the number be omitted would
+//    let a review be printed for one wallet and a transaction signed by another.
+//
+// ⚠ They moved out of `wallet-sign.ts` on 2026-09-16 — that file is what signs, and it has a
+//   ceiling. Re-exported from there, so no caller spells a new path.
+export {};

package/dist/wallet-sign.d.ts

@@ -1,10 +1,6 @@
 import type { SignExtension } from "./extend-plan.ts";
-import { type TransferShape } from "./wallet-send-chain.ts";
-import { type StorageOpShape } from "./storage-control-chain.ts";
-import { type SwapShape } from "./wallet-swap-chain.ts";
-import type { Network } from "./network.ts";
-import type { RegisterShape } from "./upload-wallet-plan.ts";
-import type { Certificate } from "./upload-wire.ts";
+import type { SignBlobCertify, SignBlobRegister, SignMessage, SignStorageOp, SignSwap, SignTransfer } from "./wallet-sign-seams.ts";
+export type { SignBlobCertify, SignBlobRegister, SignMessage, SignStorageOp, SignSwap, SignTransfer, } from "./wallet-sign-seams.ts";
 /**
  * The address this tool would sign as.
  *
@@ -14,7 +10,7 @@ import type { Certificate } from "./upload-wire.ts";
  *    part is silent — a signature from an address with nothing in it, or worse, money sent to an
  *    address that signs nothing. A test compares them, offline, for free.
  */
-export declare function signerAddress(code: string): Promise<string>;
+export declare function signerAddress(code: string, index?: number): Promise<string>;
 /**
  * Extend every listed blob by `epochs`, in ONE transaction, signed by the account's own wallet.
  *
@@ -50,19 +46,6 @@ export declare const signTransfer: SignTransfer;
  *    signed text from ever being read as a transaction this wallet authorised.
  */
 export declare const signMessage: SignMessage;
-/** The seam `commands/wallet-hall.ts` signs through. Returns the base64 signature, nothing else. */
-export type SignMessage = (input: {
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    message: string;
-}) => Promise<string>;
-/** The seam `commands/wallet-send.ts` signs through. Returns the transaction digest. */
-export type SignTransfer = (input: {
-    network: string;
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    shape: TransferShape;
-}) => Promise<string>;
 /**
  * Swap SUI for WAL or WAL for SUI on the named venue, in ONE transaction, signed by the account's
  * own wallet. Every output goes back to the signer — DeepBook's three coins are sent there by this
@@ -75,13 +58,6 @@ export type SignTransfer = (input: {
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  */
 export declare const signSwap: SignSwap;
-/** The seam `commands/wallet-swap.ts` signs through. Returns the transaction digest. */
-export type SignSwap = (input: {
-    network: Network;
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    shape: SwapShape;
-}) => Promise<string>;
 /**
  * Register ONE part's blob, signed by the account's own wallet: the relay's tip, then the storage
  * — bought for `epochs`, or a resource the wallet already holds, cut to fit first if asked.
@@ -97,32 +73,6 @@ export type SignSwap = (input: {
 export declare const signBlobRegister: SignBlobRegister;
 /** Certify ONE registered part from the relay's certificate. Gas only; nothing else leaves the wallet. */
 export declare const signBlobCertify: SignBlobCertify;
-/** The seam the wallet rail registers through. */
-export type SignBlobRegister = (input: {
-    network: Network;
-    code: string;
-    relayUrl: string;
-} & RegisterShape) => Promise<{
-    digest: string;
-    blobObjectId: string;
-    endEpoch: number;
-}>;
-/** The seam the wallet rail certifies through. Returns the transaction digest. */
-export type SignBlobCertify = (input: {
-    network: Network;
-    code: string;
-    relayUrl: string;
-    blobId: string;
-    blobObjectId: string;
-    certificate: Certificate;
-}) => Promise<string>;
-/** How a storage-resource operation is signed; the shape carries what the review priced. */
-export type SignStorageOp = (input: {
-    network: Network;
-    code: string;
-    shape: StorageOpShape;
-    walrusPackageId: string;
-}) => Promise<string>;
 /**
  * Cut, join or hand over a storage resource, in ONE transaction, signed by the account's own wallet.
  *

package/dist/wallet-sign.js

@@ -45,7 +45,7 @@ import { BUILT_IN_WALLET_INDEX } from "./wallet.js";
  * ⛔ NOT EXPORTED. A caller that could hold this could sign anything, and the whole of this tool's
  *    story about the wallet is that one command signs one shape of transaction.
  */
-async function keypairFor(code) {
+async function keypairFor(code, index) {
     // The one refusal text for a malformed code lives in `account.ts`, so a typo fails here the same
     // way it fails everywhere else in this tool rather than as an engine error.
     await assertUsableCode(code);
@@ -61,7 +61,7 @@ async function keypairFor(code) {
         derived = glue.kdf_derive(bytes);
         const [from, to] = DERIVED.walletRoot;
         root = derived.slice(from, to);
-        seed = glue.wallet_seed_for(root, BUILT_IN_WALLET_INDEX);
+        seed = glue.wallet_seed_for(root, index);
         return Ed25519Keypair.fromSecretKey(seed);
     }
     catch (error) {
@@ -86,8 +86,8 @@ async function keypairFor(code) {
  *    part is silent — a signature from an address with nothing in it, or worse, money sent to an
  *    address that signs nothing. A test compares them, offline, for free.
  */
-export async function signerAddress(code) {
-    return (await keypairFor(code)).toSuiAddress();
+export async function signerAddress(code, index = BUILT_IN_WALLET_INDEX) {
+    return (await keypairFor(code, index)).toSuiAddress();
 }
 /**
  * Extend every listed blob by `epochs`, in ONE transaction, signed by the account's own wallet.
@@ -104,7 +104,7 @@ export async function signerAddress(code) {
  *   was executed. The caller re-reads the chain rather than offering a second attempt against
  *   numbers it read before.
  */
-export const signExtension = async ({ network, code, objectIds, epochs }) => {
+export const signExtension = async ({ network, code, wallet, objectIds, epochs }) => {
     const unique = [...new Set(objectIds)];
     if (unique.length === 0) {
         throw new NmtsError("There is nothing on this file that can be extended.", { exitCode: 4 });
@@ -113,7 +113,7 @@ export const signExtension = async ({ network, code, objectIds, epochs }) => {
         throw new NmtsError("An extension must be a positive whole number of epochs.", { exitCode: 2 });
     }
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = new Transaction();
     // The sender must be set before the fragments resolve: paying with the SDK's default coin
     // selection picks the WAL coins from the sender's own address.
@@ -158,9 +158,9 @@ export const signExtension = async ({ network, code, objectIds, epochs }) => {
  *
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  */
-export const signTransfer = async ({ network, code, shape }) => {
+export const signTransfer = async ({ network, code, wallet, shape }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = transferTransaction({ ...shape, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -190,7 +190,9 @@ export const signTransfer = async ({ network, code, shape }) => {
  *    signed text from ever being read as a transaction this wallet authorised.
  */
 export const signMessage = async ({ code, message }) => {
-    const keypair = await keypairFor(code);
+    // ⚠ THE FIRST WALLET SIGNS THE NAME — the address that stands in the hall is that wallet's, and
+    //   the account's choice of paying wallet does not reach this command yet.
+    const keypair = await keypairFor(code, BUILT_IN_WALLET_INDEX);
     const { signature } = await keypair.signPersonalMessage(new TextEncoder().encode(message));
     return signature;
 };
@@ -207,7 +209,10 @@ export const signMessage = async ({ code, message }) => {
  */
 export const signSwap = async ({ network, code, shape }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    // ⚠ SWAPS FROM THE FIRST WALLET — the coins being swapped are that wallet's, and the account's
+    //   choice of paying wallet does not reach this command yet. The day it does, this line and the
+    //   review above it carry the same number.
+    const keypair = await keypairFor(code, BUILT_IN_WALLET_INDEX);
     const tx = swapTransaction({ ...shape, network, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -247,9 +252,9 @@ function refusedBecause(result) {
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  *   The caller keeps its record and re-reads it rather than registering again.
  */
-export const signBlobRegister = async ({ network, code, relayUrl, ...shape }) => {
+export const signBlobRegister = async ({ network, code, wallet, relayUrl, ...shape }) => {
     const client = payingClient(network, relayUrl);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = await registerTransaction(client, network, { ...shape, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -270,9 +275,9 @@ export const signBlobRegister = async ({ network, code, relayUrl, ...shape }) =>
     return { digest: result.digest, ...blob };
 };
 /** Certify ONE registered part from the relay's certificate. Gas only; nothing else leaves the wallet. */
-export const signBlobCertify = async ({ network, code, relayUrl, ...shape }) => {
+export const signBlobCertify = async ({ network, code, wallet, relayUrl, ...shape }) => {
     const client = payingClient(network, relayUrl);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = certifyTransaction(client, shape);
     tx.setSender(keypair.toSuiAddress());
     const result = await client.signAndExecuteTransaction({
@@ -300,7 +305,9 @@ export const signBlobCertify = async ({ network, code, relayUrl, ...shape }) =>
  */
 export const signStorageOp = async ({ network, code, shape, walrusPackageId }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    // ⚠ RESHAPES THE FIRST WALLET'S STORAGE — that wallet holds the resource; the paying-wallet choice
+    //   does not reach this command yet.
+    const keypair = await keypairFor(code, BUILT_IN_WALLET_INDEX);
     const tx = storageOpTransaction(shape, { walrusPackageId, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({ transaction: tx, signer: keypair, options: { showEffects: true } });
     const effects = result.effects;