run402 4.93.2 → 4.95.0

package/lib/assets.mjs

@@ -2,11 +2,11 @@
  * run402 assets — direct-to-S3 storage CLI.
  *
  * Usage:
- *   run402 assets put <file> [files...] [--project <id>] [--key <dest>] [--content-type <mime>] [--private] [--immutable] [--concurrency N] [--no-resume]
- *   run402 assets get <key> --output <file> [--project <id>]
- *   run402 assets ls [--project <id>] [--prefix <p>] [--limit <n>]
- *   run402 assets rm <key> [--project <id>]
- *   run402 assets sign <key> [--project <id>] [--ttl <seconds>]
+ *   run402 assets put <file> [files...] [--project <project_id>] [--key <dest>] [--content-type <mime>] [--private] [--immutable] [--concurrency N] [--no-resume]
+ *   run402 assets get <key> --output <file> [--project <project_id>]
+ *   run402 assets ls [--project <project_id>] [--prefix <p>] [--limit <n>]
+ *   run402 assets rm <key> [--project <project_id>]
+ *   run402 assets sign <key> [--project <project_id>] [--ttl <seconds>]
  *
  * For any file ≤ 5 GiB a single presigned PUT is used. Larger files use S3
  * multipart uploads with 16 MiB parts (640 parts at 10 GiB; up to 10 000
@@ -45,7 +45,7 @@ Usage:
   run402 assets diagnose <url> [options]
 
 Options:
-  --project <id>      Project ID (defaults to active project from 'run402 projects use')
+  --project <project_id>      Project ID (defaults to active project from 'run402 projects use')
   --key <dest>        Destination key (put only; defaults to file basename)
   --content-type <mime>  MIME override for blob put (defaults to extension inference)
   --private           Upload as private (not served by CDN; apikey required to read)
@@ -89,7 +89,7 @@ Arguments:
   <file>              Path to a file (or glob); pass multiple files to batch-upload
 
 Options:
-  --project <id>      Project ID (defaults to active project from 'run402 projects use')
+  --project <project_id>      Project ID (defaults to active project from 'run402 projects use')
   --key <dest>        Destination key; defaults to file basename. Use trailing '/' as prefix.
   --content-type <mime>  MIME override; defaults to inferring from the destination key extension
   --private           Upload as private (not served by CDN; apikey required to read)
@@ -124,7 +124,7 @@ Arguments:
 
 Options:
   --output <file>     Local destination path (required)
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 assets get images/logo.png --output /tmp/logo.png --project prj_abc123
@@ -135,7 +135,7 @@ Usage:
   run402 assets ls [options]
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
   --prefix <p>        Only list keys starting with this prefix
   --limit <n>         Max results (default 100, max 1000)
   --sort <key>        v1.50: key:asc (default) | createdAt:asc | createdAt:desc.
@@ -162,7 +162,7 @@ Arguments:
   <key>               Blob key to delete
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 assets rm images/logo.png --project prj_abc123
@@ -176,7 +176,7 @@ Arguments:
   <key>               Blob key to sign
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
   --ttl <seconds>     Signed-URL TTL (default 3600, min 60, max 604800)
 
 Examples:
@@ -191,12 +191,12 @@ Arguments:
   <url>               Full blob URL (e.g. https://app.run402.com/_blob/avatar.png)
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Output:
   - Prints the JSON envelope on stdout (parseable by agent shell loops).
   - Vantage caveat ("# probed once from gateway-us-east-1; not a global view")
-    on stderr — visible to TTY operators, ignored by piped consumers.
+    on stderr — visible to a person at a TTY, ignored by piped consumers.
 
 Exit codes:
   0   observed SHA matches the gateway's expected SHA
@@ -575,7 +575,7 @@ async function diagnose(argv) {
     const env = await getSdk().assets.diagnoseUrl(resolvedId, url);
     // Always print the JSON envelope for agent consumption (parseable).
     console.log(JSON.stringify(toCliDiagnoseEnvelope(env), null, 2));
-    // Vantage caveat to stderr so a TTY operator sees it; agent shell loops
+    // Vantage caveat to stderr so a person at a TTY sees it; agent shell loops
     // that pipe stdout into another tool aren't affected.
     process.stderr.write(
       `\n# probed once from ${env.vantage}; not a global view\n`,

package/lib/auth.mjs

@@ -9,43 +9,43 @@ Usage:
   run402 auth <subcommand> [args...]
 
 Subcommands:
-  magic-link --email <addr> [--delivery link|code|both] [--redirect <url>] [--project <id>]
+  magic-link --email <addr> [--delivery link|code|both] [--redirect <url>] [--project <project_id>]
     Request passwordless email authentication. Link remains the default.
 
-  verify (--token <token> | --challenge-id <id> --code <6 digits>) [--project <id>]
+  verify (--token <token> | --challenge-id <challenge_id> --code <6 digits>) [--project <project_id>]
     Exchange one email credential for access_token + refresh_token.
 
-  create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <id>]
+  create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <project_id>]
     Create or update a project auth user with the service key.
 
-  invite-user --email <addr> --redirect <url> [--admin <true|false>] [--project <id>]
+  invite-user --email <addr> --redirect <url> [--admin <true|false>] [--project <project_id>]
     Create/update a user and send a trusted invite magic link.
 
-  set-password --token <bearer> --new <password> [--current <password>] [--project <id>]
+  set-password --token <bearer> --new <password> [--current <password>] [--project <project_id>]
     Change, reset, or set a user's password. Requires the user's access_token.
 
-  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--allowed-email-domains <csv|none>] [--project <id>]
+  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--allowed-email-domains <csv|none>] [--project <project_id>]
     Update project auth settings (requires service_key).
 
-  passkey-register-options --token <bearer> --app-origin <origin> [--project <id>]
+  passkey-register-options --token <bearer> --app-origin <origin> [--project <project_id>]
     Create WebAuthn registration options for the authenticated user.
 
-  passkey-register-verify --token <bearer> --challenge <id> --response <json> [--label <text>] [--project <id>]
+  passkey-register-verify --token <bearer> --challenge <challenge_id> --response <json> [--label <text>] [--project <project_id>]
     Verify and store a passkey registration response.
 
-  passkey-login-options --app-origin <origin> [--email <addr>] [--project <id>]
+  passkey-login-options --app-origin <origin> [--email <addr>] [--project <project_id>]
     Create WebAuthn login options.
 
-  passkey-login-verify --challenge <id> --response <json> [--project <id>]
+  passkey-login-verify --challenge <challenge_id> --response <json> [--project <project_id>]
     Verify a passkey login response and return session tokens.
 
-  passkeys --token <bearer> [--project <id>]
+  passkeys --token <bearer> [--project <project_id>]
     List the authenticated user's passkeys.
 
-  delete-passkey --token <bearer> --id <passkey_id> [--project <id>]
+  delete-passkey --token <bearer> --id <passkey_id> [--project <project_id>]
     Delete one authenticated-user passkey.
 
-  providers [--project <id>]
+  providers [--project <project_id>]
     List available auth providers for the project.
 
   scaffold-roles [--table <name>] [--user-col <col>] [--role-col <col>] [--roles <csv>] [--cache-ttl <secs>]
@@ -73,7 +73,7 @@ Options:
   --redirect <url>    Required for link/both; optional for code
   --intent <intent>   signin (default), invite, claim, or recovery
   --state <value>     Optional client_state preserved through verification
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Notes:
   Acceptance does not prove delivery or disclose whether an account exists.
@@ -95,7 +95,7 @@ Options:
   --invite            Send a trusted invite magic link
   --redirect <url>    Required when --invite is used
   --state <value>     Optional client_state for the invite
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth create-user --email user@example.com
@@ -112,19 +112,19 @@ Options:
   --redirect <url>    Required: allowed auth redirect URL
   --admin <bool>      Optional: set project_admin status before inviting
   --state <value>     Optional client_state for the invite
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 `,
   verify: `run402 auth verify — Exchange an email credential for session tokens
 
 Usage:
   run402 auth verify --token <token> [options]
-  run402 auth verify --challenge-id <id> --code <6 digits> [options]
+  run402 auth verify --challenge-id <challenge_id> --code <6 digits> [options]
 
 Options:
   --token <token>     Required: the one-time magic-link token
-  --challenge-id <id> Required with --code: opaque handle from magic-link request
+  --challenge-id <challenge_id> Required with --code: opaque handle from magic-link request
   --code <digits>     Required with --challenge-id: six-digit email code
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Notes:
   Returns an access_token + refresh_token pair on success.
@@ -142,7 +142,7 @@ Options:
   --token <bearer>    Required: the user's access_token (Bearer token)
   --new <password>    Required: new password
   --current <pwd>     Current password (required when one is already set)
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth set-password --token eyJ... --new "new-pass" \\
@@ -159,7 +159,7 @@ Options:
   --public-signup <policy>              open, known_email, or invite_only
   --require-admin-passkey <true|false>  Require passkey auth for project_admin sessions
   --allowed-email-domains <csv|none>    Restrict hosted Google sign-in to these domains; 'none' clears (unrestricted)
-  --project <id>                        Project ID (defaults to active project)
+  --project <project_id>                        Project ID (defaults to active project)
 
 Notes:
   Requires the project's service_key (admin-level).
@@ -180,19 +180,19 @@ Usage:
 Options:
   --token <bearer>       Required: authenticated user's access_token
   --app-origin <origin>  Required: exact app origin for WebAuthn
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-register-verify": `run402 auth passkey-register-verify — Verify passkey registration
 
 Usage:
-  run402 auth passkey-register-verify --token <bearer> --challenge <id> --response <json> [options]
+  run402 auth passkey-register-verify --token <bearer> --challenge <challenge_id> --response <json> [options]
 
 Options:
   --token <bearer>       Required: authenticated user's access_token
-  --challenge <id>       Required: challenge_id returned by passkey-register-options
+  --challenge <challenge_id>       Required: challenge_id returned by passkey-register-options
   --response <json>      Required: browser PublicKeyCredential JSON
   --label <text>         Optional passkey label
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-login-options": `run402 auth passkey-login-options — Create passkey login options
 
@@ -202,17 +202,17 @@ Usage:
 Options:
   --app-origin <origin>  Required: exact app origin for WebAuthn
   --email <addr>         Optional email hint
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-login-verify": `run402 auth passkey-login-verify — Verify passkey login
 
 Usage:
-  run402 auth passkey-login-verify --challenge <id> --response <json> [options]
+  run402 auth passkey-login-verify --challenge <challenge_id> --response <json> [options]
 
 Options:
-  --challenge <id>       Required: challenge_id returned by passkey-login-options
+  --challenge <challenge_id>       Required: challenge_id returned by passkey-login-options
   --response <json>      Required: browser PublicKeyCredential JSON
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   passkeys: `run402 auth passkeys — List passkeys
 
@@ -221,7 +221,7 @@ Usage:
 
 Options:
   --token <bearer>       Required: authenticated user's access_token
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "delete-passkey": `run402 auth delete-passkey — Delete a passkey
 
@@ -231,7 +231,7 @@ Usage:
 Options:
   --token <bearer>       Required: authenticated user's access_token
   --id <passkey_id>      Required: passkey ID to delete
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   providers: `run402 auth providers — List available auth providers
 
@@ -239,7 +239,7 @@ Usage:
   run402 auth providers [options]
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth providers
@@ -609,7 +609,7 @@ async function passkeyRegisterVerify(args) {
   const label = parseFlag(args, "--label");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
   if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
-  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <challenge_id>" });
   const response = parseJsonFlag(args, "--response");
   try {
     const data = await getSdk().auth.verifyPasskeyRegistration(projectId, {
@@ -643,7 +643,7 @@ async function passkeyLoginOptions(args) {
 async function passkeyLoginVerify(args) {
   const challengeId = parseFlag(args, "--challenge");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
-  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <challenge_id>" });
   const response = parseJsonFlag(args, "--response");
   try {
     const data = await getSdk().auth.verifyPasskeyLogin(projectId, {

package/lib/billing.mjs

@@ -12,9 +12,9 @@ Subcommands:
   create-email <email>                     Create an email organization
   link-wallet [<org_id>] <wallet_address>  Link a wallet to an email organization
   checkout <identifier> --product <p>      Create an org checkout
-  topup <identifier> --sats <n> [--wait] [--qr <file.png>]   Top up the cash balance over Lightning (a bolt11 invoice; --qr also writes a scannable PNG)
+  topup <identifier> --sats <n> [--wait] [--qr <file.png>]   Top up the allowance over Lightning (a bolt11 invoice; --qr also writes a scannable PNG)
   auto-recharge [<org_id>] <on|off> [--threshold <n>]
-  balance <identifier>                     Balance by organization id (UUID), wallet (0x...), or email
+  balance <identifier>                     The allowance, by organization id (UUID), wallet (0x...), or email
   history <identifier> [--limit <n>]       Ledger history by organization id (UUID), wallet, or email
 
 Examples:
@@ -79,14 +79,14 @@ Options:
 
 Auth:
   Requires SIWX from a wallet linked to the organization (signed automatically from
-  the local allowance), or an admin key. Email lookups require an admin key.
+  the local wallet), or an admin key. Email lookups require an admin key.
 
 Examples:
   run402 billing history user@example.com
   run402 billing history 0x1234... --limit 100
   run402 billing history 00000000-0000-4000-8000-000000000001
 `,
-  balance: `run402 billing balance — Show balance for a organization
+  balance: `run402 billing balance — Show an organization's allowance
 
 Usage:
   run402 billing balance <identifier>
@@ -97,7 +97,7 @@ Arguments:
 
 Auth:
   Requires SIWX from a wallet linked to the organization (signed automatically from
-  the local allowance), or an admin key. Email lookups require an admin key.
+  the local wallet), or an admin key. Email lookups require an admin key.
 
 Examples:
   run402 billing balance user@example.com
@@ -262,7 +262,7 @@ async function topup(args) {
     });
     console.log(JSON.stringify(final, null, 2));
     if (final.status === "paid" || final.status === "paid_late") {
-      console.error(`Received — ${final.amount_sats} sats credited $${(final.amount_usd_micros / 1_000_000).toFixed(2)} to the balance${final.status === "paid_late" ? " (paid after the invoice expired; still credited)" : ""}.`);
+      console.error(`Received — ${final.amount_sats} sats added $${(final.amount_usd_micros / 1_000_000).toFixed(2)} to the allowance${final.status === "paid_late" ? " (paid after the invoice expired; still credited)" : ""}.`);
     } else if (final.status === "expired") {
       console.error("No payment was observed before the invoice expired. If you already paid, it still credits on its own (the gateway keeps checking for an hour after expiry) — read the top-up again, or rerun with the same --idempotency-key. Otherwise mint a fresh one with the same command.");
       process.exitCode = 2;

package/lib/branches.mjs

@@ -15,10 +15,10 @@ import {
 const HELP = `run402 branches — Contained project data branches
 
 Usage:
-  run402 branches create [--project <id>] [--from-snapshot <snapshot-id>] [--name <label>] [--email-mode sandbox|off] [--enable-cron] [--ttl-days <n>] [--json]
-  run402 branches list [--project <id>] [--json]
-  run402 branches renew <branch-project-id> [--project <id>] [--ttl-days <n>] [--json]
-  run402 branches delete <branch-project-id> [--project <id>] [--json]
+  run402 branches create [--project <project_id>] [--from-snapshot <snapshot_id>] [--name <label>] [--email-mode sandbox|off] [--enable-cron] [--ttl-days <n>] [--json]
+  run402 branches list [--project <project_id>] [--json]
+  run402 branches renew <branch_project_id> [--project <project_id>] [--ttl-days <n>] [--json]
+  run402 branches delete <branch_project_id> [--project <project_id>] [--json]
 
 Legacy (still supported): a leading prj_... parent-project positional,
 e.g. run402 branches renew prj_parent prj_branch. --project defaults to the
@@ -77,7 +77,7 @@ async function list(args) {
 }
 
 async function renew(args) {
-  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches renew [project-id] <branch-project-id>");
+  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches renew [project_id] <branch_project_id>");
   const ttlDaysFlag = flagValue(args, "--ttl-days");
   const ttlDays = ttlDaysFlag === null ? undefined : parseIntegerFlag("--ttl-days", ttlDaysFlag, { min: 1, max: 30 });
   try {
@@ -91,7 +91,7 @@ async function renew(args) {
 }
 
 async function deleteBranch(args) {
-  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches delete [project-id] <branch-project-id>");
+  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches delete [project_id] <branch_project_id>");
   try {
     await getSdk().branches.delete(projectId, branchProjectId);
     console.log(JSON.stringify({ ok: true, project_id: projectId, branch_project_id: branchProjectId, deleted: true }, null, 2));
@@ -101,7 +101,7 @@ async function deleteBranch(args) {
 }
 
 function resolveProjectAndBranch(args, usage) {
-  // Canonical: `<branch-project-id> [--project <parent-id>]`. Branch ids are
+  // Canonical: `<branch_project_id> [--project <parent_project_id>]`. Branch ids are
   // themselves prj_..., so a leading prj_ positional is only treated as the
   // PARENT project when a second positional follows (requireRestPositional) —
   // the legacy `renew prj_parent prj_branch` form.

package/lib/buzz-doctor.mjs

@@ -230,7 +230,7 @@ async function checkRun402Cli({ cwd, env, argv, run402Executable, updateCheck })
     install_confidence: install.confidence,
     package_manager: install.package_manager,
     compatibility_source: "version_and_capability_probe",
-    required_capabilities: ["doctor --buzz", "doctor --buzz-agent", "wallets current", "org whoami", "identity link nostr"],
+    required_capabilities: ["doctor --buzz", "doctor --buzz-agent", "wallets current", "whoami", "identity link nostr"],
   };
   if (update?.status === "warning") {
     const rawAction = update?.value?.next_actions?.[0];
@@ -689,7 +689,7 @@ function consoleRepair() {
     type: "restore_run402_console_access",
     surface: "buzz_settings",
     command: "Open Buzz Desktop > Settings > Agents, select this agent, allow HTTPS access to https://console.run402.com, restart the agent, then rerun Run402 setup.",
-    why: "The no-terminal human adoption handoff requires the Run402 console origin.",
+    why: "The no-terminal human adoption offer requires the Run402 console origin.",
   });
 }
 

package/lib/buzz-notifications.mjs

@@ -22,11 +22,11 @@ import {
 const HELP = `run402 buzz notifications — route project events into a Buzz community channel
 
 Usage:
-  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> (--project <id> [--project <id> ...] | --all-projects) [--event-type <t> ...] [--event-class <c> ...] [--include-org-events] [--on-call <hex-pubkey> [--on-call-name <display>]]
+  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> (--project <project_id> [--project <project_id> ...] | --all-projects) [--event-type <t> ...] [--event-class <c> ...] [--include-org-events] [--on-call <hex-pubkey> [--on-call-name <display>]]
       --all-projects         route every project the organization owns, present and future (project_scope org);
                              without it the route names its projects explicitly (--project, 1..50)
       --include-org-events   also deliver the org's own facts (the platform_payment_received receipt after a Lightning top-up) into the channel
-  run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]
+  run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]
       switch the route to the whole organization, or back to an explicit list (the stored list is kept;
       --listed on a route with no stored list needs --project)
       --on-call <hex>        the Buzz agent (64-hex pubkey) a crash or platform incident pages with a p mention — the tag that wakes a managed Buzz agent
@@ -69,7 +69,7 @@ What can be routed:
   Omitting --event-type/--event-class routes every registered type / every
   non-forbidden class. There is no empty filter: the gateway rejects [].
 
-Buzz is never a deadman channel: mandatory operator notifications keep their
+Buzz is never a deadman channel: mandatory owner notifications keep their
 human paths (email, Telegram) regardless of route state, and a Buzz delivery
 acknowledges nothing.
 
@@ -228,7 +228,7 @@ async function projects(args) {
 }
 
 /**
- * `run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]`
+ * `run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]`
  * — switch the route between the whole organization and an explicit list.
  * The stored list survives the switch to `org`; `--listed` on a route with
  * nothing stored needs `--project`.
@@ -238,7 +238,7 @@ async function scope(args) {
   const valueFlags = ["--project"];
   assertKnownFlags(a, [...valueFlags, "--org", "--listed", "--help", "-h"], valueFlags);
   const positionals = requirePositionalCount(positionalArgs(a, valueFlags), valueFlags, {
-    min: 1, max: 1, command: "run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]", missing: "<buzzper_id>",
+    min: 1, max: 1, command: "run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]", missing: "<buzzper_id>",
   });
   const [routeId] = positionals;
   const org = a.includes("--org");

package/lib/buzz.mjs

@@ -23,7 +23,7 @@ The four independent states are:
 Canonical workflows:
   run402 buzz status
   run402 buzz adopt offer --org <org_id> --identity-link <idlnk_id> [--deployment-context-file <json>]
-      --org                       the Run402 organization id as "run402 org whoami" returns it (a UUID)
+      --org                       the Run402 organization id as "run402 whoami" returns it (a UUID)
       --deployment-context-file   JSON with exactly these five non-empty strings, and no others:
                                   project_id, release_id, live_url, source_revision, verified_at
   run402 buzz install --org <org_id> --community <buzz:community:host> [--authority <hex-pubkey>]
@@ -46,7 +46,7 @@ Explicit consent/decision commands:
   run402 buzz revoke <buzzae_id>
 
 Project-event routing into a Buzz channel (configure → authorize → test → live):
-  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> --project <id> [--event-type <t> ...] [--event-class <c> ...] [--include-org-events]
+  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> --project <project_id> [--event-type <t> ...] [--event-class <c> ...] [--include-org-events]
   run402 buzz notifications status [--org <uuid> | <buzzper_id>]
   run402 buzz notifications test <buzzper_id> [--wait]
   run402 buzz notifications deliveries <buzzper_id> [--limit <n>] [--cursor <c>] [--delivery <buzzped_id>]
@@ -122,7 +122,7 @@ async function adopt(args) {
     assertKnownFlags(a, values, values);
     const [id] = requirePositionalCount(a, values, { min: 1, max: 1, command: "run402 buzz adopt complete <buzzha_id> --event-file <json>" });
     const event = readJsonFile(requiredFlag(a, "--event-file"), "--event-file");
-    return invoke(() => getSdk({ authMode: "operator" }).buzz.humanAdoptions.complete(id, event, flagValue(a, "--idempotency-key") ?? undefined));
+    return invoke(() => getSdk({ authMode: "session" }).buzz.humanAdoptions.complete(id, event, flagValue(a, "--idempotency-key") ?? undefined));
   }
   if (operation === "cancel") {
     const a = normalizeArgv(rest);

package/lib/buzz.test.mjs

@@ -84,7 +84,7 @@ describe("run402 buzz CLI", () => {
           return {
             buzz_human_adoption_offer_id: `buzzhao_${"1".repeat(32)}`,
             status: "available",
-            handoff_url: `https://console.run402.com/buzz/adoptions/buzzhao_${"1".repeat(32)}`,
+            offer_url: `https://console.run402.com/buzz/adoptions/buzzhao_${"1".repeat(32)}`,
           };
         },
       },

package/lib/cache.mjs

@@ -59,7 +59,7 @@ Subcommands:
 Common flags:
   --locale <code>              (inspect only) Inspect a specific locale's row
                                (default: project's default locale)
-  --release-id <id>            (inspect only) Inspect a specific release id
+  --release-id <release_id>            (inspect only) Inspect a specific release id
                                (default: project's active release)
 
 Output:

package/lib/cdn.mjs

@@ -2,7 +2,7 @@
  * run402 cdn — CloudFront CDN diagnostics for public blob URLs.
  *
  * Usage:
- *   run402 cdn wait-fresh <url> --sha <sha256> [--timeout <seconds>] [--project <id>]
+ *   run402 cdn wait-fresh <url> --sha <sha256> [--timeout <seconds>] [--project <project_id>]
  *
  * Wraps the SDK's `client.project(id).assets.waitFresh(...)`. Polls the gateway diagnose
  * endpoint until the URL serves the expected SHA, then exits 0. On timeout,
@@ -45,7 +45,7 @@ Arguments:
 Options:
   --sha <hex>         Expected hex SHA-256. Required.
   --timeout <secs>    Max wait in seconds. Default 60.
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Output:
   Prints a JSON result on stdout when polling ends:

package/lib/ci.mjs

@@ -21,8 +21,8 @@ const { version: RUN402_VERSION } = JSON.parse(
 const HELP = `run402 ci — Manage CI/OIDC deploy bindings
 
 Usage:
-  run402 ci link github [--project <id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
-  run402 ci list [--project <id>]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci list [--project <project_id>]
   run402 ci revoke <binding_id>
   run402 ci set-asset-scopes <binding_id> <scope1> [<scope2> ...]
 
@@ -34,18 +34,18 @@ Subcommands:
 `;
 
 const SUB_HELP = {
-  link: `run402 ci link github — Link GitHub Actions OIDC for deploy apply
+  link: `run402 ci link github — Link GitHub Actions OIDC for run402 deploy
 
 Usage:
-  run402 ci link github [--project <id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
 
 Options:
-  --project <id>          Project ID (defaults to the active project)
+  --project <project_id>          Project ID (defaults to the active project)
   --manifest <path>       Manifest path used by the generated workflow (default: run402.deploy.json)
   --repo <owner/repo>     GitHub repo (default: inferred from origin remote)
   --branch <name>         Branch subject and push trigger (default: current branch)
   --environment <name>    GitHub environment subject; adds job.environment
-  --repository-id <id>    Numeric GitHub repository id when API lookup is unavailable
+  --repository-id <repository_id>    Numeric GitHub repository id when API lookup is unavailable
   --workflow <path>       Workflow path (default: .github/workflows/run402-deploy.yml)
   --expires-at <iso>      Optional binding expiration timestamp
   --route-scope <pattern> Optional exact path or final wildcard route scope, repeatable (examples: /admin, /api/*)
@@ -60,7 +60,7 @@ Notes:
   list: `run402 ci list — List CI bindings
 
 Usage:
-  run402 ci list [--project <id>]
+  run402 ci list [--project <project_id>]
 `,
   revoke: `run402 ci revoke — Revoke a CI binding
 
@@ -245,7 +245,7 @@ ${environmentLine}    steps:
       - name: Deploy to run402
         # Redirect stdin from /dev/null: a CI runner's stdin is a FIFO/file that
         # older run402 CLIs counted as a second manifest source alongside --manifest.
-        run: npx --yes run402@${RUN402_VERSION} deploy apply --manifest ${shellQuote(manifest)} --project ${shellQuote(projectId)} < /dev/null
+        run: npx --yes run402@${RUN402_VERSION} deploy --manifest ${shellQuote(manifest)} --project ${shellQuote(projectId)} < /dev/null
 `;
 }
 
@@ -267,7 +267,7 @@ async function linkGithub(args) {
     fail({
       code: "BAD_USAGE",
       message: "Missing provider: github.",
-      hint: "run402 ci link github [--project <id>]",
+      hint: "run402 ci link github [--project <project_id>]",
     });
   }
   if (flags.branch && flags.environment) {
@@ -293,7 +293,7 @@ async function linkGithub(args) {
     fail({
       code: "GITHUB_REPOSITORY_ID_REQUIRED",
       message: `Could not fetch the numeric GitHub repository id for ${repo}.`,
-      hint: "Set GITHUB_TOKEN/GH_TOKEN or pass --repository-id <id>.",
+      hint: "Set GITHUB_TOKEN/GH_TOKEN or pass --repository-id <repository_id>.",
       details: { repo },
     });
   }
@@ -328,8 +328,8 @@ async function linkGithub(args) {
     signedDelegation = signCiDelegation(values, { apiBase: API });
   } catch (err) {
     fail({
-      code: "NO_ALLOWANCE",
-      message: err?.message || "No local allowance configured.",
+      code: "NO_WALLET",
+      message: err?.message || "No local wallet configured.",
       hint: "Run: run402 init",
     });
   }

package/lib/claims.mjs

@@ -49,10 +49,10 @@ Advisory, always:
   presence.
 
 Room addressing:
-  Default room of the active project with no flags; --project <id> for another
+  Default room of the active project with no flags; --project <project_id> for another
   project; --org <org_id> --room <key> (or RUN402_ROOM=<org_id>/<key>) for a
   named org room. --room <key> alone works when the org resolves on its own
-  (--org / RUN402_ORG / the 'org' key of the nearest .run402.json / 'org use'),
+  (--org / RUN402_ORG / the 'org' key of the nearest .run402.json / 'orgs use'),
   and {"org":"...","room":"..."} in .run402.json binds a whole checkout.
 
 Options: