run402 4.94.0 → 4.95.0

package/README.md

@@ -82,7 +82,7 @@ A hosted git remote, encrypted before it leaves the machine — no deploy, no ma
 
 **Invite / join.** The second claim kind beside handoff/resume: a Handoff passes the work on and the sender stops; an Invite grows the team while the sender keeps working. `run402 repos invite [--room <key>] [--note-file <path>]` captures the checkpoint exactly like `handoff` — the inviter's own worktree, index, branch, refs, and access are all untouched — registers the inviter's presence in a coordination room (the project's default room, or `--room <key>` for a named org room), mints a single-use bearer key (`kgi1_…`, printed to stdout exactly once), and posts ONE room message naming the checkpoint (never the key). `run402 repos join <kgi1_…>` folds the SAME cold-start chain `resume` does before the claim, clones fresh, restores the exact dirty state, pins the invite's room locally, registers its own presence, posts ONE arrival message, and reports the inviter (name, labels, liveness), the room's other live presences, and the last few messages. `run402 messages wait` is the room's blocking read from there — the agent's ear, never an error on silence. Neither `invite` nor `join` has an MCP tool, same reasoning as `handoff`/`resume`.
 
-**Named addressing.** `run402 org slug <slug>` (owner-only, small one-time fee) sets an org's globally-unique, address-form slug, after which `run402::<slug>/<name>` addresses any repo under it — `git push` to a name that doesn't exist yet push-to-creates it. `run402 repos rename <name> [--project <id>]` claims the per-org-unique `<name>` half explicitly (no fee); `repos create` claims one automatically, best-effort, when the org already has a slug. Also CLI/SDK-only — no MCP tool.
+**Named addressing.** `run402 orgs slug <slug>` (owner-only, small one-time fee) sets an org's globally-unique, address-form slug, after which `run402::<slug>/<name>` addresses any repo under it — `git push` to a name that doesn't exist yet push-to-creates it. `run402 repos rename <name> [--project <project_id>]` claims the per-org-unique `<name>` half explicitly (no fee); `repos create` claims one automatically, best-effort, when the org already has a slug. Also CLI/SDK-only — no MCP tool.
 
 ### Wallet
 
@@ -144,11 +144,11 @@ reconciliation.
 ### Database
 
 ```bash
-run402 projects sql <id> "CREATE TABLE items (id serial PRIMARY KEY, …)"
-run402 projects validate-expose <id> --file manifest.json # check auth manifest, no mutation
-run402 projects apply-expose <id> --file manifest.json   # declare what's reachable
-run402 projects rest <id> items "select=*&order=id.desc&limit=10"
-run402 projects schema <id>                              # introspect tables + RLS
+run402 projects sql <project_id> "CREATE TABLE items (id serial PRIMARY KEY, …)"
+run402 projects validate-expose <project_id> --file manifest.json # check auth manifest, no mutation
+run402 projects apply-expose <project_id> --file manifest.json   # declare what's reachable
+run402 projects rest <project_id> items "select=*&order=id.desc&limit=10"
+run402 projects schema <project_id>                              # introspect tables + RLS
 ```
 
 ### Static sites
@@ -223,18 +223,18 @@ The returned `cdn_url` is content-addressed (`pr-<public_id>.run402.com/_blob/<k
 ### Functions
 
 ```bash
-run402 functions deploy <id> my-fn --file fn.ts \
+run402 functions deploy <project_id> my-fn --file fn.ts \
   --timeout 30 --memory 256 \
   --schedule "*/15 * * * *" \
   --deps "stripe,zod@^3"
-run402 functions logs <id> my-fn --tail 100 --request-id req_abc123 --follow
-run402 functions logs --request-id req_abc123 --project <id>   # <name> optional with --request-id: every function is searched
-run402 functions logs my-fn --project <id> --all               # include the Lambda INIT_START / REPORT lines
-run402 logs --request-id req_abc123 --project <id>             # the x-run402-request-id response header, no function name needed
-run402 functions invoke my-fn --project <id> --body-file request.json
-run402 functions invoke paid-fn --project <id> --body-file request.json --idempotency-key paid:call:123 --wait
-run402 functions rebuild <id> my-fn      # refresh ONE function onto the current runtime
-run402 functions rebuild <id> --all      # refresh every function in the project
+run402 functions logs <project_id> my-fn --tail 100 --request-id req_abc123 --follow
+run402 functions logs --request-id req_abc123 --project <project_id>   # <name> optional with --request-id: every function is searched
+run402 functions logs my-fn --project <project_id> --all               # include the Lambda INIT_START / REPORT lines
+run402 logs --request-id req_abc123 --project <project_id>             # the x-run402-request-id response header, no function name needed
+run402 functions invoke my-fn --project <project_id> --body-file request.json
+run402 functions invoke paid-fn --project <project_id> --body-file request.json --idempotency-key paid:call:123 --wait
+run402 functions rebuild <project_id> my-fn      # refresh ONE function onto the current runtime
+run402 functions rebuild <project_id> --all      # refresh every function in the project
 ```
 
 Log reads are app-first: every entry carries `origin: "app" | "platform"`, the Lambda runtime lines (INIT_START, START/END/REPORT RequestId, billed duration) are hidden by default (`--app`), `--platform` shows only them and `--all` the raw stream; `hidden` counts what was dropped and a `hint` explains an empty result. `--request-id` accepts `req_`, `fnrun_`, and `fnatt_` ids, `--since` takes an ISO timestamp or epoch ms, and `run402 logs` rejects unknown flags.
@@ -258,9 +258,9 @@ import { db, adminDb, auth, email, ai } from "@run402/functions";
 ### Secrets
 
 ```bash
-run402 secrets set <id> OPENAI_API_KEY --file ./.secrets/openai-key
-printf %s "$OPENAI_API_KEY" | run402 secrets set <id> OPENAI_API_KEY --stdin
-run402 secrets list <id>
+run402 secrets set <project_id> OPENAI_API_KEY --file ./.secrets/openai-key
+printf %s "$OPENAI_API_KEY" | run402 secrets set <project_id> OPENAI_API_KEY --stdin
+run402 secrets list <project_id>
 run402 deploy --manifest run402.deploy.json   # manifest uses secrets.require, not values
 ```
 
@@ -355,13 +355,13 @@ A person signs in; the agent is your wallet (`run402 status` shows the wallet's
 - `run402 whoami` — principal, memberships, `session.grade`, and the write approvals cached on this machine.
 - `run402 approve --action <capability> (--org <org_id> | --project <project_id>)` — passkey-signed write approval for one action on one target; a person without a wallet needs it to provision, deploy, or write secrets (an interactive `provision`/`deploy` opens it for you).
 - `run402 logout` — revoke the session server-side and clear it and every write approval locally.
-- `run402 org list` — your orgs joined with the account overview (tier, lifecycle, quotas, allowance, advisories).
+- `run402 orgs list` — your orgs joined with the account overview (tier, lifecycle, quotas, allowance, advisories).
 
 Not exposed as MCP tools by design — MCP authenticates as the agent (wallet), and a person's session must not become its ambient authority.
 
 ## Active project (sticky default)
 
-After `provision`, the new project becomes the active one. `run402 projects use <id>` switches it. Most commands that take `<id>` default to the active project when omitted.
+After `provision`, the new project becomes the active one. `run402 projects use <project_id>` switches it. Most commands that take `<project_id>` default to the active project when omitted.
 
 ## Help
 

package/cli.mjs

@@ -72,13 +72,13 @@ AUTHORITY — who may act, and with what credential
   credentials Manage local credential material (project-keys)
   delegates   Scoped deploy credentials for agents (create, list, revoke, rotate)
   grants      Per-project capability grants for agent/CI principals (create, revoke)
-  org         Org membership, invites & audit (whoami, list, member, invite, audit)
+  orgs        Organizations, members, invites & audit (list, get, members, invite, audit)
   identity    Public proof-backed external agent identity links
   auth        Manage project user authentication (magic link, passwords, settings)
   ci          Link GitHub Actions OIDC deploy bindings
   login       Sign in as a person (browser passkey; --device for a read-only session)
   logout      End your sign-in session and clear it from this machine
-  whoami      Who this CLI acts as: principal, memberships, session grade
+  whoami      Who this CLI acts as: principal, memberships, session grade (--set-name sets your name)
   approve     Write approval for one action on one target (provision, deploy, secrets)
 
 DELIVER — reach a human when something happens
@@ -94,8 +94,7 @@ PLATFORM — everything else, and the things still finding a home
   contracts   KMS signers ($0.04/day rental + $0.000005/sign)
   jobs        Submit and inspect platform-managed jobs
   transfer    Project transfer to a wallet, an email, or an owned org (init, preview, list, accept, cancel)
-  cloud       Cloud portability archive export (archives create/download/status)
-  archives    Inspect and verify portable project archives locally
+  archives    Portable project archives (create, status, download --target cloud; inspect, verify; import --target core)
   gitvault    RETIRED — moved to repos (repo-surface-consolidation); every spelling answers COMMAND_MOVED/COMMAND_REMOVED
   source-access RETIRED — moved into repos (recovery-bundle + access); every spelling answers COMMAND_MOVED
   buzz        Buzz human/community/agent control-plane workflows
@@ -105,7 +104,6 @@ PLATFORM — everything else, and the things still finding a home
   cdn         CloudFront CDN diagnostics (wait-fresh) for public asset URLs
   cache       Inspect and invalidate the SSR origin cache (inspect, invalidate)
   agent       Manage agent identity (contact info)
-  core        Local Run402 Core import helpers
   dev         Run Astro dev with Run402 env + credentials in scope
 
 Global options (any command):
@@ -122,8 +120,8 @@ Examples:
   run402 deploy --manifest app.json
   run402 snapshots list --project prj_...
   run402 branches create --project prj_... --ttl-days 7 --json
-  run402 cloud archives create --project prj_... --wait --output ./project.r402ar --json
-  run402 core projects import ./project.r402ar --name imported-project --env-file ./required.env --json
+  run402 archives create --project <project_id> --target cloud --wait --output ./project.r402ar --json
+  run402 archives import ./project.r402ar --target core --name imported-project --env-file ./required.env --json
   run402 jobs submit --file job.json
   run402 projects list
   run402 projects sql "SELECT * FROM users LIMIT 5" --project <project_id>
@@ -257,21 +255,11 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "cloud": {
-    const { run } = await import("./lib/cloud.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "archives": {
     const { run } = await import("./lib/archives.mjs");
     await run(sub, rest);
     break;
   }
-  case "core": {
-    const { run } = await import("./lib/core.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "deploy": {
     const { run } = await import("./lib/deploy.mjs");
     await run([sub, ...rest].filter(Boolean));
@@ -287,8 +275,8 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "org": {
-    const { run } = await import("./lib/org.mjs");
+  case "orgs": {
+    const { run } = await import("./lib/orgs.mjs");
     await run(sub, rest);
     break;
   }

package/gitvault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.94.0",
+  "surface_version": "4.95.0",
   "verbs": [
     "repos create",
     "repos list",
@@ -26,7 +26,7 @@
   "retired_spellings": [
     {
       "spelling": "gitvault init",
-      "successor": "moved to `repos create --project <id>`"
+      "successor": "moved to `repos create --project <project_id>`"
     },
     {
       "spelling": "gitvault status",

package/lib/admin.mjs

@@ -17,12 +17,12 @@ Subcommands:
                                          (\`reactivated: true\` in the response).
                                          Replaces the v1.56 per-project pin.
 
-  archive [--project <id>] [--reason "..."]  Moderate-archive a single project. Sets
+  archive [--project <project_id>] [--reason "..."]  Moderate-archive a single project. Sets
                                          projects.archived_at = NOW(). Independent
                                          of organization lifecycle; the rest of the
                                          organization's projects keep serving.
 
-  reactivate [--project <id>]            Un-archive a project (flips archived_at
+  reactivate [--project <project_id>]            Un-archive a project (flips archived_at
                                          back to NULL). In v1.57 this no longer
                                          touches organization-level lifecycle — to
                                          reactivate a grace-state account, use
@@ -65,7 +65,7 @@ Examples:
   archive: `run402 admin archive — Moderate-archive a single project
 
 Usage:
-  run402 admin archive [--project <id>] [--reason "..."]
+  run402 admin archive [--project <project_id>] [--reason "..."]
 
 Legacy (still supported):
   run402 admin archive <project_id> [--reason "..."]
@@ -87,7 +87,7 @@ Examples:
   reactivate: `run402 admin reactivate — Un-archive a project
 
 Usage:
-  run402 admin reactivate [--project <id>]
+  run402 admin reactivate [--project <project_id>]
 
 Legacy (still supported):
   run402 admin reactivate <project_id>
@@ -143,7 +143,7 @@ async function leasePerpetual(args) {
 }
 
 async function archive(args) {
-  // Canonical: --project <id>; legacy leading prj_... positional kept.
+  // Canonical: --project <project_id>; legacy leading prj_... positional kept.
   const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAGS_BY_SUB.archive.values });
   let reason;
   for (let i = 0; i < rest.length; i++) {

package/lib/ai.mjs

@@ -24,7 +24,7 @@ Examples:
 
 Notes:
   - [project_id] defaults to the active project when omitted (set with
-    'run402 projects use <id>'). Project IDs start with 'prj_'; any first
+    'run402 projects use <project_id>'). Project IDs start with 'prj_'; any first
     positional that doesn't is treated as the next argument instead.
   - translate requires the AI Translation add-on on the project
   - moderate is free for all projects
@@ -47,7 +47,7 @@ Options:
   --to <lang>         Target language code (required, e.g. es, ja, fr)
   --from <lang>       Source language code (optional; auto-detected if omitted)
   --context <hint>    Optional translation hint (e.g. "formal business email")
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Requires the AI Translation add-on on the project
@@ -71,7 +71,7 @@ Arguments:
   <text>              Text to check (quote it to preserve spaces)
 
 Options:
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Free for all projects; uses the project's service key
@@ -91,7 +91,7 @@ Arguments:
                       Must start with 'prj_'; any other first positional is an error.
 
 Options:
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Reports translation word quota and usage; only meaningful with the
@@ -111,7 +111,7 @@ async function translate(args) {
   args = normalizeArgv(args);
   assertKnownFlags(args, TRANSLATE_VALUE_FLAGS, TRANSLATE_VALUE_FLAGS);
 
-  // --project <id> wins over positional, mirroring previous behavior.
+  // --project <project_id> wins over positional, mirroring previous behavior.
   const projectOpt = flagValue(args, "--project");
   const to = flagValue(args, "--to");
   const from = flagValue(args, "--from");

package/lib/apps.mjs

@@ -12,13 +12,13 @@ Subcommands:
   browse  [--tag <tag>]                   Browse public apps
   fork    <version_id> --name <name> [--subdomain <name>]
                                            Fork a published app into your own project
-  publish [--project <id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed]
+  publish [--project <project_id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed]
                                            Publish a project as an app
-  versions [--project <id>]                List published versions of a project
+  versions [--project <project_id>]                List published versions of a project
   inspect <version_id>                     Inspect a published app version
-  update  <version_id> [--project <id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed] [--no-fork]
+  update  <version_id> [--project <project_id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed] [--no-fork]
                                            Update a published version
-  delete  <version_id> [--project <id>]    Delete a published version
+  delete  <version_id> [--project <project_id>]    Delete a published version
 
 Legacy (still supported): the old positional forms keep working, e.g.
   run402 apps fork <version_id> <name>
@@ -72,13 +72,13 @@ Examples:
   publish: `run402 apps publish — Publish a project as an app
 
 Usage:
-  run402 apps publish [--project <id>] [options]
+  run402 apps publish [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 apps publish <project_id> [options]
 
 Options (project):
-  --project <id>      Project ID to publish (defaults to the active project)
+  --project <project_id>      Project ID to publish (defaults to the active project)
 
 Options:
   --description <d>   Human-readable description of the app
@@ -93,7 +93,7 @@ Examples:
   update: `run402 apps update — Update a published version's metadata
 
 Usage:
-  run402 apps update <version_id> [--project <id>] [options]
+  run402 apps update <version_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 apps update <project_id> <version_id> [options]
@@ -127,7 +127,7 @@ Examples:
   versions: `run402 apps versions — List published versions of a project
 
 Usage:
-  run402 apps versions [--project <id>]
+  run402 apps versions [--project <project_id>]
 
 Legacy (still supported):
   run402 apps versions <project_id>
@@ -138,7 +138,7 @@ Examples:
   delete: `run402 apps delete — Delete a published version
 
 Usage:
-  run402 apps delete <version_id> [--project <id>]
+  run402 apps delete <version_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 apps delete <project_id> <version_id>