@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/commands/put-wallet.js

@@ -1,16 +1,14 @@
 // `nmts put <file> --pay wallet` — one file in, sealed on this machine, its storage bought by the
 // PERSON'S OWN WALLET on the storage network instead of by credits.
 //
-// ⛔ IT PRICES BEFORE IT SIGNS, ALWAYS, in the order `extend` set: the parts are planned, the chain
-//    quotes each part in WAL and the relay's tip in SUI, the register transaction is dry-run for
-//    its fee, both balances are read — and only then is the review printed, a known shortfall
-//    refused, and the `wallet` agreement (scope `storage`) held against the total. `--dry-run`
-//    stops at the review and never loads the signing module.
+// ⛔ THE UPLOAD ITSELF IS NOT HERE. `upload-wallet-put.ts` prices, refuses, signs, pushes and
+//    records; this file is the terminal around it — the arguments, the printed review, the wallet
+//    agreement this machine holds, the spending ledger and the standing gift. The split is what
+//    lets the SDK pay from a wallet without a second copy of the order that keeps money safe.
 //
-// ⛔ THE SERVER IS TOLD THE STORAGE IS THE PERSON'S BY SAYING NOTHING ELSE. `POST /v1/items` forces
-//    treasury ownership only on a part that names a certified reservation; a wallet-paid part names
-//    none and carries the blob object and the end epoch instead, exactly as the browser's own
-//    wallet-paid commit does (`upload-steps.ts`).
+// ⛔ THE REVIEW IS PRINTED BEFORE ANY REFUSAL, and the agreement is asked for only after a known
+//    shortfall has already stopped the run — so a person who cannot afford it reads the numbers
+//    instead of a question. `--dry-run` stops at the review and never loads the signing module.
 //
 // ⛔ A HELD RESOURCE IS OFFERED, NEVER CHOSEN FOR THE PERSON — the owner's rule for storage
 //    resources: the leftover is shown in bytes and the person decides. The review names how many
@@ -20,27 +18,24 @@ import { basename, resolve } from "node:path";
 import { identityOf } from "../account.js";
 import { requireAccountCode } from "../code-access.js";
 import { parseAsked } from "../collision.js";
-import { DERIVED, loadCrypto } from "../crypto.js";
+import { loadCrypto } from "../crypto.js";
 import { API_KEY_ENV_VAR, readCredentialsFile, resolveApiKey } from "../credentials.js";
 import { NmtsError } from "../errors.js";
-import { setTrashed } from "../item-trash.js";
-import { addEntry } from "../manifest-write.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
+import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
 import { resolveNetwork } from "../network.js";
 import { BINARY_NAME } from "../product.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
-import { sealedLenFor } from "../seal.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { resolveServer } from "../server.js";
-import { statusOf } from "../shared/lib/storage-control/plan.js";
-import { createUploadApi } from "../upload-api.js";
-import { fileSource, partKeysOf, uploadFile } from "../upload-file.js";
-import { CREDIT_BYTES, measureLocal, partSizeFor, planAndPrice } from "../upload-price.js";
-import { clearItemRecord, clearReservation } from "../upload-store.js";
-import { walletRail } from "../upload-wallet.js";
-import { chooseUploadEpochs, daysOf, describeUploadReview, parseStorageAsk, pickResource, uploadBudget, uploadShortfallNextStep, walPrice, } from "../upload-wallet-plan.js";
-import { coinAmount, walletAddress } from "../wallet.js";
+import { fileSource } from "../upload-file-node.js";
+import { partSizeFor } from "../upload-price.js";
+import { measureLocal } from "../upload-price-node.js";
+import { describeUploadReview } from "../upload-wallet-plan.js";
+import { walletPut } from "../upload-wallet-put.js";
+import { coinAmount } from "../wallet.js";
 import { recordWalletSpend, requireWalletGrant } from "../wallet-grant.js";
-import { createBlobProtocol } from "../walrus-write.js";
 import { folderIdFor } from "./put.js";
 export async function putWithWallet(target, options) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
@@ -65,6 +60,12 @@ export async function putWithWallet(target, options) {
     const asked = parseAsked(options.onCollision);
     const list = await readFileList(server, key.key, resolved.code, identity.accountId);
     const rule = paddingRuleOf(list.manifest?.settings);
+    // ⛔ WHICH WALLET PAYS, BEFORE ANYTHING IS PRICED — out of the list that was just read, so this
+    //    costs no second request and the address in the review is the address that signs.
+    const wallet = await payingWalletIndex({
+        ...options,
+        readActiveWallet: async () => activeWalletOf(list.manifest?.settings),
+    });
     const name = options.name ?? basename(localPath);
     const destination = (options.to ?? "").replace(/^\.?\//, "").replace(/\/$/, "");
     const parentId = folderIdFor(options.to, list.manifest?.entries ?? []);
@@ -79,6 +80,7 @@ export async function putWithWallet(target, options) {
         rule,
         onCollision: asked,
         settings: list.manifest?.settings,
+        wallet,
         progress: new Progress(options.json === true ? silentSink() : stderrSink(), "uploading"),
         say,
         json: options.json === true,
@@ -100,174 +102,75 @@ export async function putWithWallet(target, options) {
     return 0;
 }
 /**
- * Review, agree, upload and record ONE file. Null when `--dry-run` stopped at the review.
+ * Review, agree, upload and record ONE file for a person who is watching. Null when `--dry-run`
+ * stopped at the review.
  *
- * ⛔ THE SIGNING MODULE IS LOADED AFTER THE AGREEMENT, and only then — a dry run and a refusal
- *    never bring the code that can spend into memory.
+ * ⛔ THE AGREEMENT HANDED IN BELOW IS THIS MACHINE'S GRANT, held against the total the review
+ *    names. It is the one gate between a program and somebody's wallet, and the reason it is
+ *    handed to the library rather than living inside it: a library call has nobody to ask.
  */
 export async function uploadOneWithWallet(ctx, file, options) {
     const { say } = ctx;
-    const { plan, sealedBytes, sealFor } = planAndPrice(file.size, ctx.partSize, ctx.rule);
-    const sealedLens = plan.map((range) => sealedLenFor(sealFor(range)));
-    const storageAsk = parseStorageAsk(options.storage);
-    if (storageAsk !== null && plan.length > 1) {
-        throw new NmtsError(`A held storage resource holds one blob, and this file is ${plan.length} parts.`, {
-            exitCode: 4,
-            nextStep: `Nothing was signed. Leave --storage off, or raise --part-size so the file is one part.`,
-        });
-    }
-    const protocol = (options.protocol ?? createBlobProtocol)(ctx.network, sealedBytes, (sent, total) => ctx.progress.update(sent, total));
-    const reads = await (options.readChain ?? defaultReads)(ctx.network, protocol.relayUrl);
-    const window = await reads.readWindow();
-    if (window === null) {
-        throw new NmtsError(`The ${ctx.network} storage network could not be read.`, {
-            exitCode: 1,
-            nextStep: `Nothing was signed and nothing was sent. Which epoch the network is in, and how far ahead it will sell, are facts only the chain has — this tool will not spend against a guess.`,
+    let outcome;
+    try {
+        outcome = await walletPut({
+            code: ctx.code,
+            apiKey: ctx.apiKey,
+            server: ctx.server,
+            network: ctx.network,
+            accountId: ctx.accountId,
+            crypt: ctx.crypt,
+            wallet: ctx.wallet,
+            partSize: ctx.partSize,
+            rule: ctx.rule,
+            onCollision: ctx.onCollision,
+        }, { source: fileSource(file.localPath, file.size), name: file.name, parentId: file.parentId, destination: file.destination }, {
+            epochs: options.epochs,
+            storage: options.storage,
+            dryRun: options.dryRun,
+            readChain: options.readChain,
+            sign: options.sign,
+            protocol: options.protocol,
+            api: options.api,
+            onProgress: (sent, total) => ctx.progress.update(sent, total),
+            onStep: (step) => tell(ctx, file.size, step),
+            onReview: (review) => {
+                if (ctx.json)
+                    return;
+                describeUploadReview(say, {
+                    name: review.name,
+                    bytes: review.bytes,
+                    parts: review.parts,
+                    epochs: review.epochs,
+                    days: review.days,
+                    endEpoch: review.endEpoch,
+                    walNeeded: review.budget.walNeededFrost,
+                    tipMist: review.tipMist,
+                    storage: review.storage,
+                    heldResources: review.heldResources,
+                }, review.budget);
+            },
+            agree: (review) => {
+                requireWalletGrant("seal", { walFrost: review.budget.walNeededFrost, suiMist: review.budget.suiNeededMist }, new Date(options.now ?? Date.now()));
+            },
+            onSpend: recordWalletSpend,
         });
     }
-    const epochs = chooseUploadEpochs(options.epochs, window);
-    const endEpoch = window.clock.current + epochs;
-    const quotes = await reads.quoteParts(sealedLens, epochs);
-    const address = await walletAddress(ctx.code);
-    let storage = { kind: "buy" };
-    let heldResources = null;
-    if (storageAsk !== null) {
-        const firstQuote = quotes[0];
-        const firstLen = sealedLens[0];
-        if (firstQuote === undefined || firstLen === undefined)
-            throw new NmtsError("unreachable: a plan with no part");
-        let resources;
-        try {
-            resources = await reads.readStorage(address);
-        }
-        catch (error) {
-            throw new NmtsError("The storage resources this wallet holds could not be read.", {
-                exitCode: 1,
-                nextStep: `Nothing was signed. That is not the same as holding none. Cause: ${error instanceof Error ? error.message : String(error)}`,
-            });
-        }
-        const encoded = await reads.encodedLength(address, firstLen);
-        storage = pickResource(storageAsk, resources, encoded, window.clock.current, endEpoch, firstQuote.writeFrost);
-    }
-    else {
-        heldResources = await reads.readStorage(address).then((rows) => rows.filter((r) => statusOf(r, window.clock.current) === "usable").length, () => null);
-    }
-    const [purse, feeMist] = await Promise.all([
-        reads.readWallet(address),
-        reads.estimateRegisterGas({
-            sender: address,
-            sealedLen: Math.max(...sealedLens),
-            epochs,
-            storage: storage.kind === "buy" ? storage : { kind: "reuse", objectId: storage.objectId, cutToBytes: storage.cutToBytes, writeFrost: storage.writeFrost },
-        }),
-    ]);
-    const budget = uploadBudget({ address, purse, feeMist, quotes, storage });
-    const tipMist = quotes.reduce((sum, q) => sum + q.tipMist, 0n);
-    const facts = {
-        bytes: file.size,
-        sealedBytes,
-        parts: plan.length,
-        epochs,
-        days: daysOf(window, epochs),
-        endEpoch,
-        paidFrom: "wallet",
-        priceFrost: budget.walNeededFrost.toString(),
-        priceWal: coinAmount(budget.walNeededFrost),
-        tipMist: tipMist.toString(),
-        tipSui: coinAmount(tipMist),
-        feeMist: feeMist === null ? null : feeMist.toString(),
-        feeSui: feeMist === null ? null : coinAmount(feeMist),
-        wallet: address,
-        walletWal: budget.walFrost === null ? null : coinAmount(budget.walFrost),
-        walletSui: budget.suiMist === null ? null : coinAmount(budget.suiMist),
-        storage: storage.kind === "buy"
-            ? { kind: "buy" }
-            : { kind: "reuse", objectId: storage.objectId, cutToBytes: storage.cutToBytes, leftoverBytes: storage.leftoverBytes },
-    };
-    if (!ctx.json) {
-        describeUploadReview(say, { name: file.name, bytes: file.size, parts: plan.length, epochs, days: daysOf(window, epochs), endEpoch, walNeeded: walPrice(quotes, storage), tipMist, storage, heldResources }, budget);
+    finally {
+        ctx.progress.done();
     }
-    if (options.dryRun === true) {
+    const facts = factsOf(outcome.review);
+    if (outcome.kind === "review") {
         if (ctx.json)
-            say(JSON.stringify({ dryRun: true, name: file.name, ...facts, signed: false }));
+            say(JSON.stringify({ dryRun: true, name: outcome.review.name, ...facts, signed: false }));
         else {
             say(``);
-            if (budget.shortfall !== null)
-                say(`  ⚠ ${budget.shortfall} As it stands, it would be refused.`);
+            if (outcome.review.budget.shortfall !== null)
+                say(`  ⚠ ${outcome.review.budget.shortfall} As it stands, it would be refused.`);
             say(`  Nothing was signed and nothing was sent. Run the same command without --dry-run to upload it.`);
         }
         return null;
     }
-    // ⛔ A WALLET KNOWN TO BE SHORT IS REFUSED BEFORE THE AGREEMENT IS ASKED FOR (`extend-budget.ts`).
-    if (budget.shortfall !== null) {
-        throw new NmtsError(budget.shortfall, { exitCode: 4, nextStep: uploadShortfallNextStep(budget) });
-    }
-    // ⛔ THE ONE GATE BETWEEN A PROGRAM AND SOMEBODY'S WALLET. Everything above is a read.
-    requireWalletGrant("seal", { walFrost: budget.walNeededFrost, suiMist: budget.suiNeededMist }, new Date(options.now ?? Date.now()));
-    const sign = options.sign ?? (await signers());
-    const derived = ctx.crypt.kdf_derive(ctx.crypt.account_code_parse(ctx.code));
-    const dataKey = derived.slice(DERIVED.dataKey[0], DERIVED.dataKey[1]);
-    derived.fill(0);
-    let result;
-    try {
-        result = await uploadFile({
-            api: options.api ?? createUploadApi(ctx.server, ctx.apiKey),
-            protocol,
-            crypt: ctx.crypt,
-            dataKey,
-            source: fileSource(file.localPath, file.size),
-            name: file.name,
-            parentId: file.parentId,
-            destination: file.destination,
-            relayUrl: protocol.relayUrl,
-            epochs,
-            currentEpoch: window.clock.current,
-            partSize: ctx.partSize,
-            padding: { rule: ctx.rule, unitBytes: CREDIT_BYTES },
-            onStep: (step) => tell(ctx, file.size, step),
-            buy: walletRail({
-                network: ctx.network,
-                code: ctx.code,
-                relayUrl: protocol.relayUrl,
-                epochs,
-                storage,
-                quotes,
-                feeMist,
-                signRegister: sign.register,
-                signCertify: sign.certify,
-                onSpend: recordWalletSpend,
-            }),
-        });
-    }
-    finally {
-        ctx.progress.done();
-        dataKey.fill(0);
-    }
-    const now = Date.now();
-    const added = await addEntry({
-        server: ctx.server,
-        apiKey: ctx.apiKey,
-        code: ctx.code,
-        accountId: ctx.accountId,
-        ...(ctx.onCollision !== undefined ? { onCollision: ctx.onCollision } : {}),
-        entry: {
-            id: result.itemId,
-            parentId: file.parentId,
-            kind: 1,
-            name: result.entry.name,
-            size: result.entry.plaintextLen,
-            createdAt: now,
-            updatedAt: now,
-            dekWrapped: result.entry.dekWrapped,
-            contentHashCt: result.entry.contentHashCt,
-        },
-    });
-    // ⛔ ONLY NOW, AND EVERY PART — the same order `put.ts` keeps and for the same reason.
-    clearItemRecord(result.fileKey);
-    for (const record of partKeysOf(result.fileKey, result.parts))
-        clearReservation(record);
-    if (added.replaced)
-        await setTrashed(ctx.server, ctx.apiKey, added.replaced.id, true);
     // ⛔ THE STANDING SHARE, AFTER THE PAYMENT AND NEVER INSIDE IT: a gift that fails must not fail
     //    the upload. A resumed run paid nothing now, so it owes nothing now. In --json the tip speaks
     //    on stderr — stdout carries the machine's one answer and nothing else.
@@ -276,11 +179,37 @@ export async function uploadOneWithWallet(ctx, file, options) {
         network: ctx.network,
         code: ctx.code,
         settings: ctx.settings,
-        paidWalFrost: result.resumed ? 0n : budget.walNeededFrost,
+        wallet: ctx.wallet,
+        paidWalFrost: outcome.resumed ? 0n : outcome.review.budget.walNeededFrost,
         say: ctx.json ? (line) => void process.stderr.write(`${line}\n`) : say,
         ...(options.tip ?? {}),
     });
-    return { itemId: result.itemId, savedAs: added.name, replaced: added.replaced?.id ?? null, seq: added.seq, resumed: result.resumed, facts };
+    return { itemId: outcome.itemId, savedAs: outcome.savedAs, replaced: outcome.replaced, seq: outcome.fileListVersion, resumed: outcome.resumed, facts };
+}
+/** The review as `--json` prints it: base units as strings, with the coin amounts beside them. */
+function factsOf(review) {
+    const { budget, storage } = review;
+    return {
+        bytes: review.bytes,
+        sealedBytes: review.sealedBytes,
+        parts: review.parts,
+        epochs: review.epochs,
+        days: review.days,
+        endEpoch: review.endEpoch,
+        paidFrom: "wallet",
+        priceFrost: budget.walNeededFrost.toString(),
+        priceWal: coinAmount(budget.walNeededFrost),
+        tipMist: review.tipMist.toString(),
+        tipSui: coinAmount(review.tipMist),
+        feeMist: budget.feeMist === null ? null : budget.feeMist.toString(),
+        feeSui: budget.feeMist === null ? null : coinAmount(budget.feeMist),
+        wallet: budget.address,
+        walletWal: budget.walFrost === null ? null : coinAmount(budget.walFrost),
+        walletSui: budget.suiMist === null ? null : coinAmount(budget.suiMist),
+        storage: storage.kind === "buy"
+            ? { kind: "buy" }
+            : { kind: "reuse", objectId: storage.objectId, cutToBytes: storage.cutToBytes, leftoverBytes: storage.leftoverBytes },
+    };
 }
 /** Each step, for a person watching. The signatures are named as what they are. */
 function tell(ctx, size, step) {
@@ -307,10 +236,3 @@ function tell(ctx, size, step) {
     if (step.step === "committing")
         say(`  saving to the drive`);
 }
-async function defaultReads(network, relayUrl) {
-    return (await import("../upload-wallet-chain.js")).walletUploadReads(network, relayUrl);
-}
-async function signers() {
-    const signing = await import("../wallet-sign.js");
-    return { register: signing.signBlobRegister, certify: signing.signBlobCertify };
-}

package/dist/commands/put.d.ts

@@ -35,16 +35,14 @@ export interface PutOptions {
     epochs?: string | number | undefined;
     /** `--pay wallet`: a held storage resource to use — `fit`, `whole`, or its object id. */
     storage?: string | undefined;
+    /** `--pay wallet`: which of this key's wallets pays, this run only. Absent = the account's own. */
+    wallet?: string | undefined;
     json?: boolean;
     write?: (line: string) => void;
 }
-/** Who pays, or a refusal for a payer this tool does not know. */
-export declare function payerOf(pay: string | undefined): "credits" | "wallet";
-/** The two options that only mean something when the wallet pays, refused when it does not. */
-export declare function refuseWalletOnlyOptions(options: {
-    epochs?: string | number | undefined;
-    storage?: string | undefined;
-}): void;
+/** Who pays, and the options that lose their meaning under that answer — the rule is in `put-payer.ts`; this is its one road. */
+import { payerOf, refuseWalletOnlyOptions } from "./put-payer.ts";
+export { payerOf, refuseWalletOnlyOptions };
 /**
  * The folder id `--to` names, or null for the root. Refuses rather than guessing.
  *

package/dist/commands/put.js

@@ -19,7 +19,8 @@ import { depositDefaultOf, depositLines, parseDeposit, refuseDepositWithWallet }
 import { DERIVED, loadCrypto } from "../crypto.js";
 import { buildIndex, fullPathOf, isLive, KIND_FOLDER, normalisePath } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { setTrashed } from "../item-trash.js";
 import { addEntry } from "../manifest-write.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
@@ -28,35 +29,14 @@ import { BINARY_NAME } from "../product.js";
 import { resolveServer } from "../server.js";
 import { clearItemRecord, clearReservation } from "../upload-store.js";
 import { createUploadApi } from "../upload-api.js";
-import { fileSource, partKeysOf, uploadFile } from "../upload-file.js";
-import { CREDIT_BYTES, creditsFor, measureLocal, partSizeFor, planAndPrice, UPLOAD_EPOCHS, } from "../upload-price.js";
+import { partKeysOf, uploadFile } from "../upload-file.js";
+import { fileSource } from "../upload-file-node.js";
+import { CREDIT_BYTES, creditsFor, partSizeFor, planAndPrice, UPLOAD_EPOCHS } from "../upload-price.js";
+import { measureLocal } from "../upload-price-node.js";
 import { createBlobProtocol, readCurrentEpoch } from "../walrus-write.js";
-/** Who pays, or a refusal for a payer this tool does not know. */
-export function payerOf(pay) {
-    if (pay === undefined || pay === "credits")
-        return "credits";
-    if (pay === "wallet")
-        return "wallet";
-    throw new NmtsError(`--pay takes credits or wallet, not "${pay}".`, {
-        exitCode: 2,
-        nextStep: `Nothing was sent. --pay wallet buys the storage from the wallet this NMTS key derives; without it credits pay.`,
-    });
-}
-/** The two options that only mean something when the wallet pays, refused when it does not. */
-export function refuseWalletOnlyOptions(options) {
-    if (options.epochs !== undefined) {
-        throw new NmtsError("--epochs only applies with --pay wallet: one credit buys a fixed term.", {
-            exitCode: 2,
-            nextStep: `Nothing was sent. Add --pay wallet to choose the term, or leave --epochs off to pay with credits.`,
-        });
-    }
-    if (options.storage !== undefined) {
-        throw new NmtsError("--storage only applies with --pay wallet: credits buy storage from the treasury.", {
-            exitCode: 2,
-            nextStep: `Nothing was sent. Add --pay wallet to use a storage resource this wallet holds.`,
-        });
-    }
-}
+/** Who pays, and the options that lose their meaning under that answer — the rule is in `put-payer.ts`; this is its one road. */
+import { payerOf, refuseWalletOnlyOptions } from "./put-payer.js";
+export { payerOf, refuseWalletOnlyOptions };
 /**
  * The folder id `--to` names, or null for the root. Refuses rather than guessing.
  *
@@ -283,9 +263,9 @@ export async function put(target, options = {}) {
     // ⛔ ONLY NOW, AND EVERY PART. Until the entry is in the list the file is paid for and invisible,
     //    and the records are the only thing that lets a second run finish the job without spending
     //    again. Clearing the file-level one first would leave a run able to commit a second time.
-    clearItemRecord(result.fileKey);
+    await clearItemRecord(result.fileKey);
     for (const record of partKeysOf(result.fileKey, result.parts))
-        clearReservation(record);
+        await clearReservation(record);
     // ⛔ THE DISPLACED FILE IS TOLD TO THE SERVER ONLY NOW, and only after the new one is in the
     //    list. Until this line the person still had the file they started with.
     // ⚠ A failure here leaves it hidden in this account's trash while the server still counts it as

package/dist/commands/receive.js

@@ -14,7 +14,7 @@ import { resolve } from "node:path";
 import { request } from "../api.js";
 import { loadCrypto } from "../crypto.js";
 import { fetchWithKey } from "../download.js";
-import { fileSink, stdoutSink } from "../download-sink.js";
+import { fileSink, stdoutSink } from "../download-sink-node.js";
 import { NmtsError } from "../errors.js";
 import { destinationFor } from "../safe-path.js";
 import { resolveNetwork } from "../network.js";

package/dist/commands/settings.js

@@ -39,5 +39,5 @@ export async function runSettings(command, args) {
         return await mode(args.operands[0], args.operands[1], { json: args.json });
     }
     const { onCollision } = await import("./on-collision.js");
-    return onCollision(args.operands[0], { json: args.json });
+    return await onCollision(args.operands[0], { json: args.json });
 }

package/dist/commands/support.js

@@ -57,7 +57,7 @@ async function sendReport(options) {
     const clean = (text) => omitLiterals(redact(text), omit);
     const message = clean(await readMessage(options)).trim();
     requireLength(message, MAX_MESSAGE_CHARS, "message");
-    const attachment = packLog(options.attachLog, clean);
+    const attachment = await packLog(options.attachLog, clean);
     const total = Buffer.byteLength(message, "utf8") + (attachment?.bytes ?? 0);
     // ⛔ THE MACHINE-READABLE PREVIEW IS THE ONLY THING PRINTED ON THAT PATH, and it is printed
     //    INSTEAD of sending rather than before it. Two JSON objects on one stream would let a caller
@@ -169,7 +169,7 @@ function standardInput() {
     });
 }
 /** Read the newest runs and pack them, or `null` when the option was not given. */
-function packLog(asked, clean) {
+async function packLog(asked, clean) {
     if (asked === undefined)
         return null;
     const count = asked === "" ? DEFAULT_ATTACHED_RUNS : Number(asked);
@@ -180,7 +180,7 @@ function packLog(asked, clean) {
     }
     if (count === 0)
         return null;
-    const runs = readRuns(count);
+    const runs = await readRuns(count);
     if (runs.length === 0)
         return null;
     return buildLogAttachment(runs, clean, MAX_ATTACHMENT_BYTES);

package/dist/commands/unlock.js

@@ -67,7 +67,7 @@ export async function unlock(action, target, options = {}) {
     }
     if (action === "unlock") {
         const key = keyOrFail(target);
-        if (options.readLine === undefined && !stdinIsATerminal() && currentMode() !== "skip-permissions") {
+        if (options.readLine === undefined && !stdinIsATerminal() && (await currentMode()) !== "skip-permissions") {
             throw new NmtsError(`A person unlocks, at a terminal — stdin here is not one.`, {
                 exitCode: 5,
                 nextStep: `If you are an agent: do not unlock things. Show the person what \`${BINARY_NAME} unlock\` ` +
@@ -80,7 +80,7 @@ export async function unlock(action, target, options = {}) {
         say(c.what);
         say(`  ${c.risk}`);
         say(`  ${c.limit}`);
-        if (currentMode() !== "skip-permissions") {
+        if ((await currentMode()) !== "skip-permissions") {
             const ask = options.readLine ?? promptLine;
             const answer = (await ask(`Unlock ${key} on this machine? [y/N] `)).trim();
             if (answer !== "y" && answer !== "Y") {

package/dist/commands/wallet-donate.d.ts

@@ -15,7 +15,10 @@ export interface WalletDonateOptions {
     yes?: boolean;
     dryRun?: boolean;
     feeCap?: string | undefined;
+    /** `--wallet N`: which wallet the gift comes from, this run only. Absent = the account's number. */
+    wallet?: string | undefined;
     /** ⚠ SEAMS, NOT OPTIONS — no flag reaches them. */
+    readActiveWallet?: () => Promise<number>;
     readDonation?: (server: string) => Promise<DonationConfig>;
     readChain?: (network: Network) => SendReads | Promise<SendReads>;
     sign?: SignTransfer;

package/dist/commands/wallet-donate.js

@@ -25,6 +25,7 @@ import { THANKS_EN, THANKS_KO } from "../standing-tip.js";
 import { explorerTxUrl } from "../shared/lib/wallet/activity.js";
 import { clampGasBudgetMist, isValidSuiAddress, parseTokenAmountToBaseUnits, validateSendForm, } from "../shared/lib/wallet/send-rules.js";
 import { coinAmount, walCoinType, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 /** The four facts and the promise, as the screens say them, in the order a person reads them. */
 export const GIFT_NOTICES = [
     "This is a voluntary gift. Nothing is provided in return, it is non-refundable, and it cannot be undone once sent.",
@@ -57,7 +58,10 @@ export async function walletDonate(operands, options = {}) {
         throw new NmtsError("Say how much.", { exitCode: 2, nextStep: `\`${BINARY_NAME} wallet donate ${coin} <amount> --yes\`` });
     }
     const resolved = await requireAccountCode();
-    const address = await walletAddress(resolved.code);
+    // ⛔ A gift leaves the same wallet storage is paid from, and it is resolved before the review is
+    //    priced — so the address a person reads is the address the coins leave.
+    const wallet = await payingWalletIndex(options);
+    const address = await walletAddress(resolved.code, wallet);
     const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
     const server = resolveServer(options.server ?? stored?.server);
     const network = resolveNetwork(server, options.network ?? stored?.network);
@@ -143,7 +147,7 @@ export async function walletDonate(operands, options = {}) {
         });
     }
     const sign = options.sign ?? (await import("../wallet-sign.js")).signTransfer;
-    const digest = await sign({ network, code: resolved.code, shape });
+    const digest = await sign({ network, code: resolved.code, wallet, shape });
     if (options.json) {
         say(JSON.stringify({ ...facts, signed: true, digest, explorerUrl: explorerTxUrl(digest, network) }));
         return 0;

package/dist/commands/wallet-hall.d.ts

@@ -6,7 +6,10 @@ export interface WalletHallOptions {
     /** `--name`: be listed under this. `--remove`: go back to a shortened address. */
     name?: string | undefined;
     remove?: boolean;
-    /** ⚠ A SEAM, NOT AN OPTION — no flag reaches it. It exists so a test never signs for real. */
+    /** `--wallet N`: which wallet signs the name, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
+    /** ⚠ SEAMS, NOT OPTIONS — no flag reaches them. They exist so a test never signs for real. */
+    readActiveWallet?: () => Promise<number>;
     sign?: SignMessage;
 }
 /** One row of the hall, as this tool needs it. Amounts are base units, exactly as they arrived. */

package/dist/commands/wallet-hall.js

@@ -6,9 +6,12 @@
 //    taken off is the NAME, which puts the entry back to a shortened address.
 //
 // ⛔ A NAME IS PUBLISHED, AND THAT IS WHY IT IS SIGNED. The proof that an address is yours is a
-//    signature by that address, so `--name` signs a short message with the wallet this NMTS
-//    key derives (`wallet-sign.ts`) and sends the signature. No session, no API key, no account
-//    id goes with it — the server is told an address, a name and a signature, and nothing else.
+//    signature by that address, so `--name` signs a short message with the wallet this account
+//    pays from (`wallet-pay-index.ts`, `wallet-sign.ts`) and sends the signature. That is the
+//    wallet a gift left from, so it is the address the hall holds an entry for. Reading WHICH
+//    wallet that is opens this account's own file list, so `--name` needs an API key where
+//    reading the hall needs none; what is SENT is unchanged — no session, no API key, no account
+//    id, just an address, a name and a signature.
 //
 // ⛔ THE MESSAGE IS BUILT IN ONE PLACE, `hallMessage` BELOW, because the server rebuilds the same
 //    bytes from the fields it was sent and compares. A space added on either side makes every
@@ -21,6 +24,7 @@ import { isRecord } from "../guards.js";
 import { BINARY_NAME, HOME_URL } from "../product.js";
 import { resolveServer } from "../server.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 /** How many rows a terminal gets. The page at the site carries the rest. */
 const SHOWN = 10;
 /**
@@ -93,7 +97,7 @@ const REFUSALS = {
     signature_invalid: {
         line: "The server did not accept the signature.",
         exitCode: 1,
-        nextStep: `Nothing was published. \`${BINARY_NAME} wallet address\` shows the wallet this run signs as.`,
+        nextStep: `Nothing was published. \`${BINARY_NAME} wallet list\` shows this key's wallets and which one this run signs as.`,
     },
 };
 /** The server the sealed sign-in points at, when there is one this run can read. */
@@ -180,14 +184,17 @@ async function readHall(server) {
 /** `--name` and `--remove`: sign the message, send it, and say what the hall shows now. */
 async function setName(server, say, options) {
     const resolved = await requireAccountCode();
-    // ⛔ The address is derived here rather than taken from a flag: a signature only proves ownership
-    //    of the address it was made by, so the two must come from the same NMTS key.
-    const address = await walletAddress(resolved.code);
+    // ⛔ WHICH WALLET, BEFORE THE ADDRESS — the entry belongs to the wallet the gift came from, which
+    //    is the account's own number, and the address is then derived here rather than taken from a
+    //    flag: a signature only proves ownership of the address it was made by, so the address, the
+    //    message and the key that signs it have to be the same wallet.
+    const wallet = await payingWalletIndex({ ...options, server });
+    const address = await walletAddress(resolved.code, wallet);
     const name = options.remove === true ? null : (options.name ?? null);
     const issuedAt = new Date(Date.now()).toISOString();
     const message = hallMessage(address, name, issuedAt);
     const sign = options.sign ?? (await import("../wallet-sign.js")).signMessage;
-    const signature = await sign({ code: resolved.code, message });
+    const signature = await sign({ code: resolved.code, wallet, message });
     let answer;
     try {
         answer = await request(server, "/v1/gifts/listing", {
@@ -207,6 +214,7 @@ async function setName(server, say, options) {
     }
     const label = isRecord(answer) ? text(answer["label"]) : "";
     say(`Listed as ${label}`);
+    say(`  from  ${address} (wallet ${wallet})`);
     say(``);
     say(`  The hall of fame is at ${HOME_URL}/hall. Run \`${BINARY_NAME} wallet hall --remove\` to go`);
     say(`  back to a shortened address; the gifts themselves stay on the chain either way.`);