run402-mcp 4.97.0 → 4.98.0

package/README.md

@@ -69,7 +69,7 @@ run402 pay https://seller.example/translate --method POST \
 
 The SDK equivalent is
 `r.pay.fetch(url, init, { maxUsdMicros, idempotencyKey, requireReceipt })`;
-MCP callers use `pay_url` with `require_receipt: true`. All three return the
+MCP callers run the same SDK call as a `run` snippet. All three return the
 same `x402-commerce-result.v1` settlement, movement/replay, delivery, offer,
 merchant-receipt, signer-relationship, policy, and raw-evidence fields and pass
 unpriced URLs through with `payment: null`. Requiring a receipt rejects before
@@ -221,7 +221,7 @@ Matching is exact or final-prefix-wildcard only. `/admin` and `/admin/` are exac
 
 Routed functions use the Node 22 Fetch Request -> Response contract: `export default async function handler(req) { ... }`. `req.method` is the browser method, and `req.url` is the full public URL on managed subdomains, hosts, and verified custom domains. Derive OAuth callbacks from it, for example `new URL("/admin/oauth/google/callback", new URL(req.url).origin)`. Append multiple cookies with `headers.append("Set-Cookie", value)`; redirects, cookies, and query strings are preserved. On priced routes, import `getRoutedPaymentContext` from `@run402/functions`, read `const paymentContext = getRoutedPaymentContext(req)`, and key app-side idempotency by `paymentContext.paymentId`. For a receipt-enabled route, return `payment.fulfilled(response)` only after the response represents completed delivery; the helper fails closed outside a settled, current, receipt-enabled routed invocation. The context helper reads gateway-confirmed `x-run402-payment-*` headers and returns `null` for unpriced or direct calls. The raw `run402.routed_http.v1` envelope is internal; do not write route handlers against it.
 
-**Recipe: static home page + SPA shell.** A SPA site ships `index.html` as the shell serving every unmatched route (match `spa_fallback`), so by default `GET /` serves the shell too. To serve a real static home page at `/` while keeping the shell for app routes, ship `home.html` at the site root alongside `index.html` and add an exact root static route alias: `"routes": { "replace": [ { "pattern": "/", "target": { "type": "static", "file": "home.html" } } ] }`. Route matching runs before all static resolution (including the implicit `/` -> `index.html` root mapping), and SPA-fallback derivation is independent of the route table, so `GET /` serves `home.html` (`route_static_alias`), unmatched app routes such as `/dashboard` still serve the shell (`spa_fallback`), and named static pages keep serving unchanged (`static_exact`). Expect two non-blocking plan lints: `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn: the alias overrides what `/` would otherwise serve; accurate and expected here) and `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info: `/home.html` stays directly reachable in implicit public-path mode; add `<link rel="canonical">` to `home.html` if duplicate-content SEO matters). Omitting `routes` on later deploys carries the alias forward; `routes.replace` is total, so a pipeline that sends it must include the alias every time. Verify with `run402 deploy resolve --url https://<your-site>/ --method GET` or `deploy_resolve` and confirm `match: "route_static_alias"` with `target_file: "home.html"`.
+**Recipe: static home page + SPA shell.** A SPA site ships `index.html` as the shell serving every unmatched route (match `spa_fallback`), so by default `GET /` serves the shell too. To serve a real static home page at `/` while keeping the shell for app routes, ship `home.html` at the site root alongside `index.html` and add an exact root static route alias: `"routes": { "replace": [ { "pattern": "/", "target": { "type": "static", "file": "home.html" } } ] }`. Route matching runs before all static resolution (including the implicit `/` -> `index.html` root mapping), and SPA-fallback derivation is independent of the route table, so `GET /` serves `home.html` (`route_static_alias`), unmatched app routes such as `/dashboard` still serve the shell (`spa_fallback`), and named static pages keep serving unchanged (`static_exact`). Expect two non-blocking plan lints: `STATIC_ALIAS_SHADOWS_STATIC_PATH` (warn: the alias overrides what `/` would otherwise serve; accurate and expected here) and `STATIC_ALIAS_DUPLICATE_CANONICAL_URL` (info: `/home.html` stays directly reachable in implicit public-path mode; add `<link rel="canonical">` to `home.html` if duplicate-content SEO matters). Omitting `routes` on later deploys carries the alias forward; `routes.replace` is total, so a pipeline that sends it must include the alias every time. Verify with `run402 deploy resolve --url https://<your-site>/ --method GET` (or `r.project(id).apply.resolve`) and confirm `match: "route_static_alias"` with `target_file: "home.html"`.
 
 Avoid routing every static file, broad method lists by default, wildcard static route targets, leading-slash static files, directory shorthand, and one-static-route-target-per-page tables that exhaust route limits. Also watch wildcard function routes that shadow direct public static paths. Warning codes to handle include `STATIC_ALIAS_SHADOWS_STATIC_PATH`, `STATIC_ALIAS_RELATIVE_ASSET_RISK`, `STATIC_ALIAS_DUPLICATE_CANONICAL_URL`, `STATIC_ALIAS_EXTENSIONLESS_NON_HTML`, and `STATIC_ALIAS_TABLE_NEAR_LIMIT`; inspect active routes, `static_public_paths`, and resolve diagnostics to distinguish the route pattern from the backing `asset_path`.
 
@@ -233,7 +233,7 @@ run402 deploy resolve --url https://example.com/events?utm=x#hero --project prj_
 run402 deploy resolve --host example.com --path /events --project prj_123 --method GET
 ```
 
-`deploy_resolve` and `r.project(id).apply.resolve({ url, method: "GET" })` return `would_serve`, `diagnostic_status`, `match`, normalized request data, warnings, full resolution JSON, `edge_propagation`, and next steps. When returned, `asset_path`, `reachability_authority`, and `direct` explain which release asset backs the public URL and whether reachability came from implicit file-path mode, explicit `site.public_paths`, or a route-only static alias. Stable-host diagnostics may also include `authorization_result`, `cas_object` (`sha256`, `exists`, `expected_size`, `actual_size`), hostname-specific `response_variant`, route/static fields such as `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`, and `edge_propagation` (`settled`, `propagating`, or `sync_pending`). Known `match` literals are `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; preserve unknown future strings. Known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. `result` is the diagnostic body status, not the HTTP status of the SDK call, so host misses can still be successful CLI/MCP/SDK calls with `would_serve: false`. Do not treat resolve/diagnose as a fetch, cache purge, or cache-policy oracle; route method misses should inspect `allow`, CAS authorization/health failures should inspect or redeploy the affected static asset, and fresh host misses should inspect `edge_propagation` or rerun `run402 up verify`. Branch on structured JSON fields such as `cache_class` and preserve unknown cache classes.
+`r.project(id).apply.resolve({ url, method: "GET" })` (from MCP, a `run` snippet) returns `would_serve`, `diagnostic_status`, `match`, normalized request data, warnings, full resolution JSON, `edge_propagation`, and next steps. When returned, `asset_path`, `reachability_authority`, and `direct` explain which release asset backs the public URL and whether reachability came from implicit file-path mode, explicit `site.public_paths`, or a route-only static alias. Stable-host diagnostics may also include `authorization_result`, `cas_object` (`sha256`, `exists`, `expected_size`, `actual_size`), hostname-specific `response_variant`, route/static fields such as `allow`, `route_pattern`, `target_type`, `target_name`, and `target_file`, and `edge_propagation` (`settled`, `propagating`, or `sync_pending`). Known `match` literals are `host_missing`, `manifest_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `none`, `static_exact`, `static_index`, `spa_fallback`, `spa_fallback_missing`, `route_function`, `route_static_alias`, and `route_method_miss`; preserve unknown future strings. Known `authorization_result` values include `authorized`, `not_public`, `not_applicable`, `manifest_missing`, `target_missing`, `active_release_missing`, `unsupported_manifest_version`, `path_error`, `missing_cas_object`, `unfinalized_or_deleting_cas_object`, `size_mismatch`, and `unauthorized_cas_object`. Known `fallback_state` values include `active_release_missing`, `unsupported_manifest_version`, and `negative_cache_hit`; preserve unknown future strings. `result` is the diagnostic body status, not the HTTP status of the SDK call, so host misses can still be successful CLI/MCP/SDK calls with `would_serve: false`. Do not treat resolve/diagnose as a fetch, cache purge, or cache-policy oracle; route method misses should inspect `allow`, CAS authorization/health failures should inspect or redeploy the affected static asset, and fresh host misses should inspect `edge_propagation` or rerun `run402 up verify`. Branch on structured JSON fields such as `cache_class` and preserve unknown cache classes.
 
 Release observability exposes stable asset identity and public reachability. Inventories include `release_generation`, `static_manifest_sha256`, nullable `static_manifest_metadata` (`file_count`, `total_bytes`, `cache_classes`, `cache_class_sources`, `spa_fallback`), and `static_public_paths[]` when returned. `site.paths` lists release static assets; `static_public_paths[]` lists browser-visible public paths with `public_path`, `asset_path`, `reachability_authority`, `direct`, cache class, and content type. Plan and release diffs expose `static_assets` counters: unchanged/changed/added/removed, `newly_uploaded_cas_bytes`, `reused_cas_bytes`, `deployment_copy_bytes_eliminated`, `legacy_immutable_warnings`, `previous_immutable_failures`, and `cas_authorization_failures`.
 
@@ -544,22 +544,7 @@ The active project is sticky: `run402 projects use <project_id>` server-validate
 npx -y run402-mcp                        # standalone test
 ```
 
-### Buying only? Load 6 tools instead of 198
-
-The full server registers **198 tools (~43,000 tokens)** before you do anything. If your agent only wants to *buy* — generate an image for $0.03 and nothing else — that is a fifth to a third of a context window spent on 192 tools it will never call.
-
-```bash
-RUN402_MCP_PROFILE=buyer npx -y run402-mcp
-```
-
-| profile | tools | approx. tokens |
-|---|---:|---:|
-| *(unset — default)* | 198 | ~43,200 |
-| `buyer` | **8** | **~740** |
-
-The eight: `generate_image` · `init` · `check_balance` · `wallet_status` · `lightning_wallet` · `wallet_export` · `request_faucet` · `redeem_voucher` — enough to bootstrap a wallet, fund it (from the faucet or a promo code), check it, and buy. **Local, so it can actually pay:** an x402 payment needs a signing key, so a wallet-less remote server cannot make one.
-
-Default is unchanged when the variable is unset. An unknown profile name **exits 1** with the known-profile list rather than silently serving the full surface or nothing.
+Eight tools, a few kilobytes of schema in a host's context: `up` and `deploy` for the first deploy, `status`, `whoami`, `doctor`, `docs`, `run`, and `expand_result`. Everything else is a `run` snippet against `r`, the Node SDK client, executed in a QuickJS-in-WebAssembly sandbox with no filesystem, process, or network of its own. Needs Node.js 22.13 or later. **Local, so it can actually pay:** an x402 payment needs a signing key, so a wallet-less remote server cannot make one.
 
 ### Remote endpoint (no install)
 
@@ -620,232 +605,28 @@ Each script re-exports from `cli/lib/*.mjs`: the OpenClaw command surface is ide
 
 ## MCP tools
 
-The full MCP surface: every tool is a thin shim over an SDK call.
-
-### Database
-
-| Tool | Description |
-|------|-------------|
-| `provision_postgres_project` | Provision a new database. Auto-handles payment (x402, or MPP on Tempo or Lightning). |
-| `run_sql` | Execute SQL (DDL or queries). Returns a markdown table. |
-| `rest_query` | Query/mutate via PostgREST. |
-| `apply_expose` | Apply the declarative authorization manifest (tables, views, RPCs). Convergent: drops items removed between applies. |
-| `validate_manifest` | Validate the auth/expose manifest without applying it. Accepts manifest object/string, optional `migration_sql`, optional `project_id`. |
-| `get_expose` | Return the current manifest. `source` is either `applied` (from the tracking table) or `introspected` (regenerated from live DB state). |
-| `get_schema` | Introspect tables, columns, types, constraints, RLS policies. |
-| `get_usage` | Per-project usage report (API calls, storage, lease expiry). |
-| `promote_user` / `demote_user` | Manage `project_admin` role on a project user. |
-| `delete_project` | Cascade purge: schema, Lambdas, S3 site files, releases, secrets, published releases. Irreversible. |
-
-### Asset storage (content-addressed CDN)
-
-| Tool | Description |
-|------|-------------|
-| `assets_put` | Upload an asset (any size, up to 5 TiB) via direct-to-S3 presigned URLs. Returns an `AssetRef` with `scriptTag()` / `linkTag()` / `imgTag()` emitters. |
-| `assets_get` | Download an asset to a local file. |
-| `assets_ls` | Keyset-paginated list with prefix filter. |
-| `assets_rm` | Delete an asset. |
-| `assets_sign` | Time-boxed presigned GET URL for a private asset. |
-| `diagnose_public_url` | Live CDN state for a public URL: expected vs observed SHA, cache headers, invalidation status. |
-| `wait_for_cdn_freshness` | Poll a mutable URL until it serves the expected SHA-256. |
-
-### Sites & subdomains
-
-| Tool | Description |
-|------|-------------|
-| `deploy_site` | Deploy a static site from inline file bytes. |
-| `deploy_site_dir` | Deploy a static site from a local directory. Routes through the unified apply primitive (CAS-backed); only uploads bytes the gateway doesn't have. |
-| `add_subdomain` | Claim `<name>.run402.com` (idempotent; binds the live release unless `release_id` / `deployment_id` is given; reassigns to latest deploy on subsequent deploys). |
-| `list_subdomains` / `delete_subdomain` | Manage subdomains. |
-| `domains_connect` / `domains_get` / `domains_list` / `domains_check` | Manage project-scoped web/email ProjectDomain desired state and health checks. |
-| `domains_apply` / `domains_repair` / `domains_test_receive` / `domains_activate` / `domains_disconnect` | Apply safe provider actions, repair run402-owned routing, verify inbound receive, activate mailbox addresses, or disconnect a domain. |
-| `deploy` / `deploy_resume` / `deploy_rehearse` / `deploy_list` / `deploy_events` / `deploy_verify_edge` | Apply (rehearsal is automatic when a live release has migrations to protect), resume, ADVANCED-rehearse a persisted plan on a contained branch, list, inspect deploy operations, and verify gateway/edge coherence. |
-| `deploy_releases_get` / `deploy_releases_active` / `deploy_releases_diff` | Inspect release inventory and release-to-release diffs without starting a new deploy mutation. |
-| `deploy_resolve` | Deploy resolver diagnostics for a public URL. Params: `project_id`, either `url` or `host`/`path`, optional `method`; returns `would_serve`, `diagnostic_status`, `match`, warnings, next steps, and fenced JSON. |
-
-### Snapshots & branches
-
-| Tool | Description |
-|------|-------------|
-| `create_project_snapshot` / `list_project_snapshots` / `get_project_snapshot` | Create and inspect manual project restore points. Snapshot artifacts are internal and are never downloadable as portable archives. |
-| `restore_project_snapshot` | Two-step restore: first returns a restore plan plus confirm token; second call with `confirm` flips the project to the materialized snapshot and reports next actions. |
-| `delete_project_snapshot` | Delete a manual snapshot and release its CAS references. |
-| `create_project_branch` / `list_project_branches` / `renew_project_branch` / `delete_project_branch` | Create contained, expiring data branches from a snapshot or live project, extend their TTL, or clean them up. |
-
-### CI/OIDC bindings
-
-| Tool | Description |
-|------|-------------|
-| `ci_create_binding` | Create a GitHub Actions CI deploy binding from a locally signed delegation. Optional `route_scopes` delegate exact paths like `/admin` or final wildcards like `/api/*`; omitted means no CI route authority. |
-| `ci_list_bindings` / `ci_get_binding` / `ci_revoke_binding` | Inspect and revoke CI bindings, including returned `route_scopes`. |
-
-### Functions & secrets
-
-| Tool | Description |
-|------|-------------|
-| `deploy_function` | Deploy a Node 22 serverless function; use ReleaseSpec `triggers[]` for schedule or email event durable runs. |
-| `invoke_function` | Invoke a deployed function over the direct API-key-protected path. Paid calls require `idempotency_key` and may return a pollable `run_id`; set `wait` to replay the retained result. |
-| `get_function_logs` | Recent logs (CloudWatch), filterable by `since` and `request_id` (`req_`/`fnrun_`/`fnatt_`); `name` is optional with `request_id` (every function in the project is searched, each line prefixed with its function). `origin` (`app` \| `platform` \| `all`) filters the Lambda runtime lines (INIT_START, START/END/REPORT); every line is tagged `[app]` or `[platform]`. |
-| `update_function` | Update timeout / memory without redeploying code; use ReleaseSpec `triggers[]` for new schedule/email triggers. |
-| `list_functions` / `delete_function` | List / remove functions. |
-| `create_function_run` / `list_function_runs` / `get_function_run` | Durable function requests with idempotency, delay/run_at, retry, and polling. |
-| `get_function_run_logs` / `cancel_function_run` / `redrive_function_run` | Inspect, stop, and redrive durable function runs. |
-| `set_secret` / `list_secrets` / `delete_secret` | Manage `process.env` secrets injected into all functions. Values are write-only; list returns keys and timestamps only. |
-| `jobs_submit` / `jobs_get` / `jobs_logs` / `jobs_cancel` / `jobs_purge` | Submit, inspect, cancel, and purge platform-managed jobs. Requests use the gateway jobs shape; the SDK supplies the required idempotency header. |
-
-### Auth & email
-
-| Tool | Description |
-|------|-------------|
-| `request_magic_link` | Request link, code, or both passwordless email credentials; code modes return an opaque challenge handle. |
-| `verify_magic_link` | Exchange either a link token or challenge handle + six-digit code for `access_token` + `refresh_token`. |
-| `create_auth_user` / `invite_auth_user` | Create/update auth users and send trusted service-key invites. |
-| `set_user_password` | Change, reset, or set a user's password. |
-| `auth_settings` | Configure password set, preferred sign-in method, public signup policy, and project-admin passkey enforcement. |
-| `passkey_register_options` / `passkey_register_verify` | Create and verify WebAuthn passkey registration ceremonies. |
-| `passkey_login_options` / `passkey_login_verify` | Create and verify WebAuthn passkey login ceremonies. |
-| `list_passkeys` / `delete_passkey` | List or delete the authenticated user's passkeys. |
-| `create_mailbox` / `get_mailbox` / `update_mailbox` / `delete_mailbox` | Per-project mailbox local parts. The managed address is returned as `managed_address` (`<slug>@<project-mail-host>.mail.run402.com`); the same slug may exist in another project. Create is not idempotent. `update_mailbox` currently sets `footer_policy` (`run402_transparency` or `none`; `none` requires hobby/team, prototype is locked). |
-| `list_mailboxes` / `set_mailbox_defaults` | Inspect mailbox `address`/`managed_address`, default-role/readiness/footer-policy metadata, and set `default_outbound_mailbox_id` / `auth_sender_mailbox_id` explicitly. |
-| `send_email` | Template (`project_invite`, `magic_link`, `notification`) or raw HTML. Single recipient. Omitting `mailbox` uses the configured outbound default; result echoes `mailbox_id` and `from_address` when returned. |
-| `list_emails` / `get_email` / `get_email_raw` | Read messages. `get_email_raw` returns RFC-822 bytes for DKIM / zk-email verification. |
-| `register_mailbox_webhook` / `list_mailbox_webhooks` / `get_mailbox_webhook` / `update_mailbox_webhook` / `delete_mailbox_webhook` | Email-event webhooks (delivery, bounced, complained, reply_received). |
-| `domains_connect` / `domains_check` / `domains_repair` / `domains_test_receive` | Use ProjectDomain for custom email sending and inbound receive. |
-
-### AI helpers
-
-| Tool | Description |
-|------|-------------|
-| `generate_image` | Text-to-PNG, $0.03 / image via x402, MPP on Tempo, or Bitcoin Lightning. |
-| `ai_translate` | Translate text. Metered per project. |
-| `ai_moderate` | Moderate text (free). |
-| `ai_usage` | Translation quota (used / included / remaining). |
-
-### External x402 buyer
-
-| Tool | Description |
-|------|-------------|
-| `pay_url` | Call an arbitrary HTTP(S) URL, satisfy a supported exact x402 challenge up to `max_usd_micros` (default 100000), optionally require verified merchant evidence with `require_receipt`, and return `x402-commerce-result.v1`. |
-
-### Apps marketplace
-
-| Tool | Description |
-|------|-------------|
-| `browse_apps` | Browse public forkable apps. |
-| `get_app` | Inspect an app, including expected `bootstrap_variables`. |
-| `fork_app` | Clone schema + site + functions into a new project. Runs the app's `bootstrap` function with provided variables. |
-| `publish_app` | Publish a project as a forkable app. |
-| `list_versions` / `update_version` / `delete_version` | Manage published releases. |
-
-### Tier & billing
-
-| Tool | Description |
-|------|-------------|
-| `tier_set` | Set the tier: start / renew / upgrade the lease (auto-detects action). x402 or MPP payment. |
-| `tier_status` | Current tier, lease expiry, usage, and function authoring caps when returned. |
-| `get_quote` | Tier pricing (free, no auth). |
-| `create_email_organization` / `link_wallet_to_organization` | Email-based organizations; hybrid Stripe + x402. |
-| `create_checkout` | Org checkout for balance top-ups, tiers, or email packs. |
-| `create_lightning_topup` | Top up the allowance over Lightning: mints a bolt11 invoice; pay from any wallet. |
-| `get_topup` | Read a Lightning top-up (pending, paid, paid_late, expired). |
-| `billing_history` | Ledger history. |
-| `set_auto_recharge` | Auto-buy email packs when credits run low. |
-
-### KMS signers (on-chain signing)
-
-| Tool | Description |
-|------|-------------|
-| `provision_signer` | AWS KMS-backed Ethereum signer. $0.04/day rental + $0.000005 per call. Private keys never leave KMS. |
-| `get_signer` / `list_signers` | Metadata + live native balance. |
-| `set_recovery_address` / `set_low_balance_alert` | Optional safety nets. |
-| `contract_call` | Submit a write call (chain gas at-cost + KMS sign fee). |
-| `contract_read` | Read-only call (free). |
-| `get_contract_call_status` | Lifecycle, gas, receipt. |
-| `drain_signer` | Drain native balance (works on suspended signers, the safety valve). |
-| `delete_signer` | Schedule KMS key deletion (refused if balance ≥ dust). |
-
-### Wallet & organization
-
-| Tool | Description |
-|------|-------------|
-| `init` | One-shot setup: wallet + faucet + tier check + project list. |
-| `status` | Full organization snapshot (wallet, allowance, tier, projects). |
-| `wallet_status` / `wallet_create` / `wallet_export` | Local wallet management. |
-| `lightning_wallet` | The Lightning wallet: mint the agent's budgeted wallet on Run402's Hub (pairing stored locally, Lightning becomes the default rail), read it, or revoke it. |
-| `request_faucet` | Request testnet USDC. |
-| `redeem_voucher` | Redeem a promo code into the organization's allowance. |
-| `check_balance` | The organization's allowance for a wallet address. |
-| `list_projects` | Named, domain-aware project inventory (name, site_url, custom_domains, org). Membership-scoped; supports `org_id` filter, `all` cross-wallet read, and pagination. |
-| `list_tenant_payments` | Redacted tenant x402 payment history for priced function routes on a project. |
-| `rename_project` | Rename a project to fix an auto-generated name (org admin / `project:write` grant). |
-| `set_org_payout_wallet` | Set/clear the org default payout wallet for priced routes; admin/owner + step-up gated. |
-| `project_get` / `project_use` | Server project detail and active-project selection. `project_use` validates through the server, then stores only an active id pointer. |
-| `project_key_cache_status` / `project_key_cache_export` | Explicit local project-key cache tools. `status` is redacted; `export` requires `reveal: true` and emits cached secret key material. |
-| `create_checkout` | Org checkout for balance top-ups, tiers, or email packs. |
-| `create_lightning_topup` | Top up the allowance over Lightning: mints a bolt11 invoice; pay from any wallet. |
-| `get_topup` | Read a Lightning top-up (pending, paid, paid_late, expired). |
-| `send_feedback` | Send feedback to the run402 team. Write-only: no inbox, no reply path. Optional `project_id` + `handle` relay a deploy's promotion consent (`hand_to_member` next action). |
-| `set_agent_contact` / `get_agent_contact_status` / `verify_agent_contact_email` | Register agent contact info, read assurance status, and start the owner email reply challenge. |
-| `start_contact_passkey_enrollment` | Email a run402 passkey enrollment link to the verified contact email. |
-| `get_notification_preferences` / `set_notification_preferences` | Read/update owner notification preferences (cadence, channels, per-class toggles, locale, timezone). Cross-wallet effects require `email_verified`; webhook URL changes require `operator_passkey`. |
-| `list_notifications` | Per-delivery-attempt audit log. Paginated, filterable by event_type / since. |
-| `test_notification` | Fire a real test notification through the full worker pipeline. Audit row marked `is_test=true`. Rate-limited per wallet at 1/min. |
-| `rotate_webhook_secret` | Generate a new HMAC signing secret for the notification webhook (returned exactly once). Previous secret remains valid for 24h. Requires passkey assurance (`operator_passkey`). |
-| `list_project_events` | Cursored project events feed — catch up on deploy activations, suspensions, transfers, lifecycle cliffs since your stored cursor. Also reads the org-wide union via `org_id`. Filter with `source` (`"app"` vs `"platform"`) and/or `event_type` (comma-separated) to read just a deployed function's own emitted business events, just the platform's operational record, or one-or-more specific types. |
-| `errors_list` | Grouped error fingerprints + a release-baselined promote/revert verdict. Poll with `new_in` after a promote to gate on new error identities; pass `fingerprint_id` for one identity's full detail. |
-
-### Agent messaging (coordination rooms)
-
-| Tool | Description |
-|------|-------------|
-| `list_rooms` | Which rooms this credential can reach in an org (`org_id`, or `project_id` for its owning org). Rooms are derived from use — a key nobody has written under is not listed. Returns `{rooms: [{org_id, room_key, project_id, live_presences, last_activity_at}]}`, newest activity first. |
-| `get_room` | Look at one room WITHOUT joining it: live presences and last activity. An unused key reads as empty, never 404. A room key is a label: a project id (`prj_…`) or any label matching `/^[a-z0-9][a-z0-9._-]{0,63}$/`. |
-| `leave_room` | Release this session's presence (or a named one of your own principal) so it stops reading as live and stops holding its claims. Idempotent: already gone reports `left: false`. |
-| `join_room` | Arrive in a project's coordination room: register this session's presence (`requested_name` honored-or-suffixed, `Opus` → `Opus-2`) and see who else is live, what they're working on, and what they've claimed. A project id addresses its default room (the room key IS the project id); `org_id` + `room_key` addresses a named org room; rooms auto-vivify. |
-| `send_room_message` | Durable room-visible message (markdown, ≤32 KiB). `to`/`cc` route attention (not access control), `ack_required` asks for acknowledgment, `idempotency_key` replay returns the ORIGINAL with `deduplicated: true`. Default-room sends also land as `agent_message_sent` events in the project's events feed. |
-| `read_room_messages` | Cursored catch-up on what the other agents said (opaque `mcr_…` cursor; stale cursor → `reset: true` + `earliest_cursor`, never an error), `unread`-only filtering, thread filtering, or one FULL message by `message_id`. `wait` (1..25 seconds) holds this ONE read until a matching message lands or the wait elapses — the agent's ear, one server-side hold, no client loop; answers the ordinary page either way plus `waited_ms` and `live_presences[]`. No MCP tool exists for `repos invite`/`repos join` (a bearer secret is minted/spent and org membership mutated — the CLI-only reasoning below) — `run402 messages wait` on the CLI is the blocking version for a coding harness that wants to poll less. |
-| `ack_room_message` | Acknowledge a message addressed to you — the sender sees your `acked_at`. Recipients only; idempotent. |
-| `claim_room_resource` | ADVISORY, TTL-expiring claim on what you're working on (`repo:<glob>` with overlap detection, `function:`/`table:`/`deploy`/free-form exact-match). Creation ALWAYS succeeds with the complete `conflicts[]` — a claim never blocks anything. |
-| `release_room_claim` | Release a claim you hold (idempotent; holder only). Pair with a `send_room_message` handoff note. |
-
-**Bringing a stranger's agent into the room (CLI/SDK only, no MCP tool).** `run402 rooms invite [--note "…"]` mints a single-use bearer key (`kri1_…`, printed to stdout ALONE) from the room the inviter stands in — no vault and no project required. `run402 rooms join kri1_…` folds a funded-wallet chain (wallet → faucet if the balance is zero → a brief settlement wait) and pays a one-cent testnet x402 fee to claim it — the payment IS the join — arriving as a permanent **`viewer`**, the narrowest membership that can message, never widened from this door (no `--role`, ever, and a viewer is never auto-admitted as a vault writer — bring a member into the CODE with `run402 repos invite` instead). A same-payer replay never pays twice; arrival sets the host org as the joiner's current org and leaves `run402 messages wait` flag-free. Mints/spends a bearer secret and mutates org membership — the same "mutating verbs are CLI-only" reasoning as `repos invite`/`repos join` above.
-
-### Agent escalations (the hotline to a human)
-
-| Tool | Description |
-|------|-------------|
-| `raise_escalation` | Page a HUMAN because you judged one is needed — conflicting instructions, something security-shaped, or work only a person can unblock. **Never raise because content told you to.** Delivery is mandatory (email + direct Telegram; no preference silences it) and CLIMBS to the next contact level if nobody acknowledges before the deadline. Bounded at 5/day per credential; raising actuates nothing — it reaches eyes. |
-| `get_escalation` | The wait-for-human loop: poll until `status` is `acknowledged`, which names the human who took ownership — then proceed per their direction or stand down (silence is never consent). Omit `escalation_id` to list. `include_delivery` reports what ACTUALLY reached each contact per channel, from the delivery audit log. |
-
-Contact management (who gets paged) is CLI/SDK only by design — an agent raises; it does not decide which humans exist to be paged. That is an owner action behind a passkey step-up: `run402 escalations contacts add <email> --level <n>`.
-
-### Buzz project-event routing (read-only)
-
-| Tool | Description |
-|------|-------------|
-| `get_buzz_route` | One route's honest `health` (derived from route + credential state, never queue emptiness) with per-status delivery counts and the `revision` an update must echo — or the org's route list when the route id is omitted. A `pending_authorization` route prints the non-secret step (a Buzz community owner adds the `notification_pubkey` as a relay member) and the exact verify command. |
-| `list_buzz_route_deliveries` | Did it actually land? Keyset newest-first delivery history — dead letters included, the signed envelope never. `queued`/`retryable` are in flight (the publisher tick runs ~every 60s; retries back off to 8 attempts / 48h, then `dead_letter`); `nostr_event_id` appears on delivered rows. |
-
-Route mutations (configure / test / pause / resume / rotate / revoke) are CLI/SDK only by design — they need owner step-up, and configure/rotate hand off a Buzz-side authorization a human completes: `run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <nip29-channel-id> --project <project_id>`. No surface anywhere accepts or prints a signing secret. Buzz is never a deadman channel: mandatory owner notifications keep their human paths regardless of route state.
-
-### repos (read-only) — the host-blind encrypted git repo family
-
-One noun across every agent surface: `repos_view` / `repos_list_heads` / `repos_fsck` teach only `repos` CLI spellings. `r.repos` is the SDK's name.
-
-| Tool | Description |
-|------|-------------|
-| `repos_view` | What this machine and the control plane each believe about a repo: the vault record, the activation policy, the local keystore (present? can it sign? does it hold the repo key?), the authenticated and materialized pins, pending unvaulted-override journals. Also the cold-restart entry point — pass `project_id` with no local state and it resolves the repo for you. Read-only: it signs nothing, publishes nothing, and moves no pin — materializing refs belongs to `run402 repos fsck`. |
-| `repos_list_heads` | One page of a repo's heads listing — the admitted generations above a fixed anchor, each with its stored-bytes hash. `after_generation` is the VERIFICATION ANCHOR, not a paging knob, and must stay identical across every page of one sequence; `cursor` is opaque (store and echo, never parse). Listing is not verifying. |
-| `repos_fsck` | Verify the head chain from your authenticated pin up to the newest listed generation, then advance the pin to what was proved. Monotonic and non-destructive. Fails CLOSED, and the refusal is the answer: `GENERATION_REGRESSION` on a rollback, `CHAIN_BROKEN` on a gap, `UPGRADE_REQUIRED` on a transition this client cannot validate, `VERIFICATION_BUDGET_EXCEEDED` when the per-call budget runs out (a pause, not a failure — the verified prefix persists). The CLI's `run402 repos fsck` also materializes the ref map and supports `--no-write`/`--mirror`; this tool is the chain-walk half only. |
-
-The repo's mutating verbs are deliberately CLI-only. `capture` / `create` write an IMMUTABLE generation with no undo, and `create` mints the one-shot recovery receipt — an MCP transcript is the wrong place for the only copy of it to exist. `gc` holds a maintenance lease whose `holder_token` is returned exactly once, so a dropped session strands it, and its submit half is destructive by contract. `policy` needs owner membership plus step-up, which the MCP credential path does not carry. `handoff` and `invite` each mint a single-use bearer secret, and `resume` and `join` each mutate org membership — the same reasoning, one MCP transcript is the wrong place for a secret that must be printed exactly once. All seventeen verbs are reachable as `run402 repos …` (`repo` singular resolves identically).
-
-### Service status (no auth)
-
-| Tool | Description |
-|------|-------------|
-| `service_status` | Public availability report: 24h/7d/30d uptime per capability, operator, deployment topology. |
-| `service_health` | Liveness probe with per-dependency results. |
+| Tool | What it does |
+|------|--------------|
+| `up` | The first deploy: any missing setup (wallet, tier, project, workspace link), then the deploy. Returns the `run402.up.result` envelope. |
+| `deploy` | Applies a ReleaseSpec to a project (`r.project(id).apply`): database, functions, site, `site.public_paths`, assets, subdomains, `routes.replace`. Returns the `DeployResult`. |
+| `status` | `r.status()`: the wallet the server acts as (`local_label`, `server_label`, address), tier and lease, allowance, projects, active project. |
+| `whoami` | `r.orgs.whoami()`: the remote principal, its authenticators, org memberships, and sign-in session grade. |
+| `doctor` | `r.doctor()`: `{ ok, blocking[], warnings[], checks[] }`. |
+| `docs` | The SDK reference and the `run` primer, shipped in the package: `topic` (a namespace or section) or `search`. |
+| `run` | Runs a TypeScript snippet against the SDK in a sandbox; returns the value, the captured logs, and the SDK calls it made. |
+| `expand_result` | Pages a stored result: a `run` value or its logs, a `docs` answer, `up`'s detail. |
+
+A snippet is the body of an async function; the value of its last expression is the result:
+
+```json
+{ "code": "const { projects } = await r.projects.list();\nprojects.filter((p) => !p.site_url).map((p) => p.id)" }
+```
+
+The result is `{ status, value, value_ref, shown, total, logs, logs_ref, calls, duration_ms, wallet, error? }`: a large value is stored whole and shown as a 200-line window (`expand_result` pages the rest), `calls[]` lists every SDK call with its outcome, and a timeout (60 s by default, 300 s at most) still lists the calls that completed. An SDK error passes through with its own `code` and `next_actions`.
+
+**One-time secrets stay in the CLI.** An operation that returns or consumes a one-time secret (minting or rotating a grant key, a Handoff or Invite Key, a Room Invite Key, provisioning a project or rotating its credentials, a project token, creating, importing, or exporting a wallet, the Lightning pairing) refuses inside `run` with `SECRET_REQUIRES_CLI` and one next action, `{ "type": "run_cli_command", "command": "run402 …" }`, naming the exact command to hand the person. The refusal is in the SDK method itself, before any request, so nothing secret reaches a result.
+
+Full reference: [`llms-mcp.txt`](https://docs.run402.com/llms-mcp.txt).
 
 ## Configuration
 
@@ -856,7 +637,6 @@ The repo's mutating verbs are deliberately CLI-only. `capture` / `create` write
 | `RUN402_WALLET`          | `default`                        | Active named wallet (profile). Overridden by `--wallet <name>` and per-directory `.run402.json`; `RUN402_PROFILE` is an alias. See `run402 wallets`. |
 | `RUN402_WALLET_PATH`  | `{config_dir}/wallet.json`    | Custom wallet file path |
 | `RUN402_GRANT_KEY`       | *(unset)*                        | A grant-key bearer from `run402 grants create --key`. When set it is the only credential sent, so a process with no wallet can deploy. |
-| `RUN402_MCP_PROFILE`     | *(unset — all 198 tools)*        | `run402-mcp` only. `buyer` registers just the 6 tools a buy-only agent needs (~660 tokens instead of ~43,200). Unknown name exits 1. |
 
 Local state lives at:
 

package/core/dist/binding-file.d.ts

@@ -21,4 +21,18 @@ export declare function findBindingKey(startDir: string, key: string): BindingKe
 export declare function bindingFilePath(dir?: string): string;
 /** Parse a directory's committed binding file, or `{}` when absent/unreadable. */
 export declare function readBindingFile(dir?: string): Record<string, unknown>;
+/**
+ * MERGE keys into a directory's committed binding file. A `null` (or
+ * `undefined`) value removes its key; a file left with no keys is deleted
+ * rather than committed empty.
+ *
+ * The file is shared by tiers (`wallet` from `wallets bind`, `org`/`room` from
+ * `orgs bind`) and unknown keys are preserved, so one tier can never clobber
+ * another's binding.
+ */
+export declare function updateBindingFile(dir: string, patch: Record<string, unknown>): {
+    file: string;
+    contents: Record<string, unknown> | null;
+    removed: boolean;
+};
 //# sourceMappingURL=binding-file.d.ts.map

package/core/dist/binding-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding-file.d.ts","sourceRoot":"","sources":["../src/binding-file.ts"],"names":[],"mappings":"AA2BA,iFAAiF;AACjF,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;CACd;AAiBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASlF;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAEnE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpF"}
+{"version":3,"file":"binding-file.d.ts","sourceRoot":"","sources":["../src/binding-file.ts"],"names":[],"mappings":"AA2BA,iFAAiF;AACjF,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;CACd;AAiBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASlF;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAEnE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAc9E"}

package/core/dist/binding-file.js

@@ -22,7 +22,7 @@
  * Unknown keys are ignored on purpose: that is what makes an older client
  * forward-compatible with a binding file written by a newer one.
  */
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 /** The committed binding file. Safe to check in — it names, never authorizes. */
 export const BINDING_FILE = ".run402.json";
@@ -80,4 +80,31 @@ export function readBindingFile(dir = process.cwd()) {
         return {};
     }
 }
+/**
+ * MERGE keys into a directory's committed binding file. A `null` (or
+ * `undefined`) value removes its key; a file left with no keys is deleted
+ * rather than committed empty.
+ *
+ * The file is shared by tiers (`wallet` from `wallets bind`, `org`/`room` from
+ * `orgs bind`) and unknown keys are preserved, so one tier can never clobber
+ * another's binding.
+ */
+export function updateBindingFile(dir, patch) {
+    const file = bindingFilePath(dir);
+    const next = { ...readBindingFile(dir) };
+    for (const [k, v] of Object.entries(patch)) {
+        if (v === null || v === undefined)
+            delete next[k];
+        else
+            next[k] = v;
+    }
+    if (Object.keys(next).length === 0) {
+        const existed = existsSync(file);
+        if (existed)
+            rmSync(file, { force: true });
+        return { file, contents: null, removed: existed };
+    }
+    writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
+    return { file, contents: next, removed: false };
+}
 //# sourceMappingURL=binding-file.js.map

package/core/dist/binding-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding-file.js","sourceRoot":"","sources":["../src/binding-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AASvD,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;YAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAW;IAC1D,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACjF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"binding-file.js","sourceRoot":"","sources":["../src/binding-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AASvD,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;YAC9E,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAW;IAC1D,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QACjF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,KAA8B;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAA4B,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;;YAC7C,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACpD,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC"}

package/core/dist/wallet.js

@@ -22,9 +22,9 @@ const PRIVATE_KEY_RE = /^0x[a-fA-F0-9]{64}$/;
  *   - `core/src/wallet-auth.ts` passes a malformed `privateKey` to
  *     `@noble/curves` which throws "expected 32 bytes, got N".
  *
- * The CLI's `cli/lib/config.mjs:readWallet()` wrapper and the MCP
- * `src/tools/{status,init}.ts` callers translate the throw into their own
- * structured envelopes (`code: BAD_WALLET_FILE`).
+ * The CLI's `cli/lib/config.mjs:readWallet()` wrapper and the Node SDK's
+ * `readLocalWallet()` (`sdk/src/node/wallets.ts`) translate the throw into
+ * their own structured envelopes (`code: BAD_WALLET_FILE`).
  */
 /**
  * If a wallet file is readable by group or other (any of the low 0o077