@needmoretruth/nmts-cli 0.34.4 → 0.36.1

package/dist/main.js

@@ -40,6 +40,7 @@ import { BINARY_NAME, VERSION } from "./product.js";
  */
 export const NOT_BUILT_YET = [];
 export async function run(argv) {
+    (await import("./host-node.js")).registerNodeHost();
     const args = parseArgs(argv);
     if (args.version) {
         process.stdout.write(`${VERSION}\n`);
@@ -54,7 +55,7 @@ export async function run(argv) {
     //    ⚠ `mode` itself is exempt: the command that prints the setting does not need it twice.
     if (args.command !== "mode") {
         const { announcement, currentMode } = await import("./autonomy.js");
-        const line = announcement(currentMode());
+        const line = announcement(await currentMode());
         if (line !== null)
             process.stderr.write(`${line}\n`);
     }
@@ -76,10 +77,8 @@ export async function run(argv) {
                 env: args.env,
             });
         }
-        case "logout": {
-            const { logout } = await import("./commands/logout.js");
-            return logout();
-        }
+        case "logout":
+            return (await import("./commands/logout.js")).logout();
         case "whoami": {
             const { whoami } = await import("./commands/whoami.js");
             return await whoami({
@@ -124,7 +123,7 @@ export async function run(argv) {
             return await wallet(args.operands[0], {
                 server: args.server, network: args.network, json: args.json, qr: args.qr,
                 rest: args.operands.slice(1), yes: args.yes, dryRun: args.dryRun, feeCap: args.feeCap,
-                to: args.to, venue: args.venue, slippageBps: args.slippageBps, acceptExtremes: args.acceptExtremes, size: args.size, epochs: args.epochs, name: args.name, remove: args.remove,
+                to: args.to, venue: args.venue, slippageBps: args.slippageBps, acceptExtremes: args.acceptExtremes, size: args.size, epochs: args.epochs, name: args.name, remove: args.remove, index: args.index, wallet: args.wallet,
             });
         }
         case "expiring": {
@@ -149,7 +148,7 @@ export async function run(argv) {
                 epochs: args.epochs,
                 dryRun: args.dryRun,
                 yes: args.yes,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "create": {
@@ -191,7 +190,7 @@ export async function run(argv) {
                 pay: args.pay,
                 epochs: args.epochs,
                 storage: args.storage,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "push": {
@@ -208,7 +207,7 @@ export async function run(argv) {
                 pay: args.pay,
                 epochs: args.epochs,
                 storage: args.storage,
-                json: args.json,
+                json: args.json, wallet: args.wallet,
             });
         }
         case "rm": {
@@ -352,6 +351,8 @@ export async function run(argv) {
             const { mcp } = await import("./commands/mcp.js");
             return await mcp({ server: args.server, network: args.network, out: args.out });
         }
+        case "platform":
+            return (await import("./commands/platform.js")).platform(args.operands[0], { out: args.out });
         case "s3": {
             const { s3 } = await import("./commands/s3.js");
             return await s3({ server: args.server, network: args.network, port: args.port, json: args.json });
@@ -385,7 +386,7 @@ async function main() {
     const { noteFailure, recordRun } = await import("./run-log.js");
     if (failed !== null)
         noteFailure(failed);
-    recordRun(argv, typeof process.exitCode === "number" ? process.exitCode : 0, Date.now() - started);
+    await recordRun(argv, typeof process.exitCode === "number" ? process.exitCode : 0, Date.now() - started);
     await noteUpdateAfter(argv, VERSION);
 }
 if (invokedDirectly(import.meta.filename)) {

package/dist/manifest-chunk-cache.d.ts

@@ -1,7 +1,7 @@
 /** The sealed bytes this machine holds under that name, or null when it holds none. */
-export declare function readCachedChunk(accountId: string, hash: string): string | null;
+export declare function readCachedChunk(accountId: string, hash: string): Promise<string | null>;
 /** Keep these sealed bytes under that name. Silent when the machine will not take them. */
-export declare function writeCachedChunk(accountId: string, hash: string, ct: string): void;
+export declare function writeCachedChunk(accountId: string, hash: string, ct: string): Promise<void>;
 /**
  * Drop every copy this account holds that the given list does not name.
  *
@@ -11,4 +11,4 @@ export declare function writeCachedChunk(accountId: string, hash: string, ct: st
  *    abandoned. Called after every complete read and every successful write, which is exactly when
  *    "what the list names" is known.
  */
-export declare function pruneChunkCache(accountId: string, keep: ReadonlySet<string>): void;
+export declare function pruneChunkCache(accountId: string, keep: ReadonlySet<string>): Promise<void>;

package/dist/manifest-chunk-cache.js

@@ -6,46 +6,45 @@
 //    rewrote one chunk costs one download instead of the whole list.
 //
 // ⛔ AND IT IS STILL CHECKED ON THE WAY OUT. The reader re-hashes what it reads from here before
-//    opening it (`manifest-chunk-flow.ts`). A directory on this machine is not a trusted store:
-//    whoever holds the machine can edit it, and the index is the only thing that says which bytes
-//    belong to which version.
+//    opening it (`manifest-chunk-flow.ts`). A store on this machine is not a trusted one: whoever
+//    holds the machine can edit it, and the index is the only thing that says which bytes belong
+//    to which version.
 //
 // ⛔ WHAT IS STORED IS SEALED. These are the account's names, folders and file keys, sealed with
-//    the NMTS key — the same bytes the server holds and cannot read. They are written 0600 in
-//    a 0700 directory, beside the kept copy of the index and for the same reason.
+//    the NMTS key — the same bytes the server holds and cannot read. Where they land, and how
+//    private that place is, is the host's business: on this machine it is a 0600 file in a 0700
+//    directory, beside the kept copy of the index and for the same reason.
 //
 // ⚠ NOTHING HERE THROWS. A cache that cannot be read or written is a slower command, never a
 //   broken one: every function answers "no copy" and the network path behind it does the work.
-import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { configDir } from "./credentials.js";
-/** A chunk's name: base64url SHA-256, unpadded — 43 characters, and it becomes a file name. */
+import { fromUtf8, utf8 } from "./bytes.js";
+import { host } from "./host.js";
+/** A chunk's name: base64url SHA-256, unpadded — 43 characters, and it becomes part of a key. */
 const NAME = /^[A-Za-z0-9_-]{43}$/;
 /**
- * ⛔ AN ACCOUNT ID BECOMES PART OF A PATH HERE, so it is CHECKED rather than trusted — the same
+ * ⛔ AN ACCOUNT ID BECOMES PART OF A KEY HERE, so it is CHECKED rather than trusted — the same
  *    check `manifest.ts` makes on the kept list, and for the same reason: a value that reaches a
- *    path join unchecked is how `..` becomes a write somewhere else.
+ *    key unchecked is how `..` becomes a write somewhere else on a host that spells keys as paths.
  */
 const ACCOUNT = /^[A-Za-z0-9_-]{1,64}$/;
-/** Where one account's chunks live, or null when the id is not one this tool derived. */
-function dirFor(accountId) {
-    if (!ACCOUNT.test(accountId))
-        return null;
-    return join(configDir(), "file-list-chunks", accountId);
+/** The key prefix one account's chunks live under, or null when the id is not one this tool derived. */
+function areaFor(accountId) {
+    return ACCOUNT.test(accountId) ? `chunks/${accountId}/` : null;
 }
-function pathFor(accountId, hash) {
-    const dir = dirFor(accountId);
-    if (dir === null || !NAME.test(hash))
-        return null;
-    return join(dir, `${hash}.ct`);
+function keyFor(accountId, hash) {
+    const area = areaFor(accountId);
+    return area === null || !NAME.test(hash) ? null : `${area}${hash}`;
 }
 /** The sealed bytes this machine holds under that name, or null when it holds none. */
-export function readCachedChunk(accountId, hash) {
-    const path = pathFor(accountId, hash);
-    if (path === null)
+export async function readCachedChunk(accountId, hash) {
+    const key = keyFor(accountId, hash);
+    if (key === null)
         return null;
     try {
-        const text = readFileSync(path, "utf8").trim();
+        const held = await host().state.read(key);
+        if (held === undefined)
+            return null;
+        const text = fromUtf8(held).trim();
         return text === "" ? null : text;
     }
     catch {
@@ -53,18 +52,16 @@ export function readCachedChunk(accountId, hash) {
     }
 }
 /** Keep these sealed bytes under that name. Silent when the machine will not take them. */
-export function writeCachedChunk(accountId, hash, ct) {
-    const dir = dirFor(accountId);
-    const path = pathFor(accountId, hash);
-    if (dir === null || path === null)
+export async function writeCachedChunk(accountId, hash, ct) {
+    const key = keyFor(accountId, hash);
+    if (key === null)
         return;
     try {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-        writeFileSync(path, `${ct}\n`, { mode: 0o600 });
+        await host().state.write(key, utf8(`${ct}\n`));
     }
     catch {
-        // Out of space, read-only home, a directory somebody removed underneath: the next read of the
-        // list fetches from the server instead, which is what this cache is an optimisation of.
+        // Out of space, a read-only home, a browser that would not open its database: the next read of
+        // the list fetches from the server instead, which is what this cache is an optimisation of.
     }
 }
 /**
@@ -76,27 +73,25 @@ export function writeCachedChunk(accountId, hash, ct) {
  *    abandoned. Called after every complete read and every successful write, which is exactly when
  *    "what the list names" is known.
  */
-export function pruneChunkCache(accountId, keep) {
-    const dir = dirFor(accountId);
-    if (dir === null)
+export async function pruneChunkCache(accountId, keep) {
+    const area = areaFor(accountId);
+    if (area === null)
         return;
-    let names;
+    let held;
     try {
-        names = readdirSync(dir);
+        held = await host().state.keys(area);
     }
     catch {
         return;
     }
-    for (const name of names) {
-        if (!name.endsWith(".ct"))
-            continue;
-        if (keep.has(name.slice(0, -3)))
+    for (const key of held) {
+        if (keep.has(key.slice(area.length)))
             continue;
         try {
-            rmSync(join(dir, name), { force: true });
+            await host().state.remove(key);
         }
         catch {
-            // A copy that will not delete costs disk and nothing else; it is named by a hash, so it can
+            // A copy that will not delete costs space and nothing else; it is named by a hash, so it can
             // never be handed back as some other version.
         }
     }

package/dist/manifest-chunk-flow.js

@@ -18,12 +18,13 @@
 // PURE OF COMMANDS: it takes a derived key and a server, and knows nothing about what an edit
 //   means. Deciding WHICH entries the list should hold is `manifest-write.ts`'s job; deciding which
 //   entry goes in which chunk is the shared packer's.
+import { fromBase64Url, toBase64Url } from "./bytes.js";
 import { request, ServerError } from "./api.js";
 import { AAD, DERIVED, loadCrypto } from "./crypto.js";
 import { NmtsError } from "./errors.js";
 import { pruneChunkCache, readCachedChunk, writeCachedChunk } from "./manifest-chunk-cache.js";
 import { keepTrying } from "./net-retry.js";
-import { registerNodeZstd } from "./zstd-node.js";
+import { host } from "./host.js";
 import { AAD_FILE_LIST_CHUNK, chunkFingerprint, decodeChunk, decodeFileList, encodeChunk, encodeIndex, FILE_LIST_VERSION_CHUNKED, } from "./shared/lib/drive/manifest-chunks.js";
 import { packAll, repack } from "./shared/lib/drive/manifest-pack.js";
 /** How many chunk requests are in flight at once. Enough to fill a link, few enough to stay fair. */
@@ -42,10 +43,10 @@ export class ManifestChunkError extends NmtsError {
     }
 }
 function sealUnder(io, aad, body) {
-    return Buffer.from(io.crypt.envelope_seal(io.key, utf8.encode(aad), body)).toString("base64url");
+    return toBase64Url(io.crypt.envelope_seal(io.key, utf8.encode(aad), body));
 }
 function openUnder(io, aad, ct) {
-    return io.crypt.envelope_open(io.key, utf8.encode(aad), Buffer.from(ct, "base64url"));
+    return io.crypt.envelope_open(io.key, utf8.encode(aad), fromBase64Url(ct));
 }
 /** What the two chunk routes answer. Narrowed here rather than trusted. */
 function ctOf(answer) {
@@ -63,7 +64,7 @@ function ctOf(answer) {
  * is a version nobody will ask for again.
  */
 export async function openChunks(io, index) {
-    registerNodeZstd();
+    await host().zstd.register();
     const refs = index.chunks;
     const out = new Array(refs.length);
     let next = 0;
@@ -78,12 +79,12 @@ export async function openChunks(io, index) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(CONCURRENCY, refs.length) }, worker));
-    pruneChunkCache(io.accountId, new Set(refs.map((c) => c.h)));
+    await pruneChunkCache(io.accountId, new Set(refs.map((c) => c.h)));
     return out;
 }
 /** One chunk: from this machine if it has it, else from the server — verified either way. */
 async function openOne(io, ref, indexSeq) {
-    const cached = readCachedChunk(io.accountId, ref.h);
+    const cached = await readCachedChunk(io.accountId, ref.h);
     let ct = cached;
     if (ct === null) {
         try {
@@ -119,7 +120,7 @@ async function openOne(io, ref, indexSeq) {
         throw new ManifestChunkError(`Part of the file list holds ${doc.items.length} entries where the index says ${ref.n}.`);
     }
     if (cached === null)
-        writeCachedChunk(io.accountId, ref.h, ct);
+        await writeCachedChunk(io.accountId, ref.h, ct);
     return doc.items;
 }
 /**
@@ -133,7 +134,7 @@ async function openOne(io, ref, indexSeq) {
  *   the chunks written by the losing attempt are named by no index and the server sweeps them.
  */
 export async function writeChunkedList(io, plan) {
-    registerNodeZstd();
+    await host().zstd.register();
     const packed = plan.previous.length > 0 ? repack(plan.previous, plan.entries) : packAll(plan.entries);
     const rows = [];
     const held = [];
@@ -168,7 +169,7 @@ export async function writeChunkedList(io, plan) {
     body.fill(0);
     const refs = rows.map((r) => r.h);
     const seq = await putIndex(io, plan.baseSeq, ct, refs, fresh);
-    pruneChunkCache(io.accountId, new Set(refs));
+    await pruneChunkCache(io.accountId, new Set(refs));
     return { seq, ct, held };
 }
 /**
@@ -197,7 +198,7 @@ async function putIndex(io, baseSeq, ct, refs, fresh) {
             for (const name of refs) {
                 if (again.has(name))
                     continue;
-                const kept = readCachedChunk(io.accountId, name);
+                const kept = await readCachedChunk(io.accountId, name);
                 if (kept !== null)
                     again.set(name, kept);
             }
@@ -231,7 +232,7 @@ async function putChunks(io, chunks) {
                 token: io.apiKey,
                 body: { ct },
             }), { retryable: (error) => error instanceof ServerError && error.status === 429 });
-            writeCachedChunk(io.accountId, name, ct);
+            await writeCachedChunk(io.accountId, name, ct);
         }
     };
     await Promise.all(Array.from({ length: Math.min(CONCURRENCY, names.length) }, worker));
@@ -259,14 +260,14 @@ function seqOf(answer) {
  *   refusing here would refuse in a case the command used to handle.
  */
 export async function namedChunks(code, ct) {
-    registerNodeZstd();
+    await host().zstd.register();
     const crypt = await loadCrypto();
     const [from, to] = DERIVED.fileListKey;
     const derived = crypt.kdf_derive(crypt.account_code_parse(code));
     const key = derived.slice(from, to);
     derived.fill(0);
     try {
-        const body = crypt.envelope_open(key, utf8.encode(AAD.fileList), Buffer.from(ct, "base64url"));
+        const body = crypt.envelope_open(key, utf8.encode(AAD.fileList), fromBase64Url(ct));
         const doc = await decodeFileList(body);
         body.fill(0);
         return doc.v === FILE_LIST_VERSION_CHUNKED ? doc.index.chunks.map((c) => c.h) : [];
@@ -292,7 +293,7 @@ export async function keptChunks(code, accountId, indexCt) {
         return null;
     const out = [];
     for (const name of names) {
-        const ct = readCachedChunk(accountId, name);
+        const ct = await readCachedChunk(accountId, name);
         if (ct === null) {
             throw new NmtsError("This machine holds the file list's index but not all of its parts.", {
                 exitCode: 4,

package/dist/manifest-write.js

@@ -236,7 +236,7 @@ export async function addEntry(input) {
     let replaced;
     // ⛔ SETTLED ONCE, OUTSIDE THE RETRY LOOP. What the machine is set to and whether a mode is on
     //    are facts about this run, not about the list version a compare-and-swap happened to read.
-    const choice = decide(input.onCollision).choice;
+    const choice = (await decide(input.onCollision)).choice;
     const result = await applyManyToList(input, (entries) => {
         const plan = planAddition(entries, input.entry, choice);
         alreadyThere = plan.alreadyThere ?? null;

package/dist/manifest.d.ts

@@ -30,7 +30,7 @@ export interface KeptList {
  *   write out a good copy because an old one is unreadable would be refusing the very thing it is
  *   for.
  */
-export declare function readKeptList(accountId: string): KeptList | null;
+export declare function readKeptList(accountId: string): Promise<KeptList | null>;
 /**
  * Record a version this machine WROTE, so the server cannot serve an older one back afterwards.
  *
@@ -40,7 +40,7 @@ export declare function readKeptList(accountId: string): KeptList | null;
  */
 export declare function recordWrittenList(accountId: string, seq: number, ct: string): Promise<void>;
 /** True when this machine has a record for the account — i.e. a rollback would be visible. */
-export declare function hasSeenBefore(accountId: string): boolean;
+export declare function hasSeenBefore(accountId: string): Promise<boolean>;
 export interface FileList {
     /** null when the account has no list yet — a new account, not an error. */
     manifest: Manifest | null;

package/dist/manifest.js

@@ -27,12 +27,11 @@
 //    exactly as the single blob was, and the chunks are kept by name in the chunk store
 //    (`manifest-chunk-cache.ts`), which is pruned to what the list just read names. So the copy is
 //    still complete — it is simply in two places, and `nmts listfile` writes them out as one file.
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { request } from "./api.js";
+import { fromBase64Url, fromUtf8, toBase64Url, utf8 } from "./bytes.js";
 import { AAD, DERIVED, loadCrypto } from "./crypto.js";
-import { configDir } from "./credentials.js";
 import { NmtsError } from "./errors.js";
+import { host } from "./host.js";
 import { openChunks } from "./manifest-chunk-flow.js";
 import { decodeFileList, FILE_LIST_VERSION_CHUNKED, } from "./shared/lib/drive/manifest-chunks.js";
 function asResponse(value) {
@@ -53,26 +52,26 @@ function asResponse(value) {
 }
 /** base64url SHA-256 of a sealed blob — the value a later list carries as its `prev`. */
 async function fingerprint(ct) {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(ct));
-    return Buffer.from(digest).toString("base64url");
-}
-function statePath() {
-    return join(configDir(), "file-list-state.json");
+    const digest = await crypto.subtle.digest("SHA-256", utf8(ct));
+    return toBase64Url(new Uint8Array(digest));
 }
+/** The one key this machine's record of what it has seen lives under. */
+const STATE_KEY = "manifest/state";
 /**
- * Where this machine keeps one account's sealed file list.
+ * The key this machine keeps one account's sealed file list under.
  *
- * ⛔ AN ACCOUNT ID BECOMES PART OF A PATH HERE, so it is CHECKED rather than trusted. Every id this
- *    tool has comes from its own derivation and is base64url, but a value that reaches a path join
- *    unchecked is how `..` becomes a write somewhere else, and the check costs one line.
+ * ⛔ AN ACCOUNT ID BECOMES PART OF A KEY HERE, so it is CHECKED rather than trusted. Every id this
+ *    tool has comes from its own derivation and is base64url, but a value that reaches a key
+ *    unchecked is how `..` becomes a write somewhere else on a host that spells keys as paths, and
+ *    the check costs one line.
  */
-function keptListPath(accountId) {
+function keptListKey(accountId) {
     if (!/^[A-Za-z0-9_-]{1,64}$/.test(accountId)) {
         throw new NmtsError("That is not an account id this tool derived.", {
             nextStep: "Nothing was written. This is a fault in the tool rather than in the account.",
         });
     }
-    return join(configDir(), `file-list-${accountId}.json`);
+    return `manifest/${accountId}`;
 }
 /** This machine's copy of one account's sealed file list. */
 /**
@@ -104,9 +103,12 @@ function isKeptList(value) {
  *   write out a good copy because an old one is unreadable would be refusing the very thing it is
  *   for.
  */
-export function readKeptList(accountId) {
+export async function readKeptList(accountId) {
     try {
-        const parsed = JSON.parse(readFileSync(keptListPath(accountId), "utf8"));
+        const held = await host().state.read(keptListKey(accountId));
+        if (held === undefined)
+            return null;
+        const parsed = JSON.parse(fromUtf8(held));
         return isKeptList(parsed) ? parsed : null;
     }
     catch {
@@ -121,17 +123,19 @@ export function readKeptList(accountId) {
  *    a run that then read an older list from the server must not overwrite the newest copy with
  *    it. The record refuses a lower version while it exists; this is what holds when it does not.
  */
-function writeKept(accountId, seq, ct) {
-    const held = readKeptList(accountId);
+async function writeKept(accountId, seq, ct) {
+    const held = await readKeptList(accountId);
     if (held !== null && held.seq > seq)
         return;
     const copy = { seq, savedAt: new Date().toISOString(), ct };
-    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
-    writeFileSync(keptListPath(accountId), `${JSON.stringify(copy, null, 2)}\n`, { mode: 0o600 });
+    await host().state.write(keptListKey(accountId), utf8(`${JSON.stringify(copy, null, 2)}\n`));
 }
-function readSeen() {
+async function readSeen() {
     try {
-        const parsed = JSON.parse(readFileSync(statePath(), "utf8"));
+        const held = await host().state.read(STATE_KEY);
+        if (held === undefined)
+            return {};
+        const parsed = JSON.parse(fromUtf8(held));
         return typeof parsed === "object" && parsed !== null ? parsed : {};
     }
     catch {
@@ -147,14 +151,13 @@ function readSeen() {
  *    would be two chances for a caller to update one and not the other — after which the machine
  *    would hold a copy of one version while claiming to have seen another.
  */
-function writeSeen(accountId, seq, fp, ct) {
-    const all = readSeen();
+async function writeSeen(accountId, seq, fp, ct) {
+    const all = await readSeen();
     all[accountId] = { seq, fingerprint: fp };
-    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
-    writeFileSync(statePath(), `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 });
+    await host().state.write(STATE_KEY, utf8(`${JSON.stringify(all, null, 2)}\n`));
     // The record goes first: it is the safety device, and a machine that failed to keep a copy must
     // still refuse an older list afterwards.
-    writeKept(accountId, seq, ct);
+    await writeKept(accountId, seq, ct);
 }
 /**
  * Record a version this machine WROTE, so the server cannot serve an older one back afterwards.
@@ -164,11 +167,11 @@ function writeSeen(accountId, seq, fp, ct) {
  *    a rollback.
  */
 export async function recordWrittenList(accountId, seq, ct) {
-    writeSeen(accountId, seq, await fingerprint(ct), ct);
+    await writeSeen(accountId, seq, await fingerprint(ct), ct);
 }
 /** True when this machine has a record for the account — i.e. a rollback would be visible. */
-export function hasSeenBefore(accountId) {
-    return existsSync(statePath()) && accountId in readSeen();
+export async function hasSeenBefore(accountId) {
+    return accountId in (await readSeen());
 }
 /**
  * Fetch and open the account's file list.
@@ -178,10 +181,10 @@ export function hasSeenBefore(accountId) {
  */
 export async function readFileList(base, apiKey, accountCode, accountId) {
     const answer = asResponse(await request(base, "/v1/manifest", { token: apiKey }));
-    const first = !hasSeenBefore(accountId);
+    const first = !(await hasSeenBefore(accountId));
     if (answer.state === "absent")
         return { manifest: null, firstTimeOnThisMachine: first };
-    const seen = readSeen()[accountId];
+    const seen = (await readSeen())[accountId];
     if (seen !== undefined && answer.seq < seen.seq) {
         throw new NmtsError(`The server offered file-list version ${answer.seq}; this machine already saw ${seen.seq}.`, {
             nextStep: "Nothing was changed. A list that goes backwards means an older copy is being served, " +
@@ -214,7 +217,7 @@ export async function readFileList(base, apiKey, accountCode, accountId) {
     try {
         let body;
         try {
-            body = crypt.envelope_open(key, new TextEncoder().encode(AAD.fileList), Buffer.from(answer.ct, "base64url"));
+            body = crypt.envelope_open(key, utf8(AAD.fileList), fromBase64Url(answer.ct));
         }
         catch {
             throw new NmtsError("The file list did not open with this account's key.", {
@@ -252,7 +255,7 @@ export async function readFileList(base, apiKey, accountCode, accountId) {
         // ⛔ THE VERSION THAT IS KEPT IS THE SEALED ONE, and so are the bytes it came out of. Believing
         //    the server's column here would let it decide which copy this machine keeps. The bytes are
         //    the INDEX at version 2; its chunks are kept beside it, by name, in the chunk store.
-        writeSeen(accountId, manifest.seq, fp, answer.ct);
+        await writeSeen(accountId, manifest.seq, fp, answer.ct);
         return out;
     }
     finally {

package/dist/mcp-tools/tiers.js

@@ -141,7 +141,7 @@ export function withTiers(tools, asker) {
             ...tool,
             description: `${tierLine(tier)}${tool.description}`,
             annotations: annotationsOf(tool.name),
-            run: async (args) => (await passTool(tool.name, args, currentMode(), asker())) ?? (await tool.run(args)),
+            run: async (args) => (await passTool(tool.name, args, await currentMode(), asker())) ?? (await tool.run(args)),
         };
     });
 }

package/dist/network.d.ts

@@ -1,6 +1,6 @@
 export declare const NETWORKS: readonly ["mainnet", "testnet"];
 export type Network = (typeof NETWORKS)[number];
-export declare const NETWORK_ENV_VAR = "NMTS_NETWORK";
+export { NETWORK_ENV_VAR } from "./env-vars.ts";
 /**
  * Decide the network for this run.
  *

package/dist/network.js

@@ -9,10 +9,14 @@
 // ⛔ SO THE RULE HERE IS: the live server implies mainnet, and ANY other server must say which
 //    network it is. There is no fallback. A tool that has to guess where somebody's files are
 //    should stop instead.
+import { NETWORK_ENV_VAR } from "./env-vars.js";
 import { NmtsError } from "./errors.js";
+import { host } from "./host.js";
 import { DEFAULT_SERVER } from "./server.js";
 export const NETWORKS = ["mainnet", "testnet"];
-export const NETWORK_ENV_VAR = "NMTS_NETWORK";
+// Re-exported: the name itself lives in a module with no imports, because `nmts --help`
+// prints it (`env-vars.ts`).
+export { NETWORK_ENV_VAR } from "./env-vars.js";
 function isNetwork(value) {
     return NETWORKS.includes(value);
 }
@@ -23,7 +27,7 @@ function isNetwork(value) {
  * make: the live server is mainnet. Anything else and it refuses.
  */
 export function resolveNetwork(server, explicit) {
-    const stated = explicit ?? process.env[NETWORK_ENV_VAR];
+    const stated = explicit ?? host().env(NETWORK_ENV_VAR);
     if (stated !== undefined && stated.length > 0) {
         if (!isNetwork(stated)) {
             throw new NmtsError(`Not a network: ${stated}`, {