@ariestools/cli 0.1.12 → 0.1.13

package/README.md

@@ -469,7 +469,7 @@ aries datalake audit purge    # Delete rotated audit files older than --max-age-
 |---|---|---|
 | `-f, --follow` | `false` | Stream new rows as they arrive (tails the most recent file) |
 | `-n, --lines <n>` | `50` | Tail this many rows (0 = start fresh in `--follow` mode) |
-| `-d, --datalake <id>` | | Filter by datalake name or id |
+| `--datalake-subject <subject>` | | Filter by the provider-scoped datalake pseudonym stored in audit rows |
 | `--status <prefix>` | | Status code prefix filter (e.g. `4` matches 4xx) |
 | `--method <verb>` | | HTTP method filter (`GET`, `POST`, …) |
 | `--authenticated <true\|false>` | | Show only authenticated or only anonymous requests |
@@ -496,8 +496,10 @@ aries datalake dev reset     # Stop the dev server and wipe all local state
 #### `aries datalake dev up`
 | Option | Default | Description |
 |---|---|---|
-| `--control-port <n>` | `8787` | Control-plane port |
-| `--plane-port <n>` | `8788` | Data-plane port |
+| `--control-port <n>` | free loopback port | Control-plane port |
+| `--plane-port <n>` | free loopback port | Data-plane port |
+| `--control-audience <aud>` | `aries-datalake-control` | Exact JWT audience accepted by the control plane |
+| `--cors-origin <origin>` | disabled | Exact browser origin to allow; repeat for multiple origins |
 | `--timeout <s>` | `10` | Seconds to wait for health |
 | `--persist` | `false` | Persist store state to disk so it survives restarts |
 | `--audit` | `false` | Write a JSONL audit log of every data-plane request |
@@ -846,7 +848,7 @@ Produces a BoundWitness.
 
 A wallet account can mint a JWT-shaped, time-bounded permission token that a site verifies locally, without running its own login flow. Think of it as reverse OAuth: the holder signs an attestation declaring an audience (the domain they intend to use the token at) and an expiration; the site checks the signature and claims and grants the session.
 
-The token is the standard `header.payload.signature` JWT format, base64url-encoded. The signing input is `keccak256(utf8("${headerB64}.${payloadB64}"))` and the alg is `ES256K` (secp256k1 ECDSA). The header carries both `kid` (signer address) and `pub` (full public key) so verification is self-contained — no out-of-band pubkey lookup is needed.
+The token is the standard `header.payload.signature` JWT format, base64url-encoded. The signing input is `SHA-256(utf8("${headerB64}.${payloadB64}"))` and the alg is `ES256K` (secp256k1 ECDSA). The header carries both `kid` (signer address) and `pub` (full public key) so verification is self-contained — no out-of-band pubkey lookup is needed.
 
 **Header** fields: `alg` (`ES256K`), `typ` (`JWT`), `kid` (40-char lowercase hex address), `pub` (hex public key bytes).