run402 4.94.0 → 4.95.0

package/lib/auth.mjs

@@ -9,43 +9,43 @@ Usage:
   run402 auth <subcommand> [args...]
 
 Subcommands:
-  magic-link --email <addr> [--delivery link|code|both] [--redirect <url>] [--project <id>]
+  magic-link --email <addr> [--delivery link|code|both] [--redirect <url>] [--project <project_id>]
     Request passwordless email authentication. Link remains the default.
 
-  verify (--token <token> | --challenge-id <id> --code <6 digits>) [--project <id>]
+  verify (--token <token> | --challenge-id <challenge_id> --code <6 digits>) [--project <project_id>]
     Exchange one email credential for access_token + refresh_token.
 
-  create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <id>]
+  create-user --email <addr> [--admin <true|false>] [--invite] [--redirect <url>] [--project <project_id>]
     Create or update a project auth user with the service key.
 
-  invite-user --email <addr> --redirect <url> [--admin <true|false>] [--project <id>]
+  invite-user --email <addr> --redirect <url> [--admin <true|false>] [--project <project_id>]
     Create/update a user and send a trusted invite magic link.
 
-  set-password --token <bearer> --new <password> [--current <password>] [--project <id>]
+  set-password --token <bearer> --new <password> [--current <password>] [--project <project_id>]
     Change, reset, or set a user's password. Requires the user's access_token.
 
-  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--allowed-email-domains <csv|none>] [--project <id>]
+  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--allowed-email-domains <csv|none>] [--project <project_id>]
     Update project auth settings (requires service_key).
 
-  passkey-register-options --token <bearer> --app-origin <origin> [--project <id>]
+  passkey-register-options --token <bearer> --app-origin <origin> [--project <project_id>]
     Create WebAuthn registration options for the authenticated user.
 
-  passkey-register-verify --token <bearer> --challenge <id> --response <json> [--label <text>] [--project <id>]
+  passkey-register-verify --token <bearer> --challenge <challenge_id> --response <json> [--label <text>] [--project <project_id>]
     Verify and store a passkey registration response.
 
-  passkey-login-options --app-origin <origin> [--email <addr>] [--project <id>]
+  passkey-login-options --app-origin <origin> [--email <addr>] [--project <project_id>]
     Create WebAuthn login options.
 
-  passkey-login-verify --challenge <id> --response <json> [--project <id>]
+  passkey-login-verify --challenge <challenge_id> --response <json> [--project <project_id>]
     Verify a passkey login response and return session tokens.
 
-  passkeys --token <bearer> [--project <id>]
+  passkeys --token <bearer> [--project <project_id>]
     List the authenticated user's passkeys.
 
-  delete-passkey --token <bearer> --id <passkey_id> [--project <id>]
+  delete-passkey --token <bearer> --id <passkey_id> [--project <project_id>]
     Delete one authenticated-user passkey.
 
-  providers [--project <id>]
+  providers [--project <project_id>]
     List available auth providers for the project.
 
   scaffold-roles [--table <name>] [--user-col <col>] [--role-col <col>] [--roles <csv>] [--cache-ttl <secs>]
@@ -73,7 +73,7 @@ Options:
   --redirect <url>    Required for link/both; optional for code
   --intent <intent>   signin (default), invite, claim, or recovery
   --state <value>     Optional client_state preserved through verification
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Notes:
   Acceptance does not prove delivery or disclose whether an account exists.
@@ -95,7 +95,7 @@ Options:
   --invite            Send a trusted invite magic link
   --redirect <url>    Required when --invite is used
   --state <value>     Optional client_state for the invite
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth create-user --email user@example.com
@@ -112,19 +112,19 @@ Options:
   --redirect <url>    Required: allowed auth redirect URL
   --admin <bool>      Optional: set project_admin status before inviting
   --state <value>     Optional client_state for the invite
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 `,
   verify: `run402 auth verify — Exchange an email credential for session tokens
 
 Usage:
   run402 auth verify --token <token> [options]
-  run402 auth verify --challenge-id <id> --code <6 digits> [options]
+  run402 auth verify --challenge-id <challenge_id> --code <6 digits> [options]
 
 Options:
   --token <token>     Required: the one-time magic-link token
-  --challenge-id <id> Required with --code: opaque handle from magic-link request
+  --challenge-id <challenge_id> Required with --code: opaque handle from magic-link request
   --code <digits>     Required with --challenge-id: six-digit email code
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Notes:
   Returns an access_token + refresh_token pair on success.
@@ -142,7 +142,7 @@ Options:
   --token <bearer>    Required: the user's access_token (Bearer token)
   --new <password>    Required: new password
   --current <pwd>     Current password (required when one is already set)
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth set-password --token eyJ... --new "new-pass" \\
@@ -159,7 +159,7 @@ Options:
   --public-signup <policy>              open, known_email, or invite_only
   --require-admin-passkey <true|false>  Require passkey auth for project_admin sessions
   --allowed-email-domains <csv|none>    Restrict hosted Google sign-in to these domains; 'none' clears (unrestricted)
-  --project <id>                        Project ID (defaults to active project)
+  --project <project_id>                        Project ID (defaults to active project)
 
 Notes:
   Requires the project's service_key (admin-level).
@@ -180,19 +180,19 @@ Usage:
 Options:
   --token <bearer>       Required: authenticated user's access_token
   --app-origin <origin>  Required: exact app origin for WebAuthn
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-register-verify": `run402 auth passkey-register-verify — Verify passkey registration
 
 Usage:
-  run402 auth passkey-register-verify --token <bearer> --challenge <id> --response <json> [options]
+  run402 auth passkey-register-verify --token <bearer> --challenge <challenge_id> --response <json> [options]
 
 Options:
   --token <bearer>       Required: authenticated user's access_token
-  --challenge <id>       Required: challenge_id returned by passkey-register-options
+  --challenge <challenge_id>       Required: challenge_id returned by passkey-register-options
   --response <json>      Required: browser PublicKeyCredential JSON
   --label <text>         Optional passkey label
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-login-options": `run402 auth passkey-login-options — Create passkey login options
 
@@ -202,17 +202,17 @@ Usage:
 Options:
   --app-origin <origin>  Required: exact app origin for WebAuthn
   --email <addr>         Optional email hint
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "passkey-login-verify": `run402 auth passkey-login-verify — Verify passkey login
 
 Usage:
-  run402 auth passkey-login-verify --challenge <id> --response <json> [options]
+  run402 auth passkey-login-verify --challenge <challenge_id> --response <json> [options]
 
 Options:
-  --challenge <id>       Required: challenge_id returned by passkey-login-options
+  --challenge <challenge_id>       Required: challenge_id returned by passkey-login-options
   --response <json>      Required: browser PublicKeyCredential JSON
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   passkeys: `run402 auth passkeys — List passkeys
 
@@ -221,7 +221,7 @@ Usage:
 
 Options:
   --token <bearer>       Required: authenticated user's access_token
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   "delete-passkey": `run402 auth delete-passkey — Delete a passkey
 
@@ -231,7 +231,7 @@ Usage:
 Options:
   --token <bearer>       Required: authenticated user's access_token
   --id <passkey_id>      Required: passkey ID to delete
-  --project <id>         Project ID (defaults to active project)
+  --project <project_id>         Project ID (defaults to active project)
 `,
   providers: `run402 auth providers — List available auth providers
 
@@ -239,7 +239,7 @@ Usage:
   run402 auth providers [options]
 
 Options:
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Examples:
   run402 auth providers
@@ -609,7 +609,7 @@ async function passkeyRegisterVerify(args) {
   const label = parseFlag(args, "--label");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
   if (!accessToken) fail({ code: "BAD_USAGE", message: "Missing --token <bearer_token>" });
-  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <challenge_id>" });
   const response = parseJsonFlag(args, "--response");
   try {
     const data = await getSdk().auth.verifyPasskeyRegistration(projectId, {
@@ -643,7 +643,7 @@ async function passkeyLoginOptions(args) {
 async function passkeyLoginVerify(args) {
   const challengeId = parseFlag(args, "--challenge");
   const projectId = resolveProjectId(parseFlag(args, "--project"));
-  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <id>" });
+  if (!challengeId) fail({ code: "BAD_USAGE", message: "Missing --challenge <challenge_id>" });
   const response = parseJsonFlag(args, "--response");
   try {
     const data = await getSdk().auth.verifyPasskeyLogin(projectId, {

package/lib/branches.mjs

@@ -15,10 +15,10 @@ import {
 const HELP = `run402 branches — Contained project data branches
 
 Usage:
-  run402 branches create [--project <id>] [--from-snapshot <snapshot-id>] [--name <label>] [--email-mode sandbox|off] [--enable-cron] [--ttl-days <n>] [--json]
-  run402 branches list [--project <id>] [--json]
-  run402 branches renew <branch-project-id> [--project <id>] [--ttl-days <n>] [--json]
-  run402 branches delete <branch-project-id> [--project <id>] [--json]
+  run402 branches create [--project <project_id>] [--from-snapshot <snapshot_id>] [--name <label>] [--email-mode sandbox|off] [--enable-cron] [--ttl-days <n>] [--json]
+  run402 branches list [--project <project_id>] [--json]
+  run402 branches renew <branch_project_id> [--project <project_id>] [--ttl-days <n>] [--json]
+  run402 branches delete <branch_project_id> [--project <project_id>] [--json]
 
 Legacy (still supported): a leading prj_... parent-project positional,
 e.g. run402 branches renew prj_parent prj_branch. --project defaults to the
@@ -77,7 +77,7 @@ async function list(args) {
 }
 
 async function renew(args) {
-  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches renew [project-id] <branch-project-id>");
+  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches renew [project_id] <branch_project_id>");
   const ttlDaysFlag = flagValue(args, "--ttl-days");
   const ttlDays = ttlDaysFlag === null ? undefined : parseIntegerFlag("--ttl-days", ttlDaysFlag, { min: 1, max: 30 });
   try {
@@ -91,7 +91,7 @@ async function renew(args) {
 }
 
 async function deleteBranch(args) {
-  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches delete [project-id] <branch-project-id>");
+  const { projectId, branchProjectId } = resolveProjectAndBranch(args, "run402 branches delete [project_id] <branch_project_id>");
   try {
     await getSdk().branches.delete(projectId, branchProjectId);
     console.log(JSON.stringify({ ok: true, project_id: projectId, branch_project_id: branchProjectId, deleted: true }, null, 2));
@@ -101,7 +101,7 @@ async function deleteBranch(args) {
 }
 
 function resolveProjectAndBranch(args, usage) {
-  // Canonical: `<branch-project-id> [--project <parent-id>]`. Branch ids are
+  // Canonical: `<branch_project_id> [--project <parent_project_id>]`. Branch ids are
   // themselves prj_..., so a leading prj_ positional is only treated as the
   // PARENT project when a second positional follows (requireRestPositional) —
   // the legacy `renew prj_parent prj_branch` form.

package/lib/buzz-doctor.mjs

@@ -230,7 +230,7 @@ async function checkRun402Cli({ cwd, env, argv, run402Executable, updateCheck })
     install_confidence: install.confidence,
     package_manager: install.package_manager,
     compatibility_source: "version_and_capability_probe",
-    required_capabilities: ["doctor --buzz", "doctor --buzz-agent", "wallets current", "org whoami", "identity link nostr"],
+    required_capabilities: ["doctor --buzz", "doctor --buzz-agent", "wallets current", "whoami", "identity link nostr"],
   };
   if (update?.status === "warning") {
     const rawAction = update?.value?.next_actions?.[0];

package/lib/buzz-notifications.mjs

@@ -22,11 +22,11 @@ import {
 const HELP = `run402 buzz notifications — route project events into a Buzz community channel
 
 Usage:
-  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> (--project <id> [--project <id> ...] | --all-projects) [--event-type <t> ...] [--event-class <c> ...] [--include-org-events] [--on-call <hex-pubkey> [--on-call-name <display>]]
+  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> (--project <project_id> [--project <project_id> ...] | --all-projects) [--event-type <t> ...] [--event-class <c> ...] [--include-org-events] [--on-call <hex-pubkey> [--on-call-name <display>]]
       --all-projects         route every project the organization owns, present and future (project_scope org);
                              without it the route names its projects explicitly (--project, 1..50)
       --include-org-events   also deliver the org's own facts (the platform_payment_received receipt after a Lightning top-up) into the channel
-  run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]
+  run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]
       switch the route to the whole organization, or back to an explicit list (the stored list is kept;
       --listed on a route with no stored list needs --project)
       --on-call <hex>        the Buzz agent (64-hex pubkey) a crash or platform incident pages with a p mention — the tag that wakes a managed Buzz agent
@@ -228,7 +228,7 @@ async function projects(args) {
 }
 
 /**
- * `run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]`
+ * `run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]`
  * — switch the route between the whole organization and an explicit list.
  * The stored list survives the switch to `org`; `--listed` on a route with
  * nothing stored needs `--project`.
@@ -238,7 +238,7 @@ async function scope(args) {
   const valueFlags = ["--project"];
   assertKnownFlags(a, [...valueFlags, "--org", "--listed", "--help", "-h"], valueFlags);
   const positionals = requirePositionalCount(positionalArgs(a, valueFlags), valueFlags, {
-    min: 1, max: 1, command: "run402 buzz notifications scope <buzzper_id> --org | --listed [--project <id> ...]", missing: "<buzzper_id>",
+    min: 1, max: 1, command: "run402 buzz notifications scope <buzzper_id> --org | --listed [--project <project_id> ...]", missing: "<buzzper_id>",
   });
   const [routeId] = positionals;
   const org = a.includes("--org");

package/lib/buzz.mjs

@@ -23,7 +23,7 @@ The four independent states are:
 Canonical workflows:
   run402 buzz status
   run402 buzz adopt offer --org <org_id> --identity-link <idlnk_id> [--deployment-context-file <json>]
-      --org                       the Run402 organization id as "run402 org whoami" returns it (a UUID)
+      --org                       the Run402 organization id as "run402 whoami" returns it (a UUID)
       --deployment-context-file   JSON with exactly these five non-empty strings, and no others:
                                   project_id, release_id, live_url, source_revision, verified_at
   run402 buzz install --org <org_id> --community <buzz:community:host> [--authority <hex-pubkey>]
@@ -46,7 +46,7 @@ Explicit consent/decision commands:
   run402 buzz revoke <buzzae_id>
 
 Project-event routing into a Buzz channel (configure → authorize → test → live):
-  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> --project <id> [--event-type <t> ...] [--event-class <c> ...] [--include-org-events]
+  run402 buzz notifications configure --org <uuid> --installation <buzzci_id> --name <route_name> --channel <uuid> --project <project_id> [--event-type <t> ...] [--event-class <c> ...] [--include-org-events]
   run402 buzz notifications status [--org <uuid> | <buzzper_id>]
   run402 buzz notifications test <buzzper_id> [--wait]
   run402 buzz notifications deliveries <buzzper_id> [--limit <n>] [--cursor <c>] [--delivery <buzzped_id>]

package/lib/cache.mjs

@@ -59,7 +59,7 @@ Subcommands:
 Common flags:
   --locale <code>              (inspect only) Inspect a specific locale's row
                                (default: project's default locale)
-  --release-id <id>            (inspect only) Inspect a specific release id
+  --release-id <release_id>            (inspect only) Inspect a specific release id
                                (default: project's active release)
 
 Output:

package/lib/cdn.mjs

@@ -2,7 +2,7 @@
  * run402 cdn — CloudFront CDN diagnostics for public blob URLs.
  *
  * Usage:
- *   run402 cdn wait-fresh <url> --sha <sha256> [--timeout <seconds>] [--project <id>]
+ *   run402 cdn wait-fresh <url> --sha <sha256> [--timeout <seconds>] [--project <project_id>]
  *
  * Wraps the SDK's `client.project(id).assets.waitFresh(...)`. Polls the gateway diagnose
  * endpoint until the URL serves the expected SHA, then exits 0. On timeout,
@@ -45,7 +45,7 @@ Arguments:
 Options:
   --sha <hex>         Expected hex SHA-256. Required.
   --timeout <secs>    Max wait in seconds. Default 60.
-  --project <id>      Project ID (defaults to active project)
+  --project <project_id>      Project ID (defaults to active project)
 
 Output:
   Prints a JSON result on stdout when polling ends:

package/lib/ci.mjs

@@ -21,8 +21,8 @@ const { version: RUN402_VERSION } = JSON.parse(
 const HELP = `run402 ci — Manage CI/OIDC deploy bindings
 
 Usage:
-  run402 ci link github [--project <id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
-  run402 ci list [--project <id>]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci list [--project <project_id>]
   run402 ci revoke <binding_id>
   run402 ci set-asset-scopes <binding_id> <scope1> [<scope2> ...]
 
@@ -37,15 +37,15 @@ const SUB_HELP = {
   link: `run402 ci link github — Link GitHub Actions OIDC for run402 deploy
 
 Usage:
-  run402 ci link github [--project <id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
+  run402 ci link github [--project <project_id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <repository_id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
 
 Options:
-  --project <id>          Project ID (defaults to the active project)
+  --project <project_id>          Project ID (defaults to the active project)
   --manifest <path>       Manifest path used by the generated workflow (default: run402.deploy.json)
   --repo <owner/repo>     GitHub repo (default: inferred from origin remote)
   --branch <name>         Branch subject and push trigger (default: current branch)
   --environment <name>    GitHub environment subject; adds job.environment
-  --repository-id <id>    Numeric GitHub repository id when API lookup is unavailable
+  --repository-id <repository_id>    Numeric GitHub repository id when API lookup is unavailable
   --workflow <path>       Workflow path (default: .github/workflows/run402-deploy.yml)
   --expires-at <iso>      Optional binding expiration timestamp
   --route-scope <pattern> Optional exact path or final wildcard route scope, repeatable (examples: /admin, /api/*)
@@ -60,7 +60,7 @@ Notes:
   list: `run402 ci list — List CI bindings
 
 Usage:
-  run402 ci list [--project <id>]
+  run402 ci list [--project <project_id>]
 `,
   revoke: `run402 ci revoke — Revoke a CI binding
 
@@ -267,7 +267,7 @@ async function linkGithub(args) {
     fail({
       code: "BAD_USAGE",
       message: "Missing provider: github.",
-      hint: "run402 ci link github [--project <id>]",
+      hint: "run402 ci link github [--project <project_id>]",
     });
   }
   if (flags.branch && flags.environment) {
@@ -293,7 +293,7 @@ async function linkGithub(args) {
     fail({
       code: "GITHUB_REPOSITORY_ID_REQUIRED",
       message: `Could not fetch the numeric GitHub repository id for ${repo}.`,
-      hint: "Set GITHUB_TOKEN/GH_TOKEN or pass --repository-id <id>.",
+      hint: "Set GITHUB_TOKEN/GH_TOKEN or pass --repository-id <repository_id>.",
       details: { repo },
     });
   }

package/lib/claims.mjs

@@ -49,10 +49,10 @@ Advisory, always:
   presence.
 
 Room addressing:
-  Default room of the active project with no flags; --project <id> for another
+  Default room of the active project with no flags; --project <project_id> for another
   project; --org <org_id> --room <key> (or RUN402_ROOM=<org_id>/<key>) for a
   named org room. --room <key> alone works when the org resolves on its own
-  (--org / RUN402_ORG / the 'org' key of the nearest .run402.json / 'org use'),
+  (--org / RUN402_ORG / the 'org' key of the nearest .run402.json / 'orgs use'),
   and {"org":"...","room":"..."} in .run402.json binds a whole checkout.
 
 Options:

package/lib/command-manifest.mjs

@@ -13,13 +13,13 @@
  *   positionals            canonical positional ATTRIBUTES (post-conventions).
  *                          A variadic list of the SAME kind counts as one.
  *   projectScoped          command operates on a project and accepts
- *                          `--project <id>` (precedence: --project > legacy
+ *                          `--project <project_id>` (precedence: --project > legacy
  *                          leading prj_ positional > active project)
  *   orgScoped              command acts ON an organization and resolves it
  *                          through the ONE shared chain (cli-org-context):
  *                          an optional leading <org_id> positional, else
  *                          --org, else RUN402_ORG, else the .run402.json
- *                          binding, else `org use`. The gate drives every
+ *                          binding, else `orgs use`. The gate drives every
  *                          such entry through --org AND RUN402_ORG with no
  *                          positional and fails on any "Missing <org_id>".
  *                          Any entry with an `org_id` positional MUST be
@@ -151,7 +151,6 @@ export const COMMAND_MANIFEST = [
   { path: ["projects", "delete"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
   { path: ["projects", "promote-user"], positionals: [p("email")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["user@example.com"] },
   { path: ["projects", "demote-user"], positionals: [p("email")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["user@example.com"] },
-  { path: ["projects", "export"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
 
   // ── snapshots ────────────────────────────────────────────────────────────
   { path: ["snapshots", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
@@ -171,13 +170,13 @@ export const COMMAND_MANIFEST = [
   { path: ["admin", "archive"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["--reason", "gate"] },
   { path: ["admin", "reactivate"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
 
-  // ── cloud / archives / core ──────────────────────────────────────────────
-  { path: ["cloud", "archives", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
-  { path: ["cloud", "archives", "download"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1", "--output", "__OUT_FILE__"] },
-  { path: ["cloud", "archives", "status"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1"] },
+  // ── archives ─────────────────────────────────────────────────────────────
+  { path: ["archives", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
+  { path: ["archives", "download"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1", "--output", "__OUT_FILE__"] },
+  { path: ["archives", "status"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1"] },
   { path: ["archives", "inspect"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__"] },
   { path: ["archives", "verify"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__"] },
-  { path: ["core", "projects", "import"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__", "--name", "gate-import"] },
+  { path: ["archives", "import"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__", "--name", "gate-import"] },
 
   // ── deploy (unified deploy v2) ───────────────────────────────────────────
   // Bare `run402 deploy` IS the deploy (a verb); the family's subcommands
@@ -209,31 +208,30 @@ export const COMMAND_MANIFEST = [
   { path: ["transfer", "accept"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "cancel"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
 
-  // ── org ──────────────────────────────────────────────────────────────────
-  { path: ["org", "create"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "get"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "rename"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--name", "Gate"] },
-  { path: ["org", "payout-wallet"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
+  // ── orgs ──────────────────────────────────────────────────────────────────
+  { path: ["orgs", "create"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "get"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "rename"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--name", "Gate"] },
+  { path: ["orgs", "payout-wallet"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
   // `--org` (not a positional org_id
   // like rename/payout-wallet above) goes through resolveOrg's SHAPE
   // validation (a real UUID) — "org_gate1" fails that locally, so this needs
-  // the same UUID-shaped fixture `org use` below already established.
-  { path: ["org", "slug"], positionals: [p("slug")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["acme", "--org", "11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "whoami"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "audit"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "use"], positionals: [p("org_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "current"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "clear"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "bind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--org", "11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "unbind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "member", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "member", "add"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
-  { path: ["org", "member", "role"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1", "--role", "viewer"] },
-  { path: ["org", "member", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
-  { path: ["org", "invite", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "invite", "create"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--email", "gate@example.com"] },
-  { path: ["org", "invite", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
+  // the same UUID-shaped fixture `orgs use` below already established.
+  { path: ["orgs", "slug"], positionals: [p("slug")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["acme", "--org", "11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "audit"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "use"], positionals: [p("org_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "current"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "clear"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "bind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--org", "11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "unbind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "members", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "members", "add"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
+  { path: ["orgs", "members", "role"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1", "--role", "viewer"] },
+  { path: ["orgs", "members", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
+  { path: ["orgs", "invite", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "invite", "create"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--email", "gate@example.com"] },
+  { path: ["orgs", "invite", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
 
   // ── grants ───────────────────────────────────────────────────────────────
   { path: ["grants", "create"], positionals: [p("wallet")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["0x1111111111111111111111111111111111111111", "--capability", "deploy"] },
@@ -245,8 +243,8 @@ export const COMMAND_MANIFEST = [
   { path: ["delegates", "revoke"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
   { path: ["delegates", "rotate"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
 
-  // ── events / errors (flat, merged runners) ───────────────────────────────
-  { path: ["events"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },
+  // ── events / live ────────────────────────────────────────────────────────
+  { path: ["events", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["live"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--tables", "cells", "--once"], runStyle: "merged" },
   { path: ["deliveries", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["deliveries", "get"], positionals: [p("notification_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["n_1"], runStyle: "sub" },
@@ -327,7 +325,8 @@ export const COMMAND_MANIFEST = [
   // Principal-scoped (one bundle covers every vault you can read), so no
   // --project — deliberately unlike its eleven vault-scoped siblings.
   { path: ["repos", "recovery-bundle"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--out", "-"], runStyle: "sub", skipBehavioral: "exports the caller's live member recovery bundle (stamps recovery-posture export evidence server-side)" },
-  { path: ["errors"], positionals: [p("fingerprint_id", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },
+  { path: ["errors", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
+  { path: ["errors", "get"], positionals: [p("fingerprint_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["fp_gate1"], runStyle: "sub" },
 
   // ── jobs ─────────────────────────────────────────────────────────────────
   { path: ["jobs", "submit"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--file", "__FIXTURE_FILE__"] },
@@ -484,8 +483,8 @@ export const COMMAND_MANIFEST = [
   // without rejecting it," which this satisfies.
   { path: ["doctor"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--no-scan"], runStyle: "merged" },
   { path: ["webhook-secret", "rotate"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  // `run402 logs [<function>] --request-id <id>`: the optional positional is
-  // the function name (`run402 errors` samples print it that way); it is
+  // `run402 logs [<function>] --request-id <request_id>`: the optional positional is
+  // the function name (`run402 errors list` samples print it that way); it is
   // never a project id.
   { path: ["logs"], positionals: [p("function", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--request-id", "req_gate123"], runStyle: "merged" },
 ];
@@ -539,7 +538,7 @@ export const RESERVED_SUBCOMMANDS = {
   // `reconcile` answer COMMAND_REMOVED (no equivalent successor for either —
   // `push`'s one-release alias window is over, `reconcile` was a workaround
   // with no permanent replacement, only a read at `repos access`).
-  "gitvault:init": "moved to `repos create --project <id>`",
+  "gitvault:init": "moved to `repos create --project <project_id>`",
   "gitvault:status": "moved to `repos view`",
   "gitvault:snapshot": "moved to `repos snapshot`",
   "gitvault:policy": "moved to `repos policy`",

package/lib/config.mjs

@@ -101,11 +101,11 @@ export function findProject(id) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: `No local project credentials cached for ${idStr}.`,
-      hint: "Use a principal-auth command, or import project keys with `run402 credentials project-keys import --project <id> --service-key-stdin`.",
+      hint: "Use a principal-auth command, or import project keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin`.",
       details: { project_id: idStr, source: "local_cache", cache_path: projectCredentialsFile(), wallet: activeProfile(), profile: activeProfile() },
       next_actions: [{
         type: "run_command",
-        command: `run402 credentials project-keys status --project ${idStr || "<id>"}`,
+        command: `run402 credentials project-keys status --project ${idStr || "<project_id>"}`,
         why: "Inspect the local project-key cache without revealing secrets.",
       }],
     });
@@ -119,7 +119,7 @@ export function resolveProject(id) {
     fail({
       code: "PROJECT_REQUIRED",
       message: "no project specified and no active project set.",
-      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or run: run402 projects use <id>",
+      hint: "Pass --project <project_id>, set RUN402_PROJECT_ID, or run: run402 projects use <project_id>",
       next_actions: [selectProjectAction()],
     });
   }
@@ -132,7 +132,7 @@ export function resolveProjectId(id) {
     fail({
       code: "PROJECT_REQUIRED",
       message: "no project specified and no active project set.",
-      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or run: run402 projects use <id>",
+      hint: "Pass --project <project_id>, set RUN402_PROJECT_ID, or run: run402 projects use <project_id>",
       next_actions: [selectProjectAction()],
     });
   }

package/lib/contacts.mjs

@@ -12,7 +12,7 @@
  * "how can this human be reached" — not the mechanisms, which really are
  * different and are not pretended otherwise.
  *
- * `rm <id>` takes a bare id and works out which backend owns it, because both
+ * `rm <contact_id>` takes a bare id and works out which backend owns it, because both
  * are UUIDs and a caller holding one from `contacts list` should not have to
  * know which subsystem minted it. That costs one extra read and removes a
  * `--kind` flag nobody could answer without looking it up.
@@ -44,7 +44,7 @@ Usage:
   run402 contacts list
   run402 contacts add <email> [--level <1-10>] [--name <display>]
   run402 contacts connect telegram [--label <name>]
-  run402 contacts rm <id>
+  run402 contacts rm <contact_id>
   run402 contacts preferences
   run402 contacts preferences set <key>=<value> [<key>=<value> ...]
   run402 contacts test [--source app|platform] [--type <event_type>]
@@ -339,7 +339,7 @@ async function removeContact(args) {
   assertKnownFlags(a, ["--org", "--help", "-h"], ["--org"]);
   const positionals = positionalArgs(a, ["--org"]);
   requirePositionalCount(positionals, ["--org"], {
-    min: 1, max: 1, command: "run402 contacts rm", missing: "<id>",
+    min: 1, max: 1, command: "run402 contacts rm", missing: "<contact_id>",
   });
   const id = positionals[0];
   const sdk = getSdk();