@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/shared/lib/drive/manifest-settings.d.ts

@@ -51,12 +51,58 @@ export interface AccountSettings {
      * = never agreed: raising the tip above 0 asks for that agreement once, and later changes do not.
      */
     tipConsentAt?: number;
+    /**
+     * WHICH WALLET PAYS — the index the NMTS key derives it at (NCF-3 §1.3, `walletSeed(N)`). Absent
+     * = 0, the wallet every account has had since the beginning.
+     *
+     * ⛔ HERE, IN THE SEALED LIST, AND NOT BESIDE THE derived/imported SWITCH. That switch is about
+     * this DEVICE (which key this browser opens), so it lives in device storage; the number is about
+     * the ACCOUNT — it decides which address the storage is paid from, and a phone and a laptop that
+     * disagreed about it would spend from two different balances for one person.
+     *
+     * Whole, 0 to just under 2^31: the format derives a wallet at every index and this is the range
+     * an index is written in.
+     */
+    activeWallet?: number;
+    /**
+     * HOW MANY WALLETS THIS ACCOUNT HAS MADE — the list the wallets screen draws, 1 to 1000. Absent
+     * = 1, the one wallet an account starts with.
+     *
+     * ⚠ IT IS A COUNT, NOT A SET. Numbers come from the key, so a wallet cannot be deleted and the
+     * list is always 0…count-1; "making the next wallet" is this number going up by one, and a scan
+     * that finds a funded wallet further out pulls it up to that number + 1.
+     */
+    walletCount?: number;
 }
 /** The sanity bounds a stored text scale must sit in to be USED. One place; codec and UI agree. */
 export declare const TEXT_SCALE_MIN_PCT = 80;
 export declare const TEXT_SCALE_MAX_PCT = 160;
 /** Follow the device. Not written to the wire — absence is the only spelling of it. */
 export declare const TEXT_SCALE_DEFAULT_PCT = 100;
+/**
+ * The index range a wallet number is written in: whole, 0 to just under 2^31.
+ *
+ * ⛔ THE CEILING IS THE WIRE'S, NOT THE FORMAT'S. `walletSeed(N)` is defined for every N the
+ * engine can be handed; what is bounded here is what this build will WRITE and read back, so a
+ * number some other build miswrote cannot come back as something no screen can draw.
+ */
+export declare const WALLET_INDEX_LIMIT: number;
+/** The wallet an account pays from when nobody chose. Not written to the wire — absence spells it. */
+export declare const ACTIVE_WALLET_DEFAULT = 0;
+/** The most wallets one account's list holds. */
+export declare const WALLET_COUNT_MAX = 1000;
+/** What an account's list holds before anybody made a second one. Absence spells it. */
+export declare const WALLET_COUNT_DEFAULT = 1;
+/** Which wallet this account pays from. Absence is wallet 0, never "unknown". */
+export declare function activeWalletOf(settings: AccountSettings | null | undefined): number;
+/**
+ * How many wallets this account's list holds.
+ *
+ * ⛔ THE INVARIANT LIVES HERE: the paying wallet is always IN the list. A stored count that does
+ * not reach the active number is raised to hold it — never the other way round, because lowering
+ * it would hide a wallet somebody is paying from, and a wallet cannot be deleted anyway.
+ */
+export declare function walletCountOf(settings: AccountSettings | null | undefined): number;
 export interface WireSettings {
     /** developerMode. */
     dm?: 1;
@@ -84,6 +130,15 @@ export interface WireSettings {
     tp?: number;
     /** tipConsentAt. */
     tc?: number;
+    /** activeWallet, present only when it is not wallet 0. */
+    aw?: number;
+    /**
+     * walletCount, present only when the account has made more than one.
+     *
+     * ⚠ A count above the ceiling is DROPPED on both sides, and nothing is lost by that: the read
+     * below raises the count to hold `aw` again, so the paying wallet stays in the list either way.
+     */
+    wc?: number;
 }
 /** The most a standing tip can be: the whole payment. Above the dial's 10 % it is typed and confirmed. */
 export declare const TIP_TENTHS_MAX = 1000;
@@ -107,7 +162,3 @@ export declare function settingsToWire(s: AccountSettings | undefined): WireSett
  * to the device's own size, which is always readable.
  */
 export declare function settingsFromWire(w: unknown): AccountSettings | undefined;
-/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
-export declare function applyDepositPatch(next: AccountSettings, depositDefault?: number): void;
-/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
-export declare function applyTipPatch(next: AccountSettings, tipTenths?: number, tipConsentAt?: number): void;

package/dist/shared/lib/drive/manifest-settings.js

@@ -14,6 +14,48 @@ export const TEXT_SCALE_MIN_PCT = 80;
 export const TEXT_SCALE_MAX_PCT = 160;
 /** Follow the device. Not written to the wire — absence is the only spelling of it. */
 export const TEXT_SCALE_DEFAULT_PCT = 100;
+/**
+ * The index range a wallet number is written in: whole, 0 to just under 2^31.
+ *
+ * ⛔ THE CEILING IS THE WIRE'S, NOT THE FORMAT'S. `walletSeed(N)` is defined for every N the
+ * engine can be handed; what is bounded here is what this build will WRITE and read back, so a
+ * number some other build miswrote cannot come back as something no screen can draw.
+ */
+export const WALLET_INDEX_LIMIT = 2 ** 31;
+/** The wallet an account pays from when nobody chose. Not written to the wire — absence spells it. */
+export const ACTIVE_WALLET_DEFAULT = 0;
+/** The most wallets one account's list holds. */
+export const WALLET_COUNT_MAX = 1000;
+/** What an account's list holds before anybody made a second one. Absence spells it. */
+export const WALLET_COUNT_DEFAULT = 1;
+/** Is this a wallet index this build writes and reads? */
+function usableWalletIndex(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value < WALLET_INDEX_LIMIT;
+}
+/** Is this a wallet count this build writes and reads? */
+function usableWalletCount(value) {
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        value >= WALLET_COUNT_DEFAULT &&
+        value <= WALLET_COUNT_MAX);
+}
+/** Which wallet this account pays from. Absence is wallet 0, never "unknown". */
+export function activeWalletOf(settings) {
+    const stored = settings?.activeWallet;
+    return usableWalletIndex(stored) ? stored : ACTIVE_WALLET_DEFAULT;
+}
+/**
+ * How many wallets this account's list holds.
+ *
+ * ⛔ THE INVARIANT LIVES HERE: the paying wallet is always IN the list. A stored count that does
+ * not reach the active number is raised to hold it — never the other way round, because lowering
+ * it would hide a wallet somebody is paying from, and a wallet cannot be deleted anyway.
+ */
+export function walletCountOf(settings) {
+    const stored = settings?.walletCount;
+    const held = usableWalletCount(stored) ? stored : WALLET_COUNT_DEFAULT;
+    return Math.max(held, activeWalletOf(settings) + 1);
+}
 /** The most a standing tip can be: the whole payment. Above the dial's 10 % it is typed and confirmed. */
 export const TIP_TENTHS_MAX = 1000;
 /**
@@ -59,12 +101,18 @@ export function settingsToWire(s) {
     if (typeof s.tipConsentAt === "number" && Number.isFinite(s.tipConsentAt) && s.tipConsentAt > 0) {
         w.tc = Math.round(s.tipConsentAt);
     }
+    if (usableWalletIndex(s.activeWallet) && s.activeWallet !== ACTIVE_WALLET_DEFAULT)
+        w.aw = s.activeWallet;
+    if (usableWalletCount(s.walletCount) && s.walletCount !== WALLET_COUNT_DEFAULT)
+        w.wc = s.walletCount;
     return w.dm !== undefined ||
         w.tx !== undefined ||
         w.pd !== undefined ||
         w.dd !== undefined ||
         w.tp !== undefined ||
-        w.tc !== undefined
+        w.tc !== undefined ||
+        w.aw !== undefined ||
+        w.wc !== undefined
         ? w
         : null;
 }
@@ -84,6 +132,8 @@ export function settingsFromWire(w) {
     const dd = Reflect.get(w, "dd");
     const tp = Reflect.get(w, "tp");
     const tc = Reflect.get(w, "tc");
+    const aw = Reflect.get(w, "aw");
+    const wc = Reflect.get(w, "wc");
     const s = {};
     if (dm === 1)
         s.developerMode = true;
@@ -109,38 +159,26 @@ export function settingsFromWire(w) {
         s.tipTenths = tp;
     if (typeof tc === "number" && Number.isFinite(tc) && tc > 0)
         s.tipConsentAt = Math.round(tc);
+    // A wallet number outside the range is DROPPED, not clamped: paying from a wallet some other
+    // build miswrote would spend from an address this person has never seen, and wallet 0 is the one
+    // every account already has.
+    if (usableWalletIndex(aw) && aw !== ACTIVE_WALLET_DEFAULT)
+        s.activeWallet = aw;
+    if (usableWalletCount(wc) && wc !== WALLET_COUNT_DEFAULT)
+        s.walletCount = wc;
+    // ⛔ AND THE INVARIANT IS RESTORED HERE, UPWARDS ONLY (`walletCountOf`). A list whose count does
+    // not reach the paying wallet would draw a screen the paying wallet is missing from.
+    const counted = walletCountOf(s);
+    if (counted !== WALLET_COUNT_DEFAULT)
+        s.walletCount = counted;
     return s.developerMode !== undefined ||
         s.textScalePct !== undefined ||
         s.paddingMode !== undefined ||
         s.depositDefault !== undefined ||
         s.tipTenths !== undefined ||
-        s.tipConsentAt !== undefined
+        s.tipConsentAt !== undefined ||
+        s.activeWallet !== undefined ||
+        s.walletCount !== undefined
         ? s
         : undefined;
 }
-/** Folds a deposit patch into a settings copy: out-of-range is clamped, the full deposit clears. */
-export function applyDepositPatch(next, depositDefault) {
-    if (depositDefault === undefined || !Number.isFinite(depositDefault))
-        return;
-    const credits = Math.round(Math.min(DEPOSIT_MAX_CREDITS, Math.max(0, depositDefault)));
-    if (credits === DEPOSIT_DEFAULT_CREDITS)
-        delete next.depositDefault;
-    else
-        next.depositDefault = credits;
-}
-/** Folds a tip patch into a settings copy: 0 clears, above the cap is capped, fractions are rounded. */
-export function applyTipPatch(next, tipTenths, tipConsentAt) {
-    if (tipTenths !== undefined && Number.isFinite(tipTenths)) {
-        const t = Math.round(Math.min(TIP_TENTHS_MAX, Math.max(0, tipTenths)));
-        if (t === 0)
-            delete next.tipTenths;
-        else
-            next.tipTenths = t;
-    }
-    if (tipConsentAt !== undefined && Number.isFinite(tipConsentAt)) {
-        if (tipConsentAt <= 0)
-            delete next.tipConsentAt;
-        else
-            next.tipConsentAt = Math.round(tipConsentAt);
-    }
-}

package/dist/shared/lib/wallet/discover.d.ts

@@ -0,0 +1,54 @@
+/**
+ * How many unused wallets in a row end the walk.
+ *
+ * ⛔ TWENTY, THE SAME NUMBER EVERY OTHER WALLET USES. Somebody who has funded a wallet in another
+ *    tool and comes looking for it here has been taught what a scan finds by that tool; a different
+ *    number here would make the same key look like it holds different wallets in two programs.
+ */
+export declare const WALLET_SCAN_GAP = 20;
+/** What a walk found: the wallets that are in use, lowest first, and how many were asked about. */
+export interface WalletScan {
+    /** Every index the probe said was in use, ascending. */
+    readonly used: readonly number[];
+    /** How many times the probe was called — what the walk cost, in questions. */
+    readonly scanned: number;
+}
+/**
+ * Is this wallet IN USE? Answered by the caller, because what counts as "in use" is a question
+ * about a chain and this file has none: a balance in either coin, or any transaction the address
+ * has ever been in.
+ *
+ * ⚠ A PROBE THAT FAILS SHOULD THROW, not answer `false`. "Nobody could ask" and "nothing is there"
+ *   are opposite facts, and answering the second for the first would quietly end the walk early and
+ *   report a wallet with money in it as one that does not exist.
+ */
+export type WalletProbe = (index: number) => Promise<boolean>;
+/**
+ * Walk the wallets of one NMTS key from 0 upwards, and stop when the walk has learned enough.
+ *
+ * TWO RULES, AND THEY ARE DIFFERENT RULES:
+ *   · every wallet the account has already MADE is asked about, whatever the answers are. Those
+ *     wallets are on the person's screen; a walk that skipped one because its neighbour was empty
+ *     would be reporting about a wallet it never asked about.
+ *   · past those, the walk keeps going as long as it keeps finding wallets in use, and ends after
+ *     `gap` unused ones in a row.
+ *
+ * ⚠ THE RUN CARRIES OVER from the made wallets into the walk past them. A list of thirty wallets
+ *   nobody ever funded is thirty unused answers, and starting the count again at the end of it
+ *   would ask for twenty more that nobody has any reason to expect anything from.
+ */
+export declare function discoverWallets(probe: WalletProbe, { count, gap }: {
+    count: number;
+    gap?: number;
+}): Promise<WalletScan>;
+/**
+ * How far a walk can reach as it stands — the number a progress line counts towards.
+ *
+ * ⛔ IT MOVES, because the walk's end moves: finding a wallet in use buys another `gap` questions
+ *    past it. A progress line drawn against the number the walk STARTED with would sit at "20/20"
+ *    while the walk kept going, which reads as a screen that has stopped answering.
+ */
+export declare function walletScanReach({ count, gap }: {
+    count: number;
+    gap?: number;
+}, highestUsed: number | null): number;

package/dist/shared/lib/wallet/discover.js

@@ -0,0 +1,66 @@
+// Finding the wallets an NMTS key has already used — the scan every HD wallet does, and where it
+// stops. ⚠ PUBLISHED — copied byte-for-byte into the `nmts` command-line package; keep comments
+// self-contained English.
+//
+// ⛔ PURE, AND THAT IS THE WHOLE POINT. One NMTS key derives a wallet at every index (NCF-3 §1.3),
+//    so "which of them exist" is not a question anybody can answer by looking: nothing is
+//    registered anywhere, and an unused wallet and a wallet nobody has funded yet are the same
+//    thing. The answer is a WALK — ask about one number, then the next — and the only real decision
+//    in it is when to stop. That decision is arithmetic, so it is written here, once, with no
+//    chain, no fetch and no clock in it; the browser and the `nmts` command each bring their own
+//    `probe` and get the same answer out.
+//
+// ⛔ WHY IT STOPS AT ALL. The index space is unbounded, so a walk that asked for proof of absence
+//    would never end. Stopping after a run of unused wallets is what every HD wallet does (the
+//    convention BIP-44 §Address gap limit wrote down), and the cost of the rule is stated rather
+//    than hidden: a wallet funded further out than the gap is NOT found by a scan. It is not lost —
+//    numbers come from the key, so asking for that number directly still opens it.
+/**
+ * How many unused wallets in a row end the walk.
+ *
+ * ⛔ TWENTY, THE SAME NUMBER EVERY OTHER WALLET USES. Somebody who has funded a wallet in another
+ *    tool and comes looking for it here has been taught what a scan finds by that tool; a different
+ *    number here would make the same key look like it holds different wallets in two programs.
+ */
+export const WALLET_SCAN_GAP = 20;
+/**
+ * Walk the wallets of one NMTS key from 0 upwards, and stop when the walk has learned enough.
+ *
+ * TWO RULES, AND THEY ARE DIFFERENT RULES:
+ *   · every wallet the account has already MADE is asked about, whatever the answers are. Those
+ *     wallets are on the person's screen; a walk that skipped one because its neighbour was empty
+ *     would be reporting about a wallet it never asked about.
+ *   · past those, the walk keeps going as long as it keeps finding wallets in use, and ends after
+ *     `gap` unused ones in a row.
+ *
+ * ⚠ THE RUN CARRIES OVER from the made wallets into the walk past them. A list of thirty wallets
+ *   nobody ever funded is thirty unused answers, and starting the count again at the end of it
+ *   would ask for twenty more that nobody has any reason to expect anything from.
+ */
+export async function discoverWallets(probe, { count, gap = WALLET_SCAN_GAP }) {
+    const used = [];
+    let scanned = 0;
+    let unusedInARow = 0;
+    for (let index = 0; index < count || unusedInARow < gap; index += 1) {
+        const inUse = await probe(index);
+        scanned += 1;
+        if (inUse) {
+            used.push(index);
+            unusedInARow = 0;
+        }
+        else {
+            unusedInARow += 1;
+        }
+    }
+    return { used, scanned };
+}
+/**
+ * How far a walk can reach as it stands — the number a progress line counts towards.
+ *
+ * ⛔ IT MOVES, because the walk's end moves: finding a wallet in use buys another `gap` questions
+ *    past it. A progress line drawn against the number the walk STARTED with would sit at "20/20"
+ *    while the walk kept going, which reads as a screen that has stopped answering.
+ */
+export function walletScanReach({ count, gap = WALLET_SCAN_GAP }, highestUsed) {
+    return Math.max(count, highestUsed === null ? 0 : highestUsed + 1) + gap;
+}

package/dist/standing-tip.d.ts

@@ -15,6 +15,9 @@ export interface StandingTipInput {
     } | undefined;
     /** What was just paid for storage, in WAL base units. */
     paidWalFrost: bigint;
+    /** ⛔ The wallet the storage was just paid from — a gift from a different one would come out of
+     *  a balance nobody was looking at, and the payment above named this one. */
+    wallet: number;
     say: (line: string) => void;
     /** Seams for tests. */
     readDonation?: (server: string) => Promise<DonationConfig>;

package/dist/standing-tip.js

@@ -37,6 +37,7 @@ export async function standingTipAfter(input) {
         const digest = await sign({
             network: input.network,
             code: input.code,
+            wallet: input.wallet,
             shape: { coin: "WAL", amountBaseUnits: amount, destination: config.devAddress, walType: walCoinType(input.network) },
         });
         input.say(`  Your standing ${percentText(tenths)} % gift — ${coinAmount(amount)} WAL — went to the developer. Transaction ${digest}`);

package/dist/upload-file-node.d.ts

@@ -0,0 +1,3 @@
+import { type PlaintextSource } from "./upload-file.ts";
+/** Read a file off the disk, a chunk at a time. */
+export declare function fileSource(path: string, size: number): PlaintextSource;

package/dist/upload-file-node.js

@@ -0,0 +1,38 @@
+// A file on THIS MACHINE, read a chunk at a time, as a plaintext source.
+//
+// ⛔ THE SEAM IS `upload-file.ts`'S AND THIS IS THE ONE IMPLEMENTATION THAT NEEDS A DISK. A caller
+//    in a browser hands in a `Blob` instead (the SDK's `blobSource`), and everything downstream —
+//    the part plan, the sealing, the reservation records — is the same code for both.
+import { open } from "node:fs/promises";
+import { NmtsError } from "./errors.js";
+import { READ_CHUNK_BYTES } from "./upload-file.js";
+/** Read a file off the disk, a chunk at a time. */
+export function fileSource(path, size) {
+    return {
+        size,
+        async *read(offset, length) {
+            const handle = await open(path, "r");
+            try {
+                const buffer = new Uint8Array(Math.min(READ_CHUNK_BYTES, length));
+                let at = 0;
+                while (at < length) {
+                    const want = Math.min(buffer.length, length - at);
+                    const { bytesRead } = await handle.read(buffer, 0, want, offset + at);
+                    if (bytesRead === 0) {
+                        // ⛔ SHORT IS NOT DONE. The plan was made from the size this file had when it was
+                        //    measured; a read that ends early means it shrank underneath us, and sealing what
+                        //    arrived would declare a length the bytes do not match.
+                        throw new NmtsError(`${path} ended after ${at} of ${length} bytes.`, {
+                            nextStep: "Nothing was sent. The file changed while it was being read.",
+                        });
+                    }
+                    at += bytesRead;
+                    yield new Uint8Array(buffer.subarray(0, bytesRead));
+                }
+            }
+            finally {
+                await handle.close();
+            }
+        },
+    };
+}

package/dist/upload-file.d.ts

@@ -2,6 +2,8 @@ import { type CryptoGlue } from "./crypto.ts";
 import { type PaddingRule } from "./shared/lib/crypto/size-padding.ts";
 import { entryOf } from "./upload.ts";
 import type { BlobProtocol, PaidPart, UploadApi, UploadInput, UploadResult, UploadStep } from "./upload-wire.ts";
+/** How much plaintext is handed to the engine at a time. Matches the format's own chunk size. */
+export declare const READ_CHUNK_BYTES: number;
 /**
  * Where the plaintext comes from.
  *
@@ -15,8 +17,6 @@ export interface PlaintextSource {
     /** Read `[offset, offset + length)`, in pieces small enough to hold. */
     read(offset: number, length: number): AsyncIterable<Uint8Array>;
 }
-/** Read a file off the disk, a chunk at a time. */
-export declare function fileSource(path: string, size: number): PlaintextSource;
 export interface FileUploadInput {
     api: UploadApi;
     protocol: BlobProtocol;

package/dist/upload-file.js

@@ -15,8 +15,8 @@
 //    the reservation key, and the SHA-256 the account will check the contents against — because
 //    both are needed BEFORE the first part is sealed. The second pass is the sealing itself. The
 //    alternative is holding the file, which is the thing this module exists to avoid.
-import { createHash } from "node:crypto";
-import { open } from "node:fs/promises";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { fromBase64Url } from "./bytes.js";
 import { AAD } from "./crypto.js";
 import { NmtsError } from "./errors.js";
 import { fileSecrets, sealPart } from "./seal.js";
@@ -27,37 +27,7 @@ import { buyAndPushPart, entryOf } from "./upload.js";
 import { commitItem } from "./upload-steps.js";
 import { finishReservationKey, partKey, readItemRecord, readReservationBytes, readReservationRecord, startReservationKey, } from "./upload-store.js";
 /** How much plaintext is handed to the engine at a time. Matches the format's own chunk size. */
-const READ_CHUNK_BYTES = 4 * 2 ** 20;
-/** Read a file off the disk, a chunk at a time. */
-export function fileSource(path, size) {
-    return {
-        size,
-        async *read(offset, length) {
-            const handle = await open(path, "r");
-            try {
-                const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, length));
-                let at = 0;
-                while (at < length) {
-                    const want = Math.min(buffer.length, length - at);
-                    const { bytesRead } = await handle.read(buffer, 0, want, offset + at);
-                    if (bytesRead === 0) {
-                        // ⛔ SHORT IS NOT DONE. The plan was made from the size this file had when it was
-                        //    measured; a read that ends early means it shrank underneath us, and sealing what
-                        //    arrived would declare a length the bytes do not match.
-                        throw new NmtsError(`${path} ended after ${at} of ${length} bytes.`, {
-                            nextStep: "Nothing was sent. The file changed while it was being read.",
-                        });
-                    }
-                    at += bytesRead;
-                    yield new Uint8Array(buffer.subarray(0, bytesRead));
-                }
-            }
-            finally {
-                await handle.close();
-            }
-        },
-    };
-}
+export const READ_CHUNK_BYTES = 4 * 2 ** 20;
 /**
  * Upload one file and return what the caller must write into the account's file list.
  *
@@ -83,15 +53,15 @@ export async function uploadFile(input) {
     //    `POST /v1/items` exists and is paid for; all that can still be missing is the account's own
     //    list. Asking the server about every part again would be a round trip per part to learn
     //    something the record already says.
-    const committed = readItemRecord(fileKey);
+    const committed = await readItemRecord(fileKey);
     if (committed?.itemId !== undefined) {
-        const entry = recordedEntry(fileKey, plan.length, source.size);
+        const entry = await recordedEntry(fileKey, plan.length, source.size);
         if (entry !== null) {
             return { itemId: committed.itemId, resumed: true, ledgerIds: [], fileKey, parts: plan.length, entry };
         }
     }
     // ── the file's secrets: from the record if one exists, otherwise made now ──
-    const secrets = openSecrets(input, fileKey, plan.length, contentDigest);
+    const secrets = await openSecrets(input, fileKey, plan.length, contentDigest);
     try {
         const entry = {
             name: input.name,
@@ -103,7 +73,7 @@ export async function uploadFile(input) {
         const paid = [];
         for (const range of plan) {
             const key = partKey(fileKey, range.partIndex);
-            const stored = readReservationRecord(key);
+            const stored = await readReservationRecord(key);
             // ⛔ A PART THAT IS WRITTEN DOWN IS NEVER SEALED AGAIN. Its bytes are a particular sealing
             //    the treasury may already have paid to register; a fresh one is a different blob.
             // ⛔ THE LAST PART ONLY. Every reader recovers the parts' real lengths from the file's size
@@ -119,7 +89,7 @@ export async function uploadFile(input) {
                 : range.length;
             const sealed = stored === null
                 ? await sealPartOf(input, secrets.dek, range, plan.length, sealFrom)
-                : readReservationBytes(key);
+                : await readReservationBytes(key);
             paid.push(await (input.buy ?? buyAndPushPart)({
                 api: input.api,
                 protocol: input.protocol,
@@ -162,12 +132,12 @@ export function partKeysOf(fileKey, parts) {
 }
 /** Read the whole file once, feeding the key hash and returning the content digest. */
 async function hashWhole(source, keyHash) {
-    const content = createHash("sha256");
+    const content = sha256.create();
     for await (const chunk of source.read(0, source.size)) {
         keyHash.update(chunk);
         content.update(chunk);
     }
-    return new Uint8Array(content.digest());
+    return content.digest();
 }
 /**
  * The file's key and sealed content hash — from a written-down part if there is one.
@@ -176,12 +146,12 @@ async function hashWhole(source, keyHash) {
  *    the bytes already on the network cannot be re-sealed. Unwrapping the recorded one is what
  *    makes the parts still to come belong to the same file.
  */
-function openSecrets(input, fileKey, parts, contentDigest) {
+async function openSecrets(input, fileKey, parts, contentDigest) {
     for (const key of partKeysOf(fileKey, parts)) {
-        const record = readReservationRecord(key);
+        const record = await readReservationRecord(key);
         if (record === null)
             continue;
-        const wrapped = new Uint8Array(Buffer.from(record.dekWrapped, "base64url"));
+        const wrapped = fromBase64Url(record.dekWrapped);
         const dek = input.crypt.envelope_open(input.dataKey, new TextEncoder().encode(AAD.dekWrap), wrapped);
         return { dek, dekWrapped: record.dekWrapped, contentHashCt: record.contentHashCt };
     }
@@ -226,9 +196,9 @@ export { entryOf };
  *    sealed with. A run that wrote its own freshly generated one into the list would produce a
  *    file that is paid for, present, correctly named and impossible to open.
  */
-function recordedEntry(fileKey, parts, size) {
+async function recordedEntry(fileKey, parts, size) {
     for (const key of partKeysOf(fileKey, parts)) {
-        const record = readReservationRecord(key);
+        const record = await readReservationRecord(key);
         if (record === null)
             continue;
         return {

package/dist/upload-price-node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * How big the local file is, with the two refusals that are worth their own words.
+ *
+ * ⛔ IT IS NOT READ HERE. A file large enough to need several parts is a file too large to hold,
+ *    and the size is all that is needed to plan the upload and quote its price. The bytes are read
+ *    later, a slice at a time, by the part that is being sealed.
+ */
+export declare function measureLocal(path: string): number;

package/dist/upload-price-node.js

@@ -0,0 +1,37 @@
+// How big a file on THIS MACHINE is — the one thing the upload price needs that a browser has no
+// equivalent of.
+//
+// ⛔ THE ARITHMETIC IS NOT HERE. `upload-price.ts` turns a size into parts and a price and runs
+//    anywhere; this is the one call that asks a disk, and it is separate so that the price is
+//    reachable from a page where bytes arrive as a `Blob` and their length is already known.
+import { statSync } from "node:fs";
+import { NmtsError } from "./errors.js";
+/**
+ * How big the local file is, with the two refusals that are worth their own words.
+ *
+ * ⛔ IT IS NOT READ HERE. A file large enough to need several parts is a file too large to hold,
+ *    and the size is all that is needed to plan the upload and quote its price. The bytes are read
+ *    later, a slice at a time, by the part that is being sealed.
+ */
+export function measureLocal(path) {
+    let stat;
+    try {
+        stat = statSync(path);
+    }
+    catch {
+        throw new NmtsError(`There is no file at ${path}.`, { exitCode: 4 });
+    }
+    if (stat.isDirectory()) {
+        throw new NmtsError(`${path} is a folder.`, {
+            exitCode: 4,
+            nextStep: "This version uploads one file at a time.",
+        });
+    }
+    if (stat.size === 0) {
+        throw new NmtsError(`${path} is empty.`, {
+            exitCode: 4,
+            nextStep: "The storage network has nothing to store and would refuse the reservation.",
+        });
+    }
+    return stat.size;
+}

package/dist/upload-price.d.ts

@@ -18,14 +18,6 @@ export declare const CREDIT_BYTES: number;
  * shows afterwards. The server is still the authority; this is a quote, not a promise.
  */
 export declare function creditsFor(sealedBytes: number, epochs?: number): number;
-/**
- * How big the local file is, with the two refusals that are worth their own words.
- *
- * ⛔ IT IS NOT READ HERE. A file large enough to need several parts is a file too large to hold,
- *    and the size is all that is needed to plan the upload and quote its price. The bytes are read
- *    later, a slice at a time, by the part that is being sealed.
- */
-export declare function measureLocal(path: string): number;
 /**
  * How much of the file goes into one part.
  *

package/dist/upload-price.js

@@ -1,10 +1,10 @@
 // What an upload will cost, and how the file is cut up to pay for it.
 //
 // ⛔ SPLIT OUT OF `put.ts` SO THAT FILE STAYS READABLE IN ONE SITTING. Everything here is
-//    arithmetic over numbers — no network, no crypto, no disk beyond one `stat` — which is what
-//    lets `--dry-run` answer without reading a very large file, and what lets a test drive the
-//    price without an account.
-import { statSync } from "node:fs";
+//    arithmetic over numbers — no network, no crypto and no disk at all — which is what lets
+//    `--dry-run` answer without reading a very large file, and what lets a test drive the price
+//    without an account. Measuring a file on this machine is Node's, and is in
+//    `upload-price-node.ts`.
 import { NmtsError } from "./errors.js";
 import { DEFAULT_PART_BYTES, NCF3_SHAPE, sealedLenFor } from "./seal.js";
 import { paddedPlaintextLen } from "./shared/lib/crypto/size-padding.js";
@@ -30,35 +30,6 @@ export function creditsFor(sealedBytes, epochs = UPLOAD_EPOCHS) {
     const mib = Math.ceil(sealedBytes / CREDIT_BYTES);
     return Math.ceil((mib * epochs) / UPLOAD_EPOCHS);
 }
-/**
- * How big the local file is, with the two refusals that are worth their own words.
- *
- * ⛔ IT IS NOT READ HERE. A file large enough to need several parts is a file too large to hold,
- *    and the size is all that is needed to plan the upload and quote its price. The bytes are read
- *    later, a slice at a time, by the part that is being sealed.
- */
-export function measureLocal(path) {
-    let stat;
-    try {
-        stat = statSync(path);
-    }
-    catch {
-        throw new NmtsError(`There is no file at ${path}.`, { exitCode: 4 });
-    }
-    if (stat.isDirectory()) {
-        throw new NmtsError(`${path} is a folder.`, {
-            exitCode: 4,
-            nextStep: "This version uploads one file at a time.",
-        });
-    }
-    if (stat.size === 0) {
-        throw new NmtsError(`${path} is empty.`, {
-            exitCode: 4,
-            nextStep: "The storage network has nothing to store and would refuse the reservation.",
-        });
-    }
-    return stat.size;
-}
 /**
  * How much of the file goes into one part.
  *