run402 4.93.2 → 4.95.0

package/lib/contacts.mjs

@@ -12,17 +12,17 @@
  * "how can this human be reached" — not the mechanisms, which really are
  * different and are not pretended otherwise.
  *
- * `rm <id>` takes a bare id and works out which backend owns it, because both
+ * `rm <contact_id>` takes a bare id and works out which backend owns it, because both
  * are UUIDs and a caller holding one from `contacts list` should not have to
  * know which subsystem minted it. That costs one extra read and removes a
  * `--kind` flag nobody could answer without looking it up.
  *
  * HTTP paths are unchanged (`/agent/v1/notifications/channels*`,
- * `/orgs/v1/:org_id/escalation-contacts*`); the allowance auth headers below
+ * `/orgs/v1/:org_id/escalation-contacts*`); the SIWX auth headers below
  * are PATH-scoped and must keep naming the real routes.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
-import { operatorProofs } from "./operator-proofs.mjs";
+import { walletAuthHeaders } from "./config.mjs";
+import { sessionProofs } from "./session-proofs.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -44,7 +44,7 @@ Usage:
   run402 contacts list
   run402 contacts add <email> [--level <1-10>] [--name <display>]
   run402 contacts connect telegram [--label <name>]
-  run402 contacts rm <id>
+  run402 contacts rm <contact_id>
   run402 contacts preferences
   run402 contacts preferences set <key>=<value> [<key>=<value> ...]
   run402 contacts test [--source app|platform] [--type <event_type>]
@@ -59,7 +59,7 @@ Two kinds, one question:
 Every row carries \`kind\`. \`rm\` takes either kind's id and works out which.
 
 Notes:
-  - Adding an address with no verified operator email is ACCEPTED with a
+  - Adding an address with no verified contact email is ACCEPTED with a
     reachability warning — you must be able to configure the chain before the
     humans are bound.
   - What actually landed is \`run402 deliveries\`.
@@ -69,7 +69,7 @@ async function preferences(args) {
   const parsedArgs = normalizeArgv(args);
   assertKnownFlags(parsedArgs, ["--help", "-h"]);
   const positionals = positionalArgs(parsedArgs);
-  allowanceAuthHeaders("/agent/v1/notifications/preferences");
+  walletAuthHeaders("/agent/v1/notifications/preferences");
 
   if (positionals.length === 0) {
     // GET preferences
@@ -104,7 +104,7 @@ async function preferences(args) {
     }
   }
   try {
-    const data = await getSdk().admin.setNotificationPreferences(patch, operatorProofs("/agent/v1/notifications/preferences"));
+    const data = await getSdk().admin.setNotificationPreferences(patch, sessionProofs("/agent/v1/notifications/preferences"));
     console.log(JSON.stringify(data, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -185,7 +185,7 @@ async function channelsConnect(args) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for notifications channels connect: ${positionals[1]}` });
   }
 
-  const proofs = operatorProofs("/agent/v1/notifications/channels/telegram");
+  const proofs = sessionProofs("/agent/v1/notifications/channels/telegram");
   let pending;
   try {
     pending = await getSdk().admin.channels.connectTelegram(label ? { label } : {}, proofs);
@@ -215,7 +215,7 @@ async function channelsConnect(args) {
 }
 
 async function channelsList() {
-  allowanceAuthHeaders("/agent/v1/notifications/channels");
+  walletAuthHeaders("/agent/v1/notifications/channels");
   try {
     console.log(JSON.stringify(await getSdk().admin.channels.list(), null, 2));
   } catch (err) {
@@ -232,9 +232,9 @@ async function channelsRevoke(args) {
     command: "run402 notifications channels revoke <binding_id>",
     missing: "Missing <binding_id>.",
   });
-  allowanceAuthHeaders("/agent/v1/notifications/channels/telegram");
+  walletAuthHeaders("/agent/v1/notifications/channels/telegram");
   try {
-    console.log(JSON.stringify(await getSdk().admin.channels.revokeTelegram(bindingId, operatorProofs("/agent/v1/notifications/channels/telegram")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.channels.revokeTelegram(bindingId, sessionProofs("/agent/v1/notifications/channels/telegram")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }
@@ -280,7 +280,7 @@ async function test(args) {
   const source = flagValue(parsedArgs, "--source");
   if (source !== null) assertAllowedValue(source, ["app", "platform"], "--source");
   const eventType = flagValue(parsedArgs, "--type");
-  allowanceAuthHeaders("/agent/v1/notifications/test");
+  walletAuthHeaders("/agent/v1/notifications/test");
   const opts = {};
   if (source) opts.source = source;
   if (eventType) opts.eventType = eventType;
@@ -319,7 +319,7 @@ async function listContacts(args) {
   }
 
   try {
-    allowanceAuthHeaders("/agent/v1/notifications/channels");
+    walletAuthHeaders("/agent/v1/notifications/channels");
     const res = await sdk.admin.channels.list();
     for (const ch of res.telegram ?? []) {
       rows.push({ kind: "telegram", id: ch.binding_id ?? ch.id, ...ch });
@@ -339,7 +339,7 @@ async function removeContact(args) {
   assertKnownFlags(a, ["--org", "--help", "-h"], ["--org"]);
   const positionals = positionalArgs(a, ["--org"]);
   requirePositionalCount(positionals, ["--org"], {
-    min: 1, max: 1, command: "run402 contacts rm", missing: "<id>",
+    min: 1, max: 1, command: "run402 contacts rm", missing: "<contact_id>",
   });
   const id = positionals[0];
   const sdk = getSdk();
@@ -354,7 +354,7 @@ async function removeContact(args) {
         return;
       }
     }
-    allowanceAuthHeaders("/agent/v1/notifications/channels");
+    walletAuthHeaders("/agent/v1/notifications/channels");
     const chans = await sdk.admin.channels.list();
     const chan = (chans.telegram ?? []).find((c) => (c.binding_id ?? c.id) === id);
     if (chan) {

package/lib/contracts.mjs

@@ -14,7 +14,7 @@ import {
 const HELP = `run402 contracts — KMS-backed Ethereum signers for smart-contract calls
 
   Pricing: $0.04/day per signer ($1.20/month) plus $0.000005 per contract call.
-  Signer creation requires $1.20 in cash credit (30 days of rent).
+  Signer creation requires $1.20 of allowance (30 days of rent).
   Non-custodial: see https://run402.com/humans/terms.html#non-custodial-kms-wallets
 
 Usage:
@@ -53,7 +53,7 @@ const SUB_HELP = {
   "provision-signer": `run402 contracts provision-signer — Provision a KMS-backed signer
 
 Usage:
-  run402 contracts provision-signer --chain <chain> [--project <id>] [options]
+  run402 contracts provision-signer --chain <chain> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts provision-signer <project_id> --chain <chain> [options]
@@ -69,7 +69,7 @@ Options:
   "set-recovery": `run402 contracts set-recovery — Set or clear the signer recovery address
 
 Usage:
-  run402 contracts set-recovery <signer_id> [--project <id>] [options]
+  run402 contracts set-recovery <signer_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts set-recovery <project_id> <signer_id> [options]
@@ -77,7 +77,7 @@ Legacy (still supported):
   "set-alert": `run402 contracts set-alert — Set the low-balance alert threshold
 
 Usage:
-  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <id>]
+  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts set-alert <project_id> <signer_id> --threshold-wei <n>
@@ -85,7 +85,7 @@ Legacy (still supported):
   call: `run402 contracts call — Submit a contract write call
 
 Usage:
-  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <id>]
+  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts call <project_id> <signer_id> --to 0x... --abi <json>
@@ -98,7 +98,7 @@ Returns the deterministic CREATE address synchronously — known from (signer, n
 before the tx confirms. Cost: chain gas at-cost + $0.000005 KMS sign fee.
 
 Usage:
-  run402 contracts deploy <signer_id> --bytecode 0x... [--project <id>] [options]
+  run402 contracts deploy <signer_id> --bytecode 0x... [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts deploy <project_id> <signer_id> --bytecode 0x... [options]
@@ -125,7 +125,7 @@ Usage:
   drain: `run402 contracts drain — Drain native balance to a destination address
 
 Usage:
-  run402 contracts drain <signer_id> --to 0x... --confirm [--project <id>]
+  run402 contracts drain <signer_id> --to 0x... --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts drain <project_id> <signer_id> --to 0x... --confirm
@@ -133,7 +133,7 @@ Legacy (still supported):
   delete: `run402 contracts delete — Schedule the KMS key for deletion
 
 Usage:
-  run402 contracts delete <signer_id> --confirm [--project <id>]
+  run402 contracts delete <signer_id> --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts delete <project_id> <signer_id> --confirm
@@ -141,7 +141,7 @@ Legacy (still supported):
   "get-signer": `run402 contracts get-signer — Get signer metadata + live balance
 
 Usage:
-  run402 contracts get-signer <signer_id> [--project <id>]
+  run402 contracts get-signer <signer_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts get-signer <project_id> <signer_id>
@@ -156,7 +156,7 @@ Examples:
   "list-signers": `run402 contracts list-signers — List all KMS signers for a project
 
 Usage:
-  run402 contracts list-signers [--project <id>]
+  run402 contracts list-signers [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts list-signers <project_id>
@@ -173,7 +173,7 @@ Examples:
   status: `run402 contracts status — Get a contract call's status and receipt
 
 Usage:
-  run402 contracts status <call_id> [--project <id>]
+  run402 contracts status <call_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts status <project_id> <call_id>
@@ -502,7 +502,7 @@ async function deleteSigner(projectId, signerId, args) {
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") { console.log(HELP); process.exit(0); }
   if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
-  // Project selection (CLI-wide convention): `--project <id>` wins, else a
+  // Project selection (CLI-wide convention): `--project <project_id>` wins, else a
   // legacy leading `prj_...` positional, else the active project. The signer /
   // call id stays positional (`cwlt_...` / `ccall_...`). Computed lazily so
   // unknown subcommands (and the anonymous `read`) never trip project

package/lib/credentials.mjs

@@ -26,18 +26,18 @@ Usage:
   run402 credentials <subcommand> [args...]
 
 Project credentials (on the gateway — named, revocable, rotatable):
-  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>] [--import]
+  issue --kind <anon|service> --name <name> [--project <project_id>] [--expires <iso8601>] [--import]
                                 Mint one. The secret is printed ONCE.
                                 --import also writes it into this machine's
                                 local key cache (the cold-restart re-key path).
-  list [--project <id>] [--include-revoked]
+  list [--project <project_id>] [--include-revoked]
                                 List credentials (metadata only, never secrets)
-  status [--project <id>]       Are you still on the retiring legacy key?
-  rotate <credential_id> [--project <id>]
+  status [--project <project_id>]       Are you still on the retiring legacy key?
+  rotate <credential_id> [--project <project_id>]
                                 Replace in one step; new secret printed ONCE
-  revoke <credential_id> [--project <id>] [--reason <text>]
+  revoke <credential_id> [--project <project_id>] [--reason <text>]
                                 Revoke immediately, freeing the name
-  token [--project <id>] [--kind <anon|service>]
+  token [--project <project_id>] [--kind <anon|service>]
                                 Mint a SHORT-LIVED token. Works with only a
                                 delegate — the unattended recovery path.
 
@@ -48,7 +48,7 @@ Notes:
   - 'issue', 'rotate' and 'revoke' need owner membership on the project's org
     plus a fresh step-up, so a scoped agent credential can never escalate
     itself into a permanent root. Authenticate with a wallet (SIWX) or a
-    control-plane session ('run402 operator login --step-up').
+    sign-in session ('run402 login').
   - 'token' is the exception: a delegate can mint one with no human present.
   - Secrets are returned EXACTLY ONCE and are never recoverable. Full JSON goes
     to stdout so you can pipe it; the warnings go to stderr.
@@ -68,12 +68,12 @@ Usage:
 
 Subcommands:
   list                                List cached project-key entries, redacted
-  status --project <id>               Show one cached entry, redacted
-  import --project <id> --service-key-stdin
-  import --project <id> --service-key-env <env>
-  import --project <id> --anon-key-env <env>   Rotate only the anon key
-  export --project <id> --reveal       Print cached keys, including secrets
-  remove --project <id>                Remove one cached key entry
+  status --project <project_id>               Show one cached entry, redacted
+  import --project <project_id> --service-key-stdin
+  import --project <project_id> --service-key-env <env>
+  import --project <project_id> --anon-key-env <env>   Rotate only the anon key
+  export --project <project_id> --reveal       Print cached keys, including secrets
+  remove --project <project_id>                Remove one cached key entry
 
 Notes:
   - This is a LOCAL CACHE surface. It is not project inventory.
@@ -89,7 +89,7 @@ const SUB_HELP = {
   issue: `run402 credentials issue — mint a named project credential
 
 Usage:
-  run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]
+  run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]
                            [--expires <iso8601>]
 
 --kind    "anon" is the tenant-facing key; "service" is the privileged one.
@@ -112,28 +112,28 @@ can NEVER do this; use 'run402 credentials token' instead.
   list: `run402 credentials list — list a project's credentials
 
 Usage:
-  run402 credentials list [--project <id>] [--include-revoked]
+  run402 credentials list [--project <project_id>] [--include-revoked]
 
 Metadata only — never a secret or a secret hash. Only project.read is needed.
 `,
   status: `run402 credentials status — are you still on the retiring legacy key?
 
 Usage:
-  run402 credentials status [--project <id>]
+  run402 credentials status [--project <project_id>]
 
 Returns state "legacy" while the project still depends on the derived
 anon/service keys, or "rotatable" once it holds credentials it can revoke
 individually.
 
 There is deliberately NO deadline: retirement is gated on conditions (every
-tenant migrated, 30 consecutive days of zero legacy-key use, explicit operator
+tenant migrated, 30 consecutive days of zero legacy-key use, explicit staff
 approval), not a date. Read retirement.gated_on rather than planning against a
 date the platform has not committed to.
 `,
   rotate: `run402 credentials rotate — replace a credential in one step
 
 Usage:
-  run402 credentials rotate <credential_id> [--project <id>]
+  run402 credentials rotate <credential_id> [--project <project_id>]
 
 Mints a replacement and revokes the old one in a single transaction, keeping
 the name. The NEW secret is printed once.
@@ -146,7 +146,7 @@ compromised.
   revoke: `run402 credentials revoke — revoke a credential immediately
 
 Usage:
-  run402 credentials revoke <credential_id> [--project <id>] [--reason <text>]
+  run402 credentials revoke <credential_id> [--project <project_id>] [--reason <text>]
 
 Takes effect for every subsequent request and frees the name for reuse.
 Requires owner membership plus step-up.
@@ -154,7 +154,7 @@ Requires owner membership plus step-up.
   token: `run402 credentials token — mint a short-lived project token
 
 Usage:
-  run402 credentials token [--project <id>] [--kind <anon|service>]
+  run402 credentials token [--project <project_id>] [--kind <anon|service>]
 
 The cold-restart recovery path, and the ONE credential call an agent can make
 with no human present: a delegate is accepted here. There is no step-up because
@@ -214,7 +214,7 @@ function requireProjectFlag(projectId, usage) {
   if (!projectId) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --project <id>.",
+      message: "Missing --project <project_id>.",
       hint: usage,
     });
   }
@@ -227,7 +227,7 @@ function requireCachedProject(projectId) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: `No local project credentials cached for ${projectId}.`,
-      hint: "Import keys with `run402 credentials project-keys import --project <id> --service-key-stdin` if this operation truly requires local project credentials.",
+      hint: "Import keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin` if this operation truly requires local project credentials.",
       details: { project_id: projectId, ...provenance() },
       next_actions: [{
         type: "run_command",
@@ -256,7 +256,7 @@ async function status(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys status: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <project_id>");
   console.log(JSON.stringify(redactedEntry(id, getProject(id)), null, 2));
 }
 
@@ -311,7 +311,7 @@ async function importKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys import: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <id> --service-key-stdin");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <project_id> --service-key-stdin");
   // Resolve --anon-key-env before requiring a service key, so a missing service
   // key can report against the flags actually passed and an anon-only rotation
   // can reuse the cached service key.
@@ -346,12 +346,12 @@ async function exportKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys export: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <id> --reveal");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <project_id> --reveal");
   if (!parsed.includes("--reveal")) {
     fail({
       code: "REVEAL_REQUIRED",
       message: "Exporting full project keys requires --reveal.",
-      hint: "Use `run402 credentials project-keys status --project <id>` for redacted output.",
+      hint: "Use `run402 credentials project-keys status --project <project_id>` for redacted output.",
       details: { project_id: id, ...provenance() },
     });
   }
@@ -364,7 +364,7 @@ async function remove(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys remove: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <project_id>");
   const existed = Boolean(getProject(id));
   removeProject(id, projectCredentialsFile());
   console.log(JSON.stringify({ project_id: id, removed: existed, ...provenance() }, null, 2));
@@ -423,7 +423,7 @@ async function issue(args) {
   requirePositionalCount(rest, ISSUE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]",
+    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]",
     missing: "",
   });
   if (kind !== "anon" && kind !== "service") {
@@ -485,7 +485,7 @@ async function listCredentials(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials list [--project <id>]",
+    command: "run402 credentials list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -503,7 +503,7 @@ async function credentialStatus(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials status [--project <id>]",
+    command: "run402 credentials status [--project <project_id>]",
     missing: "",
   });
   try {
@@ -527,7 +527,7 @@ async function rotate(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project"], {
     min: 1,
     max: 1,
-    command: "run402 credentials rotate <credential_id> [--project <id>]",
+    command: "run402 credentials rotate <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -545,7 +545,7 @@ async function revoke(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project", "--reason"], {
     min: 1,
     max: 1,
-    command: "run402 credentials revoke <credential_id> [--project <id>]",
+    command: "run402 credentials revoke <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -564,7 +564,7 @@ async function token(args) {
   requirePositionalCount(rest, ["--project", "--kind"], {
     min: 0,
     max: 0,
-    command: "run402 credentials token [--project <id>]",
+    command: "run402 credentials token [--project <project_id>]",
     missing: "",
   });
   if (kind && kind !== "anon" && kind !== "service") {

package/lib/daemon-path.mjs

@@ -4,7 +4,7 @@
  * builtins (pinned by the import-graph gate test), so it must stay tiny.
  *
  * The socket lives INSIDE the client configuration directory — the same
- * 0700 trust boundary that already holds the allowance private key and the
+ * 0700 trust boundary that already holds the wallet private key and the
  * gitvault keystore — and its path is keyed by CLI version, so a CLI
  * upgrade resolves a NEW path: the new client never reaches the old daemon,
  * which idles out on its own. Windows uses a named pipe whose name carries

package/lib/delegates.mjs

@@ -15,24 +15,24 @@ Usage:
   run402 delegates <subcommand> [args...]
 
 Subcommands:
-  create --grant <grant_id> [--project <id>] [--capability <cap>] [--kind <kind>]
+  create --grant <grant_id> [--project <project_id>] [--capability <cap>] [--kind <kind>]
          [--scope <json>] [--expires <iso8601>]
                                  Mint a delegate. The bearer is printed ONCE.
-  list [--project <id>]          List delegates (never shows tokens)
-  revoke <delegate_id> [--project <id>]
+  list [--project <project_id>]          List delegates (never shows tokens)
+  revoke <delegate_id> [--project <project_id>]
                                  Revoke immediately
-  rotate <delegate_id> [--project <id>]
+  rotate <delegate_id> [--project <project_id>]
                                  Revoke + reissue; new bearer printed ONCE
 
 Notes:
   - A delegate NARROWS an existing grant, so mint the grant first:
-      run402 grants create <agent-wallet> --capability deploy --project <id>
+      run402 grants create <agent-wallet> --capability deploy --project <project_id>
     then pass the returned grant_id to 'delegates create'.
   - Mutations require you to be an owner of the project's org (wallet SIWX).
   - A delegate can never be an owner, and is revocable and expiring.
   - The token is shown ONCE and is not recoverable. Store it immediately;
     if you lose it, 'rotate' issues a new one.
-  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy apply ...
+  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy ...
   - JSON in, JSON out.
 
 Why this exists:
@@ -51,7 +51,7 @@ const SUB_HELP = {
   create: `run402 delegates create — mint a scoped deploy credential
 
 Usage:
-  run402 delegates create --grant <grant_id> [--project <id>] [--capability <cap>]
+  run402 delegates create --grant <grant_id> [--project <project_id>] [--capability <cap>]
                           [--kind <kind>] [--scope <json>] [--expires <iso8601>]
 
 --capability defaults to "deploy". --kind defaults to "run402_agent_key" (the
@@ -64,21 +64,21 @@ Requires owner of the project's org.
   list: `run402 delegates list — list a project's delegates
 
 Usage:
-  run402 delegates list [--project <id>]
+  run402 delegates list [--project <project_id>]
 
 Never returns tokens or secret material — id, kind, scope, expiry, revocation.
 `,
   revoke: `run402 delegates revoke — revoke a delegate immediately
 
 Usage:
-  run402 delegates revoke <delegate_id> [--project <id>]
+  run402 delegates revoke <delegate_id> [--project <project_id>]
 
 Takes effect for every subsequent request. Requires owner of the project's org.
 `,
   rotate: `run402 delegates rotate — revoke and reissue in one step
 
 Usage:
-  run402 delegates rotate <delegate_id> [--project <id>]
+  run402 delegates rotate <delegate_id> [--project <project_id>]
 
 Keeps the same principal, grant, kind, scope, cap and expiry. The NEW bearer is
 printed once. Use this when a token is lost or possibly exposed.
@@ -99,12 +99,12 @@ async function create(args) {
   requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 delegates create --grant <grant_id> [--project <id>]",
+    command: "run402 delegates create --grant <grant_id> [--project <project_id>]",
     missing: "",
   });
   if (!grantId) {
     console.error("Missing --grant <grant_id>. Mint one first:");
-    console.error("  run402 grants create <agent-wallet> --capability deploy --project <id>");
+    console.error("  run402 grants create <agent-wallet> --capability deploy --project <project_id>");
     process.exit(1);
   }
   const scope = scopeRaw != null
@@ -135,7 +135,7 @@ async function list(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 delegates list [--project <id>]",
+    command: "run402 delegates list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -153,7 +153,7 @@ function oneIdCommand(name) {
     const [delegateId] = requirePositionalCount(rest, ["--project"], {
       min: 1,
       max: 1,
-      command: `run402 delegates ${name} <delegate_id> [--project <id>]`,
+      command: `run402 delegates ${name} <delegate_id> [--project <project_id>]`,
       missing: "Missing <delegate_id>.",
     });
     try {

package/lib/deliveries.mjs

@@ -7,12 +7,12 @@
  * produces them, which is now `contacts` and `subscriptions`.
  *
  * HTTP paths are unchanged (`/agent/v1/notifications*`) — this is client
- * vocabulary, and the allowance auth headers below are PATH-scoped, so they
+ * vocabulary, and the SIWX auth headers below are PATH-scoped, so they
  * must keep naming the real route. Renaming them would ship broken auth
  * against a live path, which is exactly how the `feedback` rename nearly went
  * wrong.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
+import { walletAuthHeaders } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -30,7 +30,7 @@ const HELP = `run402 deliveries — did a notification actually land
 
 Usage:
   run402 deliveries list [--type <event_type>] [--since <iso>] [--limit N] [--after <cursor>]
-  run402 deliveries get <id>
+  run402 deliveries get <notification_id>
 
 Notes:
   - One row per delivery ATTEMPT, per channel, with its outcome — the audit
@@ -47,7 +47,7 @@ async function list(args) {
   if (extra.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for notifications list: ${extra[0]}` });
   }
-  allowanceAuthHeaders("/agent/v1/notifications");
+  walletAuthHeaders("/agent/v1/notifications");
   const opts = {};
   const type = flagValue(parsedArgs, "--type");
   const since = flagValue(parsedArgs, "--since");
@@ -70,9 +70,9 @@ async function get(args) {
   assertKnownFlags(parsedArgs, ["--help", "-h"]);
   const positionals = positionalArgs(parsedArgs);
   if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 notifications get <id>" });
+    fail({ code: "BAD_USAGE", message: "Usage: run402 deliveries get <notification_id>" });
   }
-  allowanceAuthHeaders("/agent/v1/notifications");
+  walletAuthHeaders("/agent/v1/notifications");
   try {
     const data = await getSdk().admin.getNotification(positionals[0]);
     console.log(JSON.stringify(data, null, 2));

package/lib/deploy-rehearse-discovery.test.mjs

@@ -3,21 +3,21 @@ import assert from "node:assert/strict";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { discoverRehearseManifest } from "./deploy-v2.mjs";
+import { discoverDeployManifest } from "./deploy-v2.mjs";
 
-describe("deploy rehearse — manifest discovery (the way up does it)", () => {
+describe("deploy / deploy rehearse — manifest discovery (the way up does it)", () => {
   it("prefers run402.json, then run402.deploy.json, then app.json, then executable configs", () => {
     const dir = mkdtempSync(join(tmpdir(), "run402-rehearse-discover-"));
     try {
-      assert.equal(discoverRehearseManifest(dir), null);
+      assert.equal(discoverDeployManifest(dir), null);
       writeFileSync(join(dir, "run402.deploy.ts"), "export default {}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.deploy.ts"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.deploy.ts"));
       writeFileSync(join(dir, "app.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "app.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "app.json"));
       writeFileSync(join(dir, "run402.deploy.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.deploy.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.deploy.json"));
       writeFileSync(join(dir, "run402.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.json"));
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }