@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/commands/delete-account.js

@@ -30,7 +30,7 @@ export async function deleteAccount(options = {}) {
     // The tier gate has already refused the auto modes and, under skip-permissions, taken a
     // --reason and the --yes. ⛔ THE SENTENCE IS STILL TYPED IN EVERY OTHER MODE: `--yes` alone does
     //    not stand for it — only the mode that turned every question off does.
-    const typedFor = options.yes === true && currentMode() === "skip-permissions";
+    const typedFor = options.yes === true && (await currentMode()) === "skip-permissions";
     const ask = options.readLine ?? promptLine;
     if (!typedFor && options.readLine === undefined && !stdinIsATerminal()) {
         throw new NmtsError("There is no terminal to type into (stdin is not a TTY).", {

package/dist/commands/erase.js

@@ -39,7 +39,7 @@ export async function erase(paths, options = {}) {
             nextStep: `\`${BINARY_NAME} ls --all\` prints the paths as this expects them.`,
         });
     }
-    const typedFor = options.yes === true && currentMode() === "skip-permissions";
+    const typedFor = options.yes === true && (await currentMode()) === "skip-permissions";
     const ask = options.readLine ?? promptLine;
     if (!typedFor && options.readLine === undefined && !stdinIsATerminal()) {
         throw new NmtsError("There is no terminal to type into (stdin is not a TTY).", {

package/dist/commands/extend.d.ts

@@ -29,5 +29,7 @@ export interface ExtendOptions {
     now?: number;
     /** ⚠ SEAMS, NOT OPTIONS — the standing tip's own read and signature. No flag reaches them. */
     tip?: Pick<StandingTipInput, "readDonation" | "sign">;
+    /** `--wallet N`: which wallet pays, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
 }
 export declare function extend(target: string | undefined, options?: ExtendOptions): Promise<number>;

package/dist/commands/extend.js

@@ -31,6 +31,8 @@ import { resolveNetwork } from "../network.js";
 import { BINARY_NAME } from "../product.js";
 import { openSession } from "../session.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
+import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { budgetFacts, describeBudget, readBudget, shortfallNextStep } from "../extend-budget.js";
 export async function extend(target, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
@@ -110,7 +112,10 @@ export async function extend(target, options = {}) {
     const cohort = Math.max(0, ...preview.targets.map((t) => t.sharedItems));
     const unreachable = preview.treasuryParts + preview.untrackedParts;
     // What the wallet holds and what the chain would charge — read, never assumed (`extend-budget.ts`).
-    const address = await walletAddress(session.code);
+    // ⛔ WHICH WALLET PAYS comes out of the list this run already read, before the price is measured
+    //    against a balance: the address below is the one that will sign (`wallet-pay-index.ts`).
+    const wallet = await payingWalletIndex({ ...options, readActiveWallet: async () => activeWalletOf(settings) });
+    const address = await walletAddress(session.code, wallet);
     const budget = await readBudget(reads, {
         address,
         objectIds: preview.targets.map((t) => t.objectId),
@@ -182,6 +187,7 @@ export async function extend(target, options = {}) {
     const digest = await sign({
         network: session.network,
         code: session.code,
+        wallet,
         objectIds: preview.targets.map((t) => t.objectId),
         epochs,
     });
@@ -227,6 +233,7 @@ export async function extend(target, options = {}) {
         network: resolveNetwork(session.server, session.network),
         code: session.code,
         settings,
+        wallet,
         paidWalFrost: frost,
         say: options.json === true ? (line) => void process.stderr.write(`${line}\n`) : say,
         ...(options.tip ?? {}),

package/dist/commands/get.js

@@ -28,7 +28,7 @@
 import { basename, resolve } from "node:path";
 import { CODE_ENV_VAR } from "../credentials.js";
 import { fetchFile } from "../download.js";
-import { fileSink, stdoutSink } from "../download-sink.js";
+import { fileSink, stdoutSink } from "../download-sink-node.js";
 import { buildIndex, entryAt, fullPathOf, KIND_FILE, normalisePath } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
 import { readFileList } from "../manifest.js";

package/dist/commands/listfile.js

@@ -35,7 +35,7 @@ export async function listfile(options = {}) {
     const emit = options.writeDocument ?? ((text) => process.stdout.write(text));
     const resolved = await requireAccountCode();
     const identity = await identityOf(resolved.code);
-    const kept = readKeptList(identity.accountId);
+    const kept = await readKeptList(identity.accountId);
     if (kept === null) {
         throw new NmtsError(`This machine has no copy of this account's file list.`, {
             exitCode: 4,

package/dist/commands/mcp.js

@@ -171,6 +171,10 @@ export async function mcp(options = {}) {
     //    reading stdout must see nothing but protocol.
     note(`${PRODUCT_NAME} · ${identity.accountId} · ${network} · files land in ${outDir}`);
     note(`Tools: ${tools.map((t) => t.name).join(" · ")}`);
+    // ⚠ READ ONCE, BEFORE THE SERVER STARTS. The line below is written from a callback the
+    //   protocol drives, and a callback that had to await would report the setting after the
+    //   sentence it belongs to.
+    const announcedMode = await currentMode();
     await serve({
         input: options.input ?? process.stdin,
         output: options.output ?? ((line) => process.stdout.write(`${line}\n`)),
@@ -193,7 +197,7 @@ export async function mcp(options = {}) {
             // ⚠ A MODE THAT IS ON DECIDES THIS, so it is read here rather than assumed. Saying "every
             //   share will ask you" to somebody who turned a mode on would be telling them the opposite
             //   of what their own setting does.
-            if (currentMode() !== "default")
+            if (announcedMode !== "default")
                 return;
             note(built === null
                 ? "This client cannot show you a question, so sharing is refused here. Share from a terminal."

package/dist/commands/mode.js

@@ -22,9 +22,9 @@ export async function mode(wanted, target, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const now = options.now ?? (() => new Date());
     if (wanted === undefined || wanted === "") {
-        const at = currentMode();
+        const at = await currentMode();
         if (options.json === true) {
-            say(JSON.stringify({ mode: at, setAt: setAt(), means: MODE_MEANS[at] }));
+            say(JSON.stringify({ mode: at, setAt: await setAt(), means: MODE_MEANS[at] }));
             return 0;
         }
         say(`${at} — ${MODE_MEANS[at]}`);

package/dist/commands/on-collision.d.ts

@@ -3,4 +3,4 @@ export interface OnCollisionOptions {
     write?: (line: string) => void;
     now?: () => Date;
 }
-export declare function onCollision(wanted: string | undefined, options?: OnCollisionOptions): number;
+export declare function onCollision(wanted: string | undefined, options?: OnCollisionOptions): Promise<number>;

package/dist/commands/on-collision.js

@@ -14,11 +14,11 @@ import { BINARY_NAME, VERSION } from "../product.js";
 function isChoice(value) {
     return COLLISION_CHOICES.includes(value);
 }
-export function onCollision(wanted, options = {}) {
+export async function onCollision(wanted, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const now = options.now ?? (() => new Date());
     if (wanted === undefined || wanted === "") {
-        const at = currentChoice();
+        const at = await currentChoice();
         if (options.json === true) {
             say(JSON.stringify({ onCollision: at, means: COLLISION_MEANS[at] }));
             return 0;
@@ -39,7 +39,7 @@ export function onCollision(wanted, options = {}) {
             nextStep: `One of: ${COLLISION_CHOICES.join(" · ")}`,
         });
     }
-    setChoice(wanted, VERSION, now());
+    await setChoice(wanted, VERSION, now());
     say(`${wanted} — ${COLLISION_MEANS[wanted]}`);
     return 0;
 }

package/dist/commands/platform.d.ts

@@ -0,0 +1,9 @@
+/** Where the pair goes when `--out` names nowhere. Beside whatever the business is running. */
+export declare const DEFAULT_KEY_FILE = "nmts-business-key.json";
+/** Where a person registers the public half. The one path this command exists to name. */
+export declare const REGISTER_PATH = "Settings \u203A Developer \u203A Platform";
+export interface PlatformOptions {
+    out?: string | undefined;
+    write?: ((line: string) => void) | undefined;
+}
+export declare function platform(sub: string | undefined, options?: PlatformOptions): number;

package/dist/commands/platform.js

@@ -0,0 +1,124 @@
+// `nmts platform` — the two things a business does from a terminal.
+//
+// ⛔ THE KEY PAIR IS MADE HERE AND REGISTERED SOMEWHERE ELSE. Making it needs nothing but a random
+//    source; registering it needs a signed-in person, because attaching a standing credential to
+//    an account is a decision a session alone may not make. So `keygen` does the half a terminal
+//    can do and `register` says, in one sentence, where the other half is.
+//
+// ⛔ THE PRIVATE HALF IS NEVER PRINTED. It goes into a file only its owner can read and nowhere
+//    else — not to stdout, not into a message, not into the run log. What this command puts on the
+//    screen is the PUBLIC half, which is what gets pasted into the browser.
+//
+// ⛔ AND THE FILE IS NEVER REPLACED. `--force` does not open it: the file it would overwrite may
+//    hold the only copy of a key a business is already registered under, and replacing it locks
+//    that business out of its own door with nothing able to bring the key back.
+import { mkdirSync, statSync, writeFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { modesAreEnforced } from "../credentials.js";
+import { NmtsError } from "../errors.js";
+import { generateBusinessKeys } from "../platform-sign.js";
+import { BINARY_NAME, HOME_URL } from "../product.js";
+import { STDOUT_TARGET } from "../stdout.js";
+/** Where the pair goes when `--out` names nowhere. Beside whatever the business is running. */
+export const DEFAULT_KEY_FILE = "nmts-business-key.json";
+/** Where a person registers the public half. The one path this command exists to name. */
+export const REGISTER_PATH = "Settings › Developer › Platform";
+export function platform(sub, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    switch (sub) {
+        case "keygen":
+            return keygen(options.out, say);
+        case "register":
+            return register(say);
+        default:
+            throw new NmtsError(sub === undefined ? "`platform` needs a subcommand." : `Unknown subcommand: ${sub}`, {
+                exitCode: 2,
+                nextStep: `\`${BINARY_NAME} platform keygen\` makes the key pair a business signs with; ` +
+                    `\`${BINARY_NAME} platform register\` says where the public half is registered.`,
+            });
+    }
+}
+/** Make the pair, write it where only its owner can read it, and print the half that is not secret. */
+function keygen(out, say) {
+    const path = targetFor(out);
+    const keys = generateBusinessKeys();
+    writeKeyFile(path, keys);
+    say(`Public key: ${keys.publicKey}`);
+    say(`Written to: ${path}`);
+    // The same sentence `nmts doctor` uses for a stored key: where no mode applies, say so.
+    if (!modesAreEnforced()) {
+        say(`Windows applies no POSIX file mode, so this file inherits its folder's permissions ` +
+            `rather than being restricted to one user.`);
+    }
+    say(`Register the public key at ${HOME_URL} — ${REGISTER_PATH}. The private half stays in that file.`);
+    return 0;
+}
+/**
+ * Say where registering happens, and stop.
+ *
+ * ⛔ EXIT 2, WHICH IS "THE COMMAND LINE WAS WRONG" AND NOT "IT FAILED". An agent that read this as
+ *    a transient failure would try it again; the code says the request cannot be made this way at
+ *    all, whatever the arguments are.
+ */
+function register(say) {
+    say(`Registering a business needs a signed-in browser session, so this tool cannot do it.`);
+    say(`Open ${HOME_URL} and go to ${REGISTER_PATH}.`);
+    say(`Paste the public key from \`${BINARY_NAME} platform keygen\` there.`);
+    return 2;
+}
+/** Where the file goes, refusing a name that is already taken and refusing stdout outright. */
+function targetFor(out) {
+    const named = out === undefined || out === "" ? DEFAULT_KEY_FILE : out;
+    if (named === STDOUT_TARGET) {
+        throw new NmtsError("The business key pair will not be sent to stdout.", {
+            exitCode: 2,
+            nextStep: "Nothing was made. stdout is what a program reads and a log keeps, and this file holds " +
+                "the private half. Name a file instead.",
+        });
+    }
+    const path = isAbsolute(named) ? named : resolve(process.cwd(), named);
+    let existing = null;
+    try {
+        existing = statSync(path);
+    }
+    catch {
+        // Not there is exactly what this wants.
+    }
+    if (existing !== null) {
+        throw new NmtsError(`${path} is already there.`, {
+            exitCode: 4,
+            nextStep: existing.isDirectory()
+                ? "--out names the FILE the key pair goes into, not a directory."
+                : "Nothing was made. That file is not replaced, whatever --force says: it may hold the " +
+                    "key a business is already registered under. Name one that does not exist.",
+        });
+    }
+    return path;
+}
+/**
+ * Write the pair, readable by nobody else.
+ *
+ * ⚠ `wx` FAILS IF THE NAME APPEARED SINCE THE CHECK ABOVE, which is the point of using it rather
+ *   than trusting that check: between the two, something else may have written there.
+ *
+ * ⚠ ON WINDOWS THE MODE IS IGNORED and the file inherits the folder's permissions — the same limit
+ *   every other file this tool writes has, and claiming otherwise would claim a guarantee the
+ *   platform does not give.
+ */
+function writeKeyFile(path, keys) {
+    mkdirSync(resolve(path, ".."), { recursive: true, mode: 0o700 });
+    // ⚠ The field names are the ones the library takes, so the parsed file goes straight into a
+    //   client without a program in the middle renaming anything.
+    const text = `${JSON.stringify({ publicKey: keys.publicKey, privateKey: keys.privateKey }, null, 2)}\n`;
+    try {
+        writeFileSync(path, text, { mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        // ⛔ THE CAUSE IS NAMED AND THE KEY IS NOT. The errno line carries the path and never the
+        //    contents, so it is safe to pass on.
+        throw new NmtsError(`The key pair could not be written to ${path}.`, {
+            exitCode: 1,
+            nextStep: `Nothing was made. Cause: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}

package/dist/commands/pull.js

@@ -21,7 +21,7 @@
 import { mkdirSync, existsSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fetchFile } from "../download.js";
-import { fileSink } from "../download-sink.js";
+import { fileSink } from "../download-sink-node.js";
 import { buildIndex, entryAt, fullPathOf, isLive, KIND_FILE, KIND_FOLDER, normalisePath, underPrefix, } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
 import { readFileList } from "../manifest.js";

package/dist/commands/push-wallet.js

@@ -3,10 +3,13 @@
 //
 // ⛔ SPLIT OUT OF `push.ts` FOR THE LENGTH GATE, and along the one seam that was already there:
 //    `push.ts` decides WHICH files go and where; this decides how the wallet pays for each.
+import { payingWalletIndex } from "../wallet-pay-index.js";
+import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { loadCrypto } from "../crypto.js";
 import { NmtsError } from "../errors.js";
 import { resolveNetwork } from "../network.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { folderFor } from "./push.js";
 /** The wallet rail, one file at a time, stopping at the first failure as the credit rail does. */
 export async function pushWithWallet(session, options, run) {
@@ -24,6 +27,10 @@ export async function pushWithWallet(session, options, run) {
         rule: run.rule,
         onCollision: run.asked,
         settings: run.settings,
+        wallet: await payingWalletIndex({
+            ...options,
+            readActiveWallet: async () => activeWalletOf(run.settings),
+        }),
         progress: new Progress(options.json === true ? silentSink() : stderrSink(), "uploading"),
         say,
         json: options.json === true,

package/dist/commands/push.d.ts

@@ -19,6 +19,8 @@ export interface PushOptions {
     epochs?: string | number | undefined;
     /** ⛔ Refused here: a held resource holds ONE blob, and a directory is many. */
     storage?: string | undefined;
+    /** `--pay wallet`: which of this key's wallets pays, this run only. Absent = the account's own. */
+    wallet?: string | undefined;
     json?: boolean;
     write?: (line: string) => void;
     /**

package/dist/commands/push.js

@@ -27,9 +27,11 @@ import { depositDefaultOf, depositLines, parseDeposit, refuseDepositWithWallet }
 import { setTrashed } from "../item-trash.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
 import { BINARY_NAME } from "../product.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { openSession } from "../session.js";
-import { fileSource, partKeysOf, uploadFile } from "../upload-file.js";
+import { partKeysOf, uploadFile } from "../upload-file.js";
+import { fileSource } from "../upload-file-node.js";
 import { createUploadApi } from "../upload-api.js";
 import { clearItemRecord, clearReservation } from "../upload-store.js";
 import { CREDIT_BYTES, partSizeFor, planAndPrice, UPLOAD_EPOCHS } from "../upload-price.js";
@@ -242,9 +244,9 @@ async function sendOne(session, crypt, one, ctx) {
             },
         });
         // ⛔ ONLY NOW. Until the entry is in the list the file is paid for and invisible.
-        clearItemRecord(result.fileKey);
+        await clearItemRecord(result.fileKey);
         for (const record of partKeysOf(result.fileKey, result.parts))
-            clearReservation(record);
+            await clearReservation(record);
         // The file this one displaced goes to the server's trash last — see the same note in `put.ts`.
         if (added.replaced)
             await setTrashed(session.server, session.apiKey, added.replaced.id, true);

package/dist/commands/put-payer.d.ts

@@ -0,0 +1,8 @@
+/** Who pays, or a refusal for a payer this tool does not know. */
+export declare function payerOf(pay: string | undefined): "credits" | "wallet";
+/** The two options that only mean something when the wallet pays, refused when it does not. */
+export declare function refuseWalletOnlyOptions(options: {
+    epochs?: string | number | undefined;
+    storage?: string | undefined;
+    wallet?: string | undefined;
+}): void;

package/dist/commands/put-payer.js

@@ -0,0 +1,41 @@
+// WHO PAYS FOR AN UPLOAD, and which options mean anything once that is answered.
+//
+// ⛔ THE OPTIONS ARE REFUSED, NOT IGNORED. `--epochs 12 --pay credits` is somebody asking for a
+//    term credits do not sell; accepting it silently would upload for a different length than the
+//    person typed and charge them for it. Every refusal here happens before a file is measured.
+//
+// ⚠ They moved out of `put.ts` on 2026-09-16 (`--wallet` joined them and that file has a ceiling).
+//   `put.ts` re-exports them, so `push.ts` and the tests spell the same path they always did.
+import { NmtsError } from "../errors.js";
+/** Who pays, or a refusal for a payer this tool does not know. */
+export function payerOf(pay) {
+    if (pay === undefined || pay === "credits")
+        return "credits";
+    if (pay === "wallet")
+        return "wallet";
+    throw new NmtsError(`--pay takes credits or wallet, not "${pay}".`, {
+        exitCode: 2,
+        nextStep: `Nothing was sent. --pay wallet buys the storage from the wallet this NMTS key derives; without it credits pay.`,
+    });
+}
+/** The two options that only mean something when the wallet pays, refused when it does not. */
+export function refuseWalletOnlyOptions(options) {
+    if (options.wallet !== undefined) {
+        throw new NmtsError("--wallet only applies with --pay wallet: credits are not held in a wallet.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to pay from one of this key's wallets.`,
+        });
+    }
+    if (options.epochs !== undefined) {
+        throw new NmtsError("--epochs only applies with --pay wallet: one credit buys a fixed term.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to choose the term, or leave --epochs off to pay with credits.`,
+        });
+    }
+    if (options.storage !== undefined) {
+        throw new NmtsError("--storage only applies with --pay wallet: credits buy storage from the treasury.", {
+            exitCode: 2,
+            nextStep: `Nothing was sent. Add --pay wallet to use a storage resource this wallet holds.`,
+        });
+    }
+}

package/dist/commands/put-wallet.d.ts

@@ -15,6 +15,8 @@ export interface WalletPayOptions {
     epochs?: string | number | undefined;
     /** `fit`, `whole`, or a held resource's object id. Absent = buy new storage. */
     storage?: string | undefined;
+    /** `--wallet N`: which wallet pays, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
     /** The instant the wallet agreement is measured against. */
     now?: number;
     /** ⚠ A SEAM, NOT AN OPTION — no flag reaches it. */
@@ -54,16 +56,20 @@ export interface WalletUploadContext {
     onCollision?: OnCollision | undefined;
     /** The sealed list's account settings, as read for this run — the standing tip lives in them. */
     settings?: AccountSettings | undefined;
+    /** Which of this key's wallets pays (`wallet-pay-index.ts`). Read from the same list as above. */
+    wallet: number;
     progress: Progress;
     say: (line: string) => void;
     json: boolean;
 }
 export declare function putWithWallet(target: string | undefined, options: PutWalletOptions): Promise<number>;
 /**
- * Review, agree, upload and record ONE file. Null when `--dry-run` stopped at the review.
+ * Review, agree, upload and record ONE file for a person who is watching. Null when `--dry-run`
+ * stopped at the review.
  *
- * ⛔ THE SIGNING MODULE IS LOADED AFTER THE AGREEMENT, and only then — a dry run and a refusal
- *    never bring the code that can spend into memory.
+ * ⛔ THE AGREEMENT HANDED IN BELOW IS THIS MACHINE'S GRANT, held against the total the review
+ *    names. It is the one gate between a program and somebody's wallet, and the reason it is
+ *    handed to the library rather than living inside it: a library call has nobody to ask.
  */
 export declare function uploadOneWithWallet(ctx: WalletUploadContext, file: WalletUploadFile, options: WalletPayOptions & {
     dryRun?: boolean | undefined;