@needmoretruth/nmts-cli 0.35.0 → 0.36.2

package/dist/commands/wallet-storage-ops.js

@@ -23,6 +23,7 @@ import { explorerTxUrl } from "../shared/lib/wallet/activity.js";
 import { isValidSuiAddress } from "../shared/lib/wallet/send-rules.js";
 import { storageOpsReads } from "../storage-control-chain.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 import { recordWalletSpend, requireWalletGrant } from "../wallet-grant.js";
 import { formatBytes } from "./wallet-storage.js";
 const FUSE_WHY = {
@@ -34,7 +35,10 @@ const FUSE_WHY = {
 export async function walletStorageOps(op, rest, options = {}) {
     const say = options.write ?? ((line) => process.stdout.write(`${line}\n`));
     const resolved = await requireAccountCode();
-    const address = await walletAddress(resolved.code);
+    // ⛔ WHICH WALLET, FIRST — the resources are read from this address, the review names it, and the
+    //    same wallet signs; a resource is reshaped by the wallet that holds it and by no other.
+    const wallet = await payingWalletIndex(options);
+    const address = await walletAddress(resolved.code, wallet);
     const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
     const server = resolveServer(options.server ?? stored?.server);
     const network = resolveNetwork(server, options.network ?? stored?.network);
@@ -76,6 +80,7 @@ export async function walletStorageOps(op, rest, options = {}) {
     // ④ The review.
     if (!options.json) {
         say(`Would ${lines.what}`);
+        say(`  from  ${address} (wallet ${wallet})`);
         for (const l of lines.detail)
             say(`  ${l}`);
         say(feeMist === null
@@ -106,7 +111,7 @@ export async function walletStorageOps(op, rest, options = {}) {
     const spend = { walFrost: 0n, suiMist: feeMist ?? 0n };
     requireWalletGrant(action, spend, new Date(options.now ?? Date.now()));
     const sign = options.signStorage ?? (await import("../wallet-sign.js")).signStorageOp;
-    const digest = await sign({ network, code: resolved.code, shape, walrusPackageId });
+    const digest = await sign({ network, code: resolved.code, wallet, shape, walrusPackageId });
     recordWalletSpend(spend);
     if (options.json) {
         say(JSON.stringify({ ...facts, signed: true, digest, explorerUrl: explorerTxUrl(digest, network) }));

package/dist/commands/wallet-swap.d.ts

@@ -22,8 +22,11 @@ export interface WalletSwapOptions {
     slippageBps?: string | undefined;
     /** `--accept-extremes`: go on past the extremes gate. A person's act — refused outside mode off. */
     acceptExtremes?: boolean;
+    /** `--wallet N`: which wallet swaps, this run only. Absent = the account's own number. */
+    wallet?: string | undefined;
     now?: number;
     /** ⚠ SEAMS, NOT OPTIONS — no flag reaches them. */
+    readActiveWallet?: () => Promise<number>;
     readChain?: (network: Network) => SwapReads | Promise<SwapReads>;
     readPrices?: (server: string) => Promise<MarketPrices | null>;
     sign?: SignSwap;

package/dist/commands/wallet-swap.js

@@ -25,6 +25,7 @@ import { explorerTxUrl } from "../shared/lib/wallet/activity.js";
 import { clampGasBudgetMist, parseTokenAmountToBaseUnits, SUI_GAS_RESERVE_MIST } from "../shared/lib/wallet/send-rules.js";
 import { clampSlippageBps, impliedRate, marketRate, maxSwappableSuiMist, minOutFromQuote, priceDeviationBps, SLIPPAGE_BPS_DEFAULT, SLIPPAGE_BPS_MAX, SLIPPAGE_BPS_MIN, swapExtremes, } from "../shared/lib/wallet/swap-rules.js";
 import { coinAmount, walletAddress } from "../wallet.js";
+import { payingWalletIndex } from "../wallet-pay-index.js";
 import { recordWalletSpend, requireWalletGrant } from "../wallet-grant.js";
 import { railsFor } from "../wallet-swap-chain.js";
 const EXTREME_WORDS = {
@@ -73,7 +74,10 @@ export async function walletSwap(operands, options = {}) {
         throw new NmtsError("Say how much.", { exitCode: 2, nextStep: `\`${BINARY_NAME} wallet swap ${coinIn} <amount|max>\` — "max" swaps everything that can be swapped.` });
     }
     const resolved = await requireAccountCode();
-    const address = await walletAddress(resolved.code);
+    // ⛔ WHICH WALLET SWAPS, FIRST — the coins that are read, the quote that is priced, the address
+    //    the review names and the key that signs are all this one wallet's.
+    const wallet = await payingWalletIndex(options);
+    const address = await walletAddress(resolved.code, wallet);
     const stored = resolved.source === "file" || resolved.source === "file-locked" ? readCredentialsFile() : null;
     const server = resolveServer(options.server ?? stored?.server);
     const network = resolveNetwork(server, options.network ?? stored?.network);
@@ -211,7 +215,7 @@ export async function walletSwap(operands, options = {}) {
     // ⑥ The review, every time.
     if (!options.json) {
         say(`Swapping ${facts.amountIn} ${coinIn} for ${coinOut} on ${venueName(venue)}`);
-        say(`  from      ${address}`);
+        say(`  from      ${address} (wallet ${wallet})`);
         say(`  Quoted    ${facts.quotedOut} ${coinOut} — the chain's answer just now, not a promise${quote.leftoverInUnits > 0n ? `; ${coinAmount(quote.leftoverInUnits)} ${coinIn} would come back unused` : ""}`);
         if (venue === "exchange")
             say(`  Rate      ${exchange?.rateWal} WAL per ${exchange?.rateSui} SUI, read off the facility; it takes no minimum`);
@@ -244,7 +248,7 @@ export async function walletSwap(operands, options = {}) {
                 nextStep: `Choose again (--slippage-bps 50, a different --fee-cap, the other venue, or later), or — as a person — add --accept-extremes to go on anyway.`,
             });
         }
-        const mode = currentMode();
+        const mode = await currentMode();
         if (mode === "auto-low" || mode === "auto-high") {
             throw new NmtsError("Going past the extremes gate is a person's act.", { exitCode: 5, nextStep: `Nothing was signed. --accept-extremes is refused in mode auto and with --skip-permissions.` });
         }
@@ -273,7 +277,7 @@ export async function walletSwap(operands, options = {}) {
     requireWalletGrant("exchange", spend, new Date(options.now ?? Date.now()));
     // ⑩ The signature.
     const sign = options.sign ?? (await import("../wallet-sign.js")).signSwap;
-    const digest = await sign({ network, code: resolved.code, shape });
+    const digest = await sign({ network, code: resolved.code, wallet, shape });
     recordWalletSpend(spend);
     if (options.json) {
         say(JSON.stringify({ ...facts, signed: true, digest, explorerUrl: explorerTxUrl(digest, network) }));

package/dist/commands/wallet.d.ts

@@ -9,7 +9,7 @@ export interface WalletOptions {
     qr?: boolean;
     /** `wallet address --index N`: which of this key's wallets to print. Absent = the first one. */
     index?: string | undefined;
-    /** `wallet send`/`donate --wallet N`: which wallet pays, this run only (`wallet-pay-index.ts`). */
+    /** `--wallet N` on `send`/`donate`/`swap`/`storage`/`hall`: which wallet, this run only. */
     wallet?: string | undefined;
     /** `wallet send`: the operands after "send", and its flags (`wallet-send.ts`). */
     rest?: readonly string[];

package/dist/crypto.d.ts

@@ -1,4 +1,4 @@
-import { type CryptoGlue } from "./crypto-surface.ts";
+import type { CryptoGlue } from "./crypto-surface.ts";
 export type { CryptoGlue, StreamOpener, StreamSealer } from "./crypto-surface.ts";
 /**
  * The associated-data strings of NCF-3, for the envelopes this tool opens.
@@ -74,8 +74,11 @@ export declare const DERIVED: {
      */
     readonly aiAccountRoot: readonly [256, 288];
 };
-export declare function engineDir(): string;
-/** Load the engine once per process. */
+/**
+ * The engine, loaded once by whichever host this program registered.
+ *
+ * Every derivation in the package goes through this one call, so a program that has not registered
+ * a host is told so here rather than somewhere deeper, where the message would be about a missing
+ * function instead of a missing entry point.
+ */
 export declare function loadCrypto(): Promise<CryptoGlue>;
-/** For tests that need a fresh load. */
-export declare function forgetCrypto(): void;

package/dist/crypto.js

@@ -1,4 +1,4 @@
-// Loading the real NMTS crypto engine in Node.
+// The frozen tables of NCF-3, and the one door to the engine that reads them.
 //
 // ⛔ NOTHING IS RE-IMPLEMENTED HERE. The bytes that derive an account's keys are the same
 //    WebAssembly the browser runs, built from the same Rust crate. Two harnesses in this repo
@@ -7,24 +7,12 @@
 //    be a second implementation that can drift from the first, silently and in the direction that
 //    loses files.
 //
-// ⛔ NO TYPE ASSERTION. A dynamically imported module is `unknown` and staying honest about that
-//    matters here more than anywhere: if a rebuild renamed an export, an `as` would turn that into
-//    "undefined is not a function" deep inside a derivation. The guard below checks each function
-//    exists before anything is derived, so a missing export is named at load time.
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { readFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { NmtsError } from "./errors.js";
-import { isCryptoGlue, missingExports } from "./crypto-surface.js";
+// ⛔ WHERE THE ENGINE COMES FROM IS THE HOST'S BUSINESS, not this file's. Node finds it on disk
+//    and a browser fetches it, and both answers land in `host().engine` — so the tables below, and
+//    every module that derives anything from them, are the same code in both. The shape check
+//    stays on the host's side of the door for the same reason: `crypto-surface.ts` is one gate
+//    that both loads pass, rather than two guards that can come to disagree.
+import { host } from "./host.js";
 /**
  * The associated-data strings of NCF-3, for the envelopes this tool opens.
  *
@@ -104,47 +92,13 @@ export const DERIVED = {
      */
     aiAccountRoot: [256, 288],
 };
-export function engineDir() {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const candidates = [
-        join(here, "..", "vendor", "nmts-crypto"),
-        join(here, "..", "..", "vendor", "nmts-crypto"),
-        join(here, "..", "..", "web", "vendor", "nmts-crypto"),
-    ];
-    for (const dir of candidates) {
-        if (existsSync(join(dir, "nmts_crypto_wasm_bg.wasm")))
-            return dir;
-    }
-    throw new NmtsError("The NMTS crypto engine is missing from this installation.", {
-        exitCode: 1,
-        nextStep: "Reinstall the package. Nothing can be encrypted or decrypted without it.",
-    });
-}
-let cached = null;
-/** Load the engine once per process. */
+/**
+ * The engine, loaded once by whichever host this program registered.
+ *
+ * Every derivation in the package goes through this one call, so a program that has not registered
+ * a host is told so here rather than somewhere deeper, where the message would be about a missing
+ * function instead of a missing entry point.
+ */
 export async function loadCrypto() {
-    if (cached !== null)
-        return cached;
-    const dir = engineDir();
-    const module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(dir, "nmts_crypto_wasm.js")).href));
-    if (typeof module !== "object" || module === null || !("default" in module)) {
-        throw new NmtsError("The NMTS crypto engine did not load (no initialiser).", { exitCode: 1 });
-    }
-    const init = Reflect.get(module, "default");
-    if (typeof init !== "function") {
-        throw new NmtsError("The NMTS crypto engine did not load (initialiser is not callable).", {
-            exitCode: 1,
-        });
-    }
-    await init({ module_or_path: await readFile(join(dir, "nmts_crypto_wasm_bg.wasm")) });
-    if (!isCryptoGlue(module)) {
-        const missing = missingExports(module);
-        throw new NmtsError(`The NMTS crypto engine is missing: ${missing.join(", ")}. This build does not match this tool.`, { exitCode: 1, nextStep: "Reinstall the package." });
-    }
-    cached = module;
-    return module;
-}
-/** For tests that need a fresh load. */
-export function forgetCrypto() {
-    cached = null;
+    return host().engine.load();
 }

package/dist/download-sink-node.d.ts

@@ -0,0 +1,49 @@
+import type { PlaintextSink } from "./download-sink.ts";
+import { type ByteDestination } from "./stdout.ts";
+/**
+ * Write to a file, through a temporary name beside it, renamed into place only when the whole
+ * file has been proved.
+ *
+ * ⛔ THE TEMPORARY FILE IS IN THE SAME DIRECTORY AS THE DESTINATION, not in a system temporary
+ *    directory, and that is the whole mechanism: `rename` is atomic only within one filesystem,
+ *    and only an atomic rename guarantees that a reader either sees nothing under the real name or
+ *    sees the finished file. A temporary directory can be — and on the machines this runs on
+ *    usually is — a different filesystem, where the same call becomes copy-then-delete and a
+ *    reader can catch the copy half done.
+ *
+ * ⛔ IT IS CREATED 0600 AND THE RENAME KEEPS THAT. The file is somebody's plaintext; it must not
+ *    be readable by other accounts on the machine for the seconds it takes to download, any more
+ *    than it may be afterwards.
+ */
+export declare function fileSink(destination: string, options: {
+    force: boolean;
+}): PlaintextSink;
+/**
+ * How much plaintext `--out -` will hold before it hands anything over. One part's worth.
+ *
+ * ⛔ NOT AN ARBITRARY NUMBER: it is the upload path's default part size, which is the most memory
+ *    this tool has ever asked for. Keeping the stdout ceiling there means the whole tool's bound
+ *    is one part plus one chunk whichever direction the bytes are going.
+ */
+export declare const STDOUT_HOLD_LIMIT: number;
+/**
+ * Hand the whole file to whatever is reading stdout — after it has been proved, not during.
+ *
+ * ⛔ THERE IS NO RENAME ON A PIPE, so the trick the file path uses is not available: a byte handed
+ *    to a reader cannot be taken back, and a reader that has already consumed half a file cannot
+ *    be told afterwards that the half was wrong. An exit code does not fix that — `nmts get x
+ *    --out - > y` leaves the truncated bytes in `y` whatever the exit code says, and an agent
+ *    reading a pipe usually acts on what it read. So this branch keeps the ORIGINAL guarantee
+ *    rather than the original size: the file is held, checked, and only then handed over, exactly
+ *    as before streaming existed.
+ *
+ * ⛔ WHICH MEANS IT HAS TO REFUSE SOMEWHERE, AND IT REFUSES OUT LOUD AND EARLY. Above the ceiling
+ *    the answer is a refusal naming `--out <name>`, which streams and is checked before the file
+ *    appears — not a silent trade of the guarantee for the size, and not the out-of-memory crash
+ *    that this used to be. `put` already refuses this way rather than discovering a limit halfway.
+ *
+ * ⚠ Every protection this branch already had is still here and still applies to the whole file:
+ *   bytes a terminal would act on are refused (`readableOnATerminal`), a reader that closed the
+ *   pipe first is an ordinary end and not a failure, and any other write failure throws.
+ */
+export declare function stdoutSink(to: ByteDestination, limit?: number): PlaintextSink;

package/dist/download-sink-node.js

@@ -0,0 +1,204 @@
+// The two places this tool can put a downloaded file: a real file, and its own stdout.
+//
+// ⛔ THE SHAPE IS `download-sink.ts`'S AND THE PROMISE IS KEPT HERE. A sink is the thing that
+//    decides what "delivered" means, and these two decide it with a rename and with a hold — both
+//    of which need Node. A browser's sink is the caller's, written against the same interface.
+import { randomBytes } from "node:crypto";
+import { createWriteStream, existsSync } from "node:fs";
+import { rename, rm } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { NmtsError } from "./errors.js";
+import { handOver } from "./stdout.js";
+/** The one refusal text for a destination that is already occupied. Shared by every command. */
+function alreadyThere(destination) {
+    return new NmtsError(`${destination} already exists.`, {
+        exitCode: 4,
+        nextStep: "Nothing was written. Pass --out to choose another name, or --force to replace it.",
+    });
+}
+/**
+ * Write to a file, through a temporary name beside it, renamed into place only when the whole
+ * file has been proved.
+ *
+ * ⛔ THE TEMPORARY FILE IS IN THE SAME DIRECTORY AS THE DESTINATION, not in a system temporary
+ *    directory, and that is the whole mechanism: `rename` is atomic only within one filesystem,
+ *    and only an atomic rename guarantees that a reader either sees nothing under the real name or
+ *    sees the finished file. A temporary directory can be — and on the machines this runs on
+ *    usually is — a different filesystem, where the same call becomes copy-then-delete and a
+ *    reader can catch the copy half done.
+ *
+ * ⛔ IT IS CREATED 0600 AND THE RENAME KEEPS THAT. The file is somebody's plaintext; it must not
+ *    be readable by other accounts on the machine for the seconds it takes to download, any more
+ *    than it may be afterwards.
+ */
+export function fileSink(destination, options) {
+    // ⛔ Asked BEFORE the download rather than at the end, which is where the old code found out.
+    //    Fetching a file to discover it had nowhere to go spent somebody's time and the storage
+    //    network's bandwidth for a refusal that was knowable up front.
+    if (!options.force && existsSync(destination))
+        throw alreadyThere(destination);
+    const temporary = join(dirname(destination), `.${basename(destination)}.nmts-${randomBytes(6).toString("hex")}.part`);
+    let stream = null;
+    let failure = null;
+    let renamed = false;
+    // ⚠ Created on the first write rather than up front: a download that fails before it produces a
+    //   byte — a wrong key, a part on a network this build cannot read — then leaves no file at all,
+    //   not even one that appears and disappears.
+    const opened = () => {
+        if (stream !== null)
+            return stream;
+        const fresh = createWriteStream(temporary, { flags: "wx", mode: 0o600 });
+        // ⛔ An 'error' with no listener is thrown out of the event loop and kills the process, which
+        //    would turn "the disk is full" into a crash with no next step. Kept, and reported by the
+        //    next call that can report it.
+        fresh.on("error", (error) => {
+            failure = error;
+        });
+        stream = fresh;
+        return fresh;
+    };
+    const closed = async () => {
+        const open = stream;
+        if (open === null)
+            return;
+        stream = null;
+        // ⚠ Waits for 'close', not 'finish': a stream that failed to open never finishes, and waiting
+        //   for the wrong event there is a hang rather than an error.
+        await new Promise((resolve) => {
+            if (open.closed) {
+                resolve();
+                return;
+            }
+            open.once("close", () => resolve());
+            open.end();
+        });
+    };
+    const abandon = async () => {
+        if (renamed)
+            return;
+        try {
+            await closed();
+        }
+        catch {
+            // Nothing to do about it: the file below is going away either way.
+        }
+        await rm(temporary, { force: true }).catch(() => undefined);
+    };
+    return {
+        // Nothing to refuse: what a disk cannot take, the write itself reports, and the temporary
+        // file means a disk that fills up leaves no file under the name somebody asked for.
+        expect: () => undefined,
+        write: async (bytes) => {
+            const target = opened();
+            await new Promise((resolve, reject) => {
+                const known = failure;
+                if (known !== null) {
+                    reject(known);
+                    return;
+                }
+                target.write(bytes, (error) => {
+                    if (error === undefined || error === null)
+                        resolve();
+                    else
+                        reject(error);
+                });
+            });
+        },
+        commit: async () => {
+            // A file of zero bytes is still a file, so the stream is opened even if nothing was written.
+            opened();
+            await closed();
+            const known = failure;
+            if (known !== null) {
+                await abandon();
+                throw new NmtsError(`${destination} could not be written: ${known.message}`, {
+                    exitCode: 1,
+                    nextStep: "Nothing was left under that name. The download itself was fine — this is the disk.",
+                });
+            }
+            // ⛔ Asked a second time, as late as possible. The first check was before the download; a
+            //    file that appeared in the meantime is somebody else's, and rename would silently
+            //    replace it. The window is now the width of one system call rather than a download.
+            if (!options.force && existsSync(destination)) {
+                await abandon();
+                throw alreadyThere(destination);
+            }
+            await rename(temporary, destination);
+            renamed = true;
+            return true;
+        },
+        abandon,
+    };
+}
+/**
+ * How much plaintext `--out -` will hold before it hands anything over. One part's worth.
+ *
+ * ⛔ NOT AN ARBITRARY NUMBER: it is the upload path's default part size, which is the most memory
+ *    this tool has ever asked for. Keeping the stdout ceiling there means the whole tool's bound
+ *    is one part plus one chunk whichever direction the bytes are going.
+ */
+export const STDOUT_HOLD_LIMIT = 64 * 2 ** 20;
+/**
+ * Hand the whole file to whatever is reading stdout — after it has been proved, not during.
+ *
+ * ⛔ THERE IS NO RENAME ON A PIPE, so the trick the file path uses is not available: a byte handed
+ *    to a reader cannot be taken back, and a reader that has already consumed half a file cannot
+ *    be told afterwards that the half was wrong. An exit code does not fix that — `nmts get x
+ *    --out - > y` leaves the truncated bytes in `y` whatever the exit code says, and an agent
+ *    reading a pipe usually acts on what it read. So this branch keeps the ORIGINAL guarantee
+ *    rather than the original size: the file is held, checked, and only then handed over, exactly
+ *    as before streaming existed.
+ *
+ * ⛔ WHICH MEANS IT HAS TO REFUSE SOMEWHERE, AND IT REFUSES OUT LOUD AND EARLY. Above the ceiling
+ *    the answer is a refusal naming `--out <name>`, which streams and is checked before the file
+ *    appears — not a silent trade of the guarantee for the size, and not the out-of-memory crash
+ *    that this used to be. `put` already refuses this way rather than discovering a limit halfway.
+ *
+ * ⚠ Every protection this branch already had is still here and still applies to the whole file:
+ *   bytes a terminal would act on are refused (`readableOnATerminal`), a reader that closed the
+ *   pipe first is an ordinary end and not a failure, and any other write failure throws.
+ */
+export function stdoutSink(to, limit = STDOUT_HOLD_LIMIT) {
+    const held = [];
+    let total = 0;
+    const tooLarge = (size) => new NmtsError(`This file is ${size} bytes, and \`--out -\` hands over at most ${limit}.`, {
+        exitCode: 4,
+        nextStep: "Nothing was written and nothing was sent. A pipe cannot be taken back, so this mode " +
+            "proves the whole file before it sends a byte, which means holding it. Use `--out <name>` " +
+            "— that writes any size, and the file only appears under that name once it has been checked.",
+    });
+    const forget = () => {
+        for (const run of held)
+            run.fill(0);
+        held.length = 0;
+    };
+    return {
+        expect: (size) => {
+            if (size > limit)
+                throw tooLarge(size);
+        },
+        write: async (bytes) => {
+            // ⚠ Copied, because the caller zeroes what it handed over as soon as this resolves.
+            total += bytes.length;
+            if (total > limit) {
+                forget();
+                throw tooLarge(total);
+            }
+            held.push(new Uint8Array(bytes));
+        },
+        commit: async () => {
+            const whole = new Uint8Array(total);
+            let at = 0;
+            for (const run of held) {
+                whole.set(run, at);
+                at += run.length;
+            }
+            forget();
+            // ⚠ NOT zeroed afterwards, deliberately: `ByteDestination` promises only that the bytes have
+            //   been handed over, and a destination is entitled to keep the array it was given — the
+            //   tests use one that does. Wiping it here would hand a reader a buffer of zeroes.
+            return await handOver(whole, to);
+        },
+        abandon: async () => forget(),
+    };
+}

package/dist/download-sink.d.ts

@@ -1,4 +1,3 @@
-import { type ByteDestination } from "./stdout.ts";
 /**
  * Somewhere a file's plaintext is delivered in order, and made visible only once.
  *
@@ -27,50 +26,3 @@ export interface PlaintextSink {
     /** Something did not check out: leave nothing behind. Never throws. */
     abandon(): Promise<void>;
 }
-/**
- * Write to a file, through a temporary name beside it, renamed into place only when the whole
- * file has been proved.
- *
- * ⛔ THE TEMPORARY FILE IS IN THE SAME DIRECTORY AS THE DESTINATION, not in a system temporary
- *    directory, and that is the whole mechanism: `rename` is atomic only within one filesystem,
- *    and only an atomic rename guarantees that a reader either sees nothing under the real name or
- *    sees the finished file. A temporary directory can be — and on the machines this runs on
- *    usually is — a different filesystem, where the same call becomes copy-then-delete and a
- *    reader can catch the copy half done.
- *
- * ⛔ IT IS CREATED 0600 AND THE RENAME KEEPS THAT. The file is somebody's plaintext; it must not
- *    be readable by other accounts on the machine for the seconds it takes to download, any more
- *    than it may be afterwards.
- */
-export declare function fileSink(destination: string, options: {
-    force: boolean;
-}): PlaintextSink;
-/**
- * How much plaintext `--out -` will hold before it hands anything over. One part's worth.
- *
- * ⛔ NOT AN ARBITRARY NUMBER: it is the upload path's default part size, which is the most memory
- *    this tool has ever asked for. Keeping the stdout ceiling there means the whole tool's bound
- *    is one part plus one chunk whichever direction the bytes are going.
- */
-export declare const STDOUT_HOLD_LIMIT: number;
-/**
- * Hand the whole file to whatever is reading stdout — after it has been proved, not during.
- *
- * ⛔ THERE IS NO RENAME ON A PIPE, so the trick the file path uses is not available: a byte handed
- *    to a reader cannot be taken back, and a reader that has already consumed half a file cannot
- *    be told afterwards that the half was wrong. An exit code does not fix that — `nmts get x
- *    --out - > y` leaves the truncated bytes in `y` whatever the exit code says, and an agent
- *    reading a pipe usually acts on what it read. So this branch keeps the ORIGINAL guarantee
- *    rather than the original size: the file is held, checked, and only then handed over, exactly
- *    as before streaming existed.
- *
- * ⛔ WHICH MEANS IT HAS TO REFUSE SOMEWHERE, AND IT REFUSES OUT LOUD AND EARLY. Above the ceiling
- *    the answer is a refusal naming `--out <name>`, which streams and is checked before the file
- *    appears — not a silent trade of the guarantee for the size, and not the out-of-memory crash
- *    that this used to be. `put` already refuses this way rather than discovering a limit halfway.
- *
- * ⚠ Every protection this branch already had is still here and still applies to the whole file:
- *   bytes a terminal would act on are refused (`readableOnATerminal`), a reader that closed the
- *   pipe first is an ordinary end and not a failure, and any other write failure throws.
- */
-export declare function stdoutSink(to: ByteDestination, limit?: number): PlaintextSink;