@runveric/cli 0.1.1 → 0.1.2

package/dist/runveric.mjs

@@ -214,12 +214,12 @@ var require_wire_identity = __commonJS({
     });
     exports.PROBLEM_TYPE_BASE = exports.RUNNER_PROTOCOL_VERSION = exports.PACKAGE_WORK_ITEM_VERSION = exports.ACTION_MANIFEST_API_VERSION = exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = exports.PACKAGE_RESULT_PROTOCOL_VERSION = void 0;
     exports.problemType = problemType;
-    exports.PACKAGE_RESULT_PROTOCOL_VERSION = "opera.dev/package-result/v1";
-    exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "opera.dev/package-execution/v1";
-    exports.ACTION_MANIFEST_API_VERSION = "opera.dev/action/v1";
-    exports.PACKAGE_WORK_ITEM_VERSION = "opera.dev/package-work-item/v1";
-    exports.RUNNER_PROTOCOL_VERSION = "opera.dev/runner-channel/v2";
-    exports.PROBLEM_TYPE_BASE = "https://opera.cloud/errors";
+    exports.PACKAGE_RESULT_PROTOCOL_VERSION = "runveric.dev/package-result/v1";
+    exports.PACKAGE_EXECUTION_PROTOCOL_VERSION = "runveric.dev/package-execution/v1";
+    exports.ACTION_MANIFEST_API_VERSION = "runveric.dev/action/v1";
+    exports.PACKAGE_WORK_ITEM_VERSION = "runveric.dev/package-work-item/v1";
+    exports.RUNNER_PROTOCOL_VERSION = "runveric.dev/runner-channel/v2";
+    exports.PROBLEM_TYPE_BASE = "https://runveric.dev/errors";
     function problemType(slug) {
       return `${exports.PROBLEM_TYPE_BASE}/${slug}`;
     }
@@ -450,7 +450,7 @@ var require_catalog = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.NEW_ACTION_WINDOW_DAYS = exports.PARAMETER_CONTROLS = exports.ACTION_LIFECYCLE_LABELS = exports.INACTIVE_ACTION_LIFECYCLES = exports.RUNNABLE_ACTION_LIFECYCLES = exports.LISTED_ACTION_LIFECYCLES = exports.ACTION_LIFECYCLE_STANDING = exports.ACTION_LIFECYCLES = void 0;
+    exports.NEW_ACTION_WINDOW_DAYS = exports.PARAMETER_ORDER_KEY = exports.PARAMETER_CONTROLS = exports.ACTION_LIFECYCLE_LABELS = exports.INACTIVE_ACTION_LIFECYCLES = exports.RUNNABLE_ACTION_LIFECYCLES = exports.LISTED_ACTION_LIFECYCLES = exports.ACTION_LIFECYCLE_STANDING = exports.ACTION_LIFECYCLES = void 0;
     exports.orderedParameterEntries = orderedParameterEntries;
     exports.withParameterOrder = withParameterOrder;
     exports.isNewAction = isNewAction;
@@ -513,9 +513,10 @@ var require_catalog = __commonJS({
       "switch",
       "info"
     ];
+    exports.PARAMETER_ORDER_KEY = "x-runveric-order";
     function orderedParameterEntries(schema) {
       const properties = schema.properties ?? {};
-      const declared = schema["x-opera-order"] ?? [];
+      const declared = schema[exports.PARAMETER_ORDER_KEY] ?? [];
       const seen = /* @__PURE__ */ new Set();
       const ordered = [];
       for (const id of declared) {
@@ -540,7 +541,7 @@ var require_catalog = __commonJS({
     function withParameterOrder(schema) {
       return {
         ...schema,
-        "x-opera-order": Object.keys(schema.properties ?? {})
+        [exports.PARAMETER_ORDER_KEY]: Object.keys(schema.properties ?? {})
       };
     }
     __name(withParameterOrder, "withParameterOrder");
@@ -916,7 +917,9 @@ var require_packages = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.PACKAGE_IMPORT_WARNING_REASONS = exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = exports.PACKAGE_IMPORT_SKIP_REASONS = exports.PACKAGE_IMPORT_LIMITS = exports.PACKAGE_DRAFT_FILTER_LABELS = exports.PACKAGE_DRAFT_FILTERS = exports.PACKAGE_INTERPRETER_LABEL = exports.PARAMETER_DETECTION_UNAVAILABLE = exports.PARAMETER_DETECTION_SOURCES = exports.PACKAGE_PARAMETERS_UNRESOLVED_COPY = exports.PACKAGE_PARAMETERS_UNRESOLVED_REASONS = exports.PACKAGE_DRAFT_STATES = exports.PACKAGE_VERSION_MODES = exports.ACTION_UNRUNNABLE_REASONS = exports.PACKAGE_SOURCE_RECONNECT_OUTCOMES = exports.ADOPTION_REVIEW_DIRECTIONS = exports.ADOPTION_CHANGE_SEVERITY = exports.ADOPTION_CHANGE_KINDS = exports.ADOPTION_CHANGE_SEVERITIES = exports.ADOPTION_STATUSES = exports.PACKAGE_INTERPRETERS = exports.PACKAGE_RUNTIME_KINDS = exports.PACKAGE_RUNNER_CONNECTOR_KEY = void 0;
+    exports.PACKAGE_IMPORT_WARNING_REASONS = exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = exports.PACKAGE_IMPORT_SKIP_REASONS = exports.PACKAGE_IMPORT_LIMITS = exports.PACKAGE_DRAFT_FILTER_LABELS = exports.PACKAGE_DRAFT_FILTERS = exports.PACKAGE_INTERPRETER_LABEL = exports.PARAMETER_DETECTION_UNAVAILABLE = exports.PARAMETER_DETECTION_SOURCES = exports.PACKAGE_PARAMETERS_UNRESOLVED_COPY = exports.PACKAGE_PARAMETERS_UNRESOLVED_REASONS = exports.PACKAGE_DRAFT_STATES = exports.PACKAGE_VERSION_MODES = exports.ACTION_UNRUNNABLE_REASONS = exports.PACKAGE_SOURCE_RECONNECT_OUTCOMES = exports.ADOPTION_REVIEW_DIRECTIONS = exports.ADOPTION_CHANGE_SEVERITY = exports.ADOPTION_CHANGE_KINDS = exports.ADOPTION_CHANGE_SEVERITIES = exports.ADOPTION_STATUSES = exports.PACKAGE_INTERPRETERS = exports.PACKAGE_RUNTIME_KINDS = exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY = exports.PACKAGE_RUNNER_CONNECTOR_KEY = void 0;
+    exports.isPackageRunnerConnectorKey = isPackageRunnerConnectorKey;
+    exports.canonicalConnectorKey = canonicalConnectorKey;
     exports.packageSourceConnectedRemovalMessage = packageSourceConnectedRemovalMessage;
     exports.packageVersionAdoptedRemovalMessage = packageVersionAdoptedRemovalMessage;
     exports.actionUnrunnableCopy = actionUnrunnableCopy;
@@ -927,7 +930,16 @@ var require_packages = __commonJS({
     __exportStar(require_package_provenance(), exports);
     __exportStar(require_package_tier(), exports);
     var brand_1 = require_brand();
-    exports.PACKAGE_RUNNER_CONNECTOR_KEY = "opera.package-runner";
+    exports.PACKAGE_RUNNER_CONNECTOR_KEY = "runveric.package-runner";
+    exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY = "opera.package-runner";
+    function isPackageRunnerConnectorKey(connectorKey) {
+      return connectorKey === exports.PACKAGE_RUNNER_CONNECTOR_KEY || connectorKey === exports.LEGACY_PACKAGE_RUNNER_CONNECTOR_KEY;
+    }
+    __name(isPackageRunnerConnectorKey, "isPackageRunnerConnectorKey");
+    function canonicalConnectorKey(connectorKey) {
+      return isPackageRunnerConnectorKey(connectorKey) ? exports.PACKAGE_RUNNER_CONNECTOR_KEY : connectorKey;
+    }
+    __name(canonicalConnectorKey, "canonicalConnectorKey");
     exports.PACKAGE_RUNTIME_KINDS = [
       "interpreter",
       "oci"
@@ -1248,7 +1260,7 @@ var require_packages = __commonJS({
       "editor_metadata",
       "os_metadata",
       "lockfile",
-      "opera_scratch",
+      "runveric_scratch",
       "not_text"
     ];
     exports.PACKAGE_IMPORT_SKIP_REASON_LABELS = {
@@ -1258,7 +1270,7 @@ var require_packages = __commonJS({
       editor_metadata: "editor settings",
       os_metadata: "operating-system metadata",
       lockfile: "a dependency lockfile",
-      opera_scratch: "scratch written by `runveric test`",
+      runveric_scratch: "scratch written by `runveric test`",
       not_text: "not UTF-8 text"
     };
     exports.PACKAGE_IMPORT_WARNING_REASONS = [
@@ -2352,18 +2364,18 @@ var require_package_execution = __commonJS({
     exports.PACKAGE_CONTAINER_ENV = {
       /** The control-plane origin the container redeems its work item at and reports to. */
       callbackBaseUrl: "OPERA_CALLBACK_BASE_URL",
-      executionId: "OPERA_EXECUTION_ID",
+      executionId: "RUNVERIC_EXECUTION_ID",
       /** Single-use; spent on the first redemption. Never copied into the package's own env. */
       runToken: "OPERA_RUN_TOKEN",
       /** What the bytes it fetched must hash to. Travels beside the work item, never inside it. */
-      contentDigest: "OPERA_CONTENT_DIGEST",
+      contentDigest: "RUNVERIC_CONTENT_DIGEST",
       /** Which runtime image this is, recorded on the run. */
       runnerImageDigest: "OPERA_RUNNER_IMAGE_DIGEST",
       /** Where the PACKAGE's outbound traffic is pointed. Absent when it declared no network. */
-      egressProxyUrl: "OPERA_EGRESS_PROXY_URL",
+      egressProxyUrl: "RUNVERIC_EGRESS_PROXY_URL",
       /** The runner-only control channel. Never copied into the package's own env. */
-      egressControlUrl: "OPERA_EGRESS_CONTROL_URL",
-      egressControlToken: "OPERA_EGRESS_CONTROL_TOKEN"
+      egressControlUrl: "RUNVERIC_EGRESS_CONTROL_URL",
+      egressControlToken: "RUNVERIC_EGRESS_CONTROL_TOKEN"
     };
   }
 });
@@ -2375,17 +2387,17 @@ var require_runner_confinement = __commonJS({
     Object.defineProperty(exports, "__esModule", {
       value: true
     });
-    exports.RUNNER_NAMESPACE = exports.CONFINEMENT_FINDING_LABEL = exports.CONFINEMENT_FINDING_SENTENCE = exports.RUNNER_ISOLATION_BLOCKS_UNDECLARED_EGRESS = exports.CONFINEMENT_FINDING_BLOCKS_EGRESS = exports.CONFINEMENT_FINDINGS = exports.RUNNER_SUBSTRATE_LABEL = exports.RUNNER_SUBSTRATES = exports.EGRESS_GATE_SHUT = exports.EGRESS_GATE_OPEN = exports.EGRESS_GATE_PREFIX = exports.EGRESS_PROBE_TIMEOUT_MS = exports.EGRESS_PROBE_BLOCKED = exports.EGRESS_PROBE_REACHED = exports.EGRESS_PROBE_PREFIX = void 0;
+    exports.CONFINEMENT_FINDING_LABEL = exports.CONFINEMENT_FINDING_SENTENCE = exports.RUNNER_ISOLATION_BLOCKS_UNDECLARED_EGRESS = exports.CONFINEMENT_FINDING_BLOCKS_EGRESS = exports.CONFINEMENT_FINDINGS = exports.RUNNER_SUBSTRATE_LABEL = exports.RUNNER_SUBSTRATES = exports.EGRESS_GATE_SHUT = exports.EGRESS_GATE_OPEN = exports.EGRESS_GATE_PREFIX = exports.EGRESS_PROBE_TIMEOUT_MS = exports.EGRESS_PROBE_BLOCKED = exports.EGRESS_PROBE_REACHED = exports.EGRESS_PROBE_PREFIX = void 0;
     exports.effectiveBlocksUndeclaredEgress = effectiveBlocksUndeclaredEgress;
     exports.confinementOverclaims = confinementOverclaims;
     exports.runnerBlocksUndeclaredEgress = runnerBlocksUndeclaredEgress;
     exports.poolConfinementSentence = poolConfinementSentence;
     var brand_1 = require_brand();
-    exports.EGRESS_PROBE_PREFIX = "opera.egress-probe";
+    exports.EGRESS_PROBE_PREFIX = "runveric.egress-probe";
     exports.EGRESS_PROBE_REACHED = "REACHED";
     exports.EGRESS_PROBE_BLOCKED = "BLOCKED";
     exports.EGRESS_PROBE_TIMEOUT_MS = 5e3;
-    exports.EGRESS_GATE_PREFIX = "opera.egress-gate";
+    exports.EGRESS_GATE_PREFIX = "runveric.egress-gate";
     exports.EGRESS_GATE_OPEN = "OPEN";
     exports.EGRESS_GATE_SHUT = "SHUT";
     exports.RUNNER_SUBSTRATES = [
@@ -2440,7 +2452,69 @@ var require_runner_confinement = __commonJS({
       return `Only ${confined} of ${findings.length} runners in this pool block undeclared outbound traffic. A run cannot choose which runner claims it, so this pool is not relied on to confine egress and packages that need their allowlist enforced are not sent here.`;
     }
     __name(poolConfinementSentence, "poolConfinementSentence");
-    exports.RUNNER_NAMESPACE = "opera-runner";
+  }
+});
+
+// ../contracts/dist/runner-install.js
+var require_runner_install = __commonJS({
+  "../contracts/dist/runner-install.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.POD_ROLE_BROKER = exports.POD_EGRESS_CONFINED = exports.POD_EGRESS_LABEL = exports.POD_RUNNER = exports.POD_ROLE = exports.POD_MANAGED_BY_VALUE = exports.POD_MANAGED_BY = exports.RUNNER_NETWORK_POLICY_NAME = exports.RUNNER_REPORT_DIRECTORY = exports.RUNNER_STATE_DIRECTORY = exports.RUNNER_CONTAINER_PREFIX = exports.RUNNER_NAMESPACE = exports.RUNNER_HOST_ENV = void 0;
+    exports.RUNNER_HOST_ENV = {
+      /** `docker` or `kubernetes`. Absent means `docker`; present and wrong is refused by name. */
+      substrate: "RUNVERIC_RUNNER_SUBSTRATE",
+      /** The https origin the runner long-polls. */
+      controlPlaneUrl: "RUNVERIC_CONTROL_PLANE_URL",
+      /** The operator-chosen name, also the container's and the Deployment's. */
+      runnerName: "RUNVERIC_RUNNER_NAME",
+      /** Single-use; spent by the first registration. */
+      registrationToken: "RUNVERIC_RUNNER_REGISTRATION_TOKEN",
+      /** The image the dispatcher starts one container of per step. */
+      stepImage: "RUNVERIC_RUNNER_STEP_IMAGE",
+      /** Optional. Absent means the runner runs built-in actions only. */
+      packageImage: "RUNVERIC_RUNNER_PACKAGE_IMAGE",
+      /** Where the credential and the stashed reports live across restarts. */
+      reportDirectory: "RUNVERIC_RUNNER_REPORT_DIR"
+    };
+    exports.RUNNER_NAMESPACE = "runveric-runner";
+    exports.RUNNER_CONTAINER_PREFIX = "runveric-";
+    exports.RUNNER_STATE_DIRECTORY = "/var/lib/runveric-runner";
+    exports.RUNNER_REPORT_DIRECTORY = `${exports.RUNNER_STATE_DIRECTORY}/reports`;
+    exports.RUNNER_NETWORK_POLICY_NAME = "runveric-confined-egress";
+    exports.POD_MANAGED_BY = "runveric.dev/managed-by";
+    exports.POD_MANAGED_BY_VALUE = "runveric-dispatcher";
+    exports.POD_ROLE = "runveric.dev/role";
+    exports.POD_RUNNER = "runveric.dev/runner";
+    exports.POD_EGRESS_LABEL = "runveric.dev/egress";
+    exports.POD_EGRESS_CONFINED = "confined";
+    exports.POD_ROLE_BROKER = "egress-broker";
+  }
+});
+
+// ../contracts/dist/authoring-cli.js
+var require_authoring_cli = __commonJS({
+  "../contracts/dist/authoring-cli.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", {
+      value: true
+    });
+    exports.RETIRED_AUTHORING_CLI_ENV = exports.AUTHORING_CLI_ENV = void 0;
+    exports.AUTHORING_CLI_ENV = {
+      /** `runveric publish`: the access token. */
+      token: "RUNVERIC_TOKEN",
+      /** `runveric publish`: the control plane's origin. */
+      url: "RUNVERIC_URL",
+      /** `runveric test`: the runner image to run in, digest-pinned — the Author page shows it. */
+      runnerImage: "RUNVERIC_RUNNER_IMAGE"
+    };
+    exports.RETIRED_AUTHORING_CLI_ENV = {
+      token: "OPERA_TOKEN",
+      url: "OPERA_URL",
+      runnerImage: "OPERA_RUNNER_IMAGE"
+    };
   }
 });
 
@@ -2464,9 +2538,10 @@ var require_runners = __commonJS({
       }, "get")
     });
     var package_provenance_1 = require_package_provenance();
-    exports.RUNNER_REGISTRATION_TOKEN_HEADER = "x-opera-runner-registration-token";
-    exports.RUNNER_CREDENTIAL_HEADER = "x-opera-runner-credential";
-    exports.RUNNER_AUTHORIZATION_TOKEN_HEADER = "x-opera-runner-authorization";
+    var runner_install_1 = require_runner_install();
+    exports.RUNNER_REGISTRATION_TOKEN_HEADER = "x-runveric-runner-registration-token";
+    exports.RUNNER_CREDENTIAL_HEADER = "x-runveric-runner-credential";
+    exports.RUNNER_AUTHORIZATION_TOKEN_HEADER = "x-runveric-runner-authorization";
     exports.RUNNER_POOL_ACCEPTS_PROVENANCE_BY_DEFAULT = {
       // Imported from a Git source this tenant connected. Still not accepted by default: a pool
       // is a machine inside a customer's network, and nothing about it is implied by connecting a
@@ -2486,7 +2561,7 @@ var require_runners = __commonJS({
     }
     __name(poolAcceptsProvenance, "poolAcceptsProvenance");
     function containerNameFor(runnerName) {
-      return `opera-${runnerName.trim()}`;
+      return `${runner_install_1.RUNNER_CONTAINER_PREFIX}${runnerName.trim()}`;
     }
     __name(containerNameFor, "containerNameFor");
     exports.RUNNER_LIFECYCLES = [
@@ -3309,7 +3384,7 @@ var require_workspace_domain = __commonJS({
       "challenge_expired",
       "held_elsewhere"
     ];
-    exports.DOMAIN_VERIFICATION_RECORD_PREFIX = "opera-domain-verification=";
+    exports.DOMAIN_VERIFICATION_RECORD_PREFIX = "runveric-domain-verification=";
     function domainVerificationRecord(domain, token) {
       return {
         name: domain,
@@ -3516,6 +3591,8 @@ var require_dist = __commonJS({
     __exportStar(require_package_egress(), exports);
     __exportStar(require_package_execution(), exports);
     __exportStar(require_runner_confinement(), exports);
+    __exportStar(require_runner_install(), exports);
+    __exportStar(require_authoring_cli(), exports);
     __exportStar(require_runners(), exports);
     __exportStar(require_runner_pool_presence(), exports);
     __exportStar(require_routable_target(), exports);
@@ -3670,6 +3747,7 @@ var require_manifest_schema = __commonJS({
         return contracts_1.RISK_LEVELS;
       }, "get")
     });
+    var contracts_2 = require_dist();
     exports.MANIFEST_FIELDS = [
       "apiVersion",
       "id",
@@ -3695,7 +3773,7 @@ var require_manifest_schema = __commonJS({
       "secrets",
       "credentialScopes",
       "license",
-      "minOperaVersion"
+      "minRunvericVersion"
     ];
     exports.PACKAGE_ID_PATTERN = /^[a-z0-9-]+\/[a-z0-9-]+$/;
     exports.SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
@@ -3708,12 +3786,18 @@ var require_manifest_schema = __commonJS({
       "properties",
       "required",
       "additionalProperties",
-      // Opera's own annotation, carried INSIDE the schema it orders rather than in a second
+      // Our own annotation, carried INSIDE the schema it orders rather than in a second
       // column: the two would otherwise separate, and a schema whose order lives elsewhere is a
       // schema that renders in the wrong order the first time one of them is copied without the
       // other. Allowed here so a normalized schema round-trips through this validator rather than
       // being rejected as an unknown field.
-      "x-opera-order"
+      //
+      // ⛔ THIS LIST IS A REJECT-UNKNOWN ALLOWLIST. `x-opera-order` left it LAST in docs/108 —
+      // after the writer stopped stamping it, 0089 stripped it from every row, and the readers
+      // stopped reading it. Nothing re-validates a STORED schema (every caller of this validator
+      // is handed authored bytes), so the order was safe; an author's file that still carries the
+      // retired key is now refused by name, as any unknown field is.
+      contracts_2.PARAMETER_ORDER_KEY
     ];
     exports.PARAMETER_PROPERTY_FIELDS = [
       "type",
@@ -3814,7 +3898,7 @@ var require_manifest_validator = __commonJS({
       });
       validateCredentialScopes(value.credentialScopes, errors);
       requiredString(value, "license", errors, manifest_schema_1.SPDX_ID_PATTERN, "an SPDX identifier");
-      requiredString(value, "minOperaVersion", errors, manifest_schema_1.SEMVER_PATTERN, "MAJOR.MINOR.PATCH");
+      requiredString(value, "minRunvericVersion", errors, manifest_schema_1.SEMVER_PATTERN, "MAJOR.MINOR.PATCH");
       return errors.length === 0 && runtime !== void 0 ? {
         ok: true,
         // The normalized runtime replaces the authored one, exactly as `discover` ids are
@@ -3853,7 +3937,7 @@ var require_manifest_validator = __commonJS({
           const declaredType = validateParameterProperty(name, property, errors);
           normalizedProperties[name] = isRecord(property) ? validateDiscoveryAnnotations(name, property, declaredType, value.properties, declarationOrder, context?.providers, errors, warnings) : property;
         }
-        validateParameterOrder(value["x-opera-order"], declarationOrder, errors);
+        validateParameterOrder(value[contracts_1.PARAMETER_ORDER_KEY], contracts_1.PARAMETER_ORDER_KEY, declarationOrder, errors);
       }
       if (!Array.isArray(value.required) || !value.required.every(isString)) {
         add(errors, "parameters.required", "Expected an array of property names.", "type");
@@ -4153,9 +4237,9 @@ var require_manifest_validator = __commonJS({
       }
     }
     __name(validateDependency, "validateDependency");
-    function validateParameterOrder(value, declarationOrder, errors) {
+    function validateParameterOrder(value, key, declarationOrder, errors) {
       if (value === void 0) return;
-      const path = "parameters.x-opera-order";
+      const path = `parameters.${key}`;
       if (!Array.isArray(value) || !value.every(isString)) {
         add(errors, path, "Expected an array of property names.", "type");
         return;
@@ -5086,7 +5170,7 @@ var require_authoring_lint = __commonJS({
       ".sh",
       ".py"
     ];
-    var RESULT_FILE_VARIABLE = "OPERA_RESULT_FILE";
+    var RESULT_FILE_VARIABLE = "RUNVERIC_RESULT_FILE";
     var ENTRYPOINT_PHASES = [
       {
         field: "entrypoint",
@@ -5675,7 +5759,7 @@ summary: ${yamlString(`${input.name} \u2014 describe in one line what an operato
 category: compute
 providers:
   - azure
-connectorKey: opera.package-runner
+connectorKey: ${contracts_1.PACKAGE_RUNNER_CONNECTOR_KEY}
 
 # \u2500\u2500 How it runs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 runtime:
@@ -5715,7 +5799,7 @@ secrets: []
 
 # \u2500\u2500 Publishing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 license: MIT
-minOperaVersion: 1.0.0
+minRunvericVersion: 1.0.0
 `;
     }
     __name(manifest, "manifest");
@@ -5752,12 +5836,12 @@ minOperaVersion: 1.0.0
       return `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 # OPERA'S WRAPPER. This file is the CONTRACT; ${bodyPath} is YOURS.
 #
-# ${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at ${sigil}OPERA_RESULT_FILE. A script
+# ${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at ${sigil}RUNVERIC_RESULT_FILE. A script
 # that exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} says so rather than inventing
 # a result. This file is what makes that impossible to get wrong by accident:
 #
 #   * it starts ${bodyPath} \u2014 your script, unchanged;
-#   * if your script wrote ${sigil}OPERA_RESULT_FILE itself, this file leaves it exactly alone;
+#   * if your script wrote ${sigil}RUNVERIC_RESULT_FILE itself, this file leaves it exactly alone;
 #   * otherwise it writes one for you \u2014 succeeded when your script exits 0, failed with the exit
 #     code and a result.error when it does not \u2014 carrying whatever your script printed as the
 #     message.
@@ -5768,21 +5852,21 @@ minOperaVersion: 1.0.0
 # WHERE YOUR SCRIPT RUNS. This file moves to the PACKAGE ROOT before starting yours, so a
 # relative path in your script means what it meant on your laptop \u2014 \`source ./lib/util.sh\` and
 # \`. ./lib/helpers.ps1\` resolve against the package, not against wherever the runner happened
-# to start. The package root is READ-ONLY and NON-EXECUTABLE: write to ${sigil}OPERA_WORK_DIR,
+# to start. The package root is READ-ONLY and NON-EXECUTABLE: write to ${sigil}RUNVERIC_WORK_DIR,
 # and call another script through your interpreter (\`bash ./tool.sh\`) rather than executing it
-# directly. ${sigil}OPERA_PACKAGE_ROOT is exported so your script can be explicit rather than
+# directly. ${sigil}RUNVERIC_PACKAGE_ROOT is exported so your script can be explicit rather than
 # assume.
 #
 # THE CONTRACT (docs/22), identical in every language:
-#   ${sigil}OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   ${sigil}OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   ${sigil}OPERA_RESULT_FILE       where the result is WRITTEN \u2014 the only result channel
-#   ${sigil}OPERA_DRY_RUN           "true" when the operator asked for a rehearsal. PASSED
+#   ${sigil}RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   ${sigil}RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   ${sigil}RUNVERIC_RESULT_FILE       where the result is WRITTEN \u2014 the only result channel
+#   ${sigil}RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal. PASSED
 #                             THROUGH, never acted on here: only your script knows which of
 #                             its steps change anything.
-#   ${sigil}OPERA_WORK_DIR          scratch space; nothing else is writable
-#   ${sigil}OPERA_PACKAGE_ROOT      this package's root, and the working directory
-# Anything printed to stdout becomes a log line. A line starting with OPERA_EVENT becomes a
+#   ${sigil}RUNVERIC_WORK_DIR          scratch space; nothing else is writable
+#   ${sigil}RUNVERIC_PACKAGE_ROOT      this package's root, and the working directory
+# Anything printed to stdout becomes a log line. A line starting with RUNVERIC_EVENT becomes a
 # structured event.
 #
 # The runner starts run/${entryFile} the same way this file starts ${bodyPath}.
@@ -5829,7 +5913,7 @@ $ErrorActionPreference = 'Continue'
 # setting only the first is a classic way to get a script that resolves paths differently from
 # the tools it calls.
 $operaPackageRoot = (Resolve-Path -LiteralPath (Join-Path $PSScriptRoot '..')).Path
-$env:OPERA_PACKAGE_ROOT = $operaPackageRoot
+$env:RUNVERIC_PACKAGE_ROOT = $operaPackageRoot
 Set-Location -LiteralPath $operaPackageRoot
 [Environment]::CurrentDirectory = $operaPackageRoot
 
@@ -5846,7 +5930,7 @@ $operaCaptured = [System.Collections.Generic.List[string]]::new()
 
 # \u2500\u2500\u2500 THE OPERATOR'S ANSWERS, BOUND TO YOUR OWN param() BLOCK \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 #
-# ${contracts_1.BRAND_SHORT_NAME} delivers the operator's answers as JSON at $env:OPERA_PARAMETERS_FILE. A script written
+# ${contracts_1.BRAND_SHORT_NAME} delivers the operator's answers as JSON at $env:RUNVERIC_PARAMETERS_FILE. A script written
 # outside ${contracts_1.BRAND_SHORT_NAME} receives its values through its param() block. THOSE ARE DIFFERENT MECHANISMS,
 # and nothing joins them unless this file does \u2014 so without the lines below a run form built from
 # a param() block would collect six answers and hand your script none of them.
@@ -5865,7 +5949,7 @@ $operaCaptured = [System.Collections.Generic.List[string]]::new()
 #
 # An answer your script does not declare is IGNORED, not an error \u2014 your script is the authority
 # on what it takes. A script with no param() block gets no arguments at all and reads
-# $env:OPERA_PARAMETERS_FILE itself, exactly as before.
+# $env:RUNVERIC_PARAMETERS_FILE itself, exactly as before.
 $operaDeclared = @()
 try {
     $operaTokens = $null
@@ -5884,10 +5968,10 @@ try {
 }
 
 $operaArguments = @()
-if ($operaDeclared.Count -gt 0 -and (Test-Path -LiteralPath $env:OPERA_PARAMETERS_FILE)) {
+if ($operaDeclared.Count -gt 0 -and (Test-Path -LiteralPath $env:RUNVERIC_PARAMETERS_FILE)) {
     $operaAnswers = $null
     try {
-        $operaAnswers = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
+        $operaAnswers = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
     } catch {
         $operaAnswers = $null
     }
@@ -5939,8 +6023,8 @@ $operaStatus = $LASTEXITCODE
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-$operaWritten = (Test-Path -LiteralPath $env:OPERA_RESULT_FILE) -and
-    ((Get-Item -LiteralPath $env:OPERA_RESULT_FILE).Length -gt 0)
+$operaWritten = (Test-Path -LiteralPath $env:RUNVERIC_RESULT_FILE) -and
+    ((Get-Item -LiteralPath $env:RUNVERIC_RESULT_FILE).Length -gt 0)
 if (-not $operaWritten) {
     $operaOutput = ($operaCaptured -join "\`n").Trim()
     # result.message is bounded at 4096 characters. Keep the TAIL, which is where a failure says
@@ -5965,7 +6049,7 @@ if (-not $operaWritten) {
             }
         }
     }
-    $operaResult | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8
+    $operaResult | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8
 }
 
 # The body's exit code is this package's exit code. ${contracts_1.BRAND_SHORT_NAME} cross-checks the two \u2014 a result that
@@ -5981,16 +6065,16 @@ exit $operaStatus
         return `${wrapperHeader(interpreter, "$", bodyPath)}
 # THE PACKAGE ROOT, and the working directory your script starts in \u2014 so \`source ./lib/util.sh\`
 # resolves against the package rather than against the scratch directory the runner starts in.
-OPERA_PACKAGE_ROOT="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-export OPERA_PACKAGE_ROOT
-cd "\${OPERA_PACKAGE_ROOT}"
+RUNVERIC_PACKAGE_ROOT="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+export RUNVERIC_PACKAGE_ROOT
+cd "\${RUNVERIC_PACKAGE_ROOT}"
 
 # THE ONE PLACE the author's path is written into this file. Everything below refers to the
 # variable, so an entrypoint containing a quote or a \`$\` is a string here and cannot become
 # syntax. The marker is how \`authoredEntrypointOf\` reads this line back \u2014 see that function.
 opera_body_path=${bashLiteral(bodyPath)} # ${ENTRYPOINT_MARKER}
-opera_body="\${OPERA_PACKAGE_ROOT}/\${opera_body_path}"
-opera_capture="\${OPERA_WORK_DIR}/.opera-body-output"
+opera_body="\${RUNVERIC_PACKAGE_ROOT}/\${opera_body_path}"
+opera_capture="\${RUNVERIC_WORK_DIR}/.runveric-body-output"
 
 # Both streams merged, so the transcript below is in the order the operator saw; \`tee\` keeps
 # every line arriving live rather than held until the body ends. errexit is lifted for exactly
@@ -6002,17 +6086,17 @@ set -e
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-if [ ! -s "\${OPERA_RESULT_FILE}" ]; then
-  OPERA_BODY_STATUS="\${opera_status}" OPERA_BODY_CAPTURE="\${opera_capture}" \\
-    OPERA_BODY_PATH="\${opera_body_path}" \\
-    python3 - > "\${OPERA_RESULT_FILE}" <<'PY'
+if [ ! -s "\${RUNVERIC_RESULT_FILE}" ]; then
+  RUNVERIC_BODY_STATUS="\${opera_status}" RUNVERIC_BODY_CAPTURE="\${opera_capture}" \\
+    RUNVERIC_BODY_PATH="\${opera_body_path}" \\
+    python3 - > "\${RUNVERIC_RESULT_FILE}" <<'PY'
 import json, os
 
 ${FALLBACK_RESULT_PYTHON}
 
-with open(os.environ["OPERA_BODY_CAPTURE"], encoding="utf-8", errors="replace") as handle:
+with open(os.environ["RUNVERIC_BODY_CAPTURE"], encoding="utf-8", errors="replace") as handle:
     captured = handle.read()
-print(json.dumps(opera_result(int(os.environ["OPERA_BODY_STATUS"]), captured, os.environ["OPERA_BODY_PATH"])))
+print(json.dumps(opera_result(int(os.environ["RUNVERIC_BODY_STATUS"]), captured, os.environ["RUNVERIC_BODY_PATH"])))
 PY
 fi
 
@@ -6037,7 +6121,7 @@ ${FALLBACK_RESULT_PYTHON}
 # or \`import\` resolves against the package rather than against the scratch directory the runner
 # starts in. os.chdir moves this process, and the body inherits it.
 opera_package_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-os.environ["OPERA_PACKAGE_ROOT"] = opera_package_root
+os.environ["RUNVERIC_PACKAGE_ROOT"] = opera_package_root
 os.chdir(opera_package_root)
 
 # THE ONE PLACE the author's path is written into this file. Everything below refers to the
@@ -6064,7 +6148,7 @@ opera_status = opera_process.wait()
 
 # THE BODY'S OWN RESULT WINS. The wrapper fills a gap; it never overwrites what an author
 # reported for themselves \u2014 outputs, checks and rollbackCapture all arrive this way.
-opera_result_file = os.environ["OPERA_RESULT_FILE"]
+opera_result_file = os.environ["RUNVERIC_RESULT_FILE"]
 opera_written = os.path.exists(opera_result_file) and os.path.getsize(opera_result_file) > 0
 if not opera_written:
     with open(opera_result_file, "w", encoding="utf-8") as handle:
@@ -6084,27 +6168,27 @@ sys.exit(opera_status)
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   $env:OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   $env:OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   $env:OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   $env:RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   $env:RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   $env:RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                                anything below changes something
-#   $env:OPERA_WORK_DIR          scratch space; nothing else is writable
+#   $env:RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 $env:OPERA_PACKAGE_ROOT \u2014 so
+# WHERE YOU ARE. Your script runs from the package root \u2014 $env:RUNVERIC_PACKAGE_ROOT \u2014 so
 # \`. ./lib/helpers.ps1\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to $env:OPERA_WORK_DIR, and start another script through its
+# and NON-EXECUTABLE: write to $env:RUNVERIC_WORK_DIR, and start another script through its
 # interpreter (\`pwsh ./tool.ps1\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to $env:OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.ps1 says how.
+# to $env:RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.ps1 says how.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
-$parameters = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
-$context = Get-Content -LiteralPath $env:OPERA_CONTEXT_FILE -Raw | ConvertFrom-Json
-$dryRun = $env:OPERA_DRY_RUN -eq 'true'
+$parameters = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
+$context = Get-Content -LiteralPath $env:RUNVERIC_CONTEXT_FILE -Raw | ConvertFrom-Json
+$dryRun = $env:RUNVERIC_DRY_RUN -eq 'true'
 
 # Strict mode makes reading an absent property an error rather than an empty string, so an
 # optional parameter is asked for explicitly. That is the point of strict mode: the failure
@@ -6118,85 +6202,85 @@ Write-Output "Running for execution $($context.executionId)."
 Write-Output "Note: \${note}"
 
 if ($dryRun) {
-    Write-Output 'OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
+    Write-Output 'RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
 } else {
     # Do the real work here.
-    Write-Output 'OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
+    Write-Output 'RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
 }
 `,
       bash: `# YOUR SCRIPT. run/main.sh \u2014 ${contracts_1.BRAND_SHORT_NAME}'s wrapper \u2014 starts this file and writes the run's result
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   $OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   $OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   $OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   $RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   $RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   $RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                            anything below changes something
-#   $OPERA_WORK_DIR          scratch space; nothing else is writable
+#   $RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 $OPERA_PACKAGE_ROOT \u2014 so
+# WHERE YOU ARE. Your script runs from the package root \u2014 $RUNVERIC_PACKAGE_ROOT \u2014 so
 # \`source ./lib/util.sh\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to $OPERA_WORK_DIR, and start another script through its
+# and NON-EXECUTABLE: write to $RUNVERIC_WORK_DIR, and start another script through its
 # interpreter (\`bash ./tool.sh\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to $OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.sh says how.
+# to $RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.sh says how.
 #
 # Started with \`bash -euo pipefail\`, so a failing command ends the run instead of continuing
 # past it.
 
-note="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["OPERA_PARAMETERS_FILE"])).get("note",""))')"
-execution_id="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["OPERA_CONTEXT_FILE"]))["executionId"])')"
+note="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["RUNVERIC_PARAMETERS_FILE"])).get("note",""))')"
+execution_id="$(python3 -c 'import json,os,sys; print(json.load(open(os.environ["RUNVERIC_CONTEXT_FILE"]))["executionId"])')"
 
 echo "Running for execution \${execution_id}."
 echo "Note: \${note}"
 
-if [ "\${OPERA_DRY_RUN}" = "true" ]; then
-  echo 'OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
+if [ "\${RUNVERIC_DRY_RUN}" = "true" ]; then
+  echo 'RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}'
 else
   # Do the real work here.
-  echo 'OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
+  echo 'RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}'
 fi
 `,
       python: `# YOUR SCRIPT. run/main.py \u2014 ${contracts_1.BRAND_SHORT_NAME}'s wrapper \u2014 starts this file and writes the run's result
 # from whether it exits 0 and what it printed. Anything that runs is a working action.
 #
 # What you are given:
-#   OPERA_PARAMETERS_FILE   the operator's answers, as JSON
-#   OPERA_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
-#   OPERA_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
+#   RUNVERIC_PARAMETERS_FILE   the operator's answers, as JSON
+#   RUNVERIC_CONTEXT_FILE      non-secret run metadata (execution id, provider, scope)
+#   RUNVERIC_DRY_RUN           "true" when the operator asked for a rehearsal \u2014 HONOUR IT if
 #                           anything below changes something
-#   OPERA_WORK_DIR          scratch space; nothing else is writable
+#   RUNVERIC_WORK_DIR          scratch space; nothing else is writable
 # Anything you print becomes a log line, and becomes the run's message.
 #
-# WHERE YOU ARE. Your script runs from the package root \u2014 OPERA_PACKAGE_ROOT \u2014 so a relative
+# WHERE YOU ARE. Your script runs from the package root \u2014 RUNVERIC_PACKAGE_ROOT \u2014 so a relative
 # \`open()\` or \`import\` resolves the way it does on your laptop. That directory is READ-ONLY
-# and NON-EXECUTABLE: write to OPERA_WORK_DIR, and start another script through its interpreter
+# and NON-EXECUTABLE: write to RUNVERIC_WORK_DIR, and start another script through its interpreter
 # (\`python3 ./tool.py\`) rather than executing it directly.
 #
 # WANT MORE THAN A MESSAGE \u2014 outputs, a rollbackCapture, your own error code? Write that JSON
-# to OPERA_RESULT_FILE yourself and the wrapper leaves it alone. run/main.py says how.
+# to RUNVERIC_RESULT_FILE yourself and the wrapper leaves it alone. run/main.py says how.
 
 import json
 import os
 
-with open(os.environ["OPERA_PARAMETERS_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_PARAMETERS_FILE"], encoding="utf-8") as handle:
     parameters = json.load(handle)
-with open(os.environ["OPERA_CONTEXT_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_CONTEXT_FILE"], encoding="utf-8") as handle:
     context = json.load(handle)
 
-dry_run = os.environ.get("OPERA_DRY_RUN") == "true"
+dry_run = os.environ.get("RUNVERIC_DRY_RUN") == "true"
 note = parameters.get("note", "")
 
 print(f"Running for execution {context['executionId']}.")
 print(f"Note: {note}")
 
 if dry_run:
-    print('OPERA_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}')
+    print('RUNVERIC_EVENT {"level":"info","message":"Dry run \u2014 nothing was changed."}')
 else:
     # Do the real work here.
-    print('OPERA_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}')
+    print('RUNVERIC_EVENT {"level":"success","message":"Nothing to change yet \u2014 this is a new action."}')
 `
     };
     var VALIDATE_SCRIPT = {
@@ -6209,7 +6293,7 @@ reason, you do not also need result.error.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
-$parameters = Get-Content -LiteralPath $env:OPERA_PARAMETERS_FILE -Raw | ConvertFrom-Json
+$parameters = Get-Content -LiteralPath $env:RUNVERIC_PARAMETERS_FILE -Raw | ConvertFrom-Json
 
 $checks = @(
     [ordered]@{ status = 'passed'; message = 'The note is present.' }
@@ -6221,7 +6305,7 @@ $failed = @($checks | Where-Object { $_.status -eq 'failed' }).Count -gt 0
     status          = if ($failed) { 'failed' } else { 'succeeded' }
     message         = if ($failed) { 'Pre-flight found a blocking problem.' } else { 'Pre-flight passed.' }
     checks          = $checks
-} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8`,
+} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8`,
       bash: `The VALIDATE phase \u2014 a pre-flight that changes nothing.
 Enable it with \`validateEntrypoint: validate/\` in action.yaml, then uncomment this file.
 
@@ -6229,7 +6313,7 @@ A validate result carries CHECKS and no outputs. One entry per thing you checked
 passed / warning / failed. If any check failed, set status to "failed" \u2014 the checks ARE the
 reason, you do not also need result.error.
 
-python3 - <<'PY' > "\${OPERA_RESULT_FILE}"
+python3 - <<'PY' > "\${RUNVERIC_RESULT_FILE}"
 import json
 checks = [{"status": "passed", "message": "The note is present."}]
 failed = any(check["status"] == "failed" for check in checks)
@@ -6253,7 +6337,7 @@ import os
 checks = [{"status": "passed", "message": "The note is present."}]
 failed = any(check["status"] == "failed" for check in checks)
 
-with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_RESULT_FILE"], "w", encoding="utf-8") as handle:
     json.dump(
         {
             "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6269,28 +6353,28 @@ with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at $env:OPERA_PRIOR_RESULT_FILE. That is why a
+Rollback reads what the run phase captured, at $env:RUNVERIC_PRIOR_RESULT_FILE. That is why a
 run that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
-$prior = Get-Content -LiteralPath $env:OPERA_PRIOR_RESULT_FILE -Raw | ConvertFrom-Json
+$prior = Get-Content -LiteralPath $env:RUNVERIC_PRIOR_RESULT_FILE -Raw | ConvertFrom-Json
 
 [ordered]@{
     protocolVersion = '${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}'
     status          = 'succeeded'
     message         = 'Rolled back.'
-} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:OPERA_RESULT_FILE -Encoding utf8`,
+} | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $env:RUNVERIC_RESULT_FILE -Encoding utf8`,
       bash: `The ROLLBACK phase \u2014 undo what the run phase did.
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at $OPERA_PRIOR_RESULT_FILE. That is why a run
+Rollback reads what the run phase captured, at $RUNVERIC_PRIOR_RESULT_FILE. That is why a run
 that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
-python3 - <<'PY' > "\${OPERA_RESULT_FILE}"
+python3 - <<'PY' > "\${RUNVERIC_RESULT_FILE}"
 import json
 print(json.dumps({
     "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6302,17 +6386,17 @@ PY`,
 Enable it by setting \`rollback: true\`, \`rollbackEntrypoint: rollback/\` and
 \`capabilities.rollback: true\` in action.yaml, then uncomment this file.
 
-Rollback reads what the run phase captured, at OPERA_PRIOR_RESULT_FILE. That is why a run
+Rollback reads what the run phase captured, at RUNVERIC_PRIOR_RESULT_FILE. That is why a run
 that intends to be undoable writes \`rollbackCapture\` into its result \u2014 this phase has
 nothing else to work from.
 
 import json
 import os
 
-with open(os.environ["OPERA_PRIOR_RESULT_FILE"], encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_PRIOR_RESULT_FILE"], encoding="utf-8") as handle:
     prior = json.load(handle)
 
-with open(os.environ["OPERA_RESULT_FILE"], "w", encoding="utf-8") as handle:
+with open(os.environ["RUNVERIC_RESULT_FILE"], "w", encoding="utf-8") as handle:
     json.dump(
         {
             "protocolVersion": "${contracts_1.PACKAGE_RESULT_PROTOCOL_VERSION}",
@@ -6339,7 +6423,7 @@ point of it is that the loop below works before you have written anything.
 
 **\`run/${bodyFile}\` is your script. \`run/${entryFile}\` is ${contracts_1.BRAND_SHORT_NAME}'s wrapper.**
 
-${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`OPERA_RESULT_FILE\`. A package that
+${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`RUNVERIC_RESULT_FILE\`. A package that
 exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} refuses it rather than inventing a
 result \u2014 that strictness is what makes every check, output and rollback capture in the product
 worth trusting.
@@ -6347,7 +6431,7 @@ worth trusting.
 \`run/${entryFile}\` is what keeps you on the right side of it. It starts \`run/${bodyFile}\`,
 and then:
 
-- if your script wrote \`OPERA_RESULT_FILE\` itself, it leaves that result exactly alone;
+- if your script wrote \`RUNVERIC_RESULT_FILE\` itself, it leaves that result exactly alone;
 - otherwise it writes one \u2014 **succeeded** when your script exits 0, **failed** with the exit
   code and a \`result.error\` when it does not \u2014 carrying whatever your script printed as the
   message.
@@ -6410,14 +6494,14 @@ script and reports the result.
 
 ## The result contract, and why the wrapper is there
 
-${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`OPERA_RESULT_FILE\`. A package that
+${contracts_1.BRAND_SHORT_NAME} reads exactly one thing from a package: the JSON at \`RUNVERIC_RESULT_FILE\`. A package that
 exits 0 without writing one has reported nothing, and ${contracts_1.BRAND_SHORT_NAME} refuses it rather than inventing a
 result \u2014 that strictness is what makes every check, output and rollback capture in the product
 worth trusting.
 
 \`run/${entryFile}\` keeps you on the right side of it. It starts \`${input.entrypoint}\`, and then:
 
-- if your script wrote \`OPERA_RESULT_FILE\` itself, it leaves that result exactly alone;
+- if your script wrote \`RUNVERIC_RESULT_FILE\` itself, it leaves that result exactly alone;
 - otherwise it writes one \u2014 **succeeded** when your script exits 0, **failed** with the exit
   code and a \`result.error\` when it does not \u2014 carrying whatever your script printed as the
   message.
@@ -6426,12 +6510,12 @@ So a script that only prints something is already a complete action.
 
 ## Where your script runs
 
-From the **package root**, which is also \`OPERA_PACKAGE_ROOT\`. That is what makes
+From the **package root**, which is also \`RUNVERIC_PACKAGE_ROOT\`. That is what makes
 \`source ./lib/util.sh\` and \`. ./lib/helpers.ps1\` resolve the way they do on your laptop.
 
 Two things about that directory are worth knowing before your first run:
 
-- it is **read-only** \u2014 write to \`OPERA_WORK_DIR\`, the only writable location;
+- it is **read-only** \u2014 write to \`RUNVERIC_WORK_DIR\`, the only writable location;
 - it is **non-executable** \u2014 start another script through its interpreter
   (\`bash ./tool.sh\`, \`pwsh ./tool.ps1\`) rather than executing it directly.
 
@@ -6486,7 +6570,7 @@ SOFTWARE.
     }
     __name(license, "license");
     var GITIGNORE = `# runveric test writes its scratch here.
-.opera/
+.runveric/
 *.log
 `;
     function yamlString(value) {
@@ -6857,7 +6941,7 @@ var require_dist2 = __commonJS({
 });
 
 // package.json
-var version = "0.1.1";
+var version = "0.1.2";
 
 // src/check.ts
 var import_action_manifest = __toESM(require_dist2());
@@ -6868,7 +6952,7 @@ import { readdir, readFile, stat } from "fs/promises";
 import { join, relative, sep } from "path";
 var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".git",
-  ".opera",
+  ".runveric",
   "node_modules",
   ".venv",
   "__pycache__",
@@ -7175,14 +7259,32 @@ __name(titleCase, "titleCase");
 var import_action_manifest3 = __toESM(require_dist2());
 var import_contracts3 = __toESM(require_dist());
 import { resolve as resolve3 } from "path";
-var TOKEN_ENV = "OPERA_TOKEN";
-var URL_ENV = "OPERA_URL";
+
+// src/renamed-variable.ts
+function renamedVariableRefusal(current, retired, env = process.env) {
+  if (env[current]?.trim()) return null;
+  if (!env[retired]?.trim()) return null;
+  return `${retired} is set, but this CLI reads ${current} \u2014 the variable was renamed in 0.1.2. Rename the export in your shell or CI; ${retired} is no longer read.`;
+}
+__name(renamedVariableRefusal, "renamedVariableRefusal");
+
+// src/publish.ts
+var TOKEN_ENV = import_contracts3.AUTHORING_CLI_ENV.token;
+var URL_ENV = import_contracts3.AUTHORING_CLI_ENV.url;
 async function runPublish(options) {
   const directory = resolve3(options.directory ?? ".");
   const baseUrl = (options.to ?? process.env[URL_ENV] ?? "").trim().replace(/\/+$/, "");
   const token = (options.token ?? process.env[TOKEN_ENV] ?? "").trim();
+  const stale = [
+    options.to === void 0 ? renamedVariableRefusal(URL_ENV, import_contracts3.RETIRED_AUTHORING_CLI_ENV.url) : null,
+    options.token === void 0 ? renamedVariableRefusal(TOKEN_ENV, import_contracts3.RETIRED_AUTHORING_CLI_ENV.token) : null
+  ].filter((sentence) => sentence !== null);
+  if (stale.length > 0) {
+    for (const sentence of stale) printError(style.red(sentence));
+    return 1;
+  }
   if (!baseUrl) {
-    printError(style.red("Where to?") + ` Pass --to https://your-opera.example.com, or set ${URL_ENV}.`);
+    printError(style.red("Where to?") + ` Pass --to https://your-runveric.example.com, or set ${URL_ENV}.`);
     return 1;
   }
   if (!token) {
@@ -7285,6 +7387,79 @@ function formatProblem(text) {
 }
 __name(formatProblem, "formatProblem");
 
+// src/runner-image.ts
+var import_contracts4 = __toESM(require_dist());
+import { execFile } from "child_process";
+import { promisify } from "util";
+var run = promisify(execFile);
+var LOCAL_RUNNER_IMAGE = "runveric-package-runner:local";
+var RUNNER_IMAGE_ENV = import_contracts4.AUTHORING_CLI_ENV.runnerImage;
+var RenamedVariableError = class extends Error {
+  static {
+    __name(this, "RenamedVariableError");
+  }
+};
+function resolveRunnerImage(flag) {
+  const explicit = flag?.trim();
+  if (explicit) return {
+    reference: explicit,
+    origin: "flag"
+  };
+  const configured = process.env[RUNNER_IMAGE_ENV]?.trim();
+  if (configured) return {
+    reference: configured,
+    origin: "environment"
+  };
+  const stale = renamedVariableRefusal(RUNNER_IMAGE_ENV, import_contracts4.RETIRED_AUTHORING_CLI_ENV.runnerImage);
+  if (stale) throw new RenamedVariableError(stale);
+  return {
+    reference: LOCAL_RUNNER_IMAGE,
+    origin: "local-build"
+  };
+}
+__name(resolveRunnerImage, "resolveRunnerImage");
+function runnerImageNote(image) {
+  switch (image.origin) {
+    case "flag":
+      return "from --image";
+    case "environment":
+      return `from ${RUNNER_IMAGE_ENV}`;
+    case "local-build":
+      return `locally built \u2014 NOT the image your ${import_contracts4.BRAND_SHORT_NAME} runs; set ${RUNNER_IMAGE_ENV} to match it`;
+  }
+}
+__name(runnerImageNote, "runnerImageNote");
+var DockerMissingError = class extends Error {
+  static {
+    __name(this, "DockerMissingError");
+  }
+};
+async function assertDockerAvailable() {
+  try {
+    await run("docker", [
+      "version",
+      "--format",
+      "{{.Server.Version}}"
+    ]);
+  } catch {
+    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts4.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
+  }
+}
+__name(assertDockerAvailable, "assertDockerAvailable");
+async function imageIsPresent(reference) {
+  try {
+    await run("docker", [
+      "image",
+      "inspect",
+      reference
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(imageIsPresent, "imageIsPresent");
+
 // src/test.ts
 var import_action_manifest4 = __toESM(require_dist2());
 import { spawn } from "child_process";
@@ -7294,9 +7469,9 @@ import { dirname as dirname2, join as join3, resolve as resolve4 } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/azure-credential.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var run = promisify(execFile);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var run2 = promisify2(execFile2);
 var AzureCredentialError = class extends Error {
   static {
     __name(this, "AzureCredentialError");
@@ -7343,7 +7518,7 @@ __name(acquireAzureCredential, "acquireAzureCredential");
 async function azJson(args) {
   let stdout;
   try {
-    ({ stdout } = await run("az", args, {
+    ({ stdout } = await run2("az", args, {
       maxBuffer: 8 * 1024 * 1024
     }));
   } catch (error) {
@@ -7359,72 +7534,6 @@ ${message.trim()}`);
 }
 __name(azJson, "azJson");
 
-// src/runner-image.ts
-var import_contracts4 = __toESM(require_dist());
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var run2 = promisify2(execFile2);
-var LOCAL_RUNNER_IMAGE = "opera-package-runner:local";
-var RUNNER_IMAGE_ENV = "OPERA_RUNNER_IMAGE";
-function resolveRunnerImage(flag) {
-  const explicit = flag?.trim();
-  if (explicit) return {
-    reference: explicit,
-    origin: "flag"
-  };
-  const configured = process.env[RUNNER_IMAGE_ENV]?.trim();
-  if (configured) return {
-    reference: configured,
-    origin: "environment"
-  };
-  return {
-    reference: LOCAL_RUNNER_IMAGE,
-    origin: "local-build"
-  };
-}
-__name(resolveRunnerImage, "resolveRunnerImage");
-function runnerImageNote(image) {
-  switch (image.origin) {
-    case "flag":
-      return "from --image";
-    case "environment":
-      return `from ${RUNNER_IMAGE_ENV}`;
-    case "local-build":
-      return `locally built \u2014 NOT the image your ${import_contracts4.BRAND_SHORT_NAME} runs; set OPERA_RUNNER_IMAGE to match it`;
-  }
-}
-__name(runnerImageNote, "runnerImageNote");
-var DockerMissingError = class extends Error {
-  static {
-    __name(this, "DockerMissingError");
-  }
-};
-async function assertDockerAvailable() {
-  try {
-    await run2("docker", [
-      "version",
-      "--format",
-      "{{.Server.Version}}"
-    ]);
-  } catch {
-    throw new DockerMissingError(`Docker is not available. \`runveric test\` runs your package in the real ${import_contracts4.BRAND_SHORT_NAME} runner image, which needs a container runtime \u2014 install Docker Desktop (or start it), then try again. \`runveric check\` needs nothing and still works.`);
-  }
-}
-__name(assertDockerAvailable, "assertDockerAvailable");
-async function imageIsPresent(reference) {
-  try {
-    await run2("docker", [
-      "image",
-      "inspect",
-      reference
-    ]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-__name(imageIsPresent, "imageIsPresent");
-
 // src/test.ts
 var import_contracts5 = __toESM(require_dist());
 var PHASES = [
@@ -7433,11 +7542,11 @@ var PHASES = [
   "rollback"
 ];
 var CONTAINER = {
-  packageRoot: "/opera/package",
-  input: "/opera/input",
-  output: "/opera/output",
-  scratch: "/opera/scratch",
-  creds: "/opera/creds"
+  packageRoot: "/runveric/package",
+  input: "/runveric/input",
+  output: "/runveric/output",
+  scratch: "/runveric/scratch",
+  creds: "/runveric/creds"
 };
 async function runTest(options) {
   const directory = resolve4(options.directory ?? ".");
@@ -7476,7 +7585,13 @@ async function runTest(options) {
     printError(style.red(error instanceof Error ? error.message : String(error)));
     return 1;
   }
-  const image = resolveRunnerImage(options.image);
+  let image;
+  try {
+    image = resolveRunnerImage(options.image);
+  } catch (error) {
+    printError(style.red(error instanceof Error ? error.message : String(error)));
+    return 1;
+  }
   try {
     await assertDockerAvailable();
   } catch (error) {
@@ -7515,7 +7630,7 @@ async function runTest(options) {
     } else {
       print(`  network        ${style.grey("none \u2014 this package declares requiresNetwork: false")}`);
     }
-    if (options.dryRun) print(`  ${style.bold("dry run")}       OPERA_DRY_RUN=true`);
+    if (options.dryRun) print(`  ${style.bold("dry run")}       RUNVERIC_DRY_RUN=true`);
     if (!await imageIsPresent(image.reference)) {
       print(`  ${style.grey("pulling the image (first run only)\u2026")}`);
     }
@@ -7645,27 +7760,27 @@ async function runContainer(options) {
   const launch = import_action_manifest4.PACKAGE_INTERPRETER_LAUNCH[options.interpreter];
   const script = `${CONTAINER.packageRoot}/${options.entrypoint}${launch.entryFile}`;
   const environment = {
-    OPERA_PROTOCOL_VERSION: import_contracts5.PACKAGE_RESULT_PROTOCOL_VERSION,
-    OPERA_PHASE: options.phase,
-    OPERA_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
-    OPERA_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
-    OPERA_RESULT_FILE: `${CONTAINER.output}/result.json`,
-    OPERA_WORK_DIR: CONTAINER.scratch,
-    OPERA_CANCEL_FILE: `${CONTAINER.input}/cancel.requested`,
-    OPERA_DRY_RUN: options.dryRun ? "true" : "false",
+    RUNVERIC_PROTOCOL_VERSION: import_contracts5.PACKAGE_RESULT_PROTOCOL_VERSION,
+    RUNVERIC_PHASE: options.phase,
+    RUNVERIC_CONTEXT_FILE: `${CONTAINER.input}/context.json`,
+    RUNVERIC_PARAMETERS_FILE: `${CONTAINER.input}/parameters.json`,
+    RUNVERIC_RESULT_FILE: `${CONTAINER.output}/result.json`,
+    RUNVERIC_WORK_DIR: CONTAINER.scratch,
+    RUNVERIC_CANCEL_FILE: `${CONTAINER.input}/cancel.requested`,
+    RUNVERIC_DRY_RUN: options.dryRun ? "true" : "false",
     // HONEST, and matching the ACA runner's own reasoning: this flag means "there is no route
     // out at all". A container with `--network none` genuinely has none; one with a network
     // does not, whether or not an allowlist would have applied.
-    OPERA_NETWORK_ISOLATED: options.requiresNetwork ? "false" : "true",
+    RUNVERIC_NETWORK_ISOLATED: options.requiresNetwork ? "false" : "true",
     LANG: "C.UTF-8",
     LC_ALL: "C.UTF-8",
     POWERSHELL_TELEMETRY_OPTOUT: "1",
     DOTNET_CLI_TELEMETRY_OPTOUT: "1",
     ...options.layout.hasPriorResult ? {
-      OPERA_PRIOR_RESULT_FILE: `${CONTAINER.input}/prior-result.json`
+      RUNVERIC_PRIOR_RESULT_FILE: `${CONTAINER.input}/prior-result.json`
     } : {},
     ...options.layout.hasCredential ? {
-      OPERA_AZURE_TOKEN_FILE: `${CONTAINER.creds}/azure-token`
+      RUNVERIC_AZURE_TOKEN_FILE: `${CONTAINER.creds}/azure-token`
     } : {},
     ...options.credentialEnv ?? {}
   };
@@ -7748,7 +7863,7 @@ async function runContainer(options) {
 __name(runContainer, "runContainer");
 function emitLine(line, stderr, onEvent) {
   if (line.length === 0) return;
-  const prefix = "OPERA_EVENT ";
+  const prefix = "RUNVERIC_EVENT ";
   if (!stderr && line.startsWith(prefix)) {
     try {
       const parsed = JSON.parse(line.slice(prefix.length));
@@ -7760,7 +7875,7 @@ function emitLine(line, stderr, onEvent) {
     }
     onEvent({
       level: "warn",
-      message: "Package emitted malformed OPERA_EVENT JSON."
+      message: "Package emitted malformed RUNVERIC_EVENT JSON."
     });
     return;
   }
@@ -7778,7 +7893,7 @@ async function reportOutcome(options) {
   const exists = await stat2(options.resultPath).catch(() => null);
   if (!exists?.isFile() || exists.size === 0) {
     printError(style.red("\nThe package wrote no result.") + `
-  result.json is the only channel ${import_contracts5.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $OPERA_RESULT_FILE is a FAILED run, whatever the script printed.
+  result.json is the only channel ${import_contracts5.BRAND_SHORT_NAME} reads. Exiting ${options.exit.code ?? "with a signal"} without writing $RUNVERIC_RESULT_FILE is a FAILED run, whatever the script printed.
   Write it as the last thing your script does, on every path \u2014 including the ones that fail.`);
     return 1;
   }
@@ -7853,17 +7968,17 @@ ${style.bold("check")}
 
 ${style.bold("test")}
   --phase <name>          validate | run | rollback. Defaults to run.
-  --dry-run               Sets OPERA_DRY_RUN=true, as an operator's rehearsal does.
+  --dry-run               Sets RUNVERIC_DRY_RUN=true, as an operator's rehearsal does.
   --param <name=value>    A parameter value. Repeatable. Defaults come from your schema.
   --params-file <path>    A JSON object of parameters. --param overrides it.
   --prior-result <path>   The run's result.json. Required shape for --phase rollback.
-  --image <ref>           The runner image. Defaults to $OPERA_RUNNER_IMAGE.
+  --image <ref>           The runner image. Defaults to $${RUNNER_IMAGE_ENV}.
   --no-credential         Skip \`az account get-access-token\`.
-  --keep                  Keep the materialized /opera tree for inspection.
+  --keep                  Keep the materialized /runveric tree for inspection.
 
 ${style.bold("publish")}
-  --to <url>              Your ${import_contracts6.BRAND_SHORT_NAME} URL. Defaults to $OPERA_URL.
-  --token <token>         Access token. Defaults to $OPERA_TOKEN.
+  --to <url>              Your ${import_contracts6.BRAND_SHORT_NAME} URL. Defaults to $${URL_ENV}.
+  --token <token>         Access token. Defaults to $${TOKEN_ENV}.
   --force                 Publish despite lint errors. Never bypasses ${import_contracts6.BRAND_SHORT_NAME}'s validation.
 
 ${style.bold("EVERYWHERE")}