@heyanon-arp/cli 0.0.15 → 0.0.16

package/dist/cli.js

@@ -34,10 +34,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 function arpHomeDir() {
   const fromEnv = process.env.HEYARP_HOME;
   if (fromEnv && fromEnv.length > 0) return fromEnv;
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".arp");
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".heyarp");
 }
 function homesRegistryPath() {
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".arp", "homes.json");
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".heyarp", "homes.json");
 }
 var import_node_os, import_node_path;
 var init_paths = __esm({
@@ -354,9 +354,8 @@ var init_api = __esm({
       }
       /**
        * Signed-request authenticated GET /v1/agents/:did. Owner-only on
-       * the server side, but in V1 it returns the same shape as
-       * /did-document — useful as a sanity check that a stored secret
-       * key still verifies.
+       * the server side; it returns the same shape as /did-document —
+       * useful as a sanity check that a stored secret key still verifies.
        */
       async getAgent(did, signer) {
         return this.signedRequest("GET", `/v1/agents/${encodeURIComponent(did)}`, null, signer);
@@ -723,17 +722,17 @@ var import_simple_update_notifier = __toESM(require("simple-update-notifier"));
 // package.json
 var package_default = {
   name: "@heyanon-arp/cli",
-  version: "0.0.15",
+  version: "0.0.16",
   description: "Command-line client for the Agent Relationship Protocol \u2014 register agents, sign envelopes, run escrowed work cycles on Solana.",
   license: "MIT",
   keywords: ["arp", "agent-relationship-protocol", "did", "solana", "escrow", "ed25519", "agents", "a2a", "cli"],
   bin: {
-    heyarp: "./dist/cli.js"
+    heyarp: "./bin/heyarp.cjs"
   },
   publishConfig: {
     access: "public"
   },
-  files: ["dist", "LICENSE", "README.md"],
+  files: ["dist", "bin", "LICENSE", "README.md"],
   engines: {
     node: ">=22"
   },
@@ -1564,7 +1563,7 @@ var import_chalk6 = __toESM(require("chalk"));
 init_api();
 init_config();
 function registerConfigCommand(root) {
-  const config = root.command("config").description("Read/write persistent CLI configuration (~/.arp/config.json)").option("--server <url>", "Override the server URL whose bucket per-server keys (e.g. defaultDid) read/write to");
+  const config = root.command("config").description("Read/write persistent CLI configuration (~/.heyarp/config.json)").option("--server <url>", "Override the server URL whose bucket per-server keys (e.g. defaultDid) read/write to");
   config.command("set <key> <value>").description(`Persist a config value. Global keys: ${GLOBAL_CONFIG_KEYS.join(", ")}. Per-server keys: ${SERVER_CONFIG_KEYS.join(", ")}`).action((key, value) => {
     const opts = config.opts();
     if (isGlobalConfigKey(key)) {
@@ -1686,7 +1685,7 @@ var import_sdk4 = require("@heyanon-arp/sdk");
 var import_chalk7 = __toESM(require("chalk"));
 init_api();
 var UNTIL_PHASES = [
-  "delegation.proposed",
+  "delegation.offered",
   "delegation.accepted",
   "delegation.locked",
   "delegation.disputing",
@@ -1695,7 +1694,6 @@ var UNTIL_PHASES = [
   "work.requested",
   "work.responded",
   "receipt.proposed",
-  "receipt.cosigned",
   "relationship.pending",
   "relationship.active",
   "relationship.paused",
@@ -1931,8 +1929,8 @@ function isPhaseTerminallyUnreachable(phase, s) {
 }
 function untilPhaseMatched(phase, s) {
   switch (phase) {
-    case "delegation.proposed":
-      return s.latestDelegation?.state === "proposed" || s.latestDelegation?.state === "offered";
+    case "delegation.offered":
+      return s.latestDelegation?.state === "offered";
     case "delegation.accepted":
       return s.latestDelegation?.state === "accepted";
     case "delegation.locked":
@@ -1948,9 +1946,7 @@ function untilPhaseMatched(phase, s) {
     case "work.responded":
       return s.latestWorkLog?.state === "responded";
     case "receipt.proposed":
-      return s.latestReceipt?.state === "proposed";
-    case "receipt.cosigned":
-      return s.latestReceipt?.state === "cosigned";
+      return s.latestReceipt != null;
     case "relationship.pending":
       return s.relationshipState === "pending";
     case "relationship.active":
@@ -2013,7 +2009,7 @@ async function composeStatus(api, signerDid, relationshipId, signer) {
   const relationship = relationships.find((r) => r.relationshipId === relationshipId);
   const counterpartyDid = relationship ? relationship.pairDidA === signerDid ? relationship.pairDidB : relationship.pairDidA : inferCounterpartyFromEntities(signerDid, allDelegations);
   const delegations = allDelegations;
-  const latestDelegation = pickLatestLive(delegations, ["proposed", "offered", "accepted", "pending_lock_finalization", "locked"]);
+  const latestDelegation = pickLatestLive(delegations, ["offered", "accepted", "pending_lock_finalization", "locked"]);
   const [workLogs, receipts] = await Promise.all([
     latestDelegation ? fetchAllPages(
       (after) => api.listWorkLogs(relationshipId, signer, { limit: 100, delegationId: latestDelegation.delegationId, ...after ? { after } : {} })
@@ -2170,9 +2166,9 @@ function nextAction(input) {
       complete: false
     };
   }
-  if (latestDelegation.state === "proposed" || latestDelegation.state === "offered") {
+  if (latestDelegation.state === "offered") {
     const iAmOfferer = latestDelegation.offererDid === signerDid;
-    const stateLabel = latestDelegation.state === "proposed" ? "PROPOSED" : `${latestDelegation.state.toUpperCase()} (\u2261 proposed)`;
+    const stateLabel = "OFFERED";
     return {
       hint: iAmOfferer ? `Delegation ${latestDelegation.delegationId} is ${stateLabel} \u2014 counterparty owes \`heyarp delegation accept\` / \`decline\`` : `Delegation ${latestDelegation.delegationId} is ${stateLabel} \u2014 you owe \`heyarp delegation accept\` / \`decline\``,
       owner: iAmOfferer ? "counterparty" : "me",
@@ -2233,24 +2229,21 @@ function nextAction(input) {
       complete: false
     };
   }
-  if (latestReceipt.state === "proposed") {
-    const iAmCaller = latestReceipt.callerDid === signerDid;
-    return {
-      // V2: there is NO cosign — buyer consent is the on-chain
-      // claim_work_payment tx, worker recourse is the
-      // review-window self-claim.
-      hint: iAmCaller ? `Receipt PROPOSED \u2014 you (caller): review the deliverable and approve payment ON-CHAIN with \`heyarp escrow claim ${latestReceipt.delegationId}\` (irreversible release; \`heyarp escrow dispute open ${latestReceipt.delegationId}\` within the review window if the work is unacceptable)` : `Receipt PROPOSED \u2014 counterparty (the buyer) owes the on-chain approval (\`heyarp escrow claim\`); once the review window lapses you may self-claim with \`heyarp escrow claim ${latestReceipt.delegationId}\``,
-      owner: iAmCaller ? "me" : "counterparty",
-      complete: false
-    };
-  }
-  return { hint: "Cycle COMPLETE \u2014 settlement recorded", owner: "none", complete: true };
+  const iAmCaller = latestReceipt.callerDid === signerDid;
+  return {
+    // There is no cosign step — buyer consent is the on-chain
+    // claim_work_payment tx, worker recourse is the
+    // review-window self-claim.
+    hint: iAmCaller ? `Receipt PROPOSED \u2014 you (caller): review the deliverable and approve payment ON-CHAIN with \`heyarp escrow claim ${latestReceipt.delegationId}\` (irreversible release; \`heyarp escrow dispute open ${latestReceipt.delegationId}\` within the review window if the work is unacceptable)` : `Receipt PROPOSED \u2014 counterparty (the buyer) owes the on-chain approval (\`heyarp escrow claim\`); once the review window lapses you may self-claim with \`heyarp escrow claim ${latestReceipt.delegationId}\``,
+    owner: iAmCaller ? "me" : "counterparty",
+    complete: false
+  };
 }
 function formatPhaseSnapshot(s) {
   const parts = [];
   parts.push(`delegation=${s.latestDelegation?.state ?? "\u2205"}`);
   if (s.latestWorkLog) parts.push(`work=${s.latestWorkLog.state}`);
-  if (s.latestReceipt) parts.push(`receipt=${s.latestReceipt.state}`);
+  if (s.latestReceipt) parts.push("receipt=proposed");
   return parts.join(", ");
 }
 function formatStatusReport(s) {
@@ -2280,7 +2273,7 @@ function formatStatusReport(s) {
   lines.push("");
   lines.push(import_chalk7.default.bold("Latest receipt"));
   if (s.latestReceipt) {
-    lines.push(`  state=${stateColor(s.latestReceipt.state)}  verdict=${s.latestReceipt.verdictFinal ?? s.latestReceipt.verdictProposed}`);
+    lines.push(`  ${stateColor("proposed")}  verdict=${s.latestReceipt.verdictProposed}`);
   } else {
     lines.push(import_chalk7.default.dim("  (none)"));
   }
@@ -2294,7 +2287,7 @@ function formatStatusReport(s) {
 }
 function cycleHeadline(s) {
   if (s.cycleComplete) {
-    return `${import_chalk7.default.bold("Cycle:")} ${import_chalk7.default.green.bold("COMPLETE")} ${import_chalk7.default.dim("\u2014 receipt cosigned, payment proven on chain")}`;
+    return `${import_chalk7.default.bold("Cycle:")} ${import_chalk7.default.green.bold("COMPLETE")} ${import_chalk7.default.dim("\u2014 payment proven on chain")}`;
   }
   switch (s.relationshipState) {
     case "not_found":
@@ -2313,7 +2306,7 @@ function cycleHeadline(s) {
   }
 }
 function stateColor(state) {
-  const c = state === "active" || state === "accepted" || state === "locked" || state === "cosigned" || state === "responded" || state === "completed" ? import_chalk7.default.green : state === "pending" || state === "proposed" || state === "requested" || state === "offered" || state === "pending_lock_finalization" ? import_chalk7.default.yellow : state === "closed" || state === "declined" || state === "canceled" || state === "replaced" || state === "not_found" || // Terminal failure states deserve the same red
+  const c = state === "active" || state === "accepted" || state === "locked" || state === "responded" || state === "completed" ? import_chalk7.default.green : state === "pending" || state === "requested" || state === "offered" || state === "pending_lock_finalization" ? import_chalk7.default.yellow : state === "closed" || state === "declined" || state === "canceled" || state === "replaced" || state === "not_found" || // Terminal failure states deserve the same red
   // treatment as declined/canceled so an operator
   // scanning `heyarp status` immediately sees
   // "this is dead, don't follow the hint blindly".
@@ -2639,6 +2632,15 @@ function resolveRpcUrl(opts) {
   if (fromConfig !== void 0 && fromConfig.length > 0) return fromConfig;
   return FALLBACK_RPC_URL;
 }
+function redactRpcUrl(url) {
+  try {
+    const u = new URL(url);
+    const hasSecret = u.pathname !== "" && u.pathname !== "/" || u.search !== "" || u.username !== "" || u.password !== "";
+    return hasSecret ? `${u.protocol}//${u.host}/<redacted>` : url;
+  } catch {
+    return "<redacted>";
+  }
+}
 var FALLBACK_PROGRAM_ID = "7trAdKybX4kMKARia9nrRPj9rBuUjDTxRzExzwFTvvXg";
 async function resolveProgramIdWithSource(api, opts) {
   if (opts.programId !== void 0 && opts.programId !== "") {
@@ -2699,10 +2701,7 @@ function registerDerivePdas(cmd) {
   ).requiredOption("--delegation-id <id>", "Delegation UUID (canonical `del_<uuid>` or bare `<uuid>` \u2014 both accepted)").option("--server <url>", "Override server URL (used only for --program-id auto-discovery)").option(
     "--program-id <pubkey>",
     "Deployed ARP escrow program id. Precedence: --program-id flag > ARP_ESCROW_PROGRAM_ID env > GET /v1/escrow/config (auto-discover). NO hardcoded fallback \u2014 wrong-program PDAs are silently wrong, so resolution failure is a loud error."
-  ).option("--rpc-url <url>", "Accepted for symmetry with `wallet verify-release` but never read \u2014 PDAs are derived locally from `program_id + delegation_id`; no RPC needed.").option(
-    "--recipient-pubkey <base58>",
-    "Accepted for symmetry with `wallet create-lock` but never read \u2014 PDAs depend ONLY on program_id + delegation_id; recipient pubkey has no derivation role."
-  ).option("--condition-hash <hex>", "Accepted for symmetry with `wallet create-lock` but never read \u2014 PDAs depend ONLY on program_id + delegation_id.").option("--amount-lamports <int>", "Accepted for symmetry with `wallet create-lock` but never read \u2014 PDAs depend ONLY on program_id + delegation_id.").option("--expiry-secs <int>", "Accepted for symmetry with `wallet create-lock` but never read \u2014 PDAs depend ONLY on program_id + delegation_id.").option("--json", "Emit JSON instead of human text (jq-pipeable: `.lock_pda`, `.escrow_pda`, `.config_pda`, `.lock_id_hex`).", false).action(async (opts) => {
+  ).option("--json", "Emit JSON instead of human text (jq-pipeable: `.lock_pda`, `.escrow_pda`, `.config_pda`, `.lock_id_hex`).", false).action(async (opts) => {
     try {
       const out = await derivePdasHandler(opts);
       if (opts.json) {
@@ -2738,8 +2737,7 @@ async function derivePdasHandler(opts) {
     lock_id_hex: lockIdHex,
     program_id: programId.toBase58(),
     lock_pda: lockPda.toBase58(),
-    // Single escrow PDA replaces the V1.5 vault + vault_authority
-    // pair in the new contract.
+    // Single escrow PDA at `[b"escrow", lock_id]`.
     escrow_pda: escrowPda.toBase58(),
     config_pda: configPda.toBase58(),
     event_authority_pda: eventAuthorityPda.toBase58()
@@ -2754,14 +2752,14 @@ var TERMINAL_METHOD = {
 };
 function registerVerifyRelease(cmd) {
   cmd.command("verify-release").description(
-    "Post-cycle on-chain assertion. Decodes the Lock account and reports the V2 state verdict: `released: true` IFF the lock is `paid` (the payee was paid via claim_work_payment); exits non-zero otherwise so `set -euo pipefail` scripts catch incomplete cycles. For the full decoded Lock use `heyarp escrow show`."
+    "Post-cycle on-chain assertion. Decodes the Lock account and reports the state verdict: `released: true` IFF the lock is `paid` (the payee was paid via claim_work_payment); exits non-zero otherwise so `set -euo pipefail` scripts catch incomplete cycles. For the full decoded Lock use `heyarp escrow show`."
   ).requiredOption("--delegation-id <id>", "Delegation UUID (canonical `del_<uuid>` or bare `<uuid>` \u2014 both accepted)").option("--server <url>", "Override ARP server URL (used only for --program-id auto-discovery)").option(
     "--rpc-url <url>",
     "Solana RPC URL. STRICT: --rpc-url flag > ARP_ESCROW_RPC_URL env > `heyarp config set rpcUrl` > FAIL \u2014 a wrong-cluster read would silently report lock_never_created."
   ).option(
     "--program-id <pubkey>",
     "Deployed ARP escrow program id. STRICT: flag > ARP_ESCROW_PROGRAM_ID env > GET /v1/escrow/config > FAIL \u2014 a wrong-program read would silently report lock_never_created."
-  ).option("--no-sig-retry", "V1 leftover, tolerated no-op \u2014 V2 locks are never closed, so there is no signature-index race to retry around.").option("--json", "Emit JSON instead of human text. jq-pipeable.", false).action(async (opts) => {
+  ).option("--from-did <did>", "Accepted for scripting symmetry with the signing commands; verify-release reads on-chain state only and needs no signer, so this is ignored.").option("--json", "Emit JSON instead of human text. jq-pipeable.", false).action(async (opts) => {
     try {
       const out = await verifyReleaseHandler(opts);
       if (opts.json) {
@@ -2790,9 +2788,6 @@ function registerVerifyRelease(cmd) {
   });
 }
 async function verifyReleaseHandler(opts) {
-  if (opts.noSigRetry) {
-    process.stderr.write("wallet verify-release: --no-sig-retry is a no-op on V2 (locks are never closed) \u2014 ignoring\n");
-  }
   const normalisedDelegationId = normaliseDelegationId(opts.delegationId);
   const api = new ArpApiClient(opts.server);
   const programId = new import_web32.PublicKey(await resolveProgramIdStrict(api, opts));
@@ -2810,7 +2805,7 @@ async function verifyReleaseHandler(opts) {
       lock_account_exists: false,
       released: false,
       status: "lock_never_created",
-      rpc_url: rpcUrl
+      rpc_url: redactRpcUrl(rpcUrl)
     };
   }
   const lock = fetched.lock;
@@ -2854,14 +2849,11 @@ function renderStatusLine(status) {
 }
 function registerCreateLock(cmd) {
   cmd.command("create-lock").description(
-    "Build + sign a create_lock Solana tx (native SOL or an SPL token); output JSON ready for attachments.escrow_lock. This command does NOT submit the tx to chain \u2014 it only signs the blob locally. M6 lock-at-accept: run this AFTER the worker accepts your offer; the actual on-chain submission happens inside `heyarp delegation fund <delegation-id> --escrow-lock-from-file <path>` (the server's escrow worker picks up the signed blob from the fund envelope's attachments and posts it). Watch for the `lock_id` appearing on-chain only AFTER `delegation fund` runs, not after this command."
+    "Build + sign a create_lock Solana tx (native SOL or an SPL token); output JSON ready for attachments.escrow_lock. This command does NOT submit the tx to chain \u2014 it only signs the blob locally. Run this AFTER the worker accepts your offer; the actual on-chain submission happens inside `heyarp delegation fund <delegation-id> --escrow-lock-from-file <path>` (the server's escrow worker picks up the signed blob from the fund envelope's attachments and posts it). Watch for the `lock_id` appearing on-chain only AFTER `delegation fund` runs, not after this command."
   ).option("--server <url>", "Override server URL for sender-key resolution").option("--from-did <did>", "Sender DID (= payer of the lock). Required when more than one agent on the host.").requiredOption("--delegation-id <id>", "Delegation UUID (drives the lock_id derivation)").requiredOption("--recipient-pubkey <base58>", "Payee Solana pubkey (recipient agent's settlement_pubkey)").option("--amount-lamports <int>", "NATIVE SOL: lock amount in lamports (1 SOL = 1_000_000_000). Required when --mint-pubkey is omitted; not allowed with it.").option("--mint-pubkey <base58>", "SPL token mint to lock. Omit for native SOL. Must be a legacy SPL Token mint (Token-2022 is not supported).").option("--amount-base-units <int>", "SPL: lock amount in the mint's base units (e.g. 1000000 = 1 USDC at 6 decimals). Canonical SPL amount input.").option(
     "--amount <decimal>",
     "SPL: lock amount as a human decimal (e.g. 1.5); converted using the mint's on-chain decimals. Convenience alternative to --amount-base-units."
   ).requiredOption("--condition-hash <hex>", "32-byte hex condition_hash from `heyarp escrow derive-condition-hash` (binds the delegation terms)").option(
-    "--expiry-secs <int>",
-    "DEPRECATED no-op \u2014 V2 derives deadlines from the on-chain Config windows; the flag is tolerated so old scripts keep running and dies with the V2 builder rewrite."
-  ).option(
     "--rpc-url <url>",
     `Solana RPC URL. Default precedence: --rpc-url flag > ARP_ESCROW_RPC_URL env > \`heyarp config set rpcUrl\` > built-in fallback (${FALLBACK_RPC_URL}).`
   ).option(
@@ -3029,9 +3021,6 @@ async function createLockHandler(opts) {
   const normalisedDelegationId = normaliseDelegationId(opts.delegationId);
   const payee = parsePubkey(opts.recipientPubkey, "--recipient-pubkey");
   const conditionHash = parseHex32(opts.conditionHash, "--condition-hash");
-  if (opts.expirySecs !== void 0) {
-    process.stderr.write("wallet create-lock: --expiry-secs is a no-op on V2 (deadlines come from the on-chain Config windows) \u2014 ignoring\n");
-  }
   const api = new ArpApiClient(opts.server);
   const offlineMode = typeof opts.programId === "string" && opts.programId !== "" || typeof process.env.ARP_ESCROW_PROGRAM_ID === "string" && process.env.ARP_ESCROW_PROGRAM_ID !== "";
   const clusterTag = opts.clusterTag !== void 0 ? Number.parseInt(opts.clusterTag, 10) : 0;
@@ -3161,7 +3150,7 @@ var POST_COMMIT_ERROR_CODES = /* @__PURE__ */ new Set([
   // against a PENDING_LOCK delegation consumes sender_sequence
   // even though it rejects.
   "DELEGATION_PENDING_LOCK",
-  // M6 lock-at-accept: the `fund` body handler (`handleFund`) emits
+  // The `fund` body handler (`handleFund`) emits
   // these AFTER the event row is committed (same lifecycle as
   // DELEGATION_INVALID_STATE). `DELEGATION_FUNDER_NOT_OFFERER` (403)
   // when a non-offerer attempts the fund; `DELEGATION_ALREADY_FUNDED`
@@ -3172,7 +3161,7 @@ var POST_COMMIT_ERROR_CODES = /* @__PURE__ */ new Set([
   // `ENV_SEQUENCE_BACKWARDS`.
   "DELEGATION_FUNDER_NOT_OFFERER",
   "DELEGATION_ALREADY_FUNDED",
-  // V1.5 lock-validator mint.owner pre-flight — kept here for
+  // Lock-validator mint.owner pre-flight — kept here for
   // documentation, but the `isPostCommitErrorCode` helper below
   // also matches any `ESC_LOCK_*` prefix. The full lock-validator
   // cross-check set (ID_MISMATCH, CONDITION_HASH_MISMATCH,
@@ -3797,7 +3786,7 @@ async function awaitDelegationLockFinalized(cmdName, api, signer, args) {
       `${cmdName}: delegation ${args.delegationId} disappeared from relationship ${args.relationshipId} during --wait-for-lock pre-flight. Re-check the delegation id with \`heyarp delegations ${args.relationshipId}\`.`
     );
   }
-  if (row.state !== "offered" && row.state !== "proposed") {
+  if (row.state !== "offered") {
     throw new Error(
       `${cmdName}: delegation ${args.delegationId} transitioned to '${row.state}' while waiting for on-chain lock confirmation; cannot ${args.action}. Re-read the delegation timeline with \`heyarp delegations ${args.relationshipId}\` to see the latest state.`
     );
@@ -4041,8 +4030,6 @@ function formatDelegationLine(d, selfDid, opts = {}) {
 }
 function colorState(s) {
   switch (s) {
-    case "proposed":
-      return import_chalk9.default.yellow("proposed");
     // `offered` is the server's actual emitted state immediately
     // after `delegation offer`; `pending_lock_finalization` is the
     // transient state while the relayer submits create_lock. Both
@@ -4056,16 +4043,16 @@ function colorState(s) {
       return import_chalk9.default.yellow("pending_lock");
     case "accepted":
       return import_chalk9.default.green("accepted");
-    // M6 lock-at-accept: the on-chain escrow lock is confirmed.
-    // Distinct branch so a LOCKED row renders without hitting the
-    // defensive fallback (which would otherwise echo the raw state).
+    // The on-chain escrow lock is confirmed. Distinct branch so a
+    // LOCKED row renders without hitting the defensive fallback
+    // (which would otherwise echo the raw state).
     case "locked":
       return import_chalk9.default.green("locked");
     case "declined":
       return import_chalk9.default.red("declined");
     case "canceled":
       return import_chalk9.default.dim("canceled");
-    // Terminal escrow outcomes (V2): completed = payee paid;
+    // Terminal escrow outcomes: completed = payee paid;
     // failed = create_lock never landed; refunded = funds returned
     // to the buyer (work expired / dispute closed);
     // dispute_resolved = operator ruled.
@@ -4503,7 +4490,7 @@ function emit(ctx, action, signature, extra = {}) {
     lock_id: ctx.lock.lockId,
     state_before: ctx.lock.state,
     signature,
-    rpc_url: ctx.rpcUrl,
+    rpc_url: redactRpcUrl(ctx.rpcUrl),
     ...extra
   };
   if (ctx.opts.json) {
@@ -4695,7 +4682,12 @@ async function showHandler(delegationId, opts) {
   const normalised = normaliseDelegationId(delegationId);
   const fetched = await fetchLockAccount(conn, programId, normalised);
   if (!fetched) {
-    jsonOut({ delegation_id: normalised.slice("del_".length), lock_exists: false, lock_pda: deriveLockPda(programId, (0, import_sdk10.deriveLockId)(normalised)).toBase58(), rpc_url: rpcUrl });
+    jsonOut({
+      delegation_id: normalised.slice("del_".length),
+      lock_exists: false,
+      lock_pda: deriveLockPda(programId, (0, import_sdk10.deriveLockId)(normalised)).toBase58(),
+      rpc_url: redactRpcUrl(rpcUrl)
+    });
     return;
   }
   const l = fetched.lock;
@@ -4714,7 +4706,7 @@ async function showHandler(delegationId, opts) {
     fee_bps_at_lock: l.feeBpsAtLock,
     worker_stake_at_lock: l.workerStakeAtLock.toString(),
     operator_dispute_fee_at_lock: l.operatorDisputeFeeAtLock.toString(),
-    rpc_url: rpcUrl
+    rpc_url: redactRpcUrl(rpcUrl)
   });
 }
 function sharedFlags(cmd) {
@@ -4949,7 +4941,7 @@ function registerEventsCommand(root) {
     false
   ).option(
     "--full-ids",
-    "Print eventId, DIDs and serverEventHash in full (no truncation). The eventId column in the default human row is truncated to `evt_<head>...<tail>` \u2014 pass --full-ids to read the full UUID for `heyarp envelope <evt-id>`. NOTE: `serverEventHash` is the hash-chain anchor, NOT the value `receipt propose / cosign` require \u2014 those want `requestHash` / `responseHash`, which are exposed by `heyarp receipts <rel-id> --full-ids`, or auto-derived via `receipt propose --auto-hashes --rel-id --request-id` / `receipt cosign --auto-hashes [--request-id]`.",
+    "Print eventId, DIDs and serverEventHash in full (no truncation). The eventId column in the default human row is truncated to `evt_<head>...<tail>` \u2014 pass --full-ids to read the full UUID for `heyarp envelope <evt-id>`. NOTE: `serverEventHash` is the hash-chain anchor, NOT the value `receipt propose` requires \u2014 that wants `requestHash` / `responseHash`, which are exposed by `heyarp receipts <rel-id> --full-ids`, or auto-derived via `receipt propose --auto-hashes --rel-id --request-id`.",
     false
   ).option(
     "--success-only",
@@ -5001,8 +4993,7 @@ async function runEvents(relationshipId, opts) {
     printVerbose(events, "Full event envelopes:", (ev) => ({
       primary: `#${ev.relationshipEventIndex} ${ev.type ?? "<unknown>"}`,
       // Surface BOTH the full eventId (used by `heyarp envelope
-      // <evt-id>`) and the full serverEventHash (used by
-      // `receipt propose` / `receipt cosign`).
+      // <evt-id>`) and the full serverEventHash.
       secondary: `eventId=${ev.eventId} serverEventHash=${ev.serverEventHash}`
     }));
   }
@@ -5310,7 +5301,7 @@ var GUIDE_SECTIONS = [
     title: "Identity",
     body: [
       "   \u2022 Each agent has a `did:arp:<base58btc>` DID + an Ed25519 identity key.",
-      "   \u2022 Keys live in `~/.arp/agents.json` (or $HEYARP_HOME/agents.json).",
+      "   \u2022 Keys live in `~/.heyarp/agents.json` (or $HEYARP_HOME/agents.json).",
       "   \u2022 State file = identity. If two agents share one home dir, EITHER can sign as",
       "     the other. For multi-agent setups on one host, set HEYARP_HOME per agent:",
       "       HEYARP_HOME=/tmp/agent-alice  heyarp register \u2026",
@@ -5337,8 +5328,8 @@ var GUIDE_SECTIONS = [
       "",
       "   (There is no separate terms-agreement step \u2014 the delegation offer",
       "   carries the agreed terms inline and the condition_hash binds them.",
-      "   M6 lock-at-accept: the escrow lock is funded AFTER acceptance via",
-      "   `delegation fund`, so an un-accepted offer never strands funds.)",
+      "   The escrow lock is funded AFTER acceptance via `delegation fund`,",
+      "   so an un-accepted offer never strands funds.)",
       "   Skipping any stage = the next stage rejects with a state-machine error.",
       "   On-chain claim_work_payment is the closure: the buyer approves, or the",
       "   worker self-claims after the review window expires."
@@ -5350,13 +5341,13 @@ var GUIDE_SECTIONS = [
     overview: true,
     title: "Escrow (how funds actually move)",
     body: [
-      "   M6 lock-at-accept: the buyer funds escrow AFTER the worker accepts.",
+      "   The buyer funds escrow AFTER the worker accepts.",
       "   `delegation offer` carries terms only (no lock). Once the worker",
       "   accepts, `delegation fund` attaches the signed Solana `create_lock`",
       "   tx blob; the worker waits for the lock to confirm (LOCKED) before",
       "   starting work, knowing the cash is locked. An un-accepted offer has",
       "   no lock to strand.",
-      "   Payment consent is ON-CHAIN (V2): the payer sends claim_work_payment to",
+      "   Payment consent is ON-CHAIN: the payer sends claim_work_payment to",
       "   approve, or the payee self-claims after the review window. Exit paths:",
       "     \u2022 cancel_lock         \u2014 buyer cancels while the lock is unaccepted",
       "     \u2022 claim_expired_work  \u2014 buyer reclaims if the work window lapses",
@@ -5557,7 +5548,7 @@ var GUIDE_SECTIONS = [
       "     relationship     : status <rel> --json \u2192 .relationshipState (NOT .state)",
       "     delegation       : status <rel> --json \u2192 .latestDelegation.state",
       "                        (or delegations <rel> --json \u2192 .[].state)",
-      "     receipt          : receipts <rel> --json \u2192 .[].state / .verdictFinal / .receiptEventHash",
+      "     receipt          : receipts <rel> --json \u2192 .[].state / .verdictProposed / .receiptEventHash",
       "     incoming events  : inbox --json \u2192 .[].body.type / .eventId / .serverTimestamp /",
       "                        .senderDid (NOT .signer)",
       "     worker pay key   : did-doc <worker-did> --field settlementPublicKey",
@@ -6067,9 +6058,9 @@ async function runInbox(positionalDid, opts) {
     printVerbose(events, "Full event envelopes:", (ev) => ({
       primary: `#${ev.relationshipEventIndex} ${ev.type ?? "<unknown>"}`,
       // eventId is the cursor used by `--before-event-id`;
-      // serverEventHash is what `receipt propose` / `cosign`
-      // requires. Surface BOTH inline so a copy-paste workflow
-      // doesn't have to dig into the JSON below.
+      // serverEventHash is what `receipt propose` requires.
+      // Surface BOTH inline so a copy-paste workflow doesn't have
+      // to dig into the JSON below.
       secondary: `eventId=${ev.eventId} serverEventHash=${ev.serverEventHash}`
     }));
   }
@@ -6221,7 +6212,7 @@ function writeSecretFile(path, body) {
 }
 function registerKeysCommand(root) {
   const keys = root.command("keys").description("Local key utilities");
-  keys.command("gen").description("Generate a fresh identity + settlement keypair (no save by default)").option("--save", "Reserved for future scratch-key storage; currently a no-op with a notice", false).action((opts) => {
+  keys.command("gen").description("Generate a fresh identity + settlement keypair (no save by default)").action(() => {
     const identity = (0, import_sdk12.generateKeyPair)();
     const settlement = (0, import_sdk12.generateKeyPair)();
     const out = [
@@ -6237,9 +6228,6 @@ function registerKeysCommand(root) {
       `  ${import_chalk17.default.cyan((0, import_sdk12.formatDid)(identity.publicKey))}`
     ];
     console.log(out.join("\n"));
-    if (opts.save) {
-      console.log(import_chalk17.default.yellow("\nNote: --save is not yet implemented. Capture the secret keys above before they scroll off-screen."));
-    }
   });
   keys.command("export <did>").description("Export an agent\u2019s key backup bundle (SECRETS) so you can recover it on another machine with `heyarp recover`. Writes to --out (mode 0600) or stdout.").option("--server <url>", "Override ARP server base URL").option("--out <file>", "Write the bundle to this file (mode 0600) instead of stdout").action((did, opts) => {
     const agent = loadAgentOrThrow(opts.server, did);
@@ -6278,7 +6266,7 @@ function decodeSeed(b64) {
 // src/commands/list.ts
 var import_chalk18 = __toESM(require("chalk"));
 function registerListCommand(root) {
-  root.command("list").description("List agents registered locally (~/.arp/agents.json)").action(() => {
+  root.command("list").description("List agents registered locally (~/.heyarp/agents.json)").action(() => {
     const rows = listAgents();
     if (rows.length === 0) {
       console.log(import_chalk18.default.dim(`No local agents. State file: ${stateFilePath()}`));
@@ -6456,7 +6444,7 @@ var import_shield2 = require("@heyanon-arp/shield");
 var import_chalk22 = __toESM(require("chalk"));
 init_api();
 function registerReceiptCommands(root) {
-  const cmd = root.command("receipt").description("Receipt envelopes \u2014 the payee proposes a delivery record (V2: payment consent is on-chain via claim_work_payment)");
+  const cmd = root.command("receipt").description("Receipt envelopes \u2014 the payee proposes a delivery record (payment consent is on-chain via claim_work_payment)");
   registerPropose(cmd);
 }
 var POST_COMMIT_ERROR_CODES2 = /* @__PURE__ */ new Set([
@@ -6467,7 +6455,7 @@ var POST_COMMIT_ERROR_CODES2 = /* @__PURE__ */ new Set([
   "RECEIPT_ISSUER_IS_CALLER",
   "RECEIPT_NOT_FOUND",
   "RECEIPT_INVALID_STATE",
-  // M6 lock-at-accept: the receipt-propose handler's LOCKED gate emits
+  // The receipt-propose handler's LOCKED gate emits
   // `DELEGATION_PENDING_LOCK` (409) when the delegation is funded but
   // the on-chain lock isn't confirmed yet (state
   // `pending_lock_finalization`). It fires from the body handler AFTER
@@ -6489,7 +6477,7 @@ var POST_COMMIT_ERROR_CODES2 = /* @__PURE__ */ new Set([
 var VERDICT_VALUES = ["accepted", "accepted_with_notes", "rejected"];
 var SHA256_RE = /^sha256:[0-9a-f]{64}$/;
 function registerPropose(parent) {
-  parent.command("propose").description("Send a receipt envelope as the PAYEE. Row lands PROPOSED; caller cosigns to flip to COSIGNED.").argument("<recipient-did>", "Recipient agent DID (= caller / offerer of the parent delegation)").argument("<delegation-id>", "Parent delegation id (UUID, must be ACCEPTED)").argument("[request-hash]", "sha256:<64 hex> \u2014 SHA-256 of the work_request payload being settled. Omit when --auto-hashes is set.").argument("[response-hash]", "sha256:<64 hex> \u2014 SHA-256 of the work_response payload being settled. Omit when --auto-hashes is set.").option("--server <url>", "Override ARP server base URL").option("--from-did <did>", "Sender DID \u2014 required only if multiple agents are registered against this server").option("--verdict <s>", "verdict_proposed (accepted | accepted_with_notes | rejected)", "accepted").option("--notes-hash <sha256>", "Optional sha256:<64 hex> notes hash").option("--deliverable-hash <sha256>", "Optional sha256:<64 hex> deliverable hash").option("--input-tokens <n>", "Optional usage.input_tokens").option("--output-tokens <n>", "Optional usage.output_tokens").option("--latency-ms <n>", "Optional usage.latency_ms").option("--model <name>", "Optional usage.model").option("--computed-amount <s>", "Optional usage.computed_amount").option("--ttl <seconds>", "Envelope TTL in seconds", "3600").option(
+  parent.command("propose").description("Send a receipt envelope as the PAYEE. Row lands PROPOSED; the buyer approves payment on-chain via claim_work_payment.").argument("<recipient-did>", "Recipient agent DID (= caller / offerer of the parent delegation)").argument("<delegation-id>", "Parent delegation id (UUID, must be ACCEPTED)").argument("[request-hash]", "sha256:<64 hex> \u2014 SHA-256 of the work_request payload being settled. Omit when --auto-hashes is set.").argument("[response-hash]", "sha256:<64 hex> \u2014 SHA-256 of the work_response payload being settled. Omit when --auto-hashes is set.").option("--server <url>", "Override ARP server base URL").option("--from-did <did>", "Sender DID \u2014 required only if multiple agents are registered against this server").option("--verdict <s>", "verdict_proposed (accepted | accepted_with_notes | rejected)", "accepted").option("--notes-hash <sha256>", "Optional sha256:<64 hex> notes hash").option("--deliverable-hash <sha256>", "Optional sha256:<64 hex> deliverable hash").option("--input-tokens <n>", "Optional usage.input_tokens").option("--output-tokens <n>", "Optional usage.output_tokens").option("--latency-ms <n>", "Optional usage.latency_ms").option("--model <name>", "Optional usage.model").option("--computed-amount <s>", "Optional usage.computed_amount").option("--ttl <seconds>", "Envelope TTL in seconds", "3600").option(
     "--auto-hashes",
     "Compute request_hash + response_hash automatically from the work-log row at (--rel-id, <delegation-id>, --request-id). Positional <request-hash>/<response-hash> become optional; if supplied they must match the computed values (consistency check). --rel-id and --request-id auto-resolve from local state when unambiguous \u2014 pass them explicitly only if the lookup finds multiple candidates.",
     false
@@ -6630,7 +6618,7 @@ async function assertSenderIsReceiptPayee(api, sender, relationshipId, delegatio
   }
   if (delegation.offererDid === sender.did) {
     throw new Error(
-      `receipt propose: ${sender.did} is the CALLER on delegation ${delegationId} (matches delegation.offererDid). Only the PAYEE \u2014 the counterparty who accepted the delegation offer \u2014 can issue a receipt; as the caller your role is to COSIGN the receipt the payee proposes. Wait for it via \`heyarp status ${relationshipId} --wait --until receipt.proposed\` then run \`heyarp receipt cosign ${relationshipId} ${delegationId} --auto-hashes [--request-id <id>] --settlement-purpose <p> --settlement-expires-at <unix> --payer-sig-from-file <path> --payee-sig-from-file <path>\`.`
+      `receipt propose: ${sender.did} is the CALLER on delegation ${delegationId} (matches delegation.offererDid). Only the PAYEE \u2014 the counterparty who accepted the delegation offer \u2014 can issue a receipt; as the caller your role is to approve payment ON-CHAIN via claim_work_payment once the payee proposes the receipt. Wait for it via \`heyarp status ${relationshipId} --wait --until receipt.proposed\`.`
     );
   }
   return delegation;
@@ -6805,19 +6793,14 @@ function requireDid2(cmdName, did, label) {
 // src/commands/receipts.ts
 var import_chalk23 = __toESM(require("chalk"));
 init_api();
-var ALLOWED_STATES2 = /* @__PURE__ */ new Set(["proposed", "cosigned"]);
 function registerReceiptsCommand(root) {
   root.command("receipts").description(
     "List receipts for a relationship (one row per (delegationId, requestHash, responseHash), oldest-first). Receipt rows expose the chain hash as `receiptEventHash` (NOT `serverEventHash` \u2014 that field is the wider envelope identifier on `heyarp events` rows). Scripts using `--json | jq .receiptEventHash` get the value; `jq .serverEventHash` silently returns null because the row doesn't carry that key."
-  ).argument("<relationship-id>", "Relationship UUID").option("--server <url>", "Override ARP server base URL").option("--state <s>", "Filter by exact state (proposed|cosigned)").option("--delegation-id <uuid>", "Narrow to receipts under a specific delegation id").option("--after <id>", "Cursor: pass the previous page's last `id` to fetch the next page").option("--limit <n>", "Max rows to return (1..100)", "20").option("--from-did <did>", "Signer DID \u2014 required only if multiple agents are registered against this server").option(
+  ).argument("<relationship-id>", "Relationship UUID").option("--server <url>", "Override ARP server base URL").option("--delegation-id <uuid>", "Narrow to receipts under a specific delegation id").option("--after <id>", "Cursor: pass the previous page's last `id` to fetch the next page").option("--limit <n>", "Max rows to return (1..100)", "20").option("--from-did <did>", "Signer DID \u2014 required only if multiple agents are registered against this server").option(
     "--verbose",
-    'After the one-line summaries, print a framed "Full receipt payloads (N rows)" block \u2014 each row labelled with full delegationId + requestHash + responseHash (the values `receipt cosign` requires) and dumped as JSON. Mutually exclusive with --json.',
+    'After the one-line summaries, print a framed "Full receipt payloads (N rows)" block \u2014 each row labelled with full delegationId + requestHash + responseHash and dumped as JSON. Mutually exclusive with --json.',
     false
-  ).option("--json", "Machine-readable mode \u2014 emit a single JSON array of receipt rows, no chalk, no summary. Pipe-safe. Mutually exclusive with --verbose.", false).option(
-    "--full-ids",
-    "Print delegationId / requestHash / responseHash / DIDs in full (no truncation). REQUIRED for piping into `receipt cosign` which needs the full sha256s.",
-    false
-  ).action(async (relationshipId, opts) => {
+  ).option("--json", "Machine-readable mode \u2014 emit a single JSON array of receipt rows, no chalk, no summary. Pipe-safe. Mutually exclusive with --verbose.", false).option("--full-ids", "Print delegationId / requestHash / responseHash / DIDs in full (no truncation).", false).action(async (relationshipId, opts) => {
     await runReceipts(relationshipId, opts);
   });
 }
@@ -6828,7 +6811,6 @@ async function runReceipts(relationshipId, opts) {
     );
   }
   const limit = parseLimit5(opts.limit);
-  const state = parseState2(opts.state);
   const api = new ArpApiClient(opts.server);
   const sender = resolveSenderAgent("receipts", opts.server, opts.fromDid);
   if (!opts.json) {
@@ -6837,7 +6819,6 @@ async function runReceipts(relationshipId, opts) {
     console.log(import_chalk23.default.dim(`Relationship: ${relationshipId}`));
   }
   const query = { limit };
-  if (state) query.state = state;
   if (opts.delegationId) query.delegationId = opts.delegationId;
   if (opts.after) query.after = opts.after;
   const signer = makeSigner(sender);
@@ -6856,11 +6837,10 @@ async function runReceipts(relationshipId, opts) {
   }
   if (opts.verbose) {
     printVerbose(rows, "Full receipt payloads:", (r) => ({
-      primary: `state=${r.state} verdict=${r.verdictFinal ?? r.verdictProposed}`,
-      // `receipt cosign` requires the FULL `requestHash` and
-      // `responseHash` plus `delegationId`. Putting all three on
-      // one inline label keeps the cosign flow grep-able without
-      // dropping into `--json | jq`.
+      primary: `verdict=${r.verdictProposed}`,
+      // Surface the FULL `requestHash` + `responseHash` + `delegationId`
+      // on one inline label so the receipt-correlation flow stays
+      // grep-able without dropping into `--json | jq`.
       secondary: `delegationId=${r.delegationId} requestHash=${r.requestHash} responseHash=${r.responseHash}`
     }));
   }
@@ -6872,29 +6852,16 @@ function formatReceiptLine(r, selfDid, opts = {}) {
   const delegationPart = opts.fullIds ? r.delegationId : idHead2(r.delegationId);
   const requestHashPart = opts.fullIds ? r.requestHash : hashHead3(r.requestHash);
   const id = import_chalk23.default.bold(`${delegationPart}/${requestHashPart}`);
-  const state = colorState2(r.state).padEnd(stateColumnWidth2());
   const callerHead = opts.fullIds ? r.callerDid : didHead3(r.callerDid);
   const payeeHead = opts.fullIds ? r.payeeDid : didHead3(r.payeeDid);
   const direction = r.payeeDid === selfDid ? `${import_chalk23.default.bold("me")}(payee) \u2192 ${import_chalk23.default.dim(callerHead)}` : `${import_chalk23.default.dim(payeeHead)}(payee) \u2192 ${import_chalk23.default.bold("me")}`;
   const verdict = formatVerdict(r);
   const responseTail = opts.fullIds ? `
   ${import_chalk23.default.dim("responseHash:")} ${import_chalk23.default.cyan(r.responseHash)}` : "";
-  return `${id}  ${state}  ${direction}  ${verdict}${responseTail}`;
-}
-function colorState2(s) {
-  switch (s) {
-    case "proposed":
-      return import_chalk23.default.yellow("proposed");
-    case "cosigned":
-      return import_chalk23.default.green("cosigned");
-  }
-}
-function stateColumnWidth2() {
-  return 8;
+  return `${id}  ${direction}  ${verdict}${responseTail}`;
 }
 function formatVerdict(r) {
-  const final = r.verdictFinal ?? r.verdictProposed;
-  switch (final) {
+  switch (r.verdictProposed) {
     case "accepted":
       return import_chalk23.default.green("accepted");
     case "accepted_with_notes":
@@ -6915,13 +6882,6 @@ function didHead3(did) {
   if (did.length <= 20) return did;
   return `${did.slice(0, 20)}...`;
 }
-function parseState2(raw) {
-  if (raw === void 0) return void 0;
-  if (!ALLOWED_STATES2.has(raw)) {
-    throw new Error(`receipts: --state must be one of proposed|cosigned (got '${raw}')`);
-  }
-  return raw;
-}
 function parseLimit5(raw) {
   if (raw === void 0) return 20;
   const n = Number(raw);
@@ -6987,8 +6947,10 @@ async function runRecover(opts) {
     lastSenderSequence = seq.lastSenderSequence;
   } catch (err) {
     process.stderr.write(
-      import_chalk24.default.yellow(`\u26A0 could not read the sender sequence from the server (${err.message}). If sends are rejected as backwards, run \`heyarp escrow recover-sequence --apply\`.
-`)
+      import_chalk24.default.yellow(
+        `\u26A0 could not read the sender sequence from the server (${err.message}). If sends are rejected as backwards, run \`heyarp escrow recover-sequence --apply\`.
+`
+      )
     );
   }
   const state = {
@@ -7040,13 +7002,12 @@ function registerRegisterCommand(root) {
     // logged by CI runners (e.g. GitHub Actions echoes the
     // full command). Safer alternatives:
     // • interactive prompt (default) — never written anywhere
-    // • `HEYARP_PASSWORD` env var (V1.5 — tracked) reads
-    //   from env so the secret stays out of argv even in
-    //   scripts
+    // • `HEYARP_PASSWORD` env var (tracked) reads from env so
+    //   the secret stays out of argv even in scripts
     // Treat `--password <s>` as a one-off local-dev affordance;
     // do NOT use it in CI pipelines without a secret-redacting
     // runner.
-    "Owner password \u2014 MUST be at least 8 characters. REQUIRED when --yes is set; otherwise the CLI prompts for it. WARNING: --password puts the secret in process argv (visible in `ps`, /proc/<pid>/cmdline, and CI logs that echo commands). Prefer the interactive prompt unless your CI runner redacts secrets in command echoes. V1.5: HEYARP_PASSWORD env var support tracked."
+    "Owner password \u2014 MUST be at least 8 characters. REQUIRED when --yes is set; otherwise the CLI prompts for it. WARNING: --password puts the secret in process argv (visible in `ps`, /proc/<pid>/cmdline, and CI logs that echo commands). Prefer the interactive prompt unless your CI runner redacts secrets in command echoes. HEYARP_PASSWORD env var support is tracked."
   ).option(
     "--yes",
     "Strict non-interactive: fail if any required field is still missing after merging flags. With --yes, --password must be supplied explicitly (>= 8 chars).",
@@ -7057,7 +7018,6 @@ function registerRegisterCommand(root) {
     // success prints. Output shape:
     // {did, settlementPublicKeyB58, identityPublicKeyB58,
     //  localStatePath, didDocument}
-    // (V1-alpha: `accountId` parked from the output.)
     // REQUIRES --yes (interactive prompts would corrupt the
     // single-doc contract).
     "Machine-readable mode \u2014 emit `{did, settlementPublicKeyB58, \u2026, didDocument}` JSON instead of human prints. REQUIRES --yes (interactive prompts would corrupt the single-doc JSON output).",
@@ -7116,8 +7076,6 @@ async function runRegister(opts, deps = defaultRegisterDeps) {
   const attestation = (0, import_sdk16.signKeyLinkAttestation)({ payload, scryptKey, scryptSaltId });
   const body = {
     challengeId: challenge.challengeId,
-    // V1-alpha: accountId parked — server's DTO no longer accepts it.
-    // accountId: answers.accountId,
     identityPublicKey: identityPublicKeyB58,
     settlementPublicKey: settlementPublicKeyB58,
     ownerAttestation: {
@@ -7210,20 +7168,11 @@ Local state saved to ${arpHomeDir()}/agents.json (mode 0600).`));
   }
 }
 async function mergeAnswers(opts) {
-  const need = opts.yes ? {
-    password: false,
-    name: false,
-    description: false,
-    tagsCsv: false
-    /* accountId parked V1-alpha */
-  } : {
+  const need = opts.yes ? { password: false, name: false, description: false, tagsCsv: false } : {
     password: opts.password === void 0,
     name: opts.name === void 0,
     description: opts.description === void 0,
     tagsCsv: opts.tag === void 0 || opts.tag.length === 0
-    // V1-alpha: accountId parked. Uncomment + restore the prompt
-    // below when launchpad↔ARP join lands.
-    // accountId: opts.accountId === undefined,
   };
   if (opts.yes) {
     const missing = [];
@@ -7275,7 +7224,6 @@ async function mergeAnswers(opts) {
     password: opts.password ?? prompted.password,
     name: opts.name ?? prompted.name,
     description: opts.description ?? prompted.description ?? "",
-    // accountId, // V1-alpha parked — see RegisterAnswers above.
     tags
   };
 }
@@ -7311,7 +7259,7 @@ function warnIfAgentsAlreadyRegistered(serverOverride) {
   const existing = listAgents().filter((row) => row.serverUrl === targetServer);
   if (existing.length === 0) return;
   const list = existing.map((row) => `   \u2022 ${import_chalk25.default.cyan(row.agent.did)}${row.agent.name ? import_chalk25.default.dim(` (${row.agent.name})`) : ""}`).join("\n");
-  console.log(import_chalk25.default.yellow("\n\u26A0  ~/.arp/agents.json already has agent(s) for this server:"));
+  console.log(import_chalk25.default.yellow("\n\u26A0  ~/.heyarp/agents.json already has agent(s) for this server:"));
   console.log(list);
   console.log(
     import_chalk25.default.dim(
@@ -7371,7 +7319,7 @@ function assertJsonRequiresYes(opts) {
 // src/commands/relationships.ts
 var import_chalk26 = __toESM(require("chalk"));
 init_api();
-var ALLOWED_STATES3 = /* @__PURE__ */ new Set(["pending", "active", "paused", "closed"]);
+var ALLOWED_STATES2 = /* @__PURE__ */ new Set(["pending", "active", "paused", "closed"]);
 function registerRelationshipsCommand(root) {
   root.command("relationships").description(
     "List relationships <did> belongs to (live + closed pairs, ordered by lastEventAt desc). DID can be passed positionally OR via --from-did; if both are omitted the resolver picks the sole local agent for the server (see `heyarp config set server` + multi-DID disambiguation rules)."
@@ -7381,7 +7329,7 @@ function registerRelationshipsCommand(root) {
 }
 async function runRelationships(positionalDid, opts) {
   const limit = parseLimit6(opts.limit);
-  const state = parseState3(opts.state);
+  const state = parseState2(opts.state);
   if (positionalDid !== void 0 && opts.fromDid !== void 0 && positionalDid !== opts.fromDid) {
     throw new Error(`relationships: positional <did> (${positionalDid}) and --from-did (${opts.fromDid}) disagree \u2014 pass only one`);
   }
@@ -7422,9 +7370,9 @@ function otherPair(r, selfDid) {
   if (r.pairDidB === selfDid) return r.pairDidA;
   return `${r.pairDidA} \u2194 ${r.pairDidB}`;
 }
-function parseState3(raw) {
+function parseState2(raw) {
   if (raw === void 0) return void 0;
-  if (!ALLOWED_STATES3.has(raw)) {
+  if (!ALLOWED_STATES2.has(raw)) {
     throw new Error(`relationships: --state must be one of pending|active|paused|closed (got '${raw}')`);
   }
   return raw;
@@ -7490,7 +7438,11 @@ var import_sdk18 = require("@heyanon-arp/sdk");
 var import_chalk28 = __toESM(require("chalk"));
 init_api();
 function registerSendHandshakeCommand(root) {
-  root.command("send-handshake").description("Send a handshake envelope to <recipient-did>. Server creates the relationship row on first contact.").argument("<recipient-did>", "Recipient agent DID (did:arp:...)").option("--server <url>", "Override ARP server base URL").option("--from-did <did>", "Sender DID \u2014 required only if multiple agents are registered against this server").option("--greeting <s>", "Optional greeting text included in body.content").option("--intent <s>", "Optional intent text included in body.content").option("--ttl <seconds>", "Envelope TTL in seconds (max 86400 = 24h)", "3600").option("--verbose", "Print the full envelope before sending and the full server response", false).action(async (recipientDid, opts) => {
+  root.command("send-handshake").description("Send a handshake envelope to <recipient-did>. Server creates the relationship row on first contact.").argument("<recipient-did>", "Recipient agent DID (did:arp:...)").option("--server <url>", "Override ARP server base URL").option("--from-did <did>", "Sender DID \u2014 required only if multiple agents are registered against this server").option("--greeting <s>", "Optional greeting text included in body.content").option("--intent <s>", "Optional intent text included in body.content").option("--ttl <seconds>", "Envelope TTL in seconds (max 86400 = 24h)", "3600").option("--verbose", "Print the full envelope before sending and the full server response. Mutually exclusive with --json.", false).option(
+    "--json",
+    "Machine-readable mode \u2014 emit a single JSON object on stdout ({ok, eventId, relationshipId, relationshipEventIndex, serverTimestamp, signedMessageHash, serverEventHash, prevServerEventHash, senderSequence}). The Server/Sender/Recipient prelude moves to stderr so `--json | jq` stays byte-pure. Mutually exclusive with --verbose.",
+    false
+  ).action(async (recipientDid, opts) => {
     await runSendHandshake(recipientDid, opts);
   });
 }
@@ -7498,12 +7450,17 @@ async function runSendHandshake(recipientDid, opts) {
   if (!isDid(recipientDid)) {
     throw new Error(`send-handshake: <recipient-did> must look like 'did:arp:...' (got '${recipientDid}')`);
   }
+  if (opts.verbose && opts.json) {
+    throw new Error(
+      "send-handshake: --verbose and --json are mutually exclusive. --json emits the structured server response; --verbose adds envelope + response dumps that would break `--json | jq`."
+    );
+  }
   const ttlSeconds = parseTtl3(opts.ttl);
   const api = new ArpApiClient(opts.server);
-  console.log(import_chalk28.default.dim(`Server: ${api.serverUrl}`));
+  progress(opts.json, import_chalk28.default.dim(`Server: ${api.serverUrl}`));
   const sender = resolveSenderAgent("send-handshake", opts.server, opts.fromDid);
-  console.log(import_chalk28.default.dim(`Sender: ${sender.did}`));
-  console.log(import_chalk28.default.dim(`Recipient: ${recipientDid}`));
+  progress(opts.json, import_chalk28.default.dim(`Sender: ${sender.did}`));
+  progress(opts.json, import_chalk28.default.dim(`Recipient: ${recipientDid}`));
   const content = {};
   if (opts.greeting) content.greeting = opts.greeting;
   if (opts.intent) content.intent = opts.intent;
@@ -7534,6 +7491,20 @@ async function runSendHandshake(recipientDid, opts) {
   }
   const result = await api.ingest(envelope);
   updateAgentLocal(opts.server, sender.did, { lastSenderSequence: nextSequence });
+  if (opts.json) {
+    jsonOut({
+      ok: true,
+      eventId: result.eventId,
+      relationshipId: result.relationshipId,
+      relationshipEventIndex: result.relationshipEventIndex,
+      serverTimestamp: result.serverTimestamp,
+      signedMessageHash: result.signedMessageHash,
+      serverEventHash: result.serverEventHash,
+      prevServerEventHash: result.prevServerEventHash ?? null,
+      senderSequence: nextSequence
+    });
+    return;
+  }
   console.log(import_chalk28.default.green("\nDelivered."));
   console.log(`${import_chalk28.default.bold("Event id")}: ${import_chalk28.default.cyan(result.eventId)}`);
   console.log(`${import_chalk28.default.bold("Relationship id")}: ${import_chalk28.default.cyan(result.relationshipId)}`);
@@ -7883,8 +7854,7 @@ function registerWhoamiCommand(root) {
     // `--payer-settlement-pubkey` / on-chain ops without a
     // server round-trip. `--local` short-circuits the signed
     // GET, prints just the resolved DID + pubkeys from local
-    // state. (V1-alpha: accountId parked, no longer in --local
-    // output.)
+    // state.
     "Print local-state info only (DID + settlement + identity pubkeys). Skips the signed server fetch \u2014 useful for scripts that need the local pubkey before the server is up, or to grep from a shell without burning a network round-trip.",
     false
   ).option("--json", "JSON output (jq-pipeable). Combines local + server data when --local is unset, or just local when --local is set.", false).action(async (didArg, opts, cmd) => {
@@ -7897,10 +7867,6 @@ function registerWhoamiCommand(root) {
         did: local.did,
         settlementPublicKeyB58: local.settlementPublicKeyB58,
         identityPublicKeyB58: local.identityPublicKeyB58,
-        // V1-alpha: accountId parked — local-state type no
-        // longer carries the field. Uncomment when launchpad↔ARP
-        // join lands.
-        // accountId: local.accountId,
         name: local.name
       };
       if (opts.local) {
@@ -7970,7 +7936,7 @@ var POST_COMMIT_ERROR_CODES3 = /* @__PURE__ */ new Set([
   "WORK_REQUEST_NOT_FOUND",
   "WORK_RESPONDER_IS_CALLER",
   "WORK_INVALID_STATE",
-  // M6 lock-at-accept: the work handler's LOCKED gate emits
+  // The work handler's LOCKED gate emits
   // `DELEGATION_PENDING_LOCK` (409) when the delegation is funded but
   // the on-chain lock isn't confirmed yet (state
   // `pending_lock_finalization`). It fires from the body handler AFTER
@@ -8232,7 +8198,7 @@ function requireDid3(cmdName, did, label) {
 // src/commands/work-list.ts
 var import_chalk33 = __toESM(require("chalk"));
 init_api();
-var ALLOWED_STATES4 = /* @__PURE__ */ new Set(["requested", "responded"]);
+var ALLOWED_STATES3 = /* @__PURE__ */ new Set(["requested", "responded"]);
 function registerWorkListCommand(root) {
   root.command("work-list").description("List work-log rows for a relationship (one row per (delegationId, requestId), oldest-first)").argument("<relationship-id>", "Relationship UUID").option("--server <url>", "Override ARP server base URL").option("--state <s>", "Filter by exact state (requested|responded)").option("--delegation-id <uuid>", "Narrow to work-logs operating under a specific delegation id").option("--after <id>", "Cursor: pass the previous page's last `id` to fetch the next page").option("--limit <n>", "Max rows to return (1..100)", "20").option("--from-did <did>", "Signer DID \u2014 required only if multiple agents are registered against this server").option(
     "--verbose",
@@ -8253,7 +8219,7 @@ async function runWorkList(relationshipId, opts) {
     );
   }
   const limit = parseLimit7(opts.limit);
-  const state = parseState4(opts.state);
+  const state = parseState3(opts.state);
   const api = new ArpApiClient(opts.server);
   const sender = resolveSenderAgent("work-list", opts.server, opts.fromDid);
   if (!opts.json) {
@@ -8296,14 +8262,14 @@ function formatWorkLogLine(w, selfDid, opts = {}) {
   const delegationPart = opts.fullIds ? w.delegationId : idHead3(w.delegationId);
   const requestPart = opts.fullIds ? w.requestId : truncate3(w.requestId, 16);
   const id = import_chalk33.default.bold(`${delegationPart}/${requestPart}`);
-  const state = colorState3(w.state).padEnd(stateColumnWidth3());
+  const state = colorState2(w.state).padEnd(stateColumnWidth2());
   const peerCallerHead = opts.fullIds ? w.callerDid : didHead5(w.callerDid);
   const peerPayeeHead = opts.fullIds ? w.payeeDid : didHead5(w.payeeDid);
   const direction = w.callerDid === selfDid ? `${import_chalk33.default.bold("me")} \u2192 ${import_chalk33.default.dim(peerPayeeHead)}` : `${import_chalk33.default.dim(peerCallerHead)} \u2192 ${import_chalk33.default.bold("me")}`;
   const outcome = formatOutcome(w);
   return `${id}  ${state}  ${direction}  ${outcome}`;
 }
-function colorState3(s) {
+function colorState2(s) {
   switch (s) {
     case "requested":
       return import_chalk33.default.yellow("requested");
@@ -8311,7 +8277,7 @@ function colorState3(s) {
       return import_chalk33.default.green("responded");
   }
 }
-function stateColumnWidth3() {
+function stateColumnWidth2() {
   return 9;
 }
 function formatOutcome(w) {
@@ -8332,9 +8298,9 @@ function truncate3(s, max) {
   if (s.length <= max) return s;
   return `${s.slice(0, max - 3)}...`;
 }
-function parseState4(raw) {
+function parseState3(raw) {
   if (raw === void 0) return void 0;
-  if (!ALLOWED_STATES4.has(raw)) {
+  if (!ALLOWED_STATES3.has(raw)) {
     throw new Error(`work-list: --state must be one of requested|responded (got '${raw}')`);
   }
   return raw;