run402 4.93.2 → 4.95.0

package/lib/subdomains.mjs

@@ -9,16 +9,16 @@ Usage:
   run402 subdomains <subcommand> [args...]
 
 Subcommands:
-  claim  <name> [--project <id>] [--release <id> | --deployment <id>]   Claim a subdomain
-  delete <name> --confirm [--project <id>]                              Release a subdomain. Requires --confirm.
-  list   [--project <id>]                                               List subdomains for a project
+  add    <name> [--project <project_id>] [--release <release_id> | --deployment <deployment_id>]   Add a subdomain
+  delete <name> --confirm [--project <project_id>]                              Release a subdomain. Requires --confirm.
+  list   [--project <project_id>]                                               List subdomains for a project
 
 Options default to the active project. With neither --release nor
---deployment, claim binds the project's live release.
+--deployment, add binds the project's live release.
 
 Examples:
-  run402 subdomains claim myapp
-  run402 subdomains claim myapp --release rel_abc123 --project prj_abc123
+  run402 subdomains add myapp
+  run402 subdomains add myapp --release rel_abc123 --project prj_abc123
   run402 subdomains delete myapp --confirm
   run402 subdomains list
 
@@ -29,20 +29,20 @@ Notes:
 `;
 
 const SUB_HELP = {
-  claim: `run402 subdomains claim — Claim a custom subdomain for a release
+  add: `run402 subdomains add — Add a subdomain for a release
 
 Usage:
-  run402 subdomains claim <name> [--project <id>] [--release <id> | --deployment <id>]
+  run402 subdomains add <name> [--project <project_id>] [--release <release_id> | --deployment <deployment_id>]
 
 Arguments:
   <name>              Subdomain name (3-63 chars, lowercase alphanumeric +
                       hyphens). Creates <name>.run402.com.
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
-  --release <id>      Release ID (rel_...) to point at. With neither flag,
+  --project <project_id>      Project ID (defaults to the active project)
+  --release <release_id>      Release ID (rel_...) to point at. With neither flag,
                       the project's live release is bound.
-  --deployment <id>   Legacy deployment ID (dpl_...); rel_.../op_... ids are
+  --deployment <deployment_id>   Legacy deployment ID (dpl_...); rel_.../op_... ids are
                       accepted too.
 
 Notes:
@@ -51,33 +51,33 @@ Notes:
   - A deploy manifest can declare the same thing: "subdomains": { "set": ["<name>"] }
 
 Examples:
-  run402 subdomains claim myapp
-  run402 subdomains claim myapp --release rel_abc123 --project prj_abc123
+  run402 subdomains add myapp
+  run402 subdomains add myapp --release rel_abc123 --project prj_abc123
 `,
-  list: `run402 subdomains list — List subdomains claimed by a project
+  list: `run402 subdomains list — List a project's subdomains
 
 Usage:
-  run402 subdomains list [--project <id>]
+  run402 subdomains list [--project <project_id>]
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Examples:
   run402 subdomains list
   run402 subdomains list --project prj_abc123
 `,
-  delete: `run402 subdomains delete — Release a claimed subdomain
+  delete: `run402 subdomains delete — Release a subdomain
 
 Usage:
-  run402 subdomains delete <name> --confirm [--project <id>]
+  run402 subdomains delete <name> --confirm [--project <project_id>]
 
 Arguments:
   <name>              Subdomain name to release
 
 Options:
   --confirm           Required: releasing a subdomain is irreversible and
-                      makes it available for any other project to claim
-  --project <id>      Project ID (defaults to the active project)
+                      makes it available for any other project to add
+  --project <project_id>      Project ID (defaults to the active project)
 
 Examples:
   run402 subdomains delete myapp --confirm
@@ -85,7 +85,7 @@ Examples:
 `,
 };
 
-async function claim(args) {
+async function add(args) {
   const parsedArgs = normalizeArgv(args);
   const valueFlags = ["--project", "--deployment", "--release"];
   assertKnownFlags(parsedArgs, [...valueFlags, "--help", "-h"], valueFlags);
@@ -99,8 +99,8 @@ async function claim(args) {
   if (positionals.length > 1) {
     fail({
       code: "BAD_USAGE",
-      message: `Unexpected argument for subdomains claim: ${positionals[1]}`,
-      hint: "Use `run402 subdomains claim <name> [--release <rel_id>]`.",
+      message: `Unexpected argument for subdomains add: ${positionals[1]}`,
+      hint: "Use `run402 subdomains add <name> [--release <rel_id>]`.",
     });
   }
   if (positionals.length === 1) {
@@ -110,14 +110,14 @@ async function claim(args) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <name>.",
-      hint: "run402 subdomains claim <name> [--project <id>] [--release <id> | --deployment <id>]",
+      hint: "run402 subdomains add <name> [--project <project_id>] [--release <release_id> | --deployment <deployment_id>]",
     });
   }
   if (opts.deployment && opts.release) {
     fail({
       code: "BAD_USAGE",
       message: "Pass either --release or --deployment, not both.",
-      hint: "run402 subdomains claim <name> [--release <id> | --deployment <id>]",
+      hint: "run402 subdomains add <name> [--release <release_id> | --deployment <deployment_id>]",
     });
   }
   const projectId = resolveProjectId(opts.project);
@@ -129,7 +129,7 @@ async function claim(args) {
   const deploymentId = opts.deployment || (opts.release ? undefined : p.last_deployment_id) || undefined;
   const releaseId = opts.release || undefined;
   try {
-    const data = await getSdk().subdomains.claim({ name, deploymentId, releaseId, projectId });
+    const data = await getSdk().subdomains.add({ name, deploymentId, releaseId, projectId });
     console.log(JSON.stringify(data, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -147,7 +147,7 @@ async function deleteSubdomain(allArgs) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <name>.",
-      hint: "run402 subdomains delete <name> --confirm [--project <id>]",
+      hint: "run402 subdomains delete <name> --confirm [--project <project_id>]",
     });
   }
   if (positionals.length > 1) {
@@ -156,7 +156,7 @@ async function deleteSubdomain(allArgs) {
   if (!argList.includes("--confirm")) {
     fail({
       code: "CONFIRMATION_REQUIRED",
-      message: `Destructive: releasing subdomain '${name}' makes it available for any other project to claim. This is irreversible. Re-run with --confirm to proceed.`,
+      message: `Destructive: releasing subdomain '${name}' makes it available for any other project to add. This is irreversible. Re-run with --confirm to proceed.`,
       details: { name },
     });
   }
@@ -186,7 +186,7 @@ async function list(args) {
     fail({
       code: "BAD_USAGE",
       message: `Unexpected argument for subdomains list: ${rest[0]}`,
-      hint: "Use `run402 subdomains list --project <id>`.",
+      hint: "Use `run402 subdomains list --project <project_id>`.",
     });
   }
   const projectId = resolveProjectId(project);
@@ -202,7 +202,7 @@ export async function run(sub, args) {
   if (!sub || sub === '--help' || sub === '-h') { console.log(HELP); process.exit(0); }
   if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
   switch (sub) {
-    case "claim": await claim(args); break;
+    case "add": await add(args); break;
     case "delete": await deleteSubdomain(args); break;
     case "list":   await list(args); break;
     default:

package/lib/subscriptions.mjs

@@ -14,11 +14,11 @@
  * successor, and the report must stop firing because the pipeline carries
  * those events — never because the check was removed.
  *
- * HTTP paths unchanged (`/agent/v1/notifications/rules*`); the allowance auth
+ * HTTP paths unchanged (`/agent/v1/notifications/rules*`); the SIWX auth
  * headers are PATH-scoped and must keep naming the real route.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
-import { operatorProofs } from "./operator-proofs.mjs";
+import { walletAuthHeaders } from "./config.mjs";
+import { sessionProofs } from "./session-proofs.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -35,7 +35,7 @@ import {
 const HELP = `run402 subscriptions — which events go where
 
 Usage:
-  run402 subscriptions add --binding <binding_id> [--project <id>] [--source app|platform] [--type a,b] [--class a,b]
+  run402 subscriptions add --binding <binding_id> [--project <project_id>] [--source app|platform] [--type a,b] [--class a,b]
   run402 subscriptions list
   run402 subscriptions rm <subscription_id>
 
@@ -68,7 +68,7 @@ function splitCsv(value) {
  *  alias for anyone who learned it from that help text. */
 export const SUBSCRIPTIONS_ADD_VALUE_FLAGS = ["--binding", "--contact", "--project", "--source", "--type", "--class"];
 export const SUBSCRIPTIONS_ADD_USAGE =
-  "run402 subscriptions add --binding <binding_id> [--project <id>] [--source app|platform] [--type a,b] [--class a,b]";
+  "run402 subscriptions add --binding <binding_id> [--project <project_id>] [--source app|platform] [--type a,b] [--class a,b]";
 export { HELP as SUBSCRIPTIONS_HELP };
 
 async function rulesAdd(args) {
@@ -96,16 +96,16 @@ async function rulesAdd(args) {
   if (typeRaw !== null) input.eventTypes = splitCsv(typeRaw);
   if (classRaw !== null) input.classes = splitCsv(classRaw);
 
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
-    console.log(JSON.stringify(await getSdk().admin.rules.create(input, operatorProofs("/agent/v1/notifications/rules")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.rules.create(input, sessionProofs("/agent/v1/notifications/rules")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }
 }
 
 async function rulesList() {
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
     console.log(JSON.stringify(await getSdk().admin.rules.list(), null, 2));
   } catch (err) {
@@ -122,9 +122,9 @@ async function rulesRm(args) {
     command: "run402 notifications rules rm <rule_id>",
     missing: "Missing <rule_id>.",
   });
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
-    console.log(JSON.stringify(await getSdk().admin.rules.delete(ruleId, operatorProofs("/agent/v1/notifications/rules")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.rules.delete(ruleId, sessionProofs("/agent/v1/notifications/rules")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }

package/lib/tier.mjs

@@ -3,30 +3,33 @@ import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, normalizeArgv, positionalArgs, flagValue, failUnknownSubcommand } from "./argparse.mjs";
 import { setTierAction } from "./next-actions.mjs";
 
-const HELP = `run402 tier — Manage your Run402 tier subscription
+const HELP = `run402 tier — Manage your Run402 tier and its lease
 
 Usage:
   run402 tier <subcommand> [args...]
 
 Subcommands:
   status                Show current tier, expiry, pool usage, and function caps when returned
-  set <tier>            Subscribe, renew, or upgrade (prepaid credit first, else x402/MPP)
+  set <tier>            Start, renew, or upgrade the lease (the allowance first, else x402/MPP)
 
-Tiers: prototype ($0.10, perpetual, free with testnet faucet), hobby ($5/30d), team ($20/30d)
+Tiers: prototype ($0.10 once, the free tier: no lease, never expires; covered by the testnet faucet), hobby ($5/30d), team ($20/30d)
 
-Prepaid credit pays first. A promo code (run402 redeem <code>) or a top-up
-sits on the organization's balance; 'tier set' settles from it with no payment
-challenge and no USDC in the wallet, and the receipt says paid_with: "credit".
-Only a balance that falls short goes to x402 / MPP, and that error names the
+The organization's allowance pays first. A promo code (run402 redeem <code>)
+or a top-up adds to the allowance; 'tier set' settles from it with no payment
+challenge and no USDC in the wallet, and the receipt says paid_with: "allowance".
+Only an allowance that falls short goes to x402 / MPP, and that error names the
 exact shortfall a voucher or top-up would cover.
 
-Tier is per organization. A single subscription covers every project on
-the account; api_calls and storage_bytes are pooled across all of them.
+Tier is per organization. One tier covers every project on the account;
+api_calls and storage_bytes are pooled across all of them. Hobby and team
+are prepaid 30-day leases that end unless renewed; nothing charges again on
+its own.
 
-The server auto-detects the action based on your allowance state:
-  - No tier or expired  → subscribe
+The server auto-detects the action from the current tier state and reports
+it as action: start | renew | upgrade:
+  - No tier or expired  → start
   - Same tier, active   → renew (extends from expiry)
-  - Higher tier         → upgrade (prorated refund to allowance)
+  - Higher tier         → upgrade (prorated refund to the allowance)
   - Lower tier, active  → rejected (wait for expiry)
 
 Examples:
@@ -36,7 +39,7 @@ Examples:
 `;
 
 const SUB_HELP = {
-  status: `run402 tier status — Show current tier subscription state
+  status: `run402 tier status — Show current tier and lease state
 
 Usage:
   run402 tier status
@@ -49,12 +52,12 @@ Notes:
   - Newer gateways include function authoring caps such as max timeout,
     max memory, max scheduled functions, minimum cron interval, and current
     scheduled-function usage
-  - Use 'run402 tier set <tier>' to subscribe, renew, or upgrade
+  - Use 'run402 tier set <tier>' to start, renew, or upgrade the lease
 
 Examples:
   run402 tier status
 `,
-  set: `run402 tier set — Subscribe, renew, or upgrade your tier
+  set: `run402 tier set — Set your tier: start, renew, or upgrade the lease
 
 Usage:
   run402 tier set <tier> [--idempotency-key <key>]
@@ -63,23 +66,27 @@ Arguments:
   <tier>              One of: prototype, hobby, team
 
 Options:
-  --idempotency-key <key>  Retry-safe key: re-running the same subscribe/renew
+  --idempotency-key <key>  Retry-safe key: re-running the same start/renew
                            intent with this key does not double-charge. Use a
                            fresh key for a deliberate second renewal.
 
 Tiers:
-  prototype           $0.10, perpetual (free with testnet faucet)
+  prototype           $0.10 once, the free tier: no lease, never expires
+                      (covered by the testnet faucet)
   hobby               $5/30d
   team                $20/30d
 
 Notes:
-  Tier is per organization, not per project. A successful subscribe,
+  Tier is per organization, not per project. A successful start,
   renew, or upgrade applies immediately to every project on the account.
+  Hobby and team are prepaid 30-day leases that end unless renewed;
+  nothing charges again on its own.
 
-  Server auto-detects action based on current allowance state:
-    - No tier or expired -> subscribe
+  Server auto-detects the action from the current tier state and reports
+  it as action: start | renew | upgrade:
+    - No tier or expired -> start
     - Same tier, active  -> renew (extends from expiry)
-    - Higher tier        -> upgrade (prorated refund to allowance)
+    - Higher tier        -> upgrade (prorated refund to the allowance)
     - Lower tier, active -> rejected (wait for expiry)
   Pays via x402 micropayments.
 
@@ -131,7 +138,7 @@ async function set(args = []) {
       next_actions: [setTierAction()],
     });
   }
-  // Caller-supplied idempotency key makes a retried subscribe/renew safe from
+  // Caller-supplied idempotency key makes a retried start/renew safe from
   // double-charge. Not auto-derived: the SDK cannot tell a retry from a new
   // renewal intent (that boundary is the caller's).
   const idempotencyKey = flagValue(parsedArgs, "--idempotency-key") ?? undefined;

package/lib/transfer.mjs

@@ -1,4 +1,4 @@
-import { allowanceAuthHeaders, resolveProjectId } from "./config.mjs";
+import { walletAuthHeaders, resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -14,21 +14,21 @@ import {
 const HELP = `run402 transfer — Project transfer, one noun for wallet, email, and owned-org recipients
 
 Usage:
-  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-collaborator developer]
+  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <project_id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-member developer]
   run402 transfer preview <transfer_id>
   run402 transfer list [--incoming | --outgoing] [--limit N] [--after <cursor>]
-  run402 transfer accept <transfer_id>
-  run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]
+  run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]
   run402 transfer cancel <transfer_id> [--reason <text>]
 
 Subcommands:
-  init        Initiate ownership change. --to <wallet> = two-party wallet transfer
-              (completed by 'accept'); --to <email> = email->org transfer (completed by 'claim');
+  init        Initiate ownership change. --to <wallet> = two-party wallet transfer;
+              --to <email> = email-addressed transfer; both are completed by 'accept'.
               --to-org <org_id> = same-actor move to an owned org (completes immediately).
   preview     Fetch the safe review document (pending transfer — kind-agnostic)
   list        List pending transfers (incoming default, or --outgoing) — pending rows unioned
-  accept      Accept an incoming WALLET transfer (your wallet must be the to_wallet)
-  claim       Claim an incoming EMAIL transfer into an org (--into <id>; omit = new org)
+  accept      Accept an incoming transfer, whatever its address (wallet: your wallet must be
+              the to_wallet; email: your verified email must match; --org <org_id> picks the
+              receiving org, omit = new org)
   cancel      Cancel a pending transfer of any kind
 
 Notes:
@@ -44,24 +44,24 @@ const SUB_HELP = {
   init: `run402 transfer init — Initiate a project transfer
 
 Usage:
-  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-collaborator developer]
+  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <project_id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-member developer]
 
 Options:
-  --project <id>         Project id (defaults to the active project)
-  --to <wallet|email>    Recipient (required). A wallet uses the two-party rail (completed by
-                         'accept'); an email uses the email->org rail (completed by 'claim').
+  --project <project_id> Project id (defaults to the active project)
+  --to <wallet|email>    Recipient (required). A wallet is accepted by that wallet's signature;
+                         an email is accepted by a principal whose verified email matches.
   --to-org <org_id>      Destination org you already own. Same-actor only in the first gateway
                          release; completes immediately and returns project keys.
   --billing-policy <p>   Billing policy (wallet rail). Phase 1A only allows 'migrate' (default).
   --message <text>       Optional note shown to the recipient in preview + emails.
   --kysigned <record_id> Optional KySigned record id (wallet rail; Phase 1A: informational only).
-  --retain-collaborator <role>  Email recipients only (v1.91): keep a 'developer' membership in
-                         the recipient's org after the transfer. The recipient must accept it at
-                         claim (--accept-retained-collaborator); omit for full severance.
+  --retain-member <role> Email recipients only: keep a 'developer' membership in the
+                         recipient's org after the transfer. The recipient must accept it at
+                         accept (--accept-retained-member); omit for full severance.
 
 Notes:
   - Caller's wallet/session must currently own or admin the project (gateway re-checks fresh DB).
-  - Owner-side mutations on the project are frozen until accept/claim/cancel/expiry.
+  - Owner-side mutations on the project are frozen until accept/cancel/expiry.
     Owned-org moves complete immediately and do not create a pending window.
   - The project lease stays with your organization; it is NOT refunded.
 `,
@@ -88,16 +88,23 @@ Options:
   --limit N         Page size (default 50).
   --after <cursor>  Opaque keyset cursor (next_cursor from a prior page).
 `,
-  accept: `run402 transfer accept — Accept an incoming WALLET transfer
+  accept: `run402 transfer accept — Accept an incoming transfer, whatever its address
 
 Usage:
-  run402 transfer accept <transfer_id>
+  run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]
 
-Your wallet must equal the transfer's to_wallet. The accept transaction
-atomically: flips ownership, revokes the previous owner's CI bindings on the
-project, enqueues notifications to both parties, and stamps a
-'secrets_rotation_advised' advisory on the project. (Email transfers complete
-via 'claim', not 'accept'.)
+The one completion. A wallet-addressed transfer is accepted by the to_wallet's
+signature; an email-addressed transfer by a principal whose verified email
+matches, into an org you own (--org) or, omitted, a brand-new org. Either way
+the accept transaction atomically: flips ownership, revokes the previous
+owner's CI bindings on the project, enqueues notifications to both parties,
+stamps a 'secrets_rotation_advised' advisory on the project, and returns the
+project keys (saved to your keystore).
+
+Options:
+  --org <org_id>           Email-addressed only: the org to receive the project (omit = new org).
+  --accept-retained-member Email-addressed only: accept the sender's retained-developer-membership
+                           offer (see 'transfer preview' retain_member). Omit = full severance.
 `,
   cancel: `run402 transfer cancel — Cancel a pending transfer
 
@@ -108,19 +115,6 @@ Cancels a pending transfer of any kind. You must be authorized for the row's
 kind (a wallet signing party, or an owner/admin of the offering org / the
 addressed-email principal). Already-processed transfers return 409
 TRANSFER_ALREADY_PROCESSED.
-`,
-  claim: `run402 transfer claim — Claim an incoming EMAIL transfer
-
-Usage:
-  run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]
-
-Claims an email-addressed transfer into an org you own. Omit --into to claim into
-a brand-new org. This is the email analog of 'accept'.
-
-Options:
-  --into <org_id>       Org to claim into (omit = brand-new org).
-  --accept-retained-collaborator Accept the sender's v1.91 retained-developer-membership offer
-                                 (see 'transfer preview' retain_collaborator). Omit = full severance.
 `,
 };
 
@@ -129,7 +123,7 @@ const RETAIN_ROLES = new Set(["developer"]);
 
 async function init(args) {
   const parsedArgs = normalizeArgv(args);
-  const valueFlags = ["--project", "--to", "--to-org", "--billing-policy", "--message", "--kysigned", "--retain-collaborator"];
+  const valueFlags = ["--project", "--to", "--to-org", "--billing-policy", "--message", "--kysigned", "--retain-member"];
   assertKnownFlags(parsedArgs, [...valueFlags, "--help", "-h"], valueFlags);
   const extra = positionalArgs(parsedArgs, valueFlags);
   if (extra.length > 0) {
@@ -146,7 +140,7 @@ async function init(args) {
   const projectFlag = flagValue(parsedArgs, "--project");
   const projectId = await resolveProjectId(projectFlag);
   if (!projectId) {
-    fail({ code: "NO_PROJECT", message: "No project id. Pass --project <id> or set an active project with 'run402 projects use <id>'." });
+    fail({ code: "NO_PROJECT", message: "No project id. Pass --project <project_id> or set an active project with 'run402 projects use <project_id>'." });
   }
   const billingPolicy = flagValue(parsedArgs, "--billing-policy");
   if (billingPolicy !== null && !BILLING_POLICIES.has(billingPolicy)) {
@@ -158,27 +152,27 @@ async function init(args) {
   }
   const message = flagValue(parsedArgs, "--message");
   const kysigned = flagValue(parsedArgs, "--kysigned");
-  const retainCollaborator = flagValue(parsedArgs, "--retain-collaborator");
+  const retainMember = flagValue(parsedArgs, "--retain-member");
 
   // One noun, three recipient shapes. --to keeps wallet/email auto-detection;
   // --to-org is explicit because org ids are not human-recipient addresses.
   const recipientKind = toOrg ? "org" : (to.includes("@") ? "email" : "wallet");
 
-  // --retain-collaborator (v1.91) is an email-only opt-in: the sender keeps a
-  // developer membership in the recipient's org (recipient must accept at claim).
-  if (retainCollaborator !== null) {
+  // --retain-member is an email-only opt-in: the sender keeps a developer
+  // membership in the recipient's org (the recipient must accept it at accept).
+  if (retainMember !== null) {
     if (recipientKind !== "email") {
       fail({
         code: "BAD_FLAG",
-        message: "--retain-collaborator applies only to email recipients.",
-        details: { flag: "--retain-collaborator" },
+        message: "--retain-member applies only to email recipients.",
+        details: { flag: "--retain-member" },
       });
     }
-    if (!RETAIN_ROLES.has(retainCollaborator)) {
+    if (!RETAIN_ROLES.has(retainMember)) {
       fail({
         code: "BAD_FLAG",
-        message: `Unsupported --retain-collaborator role: ${retainCollaborator}. Allowed: ${[...RETAIN_ROLES].join(", ")}.`,
-        details: { flag: "--retain-collaborator", value: retainCollaborator, allowed: [...RETAIN_ROLES] },
+        message: `Unsupported --retain-member role: ${retainMember}. Allowed: ${[...RETAIN_ROLES].join(", ")}.`,
+        details: { flag: "--retain-member", value: retainMember, allowed: [...RETAIN_ROLES] },
       });
     }
   }
@@ -198,7 +192,7 @@ async function init(args) {
   }
 
   // All recipient shapes initiate on the unified transfer endpoint — sign that path.
-  allowanceAuthHeaders(`/projects/v1/${projectId}/transfers`);
+  walletAuthHeaders(`/projects/v1/${projectId}/transfers`);
 
   try {
     let res;
@@ -213,7 +207,7 @@ async function init(args) {
         projectId,
         toEmail: to,
         message: message ?? undefined,
-        retainCollaborator: retainCollaborator ? { role: retainCollaborator } : undefined,
+        retainMember: retainMember ? { role: retainMember } : undefined,
       });
     } else {
       res = await getSdk().admin.transfers.initiate({
@@ -239,7 +233,7 @@ async function preview(args) {
   }
   const transferId = positionals[0];
   // Preview is kind-agnostic — one route serves wallet, email, and future org transfers.
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}`);
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}`);
 
   try {
     const data = await getSdk().admin.transfers.preview(transferId);
@@ -274,7 +268,7 @@ async function list(args) {
 
   // Incoming/outgoing are kind-agnostic — each returns the union of pending
   // wallet/email/future-org rows, tagged with recipient_kind.
-  allowanceAuthHeaders(`/agent/v1/transfers/${direction}`);
+  walletAuthHeaders(`/agent/v1/transfers/${direction}`);
 
   try {
     const result =
@@ -300,16 +294,24 @@ async function list(args) {
 
 async function accept(args) {
   const parsedArgs = normalizeArgv(args);
-  assertKnownFlags(parsedArgs, ["--help", "-h"]);
-  const positionals = positionalArgs(parsedArgs);
+  const valueFlags = ["--org"];
+  assertKnownFlags(parsedArgs, [...valueFlags, "--accept-retained-member", "--help", "-h"], valueFlags);
+  const positionals = positionalArgs(parsedArgs, valueFlags);
   if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer accept <transfer_id>" });
+    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]" });
   }
   const transferId = positionals[0];
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/accept`);
+  const orgId = flagValue(parsedArgs, "--org");
+  // Email-addressed rows only: accept the sender's retained-developer-membership
+  // offer (see the preview's `retain_member` block). Absent = full severance.
+  const acceptRetain = parsedArgs.includes("--accept-retained-member");
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}/accept`);
 
   try {
-    const data = await getSdk().admin.transfers.accept(transferId);
+    const data = await getSdk().admin.transfers.accept(transferId, {
+      orgId: orgId ?? undefined,
+      acceptRetainedMember: acceptRetain || undefined,
+    });
     console.log(JSON.stringify(data, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -327,7 +329,7 @@ async function cancel(args) {
   const transferId = positionals[0];
   const reason = flagValue(parsedArgs, "--reason");
   // Cancel is kind-agnostic — one route serves wallet and email transfers.
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/cancel`);
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}/cancel`);
 
   try {
     const data = await getSdk().admin.transfers.cancel(transferId, { reason: reason ?? undefined });
@@ -337,32 +339,6 @@ async function cancel(args) {
   }
 }
 
-async function claim(args) {
-  const parsedArgs = normalizeArgv(args);
-  const valueFlags = ["--into"];
-  assertKnownFlags(parsedArgs, [...valueFlags, "--accept-retained-collaborator", "--help", "-h"], valueFlags);
-  const positionals = positionalArgs(parsedArgs, valueFlags);
-  if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]" });
-  }
-  const transferId = positionals[0];
-  const into = flagValue(parsedArgs, "--into");
-  // v1.91: accept the sender's retained-developer-membership offer (see the
-  // preview's `retain_collaborator` block). Absent = full severance (default).
-  const acceptRetain = parsedArgs.includes("--accept-retained-collaborator");
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/claim`);
-
-  try {
-    const data = await getSdk().admin.transfers.claim(transferId, {
-      organizationId: into ?? undefined,
-      acceptRetainedCollaborator: acceptRetain || undefined,
-    });
-    console.log(JSON.stringify(data, null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") {
     console.log(HELP);
@@ -385,9 +361,6 @@ export async function run(sub, args) {
     case "accept":
       await accept(args);
       return;
-    case "claim":
-      await claim(args);
-      return;
     case "cancel":
       await cancel(args);
       return;