@needmoretruth/nmts-cli 0.35.0 → 0.36.2

package/dist/collision.js

@@ -23,12 +23,13 @@
 // ⚠ WHAT THIS CANNOT DO is tell an agent from a person. Nothing on a command line can. What it can
 //   do is make the destructive answer require a setting that was turned on deliberately, and say
 //   which setting decided.
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
-import { join } from "node:path";
 import { currentMode } from "./autonomy.js";
+import { fromUtf8, utf8 } from "./bytes.js";
 import { NmtsError } from "./errors.js";
+import { host } from "./host.js";
 import { BINARY_NAME } from "./product.js";
-import { configDir, modesAreEnforced } from "./credentials.js";
+/** The one key this answer lives under. On this machine that is `collision.json`. */
+const KEY = "collision";
 export const COLLISION_CHOICES = ["rename", "overwrite"];
 /** What each choice does, in the words the tool prints. One line each. */
 export const COLLISION_MEANS = {
@@ -53,9 +54,6 @@ export function parseAsked(typed) {
 }
 /** What is written down when nobody has chosen. */
 export const DEFAULT_COLLISION = "rename";
-function path() {
-    return join(configDir(), "collision.json");
-}
 function isChoice(value) {
     return typeof value === "string" && COLLISION_CHOICES.includes(value);
 }
@@ -65,9 +63,12 @@ function isChoice(value) {
  * ⛔ Unreadable counts as `rename`, for the same reason autonomy unreadable counts as off: the
  *    fail-safe direction for "I do not know" is the one that destroys nothing.
  */
-export function currentChoice() {
+export async function currentChoice() {
     try {
-        const parsed = JSON.parse(readFileSync(path(), "utf8"));
+        const held = await host().state.read(KEY);
+        if (held === undefined)
+            return DEFAULT_COLLISION;
+        const parsed = JSON.parse(fromUtf8(held));
         if (typeof parsed !== "object" || parsed === null)
             return DEFAULT_COLLISION;
         const choice = Reflect.get(parsed, "onCollision");
@@ -78,21 +79,17 @@ export function currentChoice() {
     }
 }
 /** Has anybody answered on this machine? Used to know whether setup still has to ask. */
-export function hasChosen() {
-    return existsSync(path());
+export async function hasChosen() {
+    return (await host().state.read(KEY)) !== undefined;
 }
 /** Write the choice down, with the date and the version that asked. */
-export function setChoice(choice, version, now) {
-    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+export async function setChoice(choice, version, now) {
     const body = { onCollision: choice, setAt: now.toISOString(), byVersion: version };
-    writeFileSync(path(), `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
-    if (modesAreEnforced())
-        chmodSync(path(), 0o600);
+    await host().state.write(KEY, utf8(`${JSON.stringify(body, null, 2)}\n`));
 }
 /** Forget the answer, so setup asks again. */
-export function forgetChoice() {
-    if (existsSync(path()))
-        rmSync(path(), { force: true });
+export async function forgetChoice() {
+    await host().state.remove(KEY);
 }
 /**
  * What to do with this collision, and what settled it.
@@ -108,14 +105,14 @@ export function forgetChoice() {
  * ⛔ THE OVERRIDE IS ONE-WAY. A mode can let `overwrite` through; nothing here turns a `rename`
  *    into an `overwrite`.
  */
-export function decide(
+export async function decide(
 /** What this run asked for, if anything. `undefined` means "use what this machine is set to". */
-askedFor, setting = currentChoice(), mode = currentMode()) {
+askedFor, setting, mode) {
     if (askedFor === undefined)
-        return { choice: setting, by: "setting" };
+        return { choice: setting ?? (await currentChoice()), by: "setting" };
     if (askedFor === "rename")
         return { choice: "rename", by: "asked-for" };
-    if (mode === "default")
+    if ((mode ?? (await currentMode())) === "default")
         return { choice: "rename", by: "agent-refused" };
     return { choice: "overwrite", by: "asked-for" };
 }

package/dist/commands/delete-account.js

@@ -30,7 +30,7 @@ export async function deleteAccount(options = {}) {
     // The tier gate has already refused the auto modes and, under skip-permissions, taken a
     // --reason and the --yes. ⛔ THE SENTENCE IS STILL TYPED IN EVERY OTHER MODE: `--yes` alone does
     //    not stand for it — only the mode that turned every question off does.
-    const typedFor = options.yes === true && currentMode() === "skip-permissions";
+    const typedFor = options.yes === true && (await currentMode()) === "skip-permissions";
     const ask = options.readLine ?? promptLine;
     if (!typedFor && options.readLine === undefined && !stdinIsATerminal()) {
         throw new NmtsError("There is no terminal to type into (stdin is not a TTY).", {

package/dist/commands/erase.js

@@ -39,7 +39,7 @@ export async function erase(paths, options = {}) {
             nextStep: `\`${BINARY_NAME} ls --all\` prints the paths as this expects them.`,
         });
     }
-    const typedFor = options.yes === true && currentMode() === "skip-permissions";
+    const typedFor = options.yes === true && (await currentMode()) === "skip-permissions";
     const ask = options.readLine ?? promptLine;
     if (!typedFor && options.readLine === undefined && !stdinIsATerminal()) {
         throw new NmtsError("There is no terminal to type into (stdin is not a TTY).", {

package/dist/commands/get.js

@@ -28,7 +28,7 @@
 import { basename, resolve } from "node:path";
 import { CODE_ENV_VAR } from "../credentials.js";
 import { fetchFile } from "../download.js";
-import { fileSink, stdoutSink } from "../download-sink.js";
+import { fileSink, stdoutSink } from "../download-sink-node.js";
 import { buildIndex, entryAt, fullPathOf, KIND_FILE, normalisePath } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
 import { readFileList } from "../manifest.js";

package/dist/commands/listfile.js

@@ -35,7 +35,7 @@ export async function listfile(options = {}) {
     const emit = options.writeDocument ?? ((text) => process.stdout.write(text));
     const resolved = await requireAccountCode();
     const identity = await identityOf(resolved.code);
-    const kept = readKeptList(identity.accountId);
+    const kept = await readKeptList(identity.accountId);
     if (kept === null) {
         throw new NmtsError(`This machine has no copy of this account's file list.`, {
             exitCode: 4,

package/dist/commands/mcp.js

@@ -171,6 +171,10 @@ export async function mcp(options = {}) {
     //    reading stdout must see nothing but protocol.
     note(`${PRODUCT_NAME} · ${identity.accountId} · ${network} · files land in ${outDir}`);
     note(`Tools: ${tools.map((t) => t.name).join(" · ")}`);
+    // ⚠ READ ONCE, BEFORE THE SERVER STARTS. The line below is written from a callback the
+    //   protocol drives, and a callback that had to await would report the setting after the
+    //   sentence it belongs to.
+    const announcedMode = await currentMode();
     await serve({
         input: options.input ?? process.stdin,
         output: options.output ?? ((line) => process.stdout.write(`${line}\n`)),
@@ -193,7 +197,7 @@ export async function mcp(options = {}) {
             // ⚠ A MODE THAT IS ON DECIDES THIS, so it is read here rather than assumed. Saying "every
             //   share will ask you" to somebody who turned a mode on would be telling them the opposite
             //   of what their own setting does.
-            if (currentMode() !== "default")
+            if (announcedMode !== "default")
                 return;
             note(built === null
                 ? "This client cannot show you a question, so sharing is refused here. Share from a terminal."

package/dist/commands/mode.js

@@ -22,9 +22,9 @@ export async function mode(wanted, target, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const now = options.now ?? (() => new Date());
     if (wanted === undefined || wanted === "") {
-        const at = currentMode();
+        const at = await currentMode();
         if (options.json === true) {
-            say(JSON.stringify({ mode: at, setAt: setAt(), means: MODE_MEANS[at] }));
+            say(JSON.stringify({ mode: at, setAt: await setAt(), means: MODE_MEANS[at] }));
             return 0;
         }
         say(`${at} — ${MODE_MEANS[at]}`);

package/dist/commands/on-collision.d.ts

@@ -3,4 +3,4 @@ export interface OnCollisionOptions {
     write?: (line: string) => void;
     now?: () => Date;
 }
-export declare function onCollision(wanted: string | undefined, options?: OnCollisionOptions): number;
+export declare function onCollision(wanted: string | undefined, options?: OnCollisionOptions): Promise<number>;

package/dist/commands/on-collision.js

@@ -14,11 +14,11 @@ import { BINARY_NAME, VERSION } from "../product.js";
 function isChoice(value) {
     return COLLISION_CHOICES.includes(value);
 }
-export function onCollision(wanted, options = {}) {
+export async function onCollision(wanted, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const now = options.now ?? (() => new Date());
     if (wanted === undefined || wanted === "") {
-        const at = currentChoice();
+        const at = await currentChoice();
         if (options.json === true) {
             say(JSON.stringify({ onCollision: at, means: COLLISION_MEANS[at] }));
             return 0;
@@ -39,7 +39,7 @@ export function onCollision(wanted, options = {}) {
             nextStep: `One of: ${COLLISION_CHOICES.join(" · ")}`,
         });
     }
-    setChoice(wanted, VERSION, now());
+    await setChoice(wanted, VERSION, now());
     say(`${wanted} — ${COLLISION_MEANS[wanted]}`);
     return 0;
 }

package/dist/commands/platform.d.ts

@@ -0,0 +1,9 @@
+/** Where the pair goes when `--out` names nowhere. Beside whatever the business is running. */
+export declare const DEFAULT_KEY_FILE = "nmts-business-key.json";
+/** Where a person registers the public half. The one path this command exists to name. */
+export declare const REGISTER_PATH = "Settings \u203A Developer \u203A Platform";
+export interface PlatformOptions {
+    out?: string | undefined;
+    write?: ((line: string) => void) | undefined;
+}
+export declare function platform(sub: string | undefined, options?: PlatformOptions): number;

package/dist/commands/platform.js

@@ -0,0 +1,153 @@
+// `nmts platform` — the two things a business does from a terminal.
+//
+// ⛔ THE KEY PAIR IS MADE HERE AND REGISTERED SOMEWHERE ELSE. Making it needs nothing but a random
+//    source; registering it needs a signed-in person, because attaching a standing credential to
+//    an account is a decision a session alone may not make. So `keygen` does the half a terminal
+//    can do and `register` says, in one sentence, where the other half is.
+//
+// ⛔ THE PRIVATE HALF IS NEVER PRINTED. It goes into a file only its owner can read and nowhere
+//    else — not to stdout, not into a message, not into the run log. What this command puts on the
+//    screen is the PUBLIC half, which is what gets pasted into the browser.
+//
+// ⛔ AND THE FILE IS NEVER REPLACED. `--force` does not open it: the file it would overwrite may
+//    hold the only copy of a key a business is already registered under, and replacing it locks
+//    that business out of its own door with nothing able to bring the key back.
+import { spawnSync } from "node:child_process";
+import { mkdirSync, statSync, writeFileSync } from "node:fs";
+import { userInfo } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import { modesAreEnforced } from "../credentials.js";
+import { NmtsError } from "../errors.js";
+import { generateBusinessKeys } from "../platform-sign.js";
+import { BINARY_NAME, HOME_URL } from "../product.js";
+import { STDOUT_TARGET } from "../stdout.js";
+/** Where the pair goes when `--out` names nowhere. Beside whatever the business is running. */
+export const DEFAULT_KEY_FILE = "nmts-business-key.json";
+/** Where a person registers the public half. The one path this command exists to name. */
+export const REGISTER_PATH = "Settings › Developer › Platform";
+export function platform(sub, options = {}) {
+    const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
+    switch (sub) {
+        case "keygen":
+            return keygen(options.out, say);
+        case "register":
+            return register(say);
+        default:
+            throw new NmtsError(sub === undefined ? "`platform` needs a subcommand." : `Unknown subcommand: ${sub}`, {
+                exitCode: 2,
+                nextStep: `\`${BINARY_NAME} platform keygen\` makes the key pair a business signs with; ` +
+                    `\`${BINARY_NAME} platform register\` says where the public half is registered.`,
+            });
+    }
+}
+/** Make the pair, write it where only its owner can read it, and print the half that is not secret. */
+function keygen(out, say) {
+    const path = targetFor(out);
+    const keys = generateBusinessKeys();
+    writeKeyFile(path, keys);
+    say(`Public key: ${keys.publicKey}`);
+    say(`Written to: ${path}`);
+    if (!modesAreEnforced()) {
+        // ⚠ THIS FILE LANDS WHEREVER THE COMMAND WAS RUN, which may be a shared folder — unlike the
+        //   stored NMTS key, which lives under the user's own profile. So on Windows the mode is not
+        //   merely reported as absent: the file is cut off from the folder's permissions.
+        say(restrictToCurrentUser(path)
+            ? `Inherited permissions were removed; only your Windows account can open this file.`
+            : `Windows applies no POSIX file mode, and restricting the file with icacls failed, so it ` +
+                `inherits its folder's permissions. Move it somewhere only you can read.`);
+    }
+    say(`Register the public key at ${HOME_URL} — ${REGISTER_PATH}. The private half stays in that file.`);
+    return 0;
+}
+/**
+ * Windows only: drop the inherited entries and grant the current account alone.
+ *
+ * ⛔ `icacls`, NOT A HAND-ROLLED ACL. It ships with every supported Windows, and this is the shape
+ *    OpenSSH asks of a private key there. One invocation does both halves, so there is no moment
+ *    with the inheritance gone and nobody granted.
+ * ⚠ A FAILURE IS REPORTED, NOT THROWN: the pair is already written and is the only copy, so the
+ *   command must still print the public half and say plainly what protects the file.
+ */
+function restrictToCurrentUser(path) {
+    try {
+        const name = userInfo().username;
+        const domain = process.env.USERDOMAIN;
+        const account = domain === undefined || domain === "" ? name : `${domain}\\${name}`;
+        const done = spawnSync("icacls", [path, "/inheritance:r", "/grant:r", `${account}:F`], {
+            windowsHide: true,
+            stdio: "ignore",
+        });
+        return done.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Say where registering happens, and stop.
+ *
+ * ⛔ EXIT 2, WHICH IS "THE COMMAND LINE WAS WRONG" AND NOT "IT FAILED". An agent that read this as
+ *    a transient failure would try it again; the code says the request cannot be made this way at
+ *    all, whatever the arguments are.
+ */
+function register(say) {
+    say(`Registering a business needs a signed-in browser session, so this tool cannot do it.`);
+    say(`Open ${HOME_URL} and go to ${REGISTER_PATH}.`);
+    say(`Paste the public key from \`${BINARY_NAME} platform keygen\` there.`);
+    return 2;
+}
+/** Where the file goes, refusing a name that is already taken and refusing stdout outright. */
+function targetFor(out) {
+    const named = out === undefined || out === "" ? DEFAULT_KEY_FILE : out;
+    if (named === STDOUT_TARGET) {
+        throw new NmtsError("The business key pair will not be sent to stdout.", {
+            exitCode: 2,
+            nextStep: "Nothing was made. stdout is what a program reads and a log keeps, and this file holds " +
+                "the private half. Name a file instead.",
+        });
+    }
+    const path = isAbsolute(named) ? named : resolve(process.cwd(), named);
+    let existing = null;
+    try {
+        existing = statSync(path);
+    }
+    catch {
+        // Not there is exactly what this wants.
+    }
+    if (existing !== null) {
+        throw new NmtsError(`${path} is already there.`, {
+            exitCode: 4,
+            nextStep: existing.isDirectory()
+                ? "--out names the FILE the key pair goes into, not a directory."
+                : "Nothing was made. That file is not replaced, whatever --force says: it may hold the " +
+                    "key a business is already registered under. Name one that does not exist.",
+        });
+    }
+    return path;
+}
+/**
+ * Write the pair, readable by nobody else.
+ *
+ * ⚠ `wx` FAILS IF THE NAME APPEARED SINCE THE CHECK ABOVE, which is the point of using it rather
+ *   than trusting that check: between the two, something else may have written there.
+ *
+ * ⚠ ON WINDOWS THE MODE IS IGNORED; `keygen` restricts the file afterwards with `icacls` and says
+ *   which of the two happened.
+ */
+function writeKeyFile(path, keys) {
+    mkdirSync(resolve(path, ".."), { recursive: true, mode: 0o700 });
+    // ⚠ The field names are the ones the library takes, so the parsed file goes straight into a
+    //   client without a program in the middle renaming anything.
+    const text = `${JSON.stringify({ publicKey: keys.publicKey, privateKey: keys.privateKey }, null, 2)}\n`;
+    try {
+        writeFileSync(path, text, { mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        // ⛔ THE CAUSE IS NAMED AND THE KEY IS NOT. The errno line carries the path and never the
+        //    contents, so it is safe to pass on.
+        throw new NmtsError(`The key pair could not be written to ${path}.`, {
+            exitCode: 1,
+            nextStep: `Nothing was made. Cause: ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+}

package/dist/commands/pull.js

@@ -21,7 +21,7 @@
 import { mkdirSync, existsSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fetchFile } from "../download.js";
-import { fileSink } from "../download-sink.js";
+import { fileSink } from "../download-sink-node.js";
 import { buildIndex, entryAt, fullPathOf, isLive, KIND_FILE, KIND_FOLDER, normalisePath, underPrefix, } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
 import { readFileList } from "../manifest.js";

package/dist/commands/push-wallet.js

@@ -8,7 +8,8 @@ import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { loadCrypto } from "../crypto.js";
 import { NmtsError } from "../errors.js";
 import { resolveNetwork } from "../network.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { folderFor } from "./push.js";
 /** The wallet rail, one file at a time, stopping at the first failure as the credit rail does. */
 export async function pushWithWallet(session, options, run) {

package/dist/commands/push.js

@@ -27,9 +27,11 @@ import { depositDefaultOf, depositLines, parseDeposit, refuseDepositWithWallet }
 import { setTrashed } from "../item-trash.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
 import { BINARY_NAME } from "../product.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { openSession } from "../session.js";
-import { fileSource, partKeysOf, uploadFile } from "../upload-file.js";
+import { partKeysOf, uploadFile } from "../upload-file.js";
+import { fileSource } from "../upload-file-node.js";
 import { createUploadApi } from "../upload-api.js";
 import { clearItemRecord, clearReservation } from "../upload-store.js";
 import { CREDIT_BYTES, partSizeFor, planAndPrice, UPLOAD_EPOCHS } from "../upload-price.js";
@@ -242,9 +244,9 @@ async function sendOne(session, crypt, one, ctx) {
             },
         });
         // ⛔ ONLY NOW. Until the entry is in the list the file is paid for and invisible.
-        clearItemRecord(result.fileKey);
+        await clearItemRecord(result.fileKey);
         for (const record of partKeysOf(result.fileKey, result.parts))
-            clearReservation(record);
+            await clearReservation(record);
         // The file this one displaced goes to the server's trash last — see the same note in `put.ts`.
         if (added.replaced)
             await setTrashed(session.server, session.apiKey, added.replaced.id, true);

package/dist/commands/put-wallet.js

@@ -26,10 +26,12 @@ import { activeWalletOf } from "../shared/lib/drive/manifest-settings.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
 import { resolveNetwork } from "../network.js";
 import { BINARY_NAME } from "../product.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { resolveServer } from "../server.js";
-import { fileSource } from "../upload-file.js";
-import { measureLocal, partSizeFor } from "../upload-price.js";
+import { fileSource } from "../upload-file-node.js";
+import { partSizeFor } from "../upload-price.js";
+import { measureLocal } from "../upload-price-node.js";
 import { describeUploadReview } from "../upload-wallet-plan.js";
 import { walletPut } from "../upload-wallet-put.js";
 import { coinAmount } from "../wallet.js";

package/dist/commands/put.js

@@ -19,7 +19,8 @@ import { depositDefaultOf, depositLines, parseDeposit, refuseDepositWithWallet }
 import { DERIVED, loadCrypto } from "../crypto.js";
 import { buildIndex, fullPathOf, isLive, KIND_FOLDER, normalisePath } from "../drive-paths.js";
 import { NmtsError } from "../errors.js";
-import { Progress, silentSink, stderrSink } from "../progress.js";
+import { Progress, silentSink } from "../progress.js";
+import { stderrSink } from "../progress-node.js";
 import { setTrashed } from "../item-trash.js";
 import { addEntry } from "../manifest-write.js";
 import { paddingRuleOf, readFileList } from "../manifest.js";
@@ -28,8 +29,10 @@ import { BINARY_NAME } from "../product.js";
 import { resolveServer } from "../server.js";
 import { clearItemRecord, clearReservation } from "../upload-store.js";
 import { createUploadApi } from "../upload-api.js";
-import { fileSource, partKeysOf, uploadFile } from "../upload-file.js";
-import { CREDIT_BYTES, creditsFor, measureLocal, partSizeFor, planAndPrice, UPLOAD_EPOCHS, } from "../upload-price.js";
+import { partKeysOf, uploadFile } from "../upload-file.js";
+import { fileSource } from "../upload-file-node.js";
+import { CREDIT_BYTES, creditsFor, partSizeFor, planAndPrice, UPLOAD_EPOCHS } from "../upload-price.js";
+import { measureLocal } from "../upload-price-node.js";
 import { createBlobProtocol, readCurrentEpoch } from "../walrus-write.js";
 /** Who pays, and the options that lose their meaning under that answer — the rule is in `put-payer.ts`; this is its one road. */
 import { payerOf, refuseWalletOnlyOptions } from "./put-payer.js";
@@ -260,9 +263,9 @@ export async function put(target, options = {}) {
     // ⛔ ONLY NOW, AND EVERY PART. Until the entry is in the list the file is paid for and invisible,
     //    and the records are the only thing that lets a second run finish the job without spending
     //    again. Clearing the file-level one first would leave a run able to commit a second time.
-    clearItemRecord(result.fileKey);
+    await clearItemRecord(result.fileKey);
     for (const record of partKeysOf(result.fileKey, result.parts))
-        clearReservation(record);
+        await clearReservation(record);
     // ⛔ THE DISPLACED FILE IS TOLD TO THE SERVER ONLY NOW, and only after the new one is in the
     //    list. Until this line the person still had the file they started with.
     // ⚠ A failure here leaves it hidden in this account's trash while the server still counts it as

package/dist/commands/receive.js

@@ -14,7 +14,7 @@ import { resolve } from "node:path";
 import { request } from "../api.js";
 import { loadCrypto } from "../crypto.js";
 import { fetchWithKey } from "../download.js";
-import { fileSink, stdoutSink } from "../download-sink.js";
+import { fileSink, stdoutSink } from "../download-sink-node.js";
 import { NmtsError } from "../errors.js";
 import { destinationFor } from "../safe-path.js";
 import { resolveNetwork } from "../network.js";

package/dist/commands/settings.js

@@ -39,5 +39,5 @@ export async function runSettings(command, args) {
         return await mode(args.operands[0], args.operands[1], { json: args.json });
     }
     const { onCollision } = await import("./on-collision.js");
-    return onCollision(args.operands[0], { json: args.json });
+    return await onCollision(args.operands[0], { json: args.json });
 }

package/dist/commands/share.js

@@ -114,7 +114,7 @@ export async function share(target, typedAddress, options = {}) {
         if (typeof identityB64 !== "string") {
             throw new NmtsError("That public code has never published an identity to share to.", {
                 exitCode: 4,
-                nextStep: "Nothing was shared. The code may be right and simply unused — somebody has to open " +
+                nextStep: "Nothing was shared. The code may be right and unused — somebody has to open " +
                     "their account once before anything can be encrypted to them.",
             });
         }

package/dist/commands/support.js

@@ -57,7 +57,7 @@ async function sendReport(options) {
     const clean = (text) => omitLiterals(redact(text), omit);
     const message = clean(await readMessage(options)).trim();
     requireLength(message, MAX_MESSAGE_CHARS, "message");
-    const attachment = packLog(options.attachLog, clean);
+    const attachment = await packLog(options.attachLog, clean);
     const total = Buffer.byteLength(message, "utf8") + (attachment?.bytes ?? 0);
     // ⛔ THE MACHINE-READABLE PREVIEW IS THE ONLY THING PRINTED ON THAT PATH, and it is printed
     //    INSTEAD of sending rather than before it. Two JSON objects on one stream would let a caller
@@ -169,7 +169,7 @@ function standardInput() {
     });
 }
 /** Read the newest runs and pack them, or `null` when the option was not given. */
-function packLog(asked, clean) {
+async function packLog(asked, clean) {
     if (asked === undefined)
         return null;
     const count = asked === "" ? DEFAULT_ATTACHED_RUNS : Number(asked);
@@ -180,7 +180,7 @@ function packLog(asked, clean) {
     }
     if (count === 0)
         return null;
-    const runs = readRuns(count);
+    const runs = await readRuns(count);
     if (runs.length === 0)
         return null;
     return buildLogAttachment(runs, clean, MAX_ATTACHMENT_BYTES);

package/dist/commands/unlock.js

@@ -67,7 +67,7 @@ export async function unlock(action, target, options = {}) {
     }
     if (action === "unlock") {
         const key = keyOrFail(target);
-        if (options.readLine === undefined && !stdinIsATerminal() && currentMode() !== "skip-permissions") {
+        if (options.readLine === undefined && !stdinIsATerminal() && (await currentMode()) !== "skip-permissions") {
             throw new NmtsError(`A person unlocks, at a terminal — stdin here is not one.`, {
                 exitCode: 5,
                 nextStep: `If you are an agent: do not unlock things. Show the person what \`${BINARY_NAME} unlock\` ` +
@@ -80,7 +80,7 @@ export async function unlock(action, target, options = {}) {
         say(c.what);
         say(`  ${c.risk}`);
         say(`  ${c.limit}`);
-        if (currentMode() !== "skip-permissions") {
+        if ((await currentMode()) !== "skip-permissions") {
             const ask = options.readLine ?? promptLine;
             const answer = (await ask(`Unlock ${key} on this machine? [y/N] `)).trim();
             if (answer !== "y" && answer !== "Y") {

package/dist/commands/wallet-hall.d.ts

@@ -6,7 +6,10 @@ export interface WalletHallOptions {
     /** `--name`: be listed under this. `--remove`: go back to a shortened address. */
     name?: string | undefined;
     remove?: boolean;
-    /** ⚠ A SEAM, NOT AN OPTION — no flag reaches it. It exists so a test never signs for real. */
+    /** `--wallet N`: which wallet signs the name, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
+    /** ⚠ SEAMS, NOT OPTIONS — no flag reaches them. They exist so a test never signs for real. */
+    readActiveWallet?: () => Promise<number>;
     sign?: SignMessage;
 }
 /** One row of the hall, as this tool needs it. Amounts are base units, exactly as they arrived. */

package/dist/commands/wallet-hall.js

@@ -6,9 +6,12 @@
 //    taken off is the NAME, which puts the entry back to a shortened address.
 //
 // ⛔ A NAME IS PUBLISHED, AND THAT IS WHY IT IS SIGNED. The proof that an address is yours is a
-//    signature by that address, so `--name` signs a short message with the wallet this NMTS
-//    key derives (`wallet-sign.ts`) and sends the signature. No session, no API key, no account
-//    id goes with it — the server is told an address, a name and a signature, and nothing else.
+//    signature by that address, so `--name` signs a short message with the wallet this account
+//    pays from (`wallet-pay-index.ts`, `wallet-sign.ts`) and sends the signature. That is the
+//    wallet a gift left from, so it is the address the hall holds an entry for. Reading WHICH
+//    wallet that is opens this account's own file list, so `--name` needs an API key where
+//    reading the hall needs none; what is SENT is unchanged — no session, no API key, no account
+//    id, just an address, a name and a signature.
 //
 // ⛔ THE MESSAGE IS BUILT IN ONE PLACE, `hallMessage` BELOW, because the server rebuilds the same
 //    bytes from the fields it was sent and compares. A space added on either side makes every
@@ -21,6 +24,7 @@ import { isRecord } from "../guards.js";
 import { BINARY_NAME, HOME_URL } from "../product.js";
 import { resolveServer } from "../server.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 /** How many rows a terminal gets. The page at the site carries the rest. */
 const SHOWN = 10;
 /**
@@ -93,7 +97,7 @@ const REFUSALS = {
     signature_invalid: {
         line: "The server did not accept the signature.",
         exitCode: 1,
-        nextStep: `Nothing was published. \`${BINARY_NAME} wallet address\` shows the wallet this run signs as.`,
+        nextStep: `Nothing was published. \`${BINARY_NAME} wallet list\` shows this key's wallets and which one this run signs as.`,
     },
 };
 /** The server the sealed sign-in points at, when there is one this run can read. */
@@ -180,14 +184,17 @@ async function readHall(server) {
 /** `--name` and `--remove`: sign the message, send it, and say what the hall shows now. */
 async function setName(server, say, options) {
     const resolved = await requireAccountCode();
-    // ⛔ The address is derived here rather than taken from a flag: a signature only proves ownership
-    //    of the address it was made by, so the two must come from the same NMTS key.
-    const address = await walletAddress(resolved.code);
+    // ⛔ WHICH WALLET, BEFORE THE ADDRESS — the entry belongs to the wallet the gift came from, which
+    //    is the account's own number, and the address is then derived here rather than taken from a
+    //    flag: a signature only proves ownership of the address it was made by, so the address, the
+    //    message and the key that signs it have to be the same wallet.
+    const wallet = await payingWalletIndex({ ...options, server });
+    const address = await walletAddress(resolved.code, wallet);
     const name = options.remove === true ? null : (options.name ?? null);
     const issuedAt = new Date(Date.now()).toISOString();
     const message = hallMessage(address, name, issuedAt);
     const sign = options.sign ?? (await import("../wallet-sign.js")).signMessage;
-    const signature = await sign({ code: resolved.code, message });
+    const signature = await sign({ code: resolved.code, wallet, message });
     let answer;
     try {
         answer = await request(server, "/v1/gifts/listing", {
@@ -207,6 +214,7 @@ async function setName(server, say, options) {
     }
     const label = isRecord(answer) ? text(answer["label"]) : "";
     say(`Listed as ${label}`);
+    say(`  from  ${address} (wallet ${wallet})`);
     say(``);
     say(`  The hall of fame is at ${HOME_URL}/hall. Run \`${BINARY_NAME} wallet hall --remove\` to go`);
     say(`  back to a shortened address; the gifts themselves stay on the chain either way.`);

package/dist/commands/wallet-storage-ops.d.ts

@@ -13,8 +13,11 @@ export interface StorageOpsOptions {
     size?: string | undefined;
     /** `split --epochs <n>`: how many epochs, from its start, the named resource keeps. */
     epochs?: string | undefined;
+    /** `--wallet N`: whose resources these are, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
     now?: number;
-    /** ⚠ A SEAM, NOT AN OPTION — no flag reaches it. */
+    /** ⚠ SEAMS, NOT OPTIONS — no flag reaches them. */
+    readActiveWallet?: () => Promise<number>;
     storageReads?: (network: Network) => StorageOpsReads;
     /** ⛔ SEPARATE FROM THE READS so a test can prove the review stops before this. */
     signStorage?: SignStorageOp;