@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/wallet-sign-seams.d.ts

@@ -0,0 +1,69 @@
+import type { StorageOpShape } from "./storage-control-chain.ts";
+import type { SwapShape } from "./wallet-swap-chain.ts";
+import type { TransferShape } from "./wallet-send-chain.ts";
+import type { RegisterShape } from "./upload-wallet-plan.ts";
+import type { Certificate } from "./upload-wire.ts";
+import type { Network } from "./network.ts";
+/** The seam `commands/wallet-hall.ts` signs through. Returns the base64 signature, nothing else. */
+export type SignMessage = (input: {
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    /**
+     * Which of this key's wallets proves the name.
+     *
+     * ⛔ IT IS THE PAYING WALLET BECAUSE THAT IS THE WALLET THE GIFT CAME FROM. A hall entry is an
+     *    address, and `wallet donate` sends from the account's own number; signing with any other
+     *    wallet would offer the server a name for an address that has never given anything.
+     */
+    wallet: number;
+    message: string;
+}) => Promise<string>;
+/** The seam `commands/wallet-send.ts` signs through. Returns the transaction digest. */
+export type SignTransfer = (input: {
+    network: string;
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    /** Which of this key's wallets pays — the account's own number (`wallet-pay-index.ts`). */
+    wallet: number;
+    shape: TransferShape;
+}) => Promise<string>;
+/** The seam `commands/wallet-swap.ts` signs through. Returns the transaction digest. */
+export type SignSwap = (input: {
+    network: Network;
+    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
+    code: string;
+    /** Which of this key's wallets swaps — the account's own number (`wallet-pay-index.ts`). */
+    wallet: number;
+    shape: SwapShape;
+}) => Promise<string>;
+/** The seam the wallet rail registers through. */
+export type SignBlobRegister = (input: {
+    network: Network;
+    code: string;
+    wallet: number;
+    relayUrl: string;
+} & RegisterShape) => Promise<{
+    digest: string;
+    blobObjectId: string;
+    endEpoch: number;
+}>;
+/** The seam the wallet rail certifies through. Returns the transaction digest. */
+export type SignBlobCertify = (input: {
+    network: Network;
+    code: string;
+    /** The same wallet that registered the part — it is the one that owns the blob object. */
+    wallet: number;
+    relayUrl: string;
+    blobId: string;
+    blobObjectId: string;
+    certificate: Certificate;
+}) => Promise<string>;
+/** How a storage-resource operation is signed; the shape carries what the review priced. */
+export type SignStorageOp = (input: {
+    network: Network;
+    code: string;
+    /** Which of this key's wallets holds the resource — the account's own number. */
+    wallet: number;
+    shape: StorageOpShape;
+    walrusPackageId: string;
+}) => Promise<string>;

package/dist/wallet-sign-seams.js

@@ -0,0 +1,16 @@
+// The shapes the signing module is reached through — one per thing this tool can sign.
+//
+// ⛔ THEY ARE SEAMS BECAUSE A TEST MUST BE ABLE TO PROVE THAT NOTHING SIGNED. Every command that
+//    spends prints a review first and stops there without `--yes`; handing it a function that
+//    fails the test if it is ever called is the only way to hold that promise, and a signature
+//    that reached a chain in a test would cost money every time the suite ran.
+//
+// ⛔ EACH ONE CARRIES **WHICH WALLET** WHERE THE MONEY COMES FROM IT (2026-09-16). One
+//    NMTS key opens a wallet at every index and the account says which one pays (`activeWallet`
+//    in the sealed file list); the command resolves that number BEFORE it prices anything, so the
+//    address in the review is the address that signs. A seam that let the number be omitted would
+//    let a review be printed for one wallet and a transaction signed by another.
+//
+// ⚠ They moved out of `wallet-sign.ts` on 2026-09-16 — that file is what signs, and it has a
+//   ceiling. Re-exported from there, so no caller spells a new path.
+export {};

package/dist/wallet-sign.d.ts

@@ -1,10 +1,6 @@
 import type { SignExtension } from "./extend-plan.ts";
-import { type TransferShape } from "./wallet-send-chain.ts";
-import { type StorageOpShape } from "./storage-control-chain.ts";
-import { type SwapShape } from "./wallet-swap-chain.ts";
-import type { Network } from "./network.ts";
-import type { RegisterShape } from "./upload-wallet-plan.ts";
-import type { Certificate } from "./upload-wire.ts";
+import type { SignBlobCertify, SignBlobRegister, SignMessage, SignStorageOp, SignSwap, SignTransfer } from "./wallet-sign-seams.ts";
+export type { SignBlobCertify, SignBlobRegister, SignMessage, SignStorageOp, SignSwap, SignTransfer, } from "./wallet-sign-seams.ts";
 /**
  * The address this tool would sign as.
  *
@@ -14,7 +10,7 @@ import type { Certificate } from "./upload-wire.ts";
  *    part is silent — a signature from an address with nothing in it, or worse, money sent to an
  *    address that signs nothing. A test compares them, offline, for free.
  */
-export declare function signerAddress(code: string): Promise<string>;
+export declare function signerAddress(code: string, index?: number): Promise<string>;
 /**
  * Extend every listed blob by `epochs`, in ONE transaction, signed by the account's own wallet.
  *
@@ -50,19 +46,6 @@ export declare const signTransfer: SignTransfer;
  *    signed text from ever being read as a transaction this wallet authorised.
  */
 export declare const signMessage: SignMessage;
-/** The seam `commands/wallet-hall.ts` signs through. Returns the base64 signature, nothing else. */
-export type SignMessage = (input: {
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    message: string;
-}) => Promise<string>;
-/** The seam `commands/wallet-send.ts` signs through. Returns the transaction digest. */
-export type SignTransfer = (input: {
-    network: string;
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    shape: TransferShape;
-}) => Promise<string>;
 /**
  * Swap SUI for WAL or WAL for SUI on the named venue, in ONE transaction, signed by the account's
  * own wallet. Every output goes back to the signer — DeepBook's three coins are sent there by this
@@ -75,13 +58,6 @@ export type SignTransfer = (input: {
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  */
 export declare const signSwap: SignSwap;
-/** The seam `commands/wallet-swap.ts` signs through. Returns the transaction digest. */
-export type SignSwap = (input: {
-    network: Network;
-    /** ⛔ The NMTS key. It never leaves this machine: it derives the wallet and nothing else. */
-    code: string;
-    shape: SwapShape;
-}) => Promise<string>;
 /**
  * Register ONE part's blob, signed by the account's own wallet: the relay's tip, then the storage
  * — bought for `epochs`, or a resource the wallet already holds, cut to fit first if asked.
@@ -97,32 +73,6 @@ export type SignSwap = (input: {
 export declare const signBlobRegister: SignBlobRegister;
 /** Certify ONE registered part from the relay's certificate. Gas only; nothing else leaves the wallet. */
 export declare const signBlobCertify: SignBlobCertify;
-/** The seam the wallet rail registers through. */
-export type SignBlobRegister = (input: {
-    network: Network;
-    code: string;
-    relayUrl: string;
-} & RegisterShape) => Promise<{
-    digest: string;
-    blobObjectId: string;
-    endEpoch: number;
-}>;
-/** The seam the wallet rail certifies through. Returns the transaction digest. */
-export type SignBlobCertify = (input: {
-    network: Network;
-    code: string;
-    relayUrl: string;
-    blobId: string;
-    blobObjectId: string;
-    certificate: Certificate;
-}) => Promise<string>;
-/** How a storage-resource operation is signed; the shape carries what the review priced. */
-export type SignStorageOp = (input: {
-    network: Network;
-    code: string;
-    shape: StorageOpShape;
-    walrusPackageId: string;
-}) => Promise<string>;
 /**
  * Cut, join or hand over a storage resource, in ONE transaction, signed by the account's own wallet.
  *

package/dist/wallet-sign.js

@@ -45,7 +45,7 @@ import { BUILT_IN_WALLET_INDEX } from "./wallet.js";
  * ⛔ NOT EXPORTED. A caller that could hold this could sign anything, and the whole of this tool's
  *    story about the wallet is that one command signs one shape of transaction.
  */
-async function keypairFor(code) {
+async function keypairFor(code, index) {
     // The one refusal text for a malformed code lives in `account.ts`, so a typo fails here the same
     // way it fails everywhere else in this tool rather than as an engine error.
     await assertUsableCode(code);
@@ -61,7 +61,7 @@ async function keypairFor(code) {
         derived = glue.kdf_derive(bytes);
         const [from, to] = DERIVED.walletRoot;
         root = derived.slice(from, to);
-        seed = glue.wallet_seed_for(root, BUILT_IN_WALLET_INDEX);
+        seed = glue.wallet_seed_for(root, index);
         return Ed25519Keypair.fromSecretKey(seed);
     }
     catch (error) {
@@ -86,8 +86,8 @@ async function keypairFor(code) {
  *    part is silent — a signature from an address with nothing in it, or worse, money sent to an
  *    address that signs nothing. A test compares them, offline, for free.
  */
-export async function signerAddress(code) {
-    return (await keypairFor(code)).toSuiAddress();
+export async function signerAddress(code, index = BUILT_IN_WALLET_INDEX) {
+    return (await keypairFor(code, index)).toSuiAddress();
 }
 /**
  * Extend every listed blob by `epochs`, in ONE transaction, signed by the account's own wallet.
@@ -104,7 +104,7 @@ export async function signerAddress(code) {
  *   was executed. The caller re-reads the chain rather than offering a second attempt against
  *   numbers it read before.
  */
-export const signExtension = async ({ network, code, objectIds, epochs }) => {
+export const signExtension = async ({ network, code, wallet, objectIds, epochs }) => {
     const unique = [...new Set(objectIds)];
     if (unique.length === 0) {
         throw new NmtsError("There is nothing on this file that can be extended.", { exitCode: 4 });
@@ -113,7 +113,7 @@ export const signExtension = async ({ network, code, objectIds, epochs }) => {
         throw new NmtsError("An extension must be a positive whole number of epochs.", { exitCode: 2 });
     }
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = new Transaction();
     // The sender must be set before the fragments resolve: paying with the SDK's default coin
     // selection picks the WAL coins from the sender's own address.
@@ -158,9 +158,9 @@ export const signExtension = async ({ network, code, objectIds, epochs }) => {
  *
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  */
-export const signTransfer = async ({ network, code, shape }) => {
+export const signTransfer = async ({ network, code, wallet, shape }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = transferTransaction({ ...shape, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -189,8 +189,10 @@ export const signTransfer = async ({ network, code, shape }) => {
  *    makes. `signPersonalMessage` and not `sign`: that intent is the domain separator which stops
  *    signed text from ever being read as a transaction this wallet authorised.
  */
-export const signMessage = async ({ code, message }) => {
-    const keypair = await keypairFor(code);
+export const signMessage = async ({ code, wallet, message }) => {
+    // The wallet the caller resolved signs it: the hall entry is that wallet's address, and it is
+    // the wallet a gift left from, so any other one would name an address that gave nothing.
+    const keypair = await keypairFor(code, wallet);
     const { signature } = await keypair.signPersonalMessage(new TextEncoder().encode(message));
     return signature;
 };
@@ -205,9 +207,9 @@ export const signMessage = async ({ code, message }) => {
  *
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  */
-export const signSwap = async ({ network, code, shape }) => {
+export const signSwap = async ({ network, code, wallet, shape }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = swapTransaction({ ...shape, network, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -247,9 +249,9 @@ function refusedBecause(result) {
  * ⚠ A FAILURE HERE IS NOT PROOF THAT NOTHING HAPPENED — the same words as the extension above.
  *   The caller keeps its record and re-reads it rather than registering again.
  */
-export const signBlobRegister = async ({ network, code, relayUrl, ...shape }) => {
+export const signBlobRegister = async ({ network, code, wallet, relayUrl, ...shape }) => {
     const client = payingClient(network, relayUrl);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = await registerTransaction(client, network, { ...shape, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({
         transaction: tx,
@@ -270,9 +272,9 @@ export const signBlobRegister = async ({ network, code, relayUrl, ...shape }) =>
     return { digest: result.digest, ...blob };
 };
 /** Certify ONE registered part from the relay's certificate. Gas only; nothing else leaves the wallet. */
-export const signBlobCertify = async ({ network, code, relayUrl, ...shape }) => {
+export const signBlobCertify = async ({ network, code, wallet, relayUrl, ...shape }) => {
     const client = payingClient(network, relayUrl);
-    const keypair = await keypairFor(code);
+    const keypair = await keypairFor(code, wallet);
     const tx = certifyTransaction(client, shape);
     tx.setSender(keypair.toSuiAddress());
     const result = await client.signAndExecuteTransaction({
@@ -298,9 +300,11 @@ export const signBlobCertify = async ({ network, code, relayUrl, ...shape }) =>
  *    so what is signed is what was reviewed. A failed execution still has a digest and still
  *    spent its gas, so the status is read and a failure is said as one.
  */
-export const signStorageOp = async ({ network, code, shape, walrusPackageId }) => {
+export const signStorageOp = async ({ network, code, wallet, shape, walrusPackageId }) => {
     const client = walrusClient(network);
-    const keypair = await keypairFor(code);
+    // The resource the review named was read from this wallet's address, so this wallet is the one
+    // that can reshape or hand it over.
+    const keypair = await keypairFor(code, wallet);
     const tx = storageOpTransaction(shape, { walrusPackageId, sender: keypair.toSuiAddress() });
     const result = await client.signAndExecuteTransaction({ transaction: tx, signer: keypair, options: { showEffects: true } });
     const effects = result.effects;

package/dist/wallet.d.ts

@@ -1,16 +1,16 @@
 import { type CryptoGlue } from "./crypto.ts";
 import type { Network } from "./network.ts";
 /**
- * The wallet this NMTS key opens by itself.
+ * The wallet this NMTS key opens by itself, when nobody has said which one.
  *
- * ⛔ IT IS WALLET 0 BECAUSE THAT IS THE ONE THE BROWSER OPENS. Every wallet, including this one,
- *    comes out of `wallet_seed_for` — there is no special case for the first — so the index is the
- *    whole of the difference between "the account's wallet" and somebody else's.
+ * ⛔ IT IS WALLET 0 BECAUSE THAT IS THE ONE EVERY ACCOUNT STARTS WITH. Every wallet, including this
+ *    one, comes out of `wallet_seed_for` — there is no special case for the first — so the index is
+ *    the whole of the difference between one wallet of this key and another.
  *
- * ⛔ EXPORTED SO THE SIGNER CANNOT PICK ITS OWN. `extend-sign.ts` derives a keypair from the same
- *    root and has to reach the SAME wallet as the address printed here; a second literal `0` over
- *    there would be a second answer to a question with one right one, and the failure is silent —
- *    a signature from an address nobody funded. `extend-sign.test.ts` compares the two.
+ * ⚠ IT IS THE OFFLINE ANSWER, NOT THE PAYING ONE (2026-09-16). `nmts wallet address` asks
+ *   nothing of anybody and so cannot know which wallet the account pays from; every command that
+ *   SPENDS reads that number out of the sealed file list first (`wallet-pay-index.ts`) and refuses
+ *   rather than falling back here — paying from the wrong wallet is not a thing to guess at.
  */
 export declare const BUILT_IN_WALLET_INDEX = 0;
 /** The chain's own coin. Its type is fixed by the chain itself and takes no network. */
@@ -50,12 +50,12 @@ export declare function walCoinType(network: Network): string;
  */
 export declare function addressFromSeed(seed: Uint8Array): string;
 /**
- * The address of the wallet this NMTS key derives. Offline: nothing is asked of anybody.
+ * The address of one of the wallets this NMTS key derives. Offline: nothing is asked of anybody.
  *
- * The same address on every network — an account has one wallet, and which chain it is looked up
- * on is a separate question from what it is called.
+ * The same address on every network — a wallet is the same wallet on every chain, and which chain
+ * it is looked up on is a separate question from what it is called.
  */
-export declare function walletAddress(code: string): Promise<string>;
+export declare function walletAddress(code: string, index?: number): Promise<string>;
 /**
  * The engine functions this module uses. Narrowed to the one it actually calls.
  *
@@ -73,7 +73,7 @@ export type WalletGlue = Pick<CryptoGlue, "wallet_seed_for">;
  *    engine expands from it — are wiped before it returns, on the failing path as well as the
  *    good one. Neither one leaves.
  */
-export declare function addressFromDerived(glue: WalletGlue, derived: Uint8Array): string;
+export declare function addressFromDerived(glue: WalletGlue, derived: Uint8Array, index?: number): string;
 /**
  * How much of one coin an address holds, exactly as the chain reported it — or why nobody knows.
  *

package/dist/wallet.js

@@ -19,16 +19,16 @@ import { assertUsableCode } from "./account.js";
 import { DERIVED, loadCrypto } from "./crypto.js";
 import { NmtsError } from "./errors.js";
 /**
- * The wallet this NMTS key opens by itself.
+ * The wallet this NMTS key opens by itself, when nobody has said which one.
  *
- * ⛔ IT IS WALLET 0 BECAUSE THAT IS THE ONE THE BROWSER OPENS. Every wallet, including this one,
- *    comes out of `wallet_seed_for` — there is no special case for the first — so the index is the
- *    whole of the difference between "the account's wallet" and somebody else's.
+ * ⛔ IT IS WALLET 0 BECAUSE THAT IS THE ONE EVERY ACCOUNT STARTS WITH. Every wallet, including this
+ *    one, comes out of `wallet_seed_for` — there is no special case for the first — so the index is
+ *    the whole of the difference between one wallet of this key and another.
  *
- * ⛔ EXPORTED SO THE SIGNER CANNOT PICK ITS OWN. `extend-sign.ts` derives a keypair from the same
- *    root and has to reach the SAME wallet as the address printed here; a second literal `0` over
- *    there would be a second answer to a question with one right one, and the failure is silent —
- *    a signature from an address nobody funded. `extend-sign.test.ts` compares the two.
+ * ⚠ IT IS THE OFFLINE ANSWER, NOT THE PAYING ONE (2026-09-16). `nmts wallet address` asks
+ *   nothing of anybody and so cannot know which wallet the account pays from; every command that
+ *   SPENDS reads that number out of the sealed file list first (`wallet-pay-index.ts`) and refuses
+ *   rather than falling back here — paying from the wrong wallet is not a thing to guess at.
  */
 export const BUILT_IN_WALLET_INDEX = 0;
 /**
@@ -83,12 +83,12 @@ export function addressFromSeed(seed) {
     return Ed25519Keypair.fromSecretKey(seed).toSuiAddress();
 }
 /**
- * The address of the wallet this NMTS key derives. Offline: nothing is asked of anybody.
+ * The address of one of the wallets this NMTS key derives. Offline: nothing is asked of anybody.
  *
- * The same address on every network — an account has one wallet, and which chain it is looked up
- * on is a separate question from what it is called.
+ * The same address on every network — a wallet is the same wallet on every chain, and which chain
+ * it is looked up on is a separate question from what it is called.
  */
-export async function walletAddress(code) {
+export async function walletAddress(code, index = BUILT_IN_WALLET_INDEX) {
     // ⛔ The one refusal text for a malformed code lives in `account.ts`. Checking here means a typo
     //    fails the same way it fails everywhere else in this tool rather than as an engine error.
     await assertUsableCode(code);
@@ -108,7 +108,7 @@ export async function walletAddress(code) {
     //    everything sliced out of it, on the failing paths as well as the good one.
     const derived = glue.kdf_derive(bytes);
     try {
-        return addressFromDerived(glue, derived);
+        return addressFromDerived(glue, derived, index);
     }
     finally {
         derived.fill(0);
@@ -123,12 +123,12 @@ export async function walletAddress(code) {
  *    engine expands from it — are wiped before it returns, on the failing path as well as the
  *    good one. Neither one leaves.
  */
-export function addressFromDerived(glue, derived) {
+export function addressFromDerived(glue, derived, index = BUILT_IN_WALLET_INDEX) {
     const [from, to] = DERIVED.walletRoot;
     const root = derived.slice(from, to);
     let seed = null;
     try {
-        seed = glue.wallet_seed_for(root, BUILT_IN_WALLET_INDEX);
+        seed = glue.wallet_seed_for(root, index);
         return addressFromSeed(seed);
     }
     finally {

package/dist/walrus-write.js

@@ -10,6 +10,7 @@
 //    transaction paid — see the note on `sendTip` below, which is not what its name suggests.
 import { SuiJsonRpcClient } from "@mysten/sui/jsonRpc";
 import { walrus } from "@mysten/walrus";
+import { toBase64Url } from "./bytes.js";
 import { epochClock } from "./expiry.js";
 // ⛔ The re-export below is what callers use; this local name is the same function,
 //    imported so the reader above can call it without importing from itself.
@@ -112,8 +113,8 @@ export function createBlobProtocol(network, bodyBytes, onSent) {
                 .catch((error) => fail("The upload relay refused the bytes", error));
             return {
                 signers: certificate.signers,
-                serialized_message_b64: Buffer.from(certificate.serializedMessage).toString("base64url"),
-                signature_b64: Buffer.from(certificate.signature).toString("base64url"),
+                serialized_message_b64: toBase64Url(certificate.serializedMessage),
+                signature_b64: toBase64Url(certificate.signature),
             };
         },
     };

package/dist/walrus.d.ts

@@ -28,22 +28,7 @@ export declare const RELAY_HOSTS: Readonly<Record<string, readonly string[]>>;
 export declare const SUI_RPC_HOSTS: Readonly<Record<string, readonly string[]>>;
 /** How long one host gets before the next is tried. A read that stalls is a read that failed. */
 export declare const READ_TIMEOUT_MS = 60000;
-/**
- * Point reads at somebody else's aggregator, or at a development stack.
- *
- * ⚠ It replaces the list rather than adding to it, and that is deliberate: a run should read from
- *   where it was told to read, not from there AND the public hosts. Comma-separated for more
- *   than one, tried in the order given.
- */
-export declare const AGGREGATOR_ENV_VAR = "NMTS_AGGREGATOR";
-/**
- * Push writes through somebody else's relay, or through a development stack.
- *
- * ⚠ ONE host, not a list. Unlike reads there is nothing to fail over to — see `RELAY_HOSTS`.
- */
-export declare const RELAY_ENV_VAR = "NMTS_RELAY";
-/** Ask a different Sui JSON-RPC node the shard-count question. */
-export declare const SUI_RPC_ENV_VAR = "NMTS_SUI_RPC";
+export { AGGREGATOR_ENV_VAR, RELAY_ENV_VAR, SUI_RPC_ENV_VAR } from "./env-vars.ts";
 /** The relay this run writes through: the environment's if it named one, else the network's. */
 export declare function relayHost(network: string): string;
 /**

package/dist/walrus.js

@@ -10,7 +10,9 @@
 //    them: here, the browser build, and the standalone recovery tool. One copy going stale shows
 //    up as "file not found", which reads as "the file is gone" — so the machine holds them level
 //    rather than a person remembering to.
+import { AGGREGATOR_ENV_VAR, RELAY_ENV_VAR, SUI_RPC_ENV_VAR } from "./env-vars.js";
 import { NmtsError } from "./errors.js";
+import { host as runtime } from "./host.js";
 /** Curated Walrus aggregator (read) endpoints per network, preference order. */
 export const AGGREGATOR_HOSTS = {
     testnet: ["https://aggregator.walrus-testnet.walrus.space"],
@@ -50,34 +52,21 @@ export const SUI_RPC_HOSTS = {
 };
 /** How long one host gets before the next is tried. A read that stalls is a read that failed. */
 export const READ_TIMEOUT_MS = 60_000;
-/**
- * Point reads at somebody else's aggregator, or at a development stack.
- *
- * ⚠ It replaces the list rather than adding to it, and that is deliberate: a run should read from
- *   where it was told to read, not from there AND the public hosts. Comma-separated for more
- *   than one, tried in the order given.
- */
-export const AGGREGATOR_ENV_VAR = "NMTS_AGGREGATOR";
-/**
- * Push writes through somebody else's relay, or through a development stack.
- *
- * ⚠ ONE host, not a list. Unlike reads there is nothing to fail over to — see `RELAY_HOSTS`.
- */
-export const RELAY_ENV_VAR = "NMTS_RELAY";
-/** Ask a different Sui JSON-RPC node the shard-count question. */
-export const SUI_RPC_ENV_VAR = "NMTS_SUI_RPC";
+// Re-exported so every caller still finds them here; the names themselves live in a module with no
+// imports, because `nmts --help` prints them (`env-vars.ts`).
+export { AGGREGATOR_ENV_VAR, RELAY_ENV_VAR, SUI_RPC_ENV_VAR } from "./env-vars.js";
 /** The relay this run writes through: the environment's if it named one, else the network's. */
 export function relayHost(network) {
-    const named = process.env[RELAY_ENV_VAR]?.trim();
+    const named = runtime().env(RELAY_ENV_VAR)?.trim();
     if (named)
         return named;
-    const host = RELAY_HOSTS[network]?.[0];
-    if (host === undefined) {
+    const known = RELAY_HOSTS[network]?.[0];
+    if (known === undefined) {
         throw new NmtsError(`No upload relay is known for the ${network} storage network.`, {
             nextStep: `Name one in ${RELAY_ENV_VAR} to upload anyway.`,
         });
     }
-    return host;
+    return known;
 }
 /**
  * Every Sui JSON-RPC node this run may ask, in order.
@@ -88,7 +77,7 @@ export function relayHost(network) {
  *    they did not choose.
  */
 export function suiRpcHosts(network) {
-    const named = process.env[SUI_RPC_ENV_VAR]?.trim();
+    const named = runtime().env(SUI_RPC_ENV_VAR)?.trim();
     if (named)
         return [named];
     const hosts = SUI_RPC_HOSTS[network];
@@ -104,7 +93,7 @@ export function suiRpcHost(network) {
     return suiRpcHosts(network)[0] ?? "";
 }
 function fromEnvironment() {
-    const raw = process.env[AGGREGATOR_ENV_VAR];
+    const raw = runtime().env(AGGREGATOR_ENV_VAR);
     if (raw === undefined)
         return null;
     const hosts = raw.split(",").map((h) => h.trim()).filter((h) => h !== "");

package/docs/commands/credits.md

@@ -27,7 +27,7 @@ is spent by moving credits, and running the same command the other way puts them
 The credits keep the expiry they already had. The move drains the soonest-expiring lots first, so
 sending 100 may arrive as several grants with different dates, and moving them never renews them.
 
-Four refusals, four different remedies, and none of them is a retry:
+Four refusals, none of them worth retrying:
 `CREDIT_TRANSFER_OUTSIDE_FAMILY` (name an account of your own) · `CREDIT_TRANSFER_SELF` (that is
 the account sending) · `CREDIT_TRANSFER_INSUFFICIENT` (send less — the refusal carries what was
 needed and what the account can spend) · `CREDIT_TRANSFER_ZERO` (send some). Nothing is moved and

package/docs/commands/platform.md

@@ -0,0 +1,14 @@
+# nmts platform — the key pair a business signs with
+
+Commands: platform
+Tiers: platform=none · platform.keygen=medium
+
+`platform keygen` makes an Ed25519 key pair and writes both halves to `nmts-business-key.json`, or
+to `--out <file>`, with mode 0600 (Windows applies no file mode, and the command says so). It
+refuses a name that already exists, whatever `--force` says, and prints only the public half.
+`platform register` cannot register it: that needs a signed-in browser session at nmts.me, under
+Settings › Developer › Platform, and the command prints that path and exits 2.
+
+The private half is what signs every request a business makes and every delegation token it mints
+for one of its users. Nothing can derive it again, and replacing the registered key invalidates every
+token the old one signed.

package/docs/commands/support.md

@@ -13,4 +13,4 @@ English. One report per problem.
 
 In the default mode it prints what it would send and asks (or takes `--yes`); in an auto mode it
 sends after printing. Replies arrive in the thread: `support list`, `support show <code>`,
-`support reply <code> --message`. If the CLI itself cannot run, the second door is nmts@nmts.me.
+`support reply <code> --message`. If the CLI itself cannot run, write to nmts@nmts.me.

package/docs/commands/trash.md

@@ -1,4 +1,4 @@
-# nmts rm, restore, sweep, erase — the trash, and the one way past it
+# nmts rm, restore, sweep, erase — the trash, and erasing for good
 
 Commands: rm, restore, sweep, erase
 Tiers: rm=low · restore=low · sweep=medium · erase=ultra-high · erase.release=ultra-high(release-storage)

package/docs/commands/wallet.md

@@ -1,12 +1,28 @@
 # nmts wallet — the wallet your NMTS key derives
 
 Commands: wallet
-Tiers: wallet=none · wallet.send=high(wallet) · wallet.swap=high(wallet) · wallet.donate=high(donate) · wallet.storage.reshape=high(wallet) · wallet.storage.give=high(wallet) · wallet.hall=none · wallet.hall.set=medium
+Tiers: wallet=none · wallet.use=low · wallet.send=high(wallet) · wallet.swap=high(wallet) · wallet.donate=high(donate) · wallet.storage.reshape=high(wallet) · wallet.storage.give=high(wallet) · wallet.hall=none · wallet.hall.set=medium
 
 `wallet` shows the address and its SUI and WAL balances; `wallet address` derives the address
-offline (`--qr` draws it); `wallet activity` lists recent transactions, named only where the chain
-proves it; `wallet storage` lists storage resources (size × time) held outside any file. None of
-these signs.
+offline (`--qr` draws it, `--index N` derives another of this key's wallets); `wallet activity`
+lists recent transactions, named only where the chain proves it; `wallet storage` lists storage
+resources (size × time) held outside any file. None of these signs.
+
+## One key, many wallets
+
+Your NMTS key derives a wallet at every number from 0 upwards, and one of them pays. `wallet list`
+walks them — it shows each number, its address and its balances, marks the one that pays, and stops
+after twenty unused wallets in a row. `wallet use <number>` moves which one pays: the number is
+kept inside your sealed file list, so the browser, this tool and every other device agree on it.
+Numbers come from the key, so a wallet cannot be deleted, and a wallet you leave keeps whatever is
+in it.
+
+`put`, `push`, `extend`, `wallet send` and `wallet donate` all pay from that wallet. The same
+number decides the rest: `wallet swap` swaps its coins, `wallet storage split|merge|transfer`
+reshapes the resources it holds, and `wallet hall --name` signs as its address. Each takes
+`--wallet <number>` to use a different one for that run only, without changing the setting.
+⛔ If the file list cannot be read, they refuse rather than falling back to wallet 0 — signing with
+a wallet nobody chose is not a thing to guess at.
 
 ## Where SUI comes from, and why it is SUI
 
@@ -14,8 +30,8 @@ You can store without any coin here: credits pay the network for you (the weekly
 nmts.me, or credits somebody gave you), and `nmts balance` shows them. The wallet matters only when
 you pay the network yourself.
 
-The files live on Walrus, and Walrus is paid on the Sui chain in WAL, with gas in SUI. That is why
-this wallet holds SUI and WAL and nothing else — not a preference, the chain the storage runs on.
+The files live on Walrus, and Walrus is paid on the Sui chain in WAL, with gas in SUI, so
+this wallet holds SUI and WAL and nothing else.
 Fiat is not taken because taking it would make NMTS hold your money, which it never does.
 
 Getting SUI (as of 2026-09-06): buy it on an exchange that lists it (Binance and Upbit did on that
@@ -63,5 +79,7 @@ One more reads the gifts back, and one flag on it publishes a name:
 - `wallet hall` prints the gift hall of fame — the developer, then the ten largest senders as read
   from the public chain, with the rest of the list at nmts.me/hall; reading it signs nothing and
   needs no NMTS key. `--name <name>` (1 to 24 characters, no links, not an address) signs a
-  short message with this account's wallet so the server shows that name beside the address, and
-  `--remove` puts the entry back to a shortened address.
+  short message with the wallet this account pays from — the wallet a gift left from — so the
+  server shows that name beside its address, and `--remove` puts the entry back to a shortened
+  address. Reading which wallet that is opens the file list, so naming yourself needs an API key
+  where reading the hall needs none.