@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/risk.d.ts

@@ -152,6 +152,9 @@ export declare const ACTS: {
     readonly mcp: {
         readonly tier: "none";
     };
+    readonly platform: {
+        readonly tier: "none";
+    };
     readonly "accept-terms": {
         readonly tier: "none";
     };
@@ -226,6 +229,10 @@ export declare const ACTS: {
         readonly tier: "medium";
         readonly what: "Revoke an API key. Whatever used it stops working.";
     };
+    readonly "platform.keygen": {
+        readonly tier: "medium";
+        readonly what: "Make a business key pair and write its private half to a file on this disk.";
+    };
     readonly "public-code.publish": {
         readonly tier: "medium";
         readonly what: "Publish this account's public code. Publishing cannot be undone.";
@@ -344,6 +351,10 @@ export declare const ACTS: {
         readonly what: "Send a gift to the developer from the wallet.";
         readonly asksItself: true;
     };
+    readonly "wallet.use": {
+        readonly tier: "low";
+        readonly what: "Change which of this key's wallets pays for storage.";
+    };
     readonly "wallet.hall": {
         readonly tier: "none";
     };

package/dist/risk.js

@@ -69,6 +69,9 @@ export const ACTS = {
     verify: { tier: "none" },
     support: { tier: "none" },
     mcp: { tier: "none" },
+    // The bare word and `platform register` only say where a business registers; what MAKES
+    // something is `platform.keygen` below.
+    platform: { tier: "none" },
     "accept-terms": { tier: "none" },
     // ── low ──
     rm: { tier: "low", what: "Move these to the trash, restorable for 30 days." },
@@ -90,6 +93,11 @@ export const ACTS = {
     "key.list": { tier: "none" },
     "key.new": { tier: "medium", what: "Make a new API key for this machine." },
     "key.revoke": { tier: "medium", what: "Revoke an API key. Whatever used it stops working." },
+    // ⛔ MEDIUM, BESIDE `key.new`, AND NOT `high`. It writes a long-lived secret to this disk, which
+    //    is more than a read; but the pair opens nothing until a person registers the public half in
+    //    a browser, nothing is spent, and the file is never replaced — so it is not the tier that
+    //    waits for an unlock.
+    "platform.keygen": { tier: "medium", what: "Make a business key pair and write its private half to a file on this disk." },
     "public-code.publish": { tier: "medium", what: "Publish this account's public code. Publishing cannot be undone." },
     "losses.dismiss": { tier: "medium", what: "Put this loss notice down. It will not be shown again." },
     // ⛔ MEDIUM AND NOT HIGH. It moves value, so it is not `low`; but it moves it INSIDE one person's
@@ -125,6 +133,10 @@ export const ACTS = {
     // ⛔ READING THE HALL IS `none` AND LISTING A NAME IS `medium`. The read signs nothing and asks
     //    nobody's wallet a question; setting a name PUBLISHES a name beside an address on a public
     //    page, which is undone by one more run of the same command but cannot be unseen.
+    // ⛔ `list` READS; `use` WRITES — it changes which address every later payment leaves from, on
+    //    every device. Low rather than high because it signs nothing and moves nothing, and running
+    //    it again puts the old number back.
+    "wallet.use": { tier: "low", what: "Change which of this key's wallets pays for storage." },
     "wallet.hall": { tier: "none" },
     "wallet.hall.set": { tier: "medium", what: "Publish this name beside your wallet's address in the gift hall of fame." },
     "wallet.storage.reshape": { tier: "high", lock: "wallet", what: "Cut or join a storage resource the wallet holds — a signed transaction.", asksItself: true },
@@ -156,6 +168,8 @@ export function actOf(args) {
             //    both land on the act that publishes; the bare command is a read like `wallet` itself.
             if (sub === "hall")
                 return args.name !== undefined || args.remove ? "wallet.hall.set" : "wallet.hall";
+            if (sub === "use")
+                return "wallet.use";
             return sub === "send" ? "wallet.send" : sub === "swap" ? "wallet.swap" : sub === "donate" ? "wallet.donate" : "wallet";
         case "put":
             return args.pay === "wallet" ? "put.wallet" : "put";
@@ -173,6 +187,8 @@ export function actOf(args) {
             return args.publish ? "public-code.publish" : "public-code";
         case "support":
             return sub === "send" || sub === "reply" ? "support.send" : "support";
+        case "platform":
+            return sub === "keygen" ? "platform.keygen" : "platform";
         case "on-collision":
             return sub === "" ? "on-collision" : "on-collision.set";
         case "padding":

package/dist/run-log.d.ts

@@ -1,3 +1,5 @@
+/** The one key the record lives under. On this machine that is `runs.jsonl` in the config directory. */
+export declare const RUN_LOG_KEY = "runlog";
 /** One request this run made, and what came back. */
 export interface HttpEvent {
     readonly kind: "http";
@@ -37,8 +39,6 @@ export declare const NO_RUN_LOG_ENV_VAR = "NMTS_NO_RUN_LOG";
 export declare const MAX_LOG_BYTES: number;
 /** The most runs `--attach-log` will take. */
 export declare const MAX_ATTACHED_RUNS = 20;
-/** Where the log lives. Inside the tool's own directory, which is already 0700. */
-export declare function runLogPath(): string;
 /** Has the person turned it off? */
 export declare function runLogIsOff(): boolean;
 /**
@@ -73,6 +73,6 @@ export declare function safeArgs(argv: readonly string[]): string[];
  * Returns nothing and throws nothing: see the header. A run that could not be written is a run
  * that is missing from a report, which is a smaller problem than a command that failed for it.
  */
-export declare function recordRun(argv: readonly string[], exit: number, ms: number, now?: Date): void;
+export declare function recordRun(argv: readonly string[], exit: number, ms: number, now?: Date): Promise<void>;
 /** The newest `count` runs, oldest first. An unreadable or missing file is no runs. */
-export declare function readRuns(count: number): RunRecord[];
+export declare function readRuns(count: number): Promise<RunRecord[]>;

package/dist/run-log.js

@@ -21,12 +21,13 @@
 //    `nmts get` to report a failure it did not have. Every write is inside a `try` that swallows.
 //    ⚠ There is no debug switch in this tool to say so through, so it is silent — which is why
 //      this paragraph is here rather than a line of output.
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { OPTIONS_TAKING_A_VALUE } from "./args.js";
-import { configDir, modesAreEnforced } from "./credentials.js";
+import { fromUtf8, utf8 } from "./bytes.js";
+import { host } from "./host.js";
 import { redact } from "./redact.js";
 import { VERSION } from "./product.js";
+/** The one key the record lives under. On this machine that is `runs.jsonl` in the config directory. */
+export const RUN_LOG_KEY = "runlog";
 /** Set this to `1` and nothing is written. */
 export const NO_RUN_LOG_ENV_VAR = "NMTS_NO_RUN_LOG";
 /**
@@ -69,13 +70,9 @@ const HIDDEN_VALUES = {
  *    common and should not be given one just for this.
  */
 let collected = [];
-/** Where the log lives. Inside the tool's own directory, which is already 0700. */
-export function runLogPath() {
-    return join(configDir(), "runs.jsonl");
-}
 /** Has the person turned it off? */
 export function runLogIsOff() {
-    return process.env[NO_RUN_LOG_ENV_VAR] === "1";
+    return host().env(NO_RUN_LOG_ENV_VAR) === "1";
 }
 function remember(event) {
     if (runLogIsOff())
@@ -158,41 +155,34 @@ export function safeArgs(argv) {
     }
     return out;
 }
-/** Write one line, creating the file 0600 if it is not there yet. */
-function append(line) {
-    const dir = configDir();
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const path = runLogPath();
-    if (!existsSync(path)) {
-        writeFileSync(path, "", { mode: 0o600 });
-        if (modesAreEnforced())
-            chmodSync(path, 0o600);
-    }
-    appendFileSync(path, line);
-    if (statSync(path).size > MAX_LOG_BYTES)
-        trim(path);
-}
 /**
- * Drop the oldest whole lines until what is left fits.
+ * Add one line, trimming the oldest away when the record has grown past its cap.
+ *
+ * ⛔ WHOLE LINES. Cutting at a byte offset leaves a half-written JSON object at the top, and a
+ *    reader that meets one has to decide whether the record is corrupt or merely trimmed.
  *
- * ⛔ WHOLE LINES. Cutting the file at a byte offset leaves a half-written JSON object at the top,
- *    and a reader that meets one has to decide whether the file is corrupt or merely trimmed.
+ * ⚠ READ, ADD, WRITE, rather than an append. A host's state is bytes under a key — the only shape
+ *   a browser's store and a file both have — and the record is a quarter of a megabyte at most,
+ *   which is what makes rewriting it affordable at the end of a run.
  */
-function trim(path) {
-    const lines = readFileSync(path, "utf8").split("\n");
+async function append(line) {
+    const state = host().state;
+    const held = await state.read(RUN_LOG_KEY);
+    const lines = (held === undefined ? "" : fromUtf8(held)).split("\n");
+    lines.push(line.replace(/\n$/, ""));
     const kept = [];
     let bytes = 0;
     for (let i = lines.length - 1; i >= 0; i -= 1) {
-        const line = lines[i];
-        if (line === undefined || line === "")
+        const one = lines[i];
+        if (one === undefined || one === "")
             continue;
-        const size = Buffer.byteLength(line, "utf8") + 1;
+        const size = utf8(one).length + 1;
         if (bytes + size > MAX_LOG_BYTES)
             break;
-        kept.unshift(line);
+        kept.unshift(one);
         bytes += size;
     }
-    writeFileSync(path, kept.length === 0 ? "" : `${kept.join("\n")}\n`, { mode: 0o600 });
+    await state.write(RUN_LOG_KEY, utf8(kept.length === 0 ? "" : `${kept.join("\n")}\n`));
 }
 /**
  * Write this run down, and forget what was collected.
@@ -200,7 +190,7 @@ function trim(path) {
  * Returns nothing and throws nothing: see the header. A run that could not be written is a run
  * that is missing from a report, which is a smaller problem than a command that failed for it.
  */
-export function recordRun(argv, exit, ms, now = new Date()) {
+export async function recordRun(argv, exit, ms, now = new Date()) {
     if (runLogIsOff()) {
         forgetRun();
         return;
@@ -220,7 +210,7 @@ export function recordRun(argv, exit, ms, now = new Date()) {
     };
     forgetRun();
     try {
-        append(`${JSON.stringify(record)}\n`);
+        await append(`${JSON.stringify(record)}\n`);
     }
     catch {
         // Swallowed on purpose. See the header: the log is a convenience and the command is the work.
@@ -274,10 +264,13 @@ function asRecord(value) {
     };
 }
 /** The newest `count` runs, oldest first. An unreadable or missing file is no runs. */
-export function readRuns(count) {
+export async function readRuns(count) {
     let text;
     try {
-        text = readFileSync(runLogPath(), "utf8");
+        const held = await host().state.read(RUN_LOG_KEY);
+        if (held === undefined)
+            return [];
+        text = fromUtf8(held);
     }
     catch {
         return [];

package/dist/seal.js

@@ -8,7 +8,8 @@
 // ⛔ THE PLAINTEXT NEVER LEAVES THIS PROCESS. What goes out is the NCF-3 stream; what the server
 //    is told is its LENGTH. The name, the folder and the real size are written into the account's
 //    sealed file list, which the server cannot open.
-import { createHash } from "node:crypto";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { toBase64Url } from "./bytes.js";
 import { AAD } from "./crypto.js";
 import { NmtsError } from "./errors.js";
 import { chunkCount, sealedLenFor as sealedLength, } from "./shared/lib/crypto/size-padding.js";
@@ -108,8 +109,8 @@ export function fileSecrets(crypt, dataKey, contentDigest) {
     const contentHashCt = crypt.envelope_seal(dataKey, encoder.encode(AAD.contentHash), contentDigest);
     return {
         dek,
-        dekWrapped: Buffer.from(dekWrapped).toString("base64url"),
-        contentHashCt: Buffer.from(contentHashCt).toString("base64url"),
+        dekWrapped: toBase64Url(dekWrapped),
+        contentHashCt: toBase64Url(contentHashCt),
     };
 }
 /**
@@ -180,7 +181,7 @@ export async function sealFile(crypt, dataKey, plaintext) {
             nextStep: "The storage network has nothing to store and would refuse the reservation.",
         });
     }
-    const digest = new Uint8Array(createHash("sha256").update(plaintext).digest());
+    const digest = sha256(plaintext);
     const secrets = fileSecrets(crypt, dataKey, digest);
     digest.fill(0);
     try {

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 export declare const DEFAULT_SERVER = "https://nmts.me";
-export declare const SERVER_ENV_VAR = "NMTS_SERVER";
+export { SERVER_ENV_VAR } from "./env-vars.ts";
 /**
  * Resolve the server for this run: an explicit argument, then the environment, then the default.
  *

package/dist/server.js

@@ -4,9 +4,13 @@
 //    development against a local stack, not as a knob to tune. It is read from an argument or the
 //    environment rather than stored, so a credentials file cannot silently point a later run
 //    somewhere else than the run that wrote it.
+import { SERVER_ENV_VAR } from "./env-vars.js";
 import { NmtsError } from "./errors.js";
+import { host } from "./host.js";
 export const DEFAULT_SERVER = "https://nmts.me";
-export const SERVER_ENV_VAR = "NMTS_SERVER";
+// Re-exported so every caller still finds it here; the name itself lives in a module with no
+// imports, because `nmts --help` prints it (`env-vars.ts`).
+export { SERVER_ENV_VAR } from "./env-vars.js";
 /**
  * Resolve the server for this run: an explicit argument, then the environment, then the default.
  *
@@ -14,7 +18,7 @@ export const SERVER_ENV_VAR = "NMTS_SERVER";
  *    typo that lands on another scheme must stop here rather than somewhere further in.
  */
 export function resolveServer(explicit) {
-    const raw = explicit ?? process.env[SERVER_ENV_VAR] ?? DEFAULT_SERVER;
+    const raw = explicit ?? host().env(SERVER_ENV_VAR) ?? DEFAULT_SERVER;
     let url;
     try {
         url = new URL(raw);

package/dist/setup-questions.js

@@ -19,13 +19,13 @@ import { promptLine, stdinIsATerminal } from "./prompt.js";
  *    never sees a line.
  */
 export async function askAboutCollisions(say) {
-    if (hasChosen() || !stdinIsATerminal())
+    if ((await hasChosen()) || !stdinIsATerminal())
         return;
     say(``);
     say(`When a file with that name is already in the drive:`);
     say(`  ${ANSWER_NUMBER.rename}  ${COLLISION_MEANS.rename}`);
     say(`  ${ANSWER_NUMBER.overwrite}  ${COLLISION_MEANS.overwrite}`);
     const choice = readAnswer(await promptLine(`[${ANSWER_NUMBER.rename}] `));
-    setChoice(choice, VERSION, new Date());
+    await setChoice(choice, VERSION, new Date());
     say(`${choice} — ${COLLISION_MEANS[choice]}  Change it: ${BINARY_NAME} on-collision <rename|overwrite>`);
 }

package/dist/shared/lib/drive/manifest-ops.d.ts

@@ -1,4 +1,4 @@
-import type { AccountSettings, ManifestEntry } from "./manifest-codec.ts";
+import type { ManifestEntry } from "./manifest-codec.ts";
 /** One drive edit, in a form that can be replayed onto a newer list. */
 export type ManifestIntent = 
 /** Insert or replace by id. Upload-commit and folder-create both land here. */
@@ -115,37 +115,15 @@ export type ManifestIntent =
  */
 export declare function applyIntent(entries: readonly ManifestEntry[], intent: ManifestIntent): readonly ManifestEntry[];
 /**
- * Which size-padding rule an account seals its next upload under.
+ * The account settings' own vocabulary — the padding rule, one settings edit, and how an edit
+ * lands — comes back out of `manifest-settings-patch.ts`, beside the fields it names.
  *
- * ⛔ DECLARED BESIDE THE PATCH THAT CARRIES IT, not in `lib/crypto/padding.ts` where the padding
- *    itself lives. `padding.ts` imports it from here. The direction matters: this file is copied
- *    byte-for-byte into the `nmts` command-line package, and a type reaching out of it into the
- *    crypto tree would drag that whole tree along with it for the sake of two string literals.
+ * ⛔ RE-EXPORTED RATHER THAN MOVED AWAY. Every caller in both packages spells it `manifest-ops`,
+ *    and a settings patch IS one of this file's intents as far as they are concerned. It moved
+ *    because the settings write path had grown into the file's ceiling (`check:size`), and
+ *    splitting it puts each rule beside the field it is about.
  */
-export type PaddingMode = "padme" | "pow2" | "none";
-/**
- * One account-settings edit, as DESIRED STATE per field — never "toggle", so replaying it onto a
- * list another device wrote lands the same answer. A default value means absence in the codec.
- */
-export interface SettingsPatch {
-    developerMode?: boolean;
-    textScalePct?: number;
-    /** Which rule seals future uploads: `"padme"` = the default, `"none"` = the file's exact length. */
-    paddingMode?: PaddingMode;
-    /** Credits held back with each credit-paid upload, 0 to `DEPOSIT_MAX_CREDITS`. */
-    depositDefault?: number;
-    /** The standing tip in tenths of a percent (0 = none) and the instant its terms were agreed to (0 clears). */
-    tipTenths?: number;
-    tipConsentAt?: number;
-}
-/**
- * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
- * changed, so callers can skip a save (a version bump every other device must download).
- *
- * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
- * the slider or the typed field lets through never reaches the wire out of range.
- */
-export declare function applySettingsPatch(settings: AccountSettings, patch: SettingsPatch): AccountSettings;
+export { applySettingsPatch, type PaddingMode, type SettingsPatch, } from "./manifest-settings-patch.ts";
 /** Replay a whole queue in order. Used to rebuild after a version conflict. */
 export declare function applyIntents(entries: readonly ManifestEntry[], intents: readonly ManifestIntent[]): readonly ManifestEntry[];
 /**

package/dist/shared/lib/drive/manifest-ops.js

@@ -1,6 +1,3 @@
-// Runtime import (relative + .ts — the header's node --test rule) for the bounds the patch obeys.
-import { TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT, } from "./manifest-codec.js";
-import { applyDepositPatch, applyTipPatch } from "./manifest-settings.js";
 /**
  * Apply one intent, returning a new list. The input is never mutated: the store keeps the
  * pre-save snapshot around to rebuild from after a version conflict.
@@ -160,44 +157,15 @@ function withShares(e, shares, at) {
     return { ...e, shares, updatedAt: at };
 }
 /**
- * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
- * changed, so callers can skip a save (a version bump every other device must download).
+ * The account settings' own vocabulary — the padding rule, one settings edit, and how an edit
+ * lands — comes back out of `manifest-settings-patch.ts`, beside the fields it names.
  *
- * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
- * the slider or the typed field lets through never reaches the wire out of range.
+ * ⛔ RE-EXPORTED RATHER THAN MOVED AWAY. Every caller in both packages spells it `manifest-ops`,
+ *    and a settings patch IS one of this file's intents as far as they are concerned. It moved
+ *    because the settings write path had grown into the file's ceiling (`check:size`), and
+ *    splitting it puts each rule beside the field it is about.
  */
-export function applySettingsPatch(settings, patch) {
-    const next = { ...settings };
-    if (patch.developerMode !== undefined) {
-        if (patch.developerMode)
-            next.developerMode = true;
-        else
-            delete next.developerMode;
-    }
-    if (patch.paddingMode !== undefined) {
-        // The default is spelled as absence, like every other field here — so two devices that both
-        // "choose the default" write the same bytes and neither bumps the list's version.
-        if (patch.paddingMode === "pow2" || patch.paddingMode === "none")
-            next.paddingMode = patch.paddingMode;
-        else
-            delete next.paddingMode;
-    }
-    if (patch.textScalePct !== undefined && Number.isFinite(patch.textScalePct)) {
-        const pct = Math.round(Math.min(TEXT_SCALE_MAX_PCT, Math.max(TEXT_SCALE_MIN_PCT, patch.textScalePct)));
-        if (pct === TEXT_SCALE_DEFAULT_PCT)
-            delete next.textScalePct;
-        else
-            next.textScalePct = pct;
-    }
-    applyDepositPatch(next, patch.depositDefault);
-    applyTipPatch(next, patch.tipTenths, patch.tipConsentAt);
-    const same = (next.developerMode === true) === (settings.developerMode === true) &&
-        next.paddingMode === settings.paddingMode && next.depositDefault === settings.depositDefault &&
-        next.textScalePct === settings.textScalePct &&
-        next.tipTenths === settings.tipTenths &&
-        next.tipConsentAt === settings.tipConsentAt;
-    return same ? settings : next;
-}
+export { applySettingsPatch, } from "./manifest-settings-patch.js";
 /** Replay a whole queue in order. Used to rebuild after a version conflict. */
 export function applyIntents(entries, intents) {
     return intents.reduce(applyIntent, entries);

package/dist/shared/lib/drive/manifest-settings-patch.d.ts

@@ -0,0 +1,52 @@
+import { type AccountSettings } from "./manifest-settings.ts";
+/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
+export declare function applyDepositPatch(next: AccountSettings, depositDefault?: number): void;
+/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
+export declare function applyTipPatch(next: AccountSettings, tipTenths?: number, tipConsentAt?: number): void;
+/**
+ * Folds a wallet patch into a settings copy: out-of-range is clamped, wallet 0 and a list of one
+ * clear, and the count is left holding the paying wallet.
+ *
+ * ⛔ THE COUNT FOLLOWS THE NUMBER, in this one write path. `wallet use 7` on a list of three
+ *    wallets means the person is paying from a wallet the screen would not have drawn; raising the
+ *    count here is what makes the two facts agree on every device at once, rather than in whichever
+ *    screen happens to notice.
+ */
+export declare function applyWalletPatch(next: AccountSettings, activeWallet?: number, walletCount?: number): void;
+/**
+ * Which size-padding rule an account seals its next upload under.
+ *
+ * ⛔ DECLARED BESIDE THE FIELD THAT CARRIES IT, not in `lib/crypto/padding.ts` where the padding
+ *    itself lives — `padding.ts` imports it through `manifest-ops.ts`, which re-exports it. The
+ *    direction matters: this file is copied byte-for-byte into the `nmts` command-line package,
+ *    and a type reaching out of it into the crypto tree would drag that whole tree along with it
+ *    for the sake of two string literals.
+ */
+export type PaddingMode = "padme" | "pow2" | "none";
+/**
+ * One account-settings edit, as DESIRED STATE per field — never "toggle", so replaying it onto a
+ * list another device wrote lands the same answer. A default value means absence in the codec.
+ */
+export interface SettingsPatch {
+    developerMode?: boolean;
+    textScalePct?: number;
+    /** Which rule seals future uploads: `"padme"` = the default, `"none"` = the file's exact length. */
+    paddingMode?: PaddingMode;
+    /** Credits held back with each credit-paid upload, 0 to `DEPOSIT_MAX_CREDITS`. */
+    depositDefault?: number;
+    /** The standing tip in tenths of a percent (0 = none) and the instant its terms were agreed to (0 clears). */
+    tipTenths?: number;
+    tipConsentAt?: number;
+    /** Which wallet pays, by index (0 = the wallet every account starts with). */
+    activeWallet?: number;
+    /** How many wallets this account's list holds. Raised to hold `activeWallet`, never lowered. */
+    walletCount?: number;
+}
+/**
+ * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
+ * changed, so callers can skip a save (a version bump every other device must download).
+ *
+ * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
+ * the slider or the typed field lets through never reaches the wire out of range.
+ */
+export declare function applySettingsPatch(settings: AccountSettings, patch: SettingsPatch): AccountSettings;

package/dist/shared/lib/drive/manifest-settings-patch.js

@@ -0,0 +1,110 @@
+// What a DEVICE writes into the account settings — one edit, as desired state per field.
+//
+// ⛔ APART FROM `manifest-settings.ts` BECAUSE THE TWO ANSWER DIFFERENT QUESTIONS. That file says
+//    what the bytes carry and what a value some other build wrote is worth (out of range is
+//    DROPPED — falling back to a default is always safe to read). This one says what happens when
+//    a person moves a control here (out of range is CLAMPED — the slider must not be able to write
+//    something the codec would then throw away). Mixing the two is how a rule ends up applied on
+//    one side only.
+//
+// ⚠ PUBLISHED — copied byte-for-byte into the `nmts` command-line package, and reached from there
+//   through `manifest-ops.ts`, which re-exports everything below.
+import { ACTIVE_WALLET_DEFAULT, DEPOSIT_DEFAULT_CREDITS, DEPOSIT_MAX_CREDITS, TEXT_SCALE_DEFAULT_PCT, TEXT_SCALE_MAX_PCT, TEXT_SCALE_MIN_PCT, TIP_TENTHS_MAX, WALLET_COUNT_DEFAULT, WALLET_COUNT_MAX, WALLET_INDEX_LIMIT, walletCountOf, } from "./manifest-settings.js";
+/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
+export function applyDepositPatch(next, depositDefault) {
+    if (depositDefault === undefined || !Number.isFinite(depositDefault))
+        return;
+    const credits = Math.round(Math.min(DEPOSIT_MAX_CREDITS, Math.max(0, depositDefault)));
+    if (credits === DEPOSIT_DEFAULT_CREDITS)
+        delete next.depositDefault;
+    else
+        next.depositDefault = credits;
+}
+/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
+export function applyTipPatch(next, tipTenths, tipConsentAt) {
+    if (tipTenths !== undefined && Number.isFinite(tipTenths)) {
+        const t = Math.round(Math.min(TIP_TENTHS_MAX, Math.max(0, tipTenths)));
+        if (t === 0)
+            delete next.tipTenths;
+        else
+            next.tipTenths = t;
+    }
+    if (tipConsentAt !== undefined && Number.isFinite(tipConsentAt)) {
+        if (tipConsentAt <= 0)
+            delete next.tipConsentAt;
+        else
+            next.tipConsentAt = Math.round(tipConsentAt);
+    }
+}
+/**
+ * Folds a wallet patch into a settings copy: out-of-range is clamped, wallet 0 and a list of one
+ * clear, and the count is left holding the paying wallet.
+ *
+ * ⛔ THE COUNT FOLLOWS THE NUMBER, in this one write path. `wallet use 7` on a list of three
+ *    wallets means the person is paying from a wallet the screen would not have drawn; raising the
+ *    count here is what makes the two facts agree on every device at once, rather than in whichever
+ *    screen happens to notice.
+ */
+export function applyWalletPatch(next, activeWallet, walletCount) {
+    if (activeWallet !== undefined && Number.isFinite(activeWallet)) {
+        const index = Math.round(Math.min(WALLET_INDEX_LIMIT - 1, Math.max(0, activeWallet)));
+        if (index === ACTIVE_WALLET_DEFAULT)
+            delete next.activeWallet;
+        else
+            next.activeWallet = index;
+    }
+    if (walletCount !== undefined && Number.isFinite(walletCount)) {
+        const count = Math.round(Math.min(WALLET_COUNT_MAX, Math.max(WALLET_COUNT_DEFAULT, walletCount)));
+        if (count === WALLET_COUNT_DEFAULT)
+            delete next.walletCount;
+        else
+            next.walletCount = count;
+    }
+    const counted = walletCountOf(next);
+    if (counted === WALLET_COUNT_DEFAULT)
+        delete next.walletCount;
+    else
+        next.walletCount = counted;
+}
+/**
+ * Apply one settings patch, returning new settings. Returns the SAME reference when nothing
+ * changed, so callers can skip a save (a version bump every other device must download).
+ *
+ * A text scale is CLAMPED into the codec's bounds here — this is the one write path, so a value
+ * the slider or the typed field lets through never reaches the wire out of range.
+ */
+export function applySettingsPatch(settings, patch) {
+    const next = { ...settings };
+    if (patch.developerMode !== undefined) {
+        if (patch.developerMode)
+            next.developerMode = true;
+        else
+            delete next.developerMode;
+    }
+    if (patch.paddingMode !== undefined) {
+        // The default is spelled as absence, like every other field here — so two devices that both
+        // "choose the default" write the same bytes and neither bumps the list's version.
+        if (patch.paddingMode === "pow2" || patch.paddingMode === "none")
+            next.paddingMode = patch.paddingMode;
+        else
+            delete next.paddingMode;
+    }
+    if (patch.textScalePct !== undefined && Number.isFinite(patch.textScalePct)) {
+        const pct = Math.round(Math.min(TEXT_SCALE_MAX_PCT, Math.max(TEXT_SCALE_MIN_PCT, patch.textScalePct)));
+        if (pct === TEXT_SCALE_DEFAULT_PCT)
+            delete next.textScalePct;
+        else
+            next.textScalePct = pct;
+    }
+    applyDepositPatch(next, patch.depositDefault);
+    applyTipPatch(next, patch.tipTenths, patch.tipConsentAt);
+    applyWalletPatch(next, patch.activeWallet, patch.walletCount);
+    const same = (next.developerMode === true) === (settings.developerMode === true) &&
+        next.paddingMode === settings.paddingMode && next.depositDefault === settings.depositDefault &&
+        next.textScalePct === settings.textScalePct &&
+        next.tipTenths === settings.tipTenths &&
+        next.tipConsentAt === settings.tipConsentAt &&
+        next.activeWallet === settings.activeWallet &&
+        next.walletCount === settings.walletCount;
+    return same ? settings : next;
+}