run402 4.94.0 → 4.95.0

package/lib/contracts.mjs

@@ -53,7 +53,7 @@ const SUB_HELP = {
   "provision-signer": `run402 contracts provision-signer — Provision a KMS-backed signer
 
 Usage:
-  run402 contracts provision-signer --chain <chain> [--project <id>] [options]
+  run402 contracts provision-signer --chain <chain> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts provision-signer <project_id> --chain <chain> [options]
@@ -69,7 +69,7 @@ Options:
   "set-recovery": `run402 contracts set-recovery — Set or clear the signer recovery address
 
 Usage:
-  run402 contracts set-recovery <signer_id> [--project <id>] [options]
+  run402 contracts set-recovery <signer_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts set-recovery <project_id> <signer_id> [options]
@@ -77,7 +77,7 @@ Legacy (still supported):
   "set-alert": `run402 contracts set-alert — Set the low-balance alert threshold
 
 Usage:
-  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <id>]
+  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts set-alert <project_id> <signer_id> --threshold-wei <n>
@@ -85,7 +85,7 @@ Legacy (still supported):
   call: `run402 contracts call — Submit a contract write call
 
 Usage:
-  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <id>]
+  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts call <project_id> <signer_id> --to 0x... --abi <json>
@@ -98,7 +98,7 @@ Returns the deterministic CREATE address synchronously — known from (signer, n
 before the tx confirms. Cost: chain gas at-cost + $0.000005 KMS sign fee.
 
 Usage:
-  run402 contracts deploy <signer_id> --bytecode 0x... [--project <id>] [options]
+  run402 contracts deploy <signer_id> --bytecode 0x... [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts deploy <project_id> <signer_id> --bytecode 0x... [options]
@@ -125,7 +125,7 @@ Usage:
   drain: `run402 contracts drain — Drain native balance to a destination address
 
 Usage:
-  run402 contracts drain <signer_id> --to 0x... --confirm [--project <id>]
+  run402 contracts drain <signer_id> --to 0x... --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts drain <project_id> <signer_id> --to 0x... --confirm
@@ -133,7 +133,7 @@ Legacy (still supported):
   delete: `run402 contracts delete — Schedule the KMS key for deletion
 
 Usage:
-  run402 contracts delete <signer_id> --confirm [--project <id>]
+  run402 contracts delete <signer_id> --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts delete <project_id> <signer_id> --confirm
@@ -141,7 +141,7 @@ Legacy (still supported):
   "get-signer": `run402 contracts get-signer — Get signer metadata + live balance
 
 Usage:
-  run402 contracts get-signer <signer_id> [--project <id>]
+  run402 contracts get-signer <signer_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts get-signer <project_id> <signer_id>
@@ -156,7 +156,7 @@ Examples:
   "list-signers": `run402 contracts list-signers — List all KMS signers for a project
 
 Usage:
-  run402 contracts list-signers [--project <id>]
+  run402 contracts list-signers [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts list-signers <project_id>
@@ -173,7 +173,7 @@ Examples:
   status: `run402 contracts status — Get a contract call's status and receipt
 
 Usage:
-  run402 contracts status <call_id> [--project <id>]
+  run402 contracts status <call_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts status <project_id> <call_id>
@@ -502,7 +502,7 @@ async function deleteSigner(projectId, signerId, args) {
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") { console.log(HELP); process.exit(0); }
   if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
-  // Project selection (CLI-wide convention): `--project <id>` wins, else a
+  // Project selection (CLI-wide convention): `--project <project_id>` wins, else a
   // legacy leading `prj_...` positional, else the active project. The signer /
   // call id stays positional (`cwlt_...` / `ccall_...`). Computed lazily so
   // unknown subcommands (and the anonymous `read`) never trip project

package/lib/credentials.mjs

@@ -26,18 +26,18 @@ Usage:
   run402 credentials <subcommand> [args...]
 
 Project credentials (on the gateway — named, revocable, rotatable):
-  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>] [--import]
+  issue --kind <anon|service> --name <name> [--project <project_id>] [--expires <iso8601>] [--import]
                                 Mint one. The secret is printed ONCE.
                                 --import also writes it into this machine's
                                 local key cache (the cold-restart re-key path).
-  list [--project <id>] [--include-revoked]
+  list [--project <project_id>] [--include-revoked]
                                 List credentials (metadata only, never secrets)
-  status [--project <id>]       Are you still on the retiring legacy key?
-  rotate <credential_id> [--project <id>]
+  status [--project <project_id>]       Are you still on the retiring legacy key?
+  rotate <credential_id> [--project <project_id>]
                                 Replace in one step; new secret printed ONCE
-  revoke <credential_id> [--project <id>] [--reason <text>]
+  revoke <credential_id> [--project <project_id>] [--reason <text>]
                                 Revoke immediately, freeing the name
-  token [--project <id>] [--kind <anon|service>]
+  token [--project <project_id>] [--kind <anon|service>]
                                 Mint a SHORT-LIVED token. Works with only a
                                 delegate — the unattended recovery path.
 
@@ -68,12 +68,12 @@ Usage:
 
 Subcommands:
   list                                List cached project-key entries, redacted
-  status --project <id>               Show one cached entry, redacted
-  import --project <id> --service-key-stdin
-  import --project <id> --service-key-env <env>
-  import --project <id> --anon-key-env <env>   Rotate only the anon key
-  export --project <id> --reveal       Print cached keys, including secrets
-  remove --project <id>                Remove one cached key entry
+  status --project <project_id>               Show one cached entry, redacted
+  import --project <project_id> --service-key-stdin
+  import --project <project_id> --service-key-env <env>
+  import --project <project_id> --anon-key-env <env>   Rotate only the anon key
+  export --project <project_id> --reveal       Print cached keys, including secrets
+  remove --project <project_id>                Remove one cached key entry
 
 Notes:
   - This is a LOCAL CACHE surface. It is not project inventory.
@@ -89,7 +89,7 @@ const SUB_HELP = {
   issue: `run402 credentials issue — mint a named project credential
 
 Usage:
-  run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]
+  run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]
                            [--expires <iso8601>]
 
 --kind    "anon" is the tenant-facing key; "service" is the privileged one.
@@ -112,14 +112,14 @@ can NEVER do this; use 'run402 credentials token' instead.
   list: `run402 credentials list — list a project's credentials
 
 Usage:
-  run402 credentials list [--project <id>] [--include-revoked]
+  run402 credentials list [--project <project_id>] [--include-revoked]
 
 Metadata only — never a secret or a secret hash. Only project.read is needed.
 `,
   status: `run402 credentials status — are you still on the retiring legacy key?
 
 Usage:
-  run402 credentials status [--project <id>]
+  run402 credentials status [--project <project_id>]
 
 Returns state "legacy" while the project still depends on the derived
 anon/service keys, or "rotatable" once it holds credentials it can revoke
@@ -133,7 +133,7 @@ date the platform has not committed to.
   rotate: `run402 credentials rotate — replace a credential in one step
 
 Usage:
-  run402 credentials rotate <credential_id> [--project <id>]
+  run402 credentials rotate <credential_id> [--project <project_id>]
 
 Mints a replacement and revokes the old one in a single transaction, keeping
 the name. The NEW secret is printed once.
@@ -146,7 +146,7 @@ compromised.
   revoke: `run402 credentials revoke — revoke a credential immediately
 
 Usage:
-  run402 credentials revoke <credential_id> [--project <id>] [--reason <text>]
+  run402 credentials revoke <credential_id> [--project <project_id>] [--reason <text>]
 
 Takes effect for every subsequent request and frees the name for reuse.
 Requires owner membership plus step-up.
@@ -154,7 +154,7 @@ Requires owner membership plus step-up.
   token: `run402 credentials token — mint a short-lived project token
 
 Usage:
-  run402 credentials token [--project <id>] [--kind <anon|service>]
+  run402 credentials token [--project <project_id>] [--kind <anon|service>]
 
 The cold-restart recovery path, and the ONE credential call an agent can make
 with no human present: a delegate is accepted here. There is no step-up because
@@ -214,7 +214,7 @@ function requireProjectFlag(projectId, usage) {
   if (!projectId) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --project <id>.",
+      message: "Missing --project <project_id>.",
       hint: usage,
     });
   }
@@ -227,7 +227,7 @@ function requireCachedProject(projectId) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: `No local project credentials cached for ${projectId}.`,
-      hint: "Import keys with `run402 credentials project-keys import --project <id> --service-key-stdin` if this operation truly requires local project credentials.",
+      hint: "Import keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin` if this operation truly requires local project credentials.",
       details: { project_id: projectId, ...provenance() },
       next_actions: [{
         type: "run_command",
@@ -256,7 +256,7 @@ async function status(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys status: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <project_id>");
   console.log(JSON.stringify(redactedEntry(id, getProject(id)), null, 2));
 }
 
@@ -311,7 +311,7 @@ async function importKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys import: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <id> --service-key-stdin");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <project_id> --service-key-stdin");
   // Resolve --anon-key-env before requiring a service key, so a missing service
   // key can report against the flags actually passed and an anon-only rotation
   // can reuse the cached service key.
@@ -346,12 +346,12 @@ async function exportKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys export: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <id> --reveal");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <project_id> --reveal");
   if (!parsed.includes("--reveal")) {
     fail({
       code: "REVEAL_REQUIRED",
       message: "Exporting full project keys requires --reveal.",
-      hint: "Use `run402 credentials project-keys status --project <id>` for redacted output.",
+      hint: "Use `run402 credentials project-keys status --project <project_id>` for redacted output.",
       details: { project_id: id, ...provenance() },
     });
   }
@@ -364,7 +364,7 @@ async function remove(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys remove: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <project_id>");
   const existed = Boolean(getProject(id));
   removeProject(id, projectCredentialsFile());
   console.log(JSON.stringify({ project_id: id, removed: existed, ...provenance() }, null, 2));
@@ -423,7 +423,7 @@ async function issue(args) {
   requirePositionalCount(rest, ISSUE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]",
+    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]",
     missing: "",
   });
   if (kind !== "anon" && kind !== "service") {
@@ -485,7 +485,7 @@ async function listCredentials(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials list [--project <id>]",
+    command: "run402 credentials list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -503,7 +503,7 @@ async function credentialStatus(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials status [--project <id>]",
+    command: "run402 credentials status [--project <project_id>]",
     missing: "",
   });
   try {
@@ -527,7 +527,7 @@ async function rotate(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project"], {
     min: 1,
     max: 1,
-    command: "run402 credentials rotate <credential_id> [--project <id>]",
+    command: "run402 credentials rotate <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -545,7 +545,7 @@ async function revoke(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project", "--reason"], {
     min: 1,
     max: 1,
-    command: "run402 credentials revoke <credential_id> [--project <id>]",
+    command: "run402 credentials revoke <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -564,7 +564,7 @@ async function token(args) {
   requirePositionalCount(rest, ["--project", "--kind"], {
     min: 0,
     max: 0,
-    command: "run402 credentials token [--project <id>]",
+    command: "run402 credentials token [--project <project_id>]",
     missing: "",
   });
   if (kind && kind !== "anon" && kind !== "service") {

package/lib/delegates.mjs

@@ -15,18 +15,18 @@ Usage:
   run402 delegates <subcommand> [args...]
 
 Subcommands:
-  create --grant <grant_id> [--project <id>] [--capability <cap>] [--kind <kind>]
+  create --grant <grant_id> [--project <project_id>] [--capability <cap>] [--kind <kind>]
          [--scope <json>] [--expires <iso8601>]
                                  Mint a delegate. The bearer is printed ONCE.
-  list [--project <id>]          List delegates (never shows tokens)
-  revoke <delegate_id> [--project <id>]
+  list [--project <project_id>]          List delegates (never shows tokens)
+  revoke <delegate_id> [--project <project_id>]
                                  Revoke immediately
-  rotate <delegate_id> [--project <id>]
+  rotate <delegate_id> [--project <project_id>]
                                  Revoke + reissue; new bearer printed ONCE
 
 Notes:
   - A delegate NARROWS an existing grant, so mint the grant first:
-      run402 grants create <agent-wallet> --capability deploy --project <id>
+      run402 grants create <agent-wallet> --capability deploy --project <project_id>
     then pass the returned grant_id to 'delegates create'.
   - Mutations require you to be an owner of the project's org (wallet SIWX).
   - A delegate can never be an owner, and is revocable and expiring.
@@ -51,7 +51,7 @@ const SUB_HELP = {
   create: `run402 delegates create — mint a scoped deploy credential
 
 Usage:
-  run402 delegates create --grant <grant_id> [--project <id>] [--capability <cap>]
+  run402 delegates create --grant <grant_id> [--project <project_id>] [--capability <cap>]
                           [--kind <kind>] [--scope <json>] [--expires <iso8601>]
 
 --capability defaults to "deploy". --kind defaults to "run402_agent_key" (the
@@ -64,21 +64,21 @@ Requires owner of the project's org.
   list: `run402 delegates list — list a project's delegates
 
 Usage:
-  run402 delegates list [--project <id>]
+  run402 delegates list [--project <project_id>]
 
 Never returns tokens or secret material — id, kind, scope, expiry, revocation.
 `,
   revoke: `run402 delegates revoke — revoke a delegate immediately
 
 Usage:
-  run402 delegates revoke <delegate_id> [--project <id>]
+  run402 delegates revoke <delegate_id> [--project <project_id>]
 
 Takes effect for every subsequent request. Requires owner of the project's org.
 `,
   rotate: `run402 delegates rotate — revoke and reissue in one step
 
 Usage:
-  run402 delegates rotate <delegate_id> [--project <id>]
+  run402 delegates rotate <delegate_id> [--project <project_id>]
 
 Keeps the same principal, grant, kind, scope, cap and expiry. The NEW bearer is
 printed once. Use this when a token is lost or possibly exposed.
@@ -99,12 +99,12 @@ async function create(args) {
   requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 delegates create --grant <grant_id> [--project <id>]",
+    command: "run402 delegates create --grant <grant_id> [--project <project_id>]",
     missing: "",
   });
   if (!grantId) {
     console.error("Missing --grant <grant_id>. Mint one first:");
-    console.error("  run402 grants create <agent-wallet> --capability deploy --project <id>");
+    console.error("  run402 grants create <agent-wallet> --capability deploy --project <project_id>");
     process.exit(1);
   }
   const scope = scopeRaw != null
@@ -135,7 +135,7 @@ async function list(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 delegates list [--project <id>]",
+    command: "run402 delegates list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -153,7 +153,7 @@ function oneIdCommand(name) {
     const [delegateId] = requirePositionalCount(rest, ["--project"], {
       min: 1,
       max: 1,
-      command: `run402 delegates ${name} <delegate_id> [--project <id>]`,
+      command: `run402 delegates ${name} <delegate_id> [--project <project_id>]`,
       missing: "Missing <delegate_id>.",
     });
     try {

package/lib/deliveries.mjs

@@ -30,7 +30,7 @@ const HELP = `run402 deliveries — did a notification actually land
 
 Usage:
   run402 deliveries list [--type <event_type>] [--since <iso>] [--limit N] [--after <cursor>]
-  run402 deliveries get <id>
+  run402 deliveries get <notification_id>
 
 Notes:
   - One row per delivery ATTEMPT, per channel, with its outcome — the audit
@@ -70,7 +70,7 @@ async function get(args) {
   assertKnownFlags(parsedArgs, ["--help", "-h"]);
   const positionals = positionalArgs(parsedArgs);
   if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 notifications get <id>" });
+    fail({ code: "BAD_USAGE", message: "Usage: run402 deliveries get <notification_id>" });
   }
   walletAuthHeaders("/agent/v1/notifications");
   try {

package/lib/deploy-v2.mjs

@@ -506,14 +506,14 @@ async function rehearseCmd(rawArgs) {
     });
     const planId = planned.plan.plan_id;
     if (!planId) {
-      fail({ code: "DRY_RUN_PLAN_NOT_COMMITTABLE", message: "Rehearsal requires a persisted plan_id, but the plan response did not include one.", details: { project_id: normalized.spec.project } });
+      fail({ code: "DRY_RUN_PLAN_NOT_COMMITTABLE", message: "Rehearsal requires a persisted plan_id, but the plan response did not include one.", details: { project_id: normalized.spec.project_id } });
     }
     await sdk._applyEngine.upload(planned.plan, {
-      project: normalized.spec.project,
+      project: normalized.spec.project_id,
       byteReaders: planned.byteReaders,
       onEvent: emit,
     });
-    return { planId, plan: planned.plan, projectId: normalized.spec.project };
+    return { planId, plan: planned.plan, projectId: normalized.spec.project_id };
   }
 
   try {
@@ -1250,11 +1250,11 @@ async function deployCmd(args) {
     target = await resolveDeploymentTarget({
       appRoot: applicationScope.app_root,
       manifestPath: manifestPath ?? undefined, projectId: opts.project || undefined, environmentProjectId: process.env.RUN402_PROJECT_ID || undefined,
-      manifestProjectId: manifestProject || (releaseSpec.project === "prj_up_preflight_placeholder" ? undefined : releaseSpec.project),
+      manifestProjectId: manifestProject || (releaseSpec.project_id === "prj_up_preflight_placeholder" ? undefined : releaseSpec.project_id),
       targetKind: isCoreApiTarget() ? "core" : "cloud", apiBase: API,
       allowUnresolved: opts.mode === "check" || opts.mode === "printSpec" || opts.mode === "printManifest",
     });
-    if (target.project_id) releaseSpec.project = target.project_id;
+    if (target.project_id) releaseSpec.project_id = target.project_id;
   } catch (err) { reportSdkError(err); }
   const idempotencyKey = normalizedManifest.idempotencyKey;
 
@@ -1289,7 +1289,7 @@ async function deployCmd(args) {
     return;
   }
   if (opts.mode === "printSpec") {
-    console.log(JSON.stringify({ ...releaseSpec, project: target.project_id ?? undefined }, null, 2));
+    console.log(JSON.stringify({ ...releaseSpec, project_id: target.project_id ?? undefined }, null, 2));
     return;
   }
 
@@ -1298,7 +1298,7 @@ async function deployCmd(args) {
   const delegateToken = delegateTokenFromEnv();
   if (useGithubActionsOidc) {
     sdkOpts = {
-      credentials: githubActionsCredentials({ projectId: releaseSpec.project, apiBase: API }),
+      credentials: githubActionsCredentials({ projectId: releaseSpec.project_id, apiBase: API }),
       disablePaidFetch: true,
     };
   } else if (delegateToken) {
@@ -1356,7 +1356,7 @@ async function deployCmd(args) {
     // Cache the activated deployment id so `run402 subdomains add` can
     // pass it as an optimization (the gateway defaults to the live release
     // without it). Best-effort: a keystore hiccup never fails the deploy.
-    rememberLastDeployment(releaseSpec.project, outcome.deploy?.urls?.deployment_id);
+    rememberLastDeployment(releaseSpec.project_id, outcome.deploy?.urls?.deployment_id);
     if (!outcome.gitvault) {
       console.log(JSON.stringify({ ...outcome.deploy, stats: sdkStats(sdk) }, null, 2));
       printVerboseStats(opts.verbose, sdk);
@@ -1467,7 +1467,7 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
     hint: "The GitHub repository id in the OIDC token does not match the linked binding.",
     next_actions: [
       editRequestAction("run402 ci link github", "Re-link from the current repository."),
-      editRequestAction("run402 ci link github --repository-id <id>", "Pass the numeric GitHub repository id if automatic lookup fails."),
+      editRequestAction("run402 ci link github --repository-id <repository_id>", "Pass the numeric GitHub repository id if automatic lookup fails."),
     ],
   },
   forbidden_spec_field: {

package/lib/dev.mjs

@@ -29,12 +29,12 @@ import { fail } from "./sdk-errors.mjs";
 const HELP = `run402 dev — Run Astro dev with Run402 context
 
 Usage:
-  run402 dev [--port <n>] [--host <h>] [--project <id>]
+  run402 dev [--port <n>] [--host <h>] [--project <project_id>]
 
 Options:
   --port <n>        Astro dev port (default 4321)
   --host <h>        Astro dev host (default localhost)
-  --project <id>    Project id (default: RUN402_PROJECT_ID env var)
+  --project <project_id>    Project id (default: RUN402_PROJECT_ID env var)
 
 The command:
   1. Loads .env.local from the current directory (if present)
@@ -85,7 +85,7 @@ export async function run(sub, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing RUN402_PROJECT_ID.",
-      hint: "Set it in .env.local (or pass --project <id>). Run 'run402 projects provision' first if you don't have one.",
+      hint: "Set it in .env.local (or pass --project <project_id>). Run 'run402 projects provision' first if you don't have one.",
     });
   }
   if (!process.env.RUN402_SERVICE_KEY) {

package/lib/doctor.mjs

@@ -75,7 +75,7 @@ function collectRepeatableFlag(args, flag) {
 const HELP = `run402 doctor — Health and config diagnostics
 
 Usage:
-  run402 doctor [--verbose] [--refresh] [--no-scan] [--scan-dir <D>] [--project <id>]
+  run402 doctor [--verbose] [--refresh] [--no-scan] [--scan-dir <D>] [--project <project_id>]
                 [--only <check> ...]
   run402 --wallet <profile> doctor --buzz --buzz-agent <npub-or-hex>
 
@@ -117,7 +117,7 @@ Options:
   --dir D        Select the application directory for deployment diagnostics.
   --manifest P   Explicitly select a manifest (executable configs are trusted code).
   --scan-dir D   Advanced arbitrary scan; does not claim deployment readiness
-  --project <id> Target THIS project's gitvault check instead of the repo-standing
+  --project <project_id> Target THIS project's gitvault check instead of the repo-standing
                  default (the 4.38.0 pin / run402 remote / RUN402_PROJECT_ID / active
                  project, in that order — see \`gitvault-target.mjs\`). Scoped to the
                  gitvault check only; every other check is wallet/machine-wide, not
@@ -675,7 +675,7 @@ export async function run(sub, args = []) {
         for (const org of posture) {
           const label = `org ${org.org_id} (${org.vault_count} vault${org.vault_count === 1 ? "" : "s"})`;
           if (org.control_plane_configured === false) {
-            gaps.push(`${label}: no human owner with a working control-plane login — if this org's agent machine dies, nobody can sign in to recover it. Invite a backup human (run402 org invite create ${org.org_id} --email <their-email> --role owner) and have them complete login at console.run402.com.`);
+            gaps.push(`${label}: no human owner with a working control-plane login — if this org's agent machine dies, nobody can sign in to recover it. Invite a backup human (run402 orgs invite create ${org.org_id} --email <their-email> --role owner) and have them complete login at console.run402.com.`);
           }
           if (org.source_backup_configured === false) {
             gaps.push(`${label}: no human member holds a working source-access key — vault history has no member-side decryption backup. Have a member complete source enrollment at console.run402.com/account → Source access.`);
@@ -735,7 +735,7 @@ export async function run(sub, args = []) {
   // with its own pinned repo id or run402/origin remote, doctor checks THAT
   // vault, not the profile's active project — the same pin > remote >
   // RUN402_PROJECT_ID env > active-project order every other gitvault verb
-  // follows (`gitvault-target.mjs`). An explicit `--project <id>` outranks
+  // follows (`gitvault-target.mjs`). An explicit `--project <project_id>` outranks
   // all of that (the resolver's own top tier), same as every other gitvault
   // verb's `--project`.
   if (wanted("gitvault")) {
@@ -848,7 +848,7 @@ export async function run(sub, args = []) {
         if (gv.gitvault_policy === "required" && !gv.keystore.holds_repo_key) {
           gaps.push(
             "gitvault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with GITVAULT_CLIENT_UPGRADE_REQUIRED. " +
-            "Run 'run402 repos create --project <id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
+            "Run 'run402 repos create --project <project_id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
           );
         } else if (gv.gitvault_policy === "required" && !gv.keystore.can_sign) {
           gaps.push("gitvault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
@@ -921,7 +921,7 @@ export async function run(sub, args = []) {
           status: gaps.length > 0 ? "warning" : "ok",
           value: gaps.length > 0 ? { ...value, gaps } : value,
           hint: (gv.vault === null
-            ? `No vault for this project (that is a normal shape). Allocate one with 'run402 repos create --project <id>'. Keystore: ${gv.keystore.root}`
+            ? `No vault for this project (that is a normal shape). Allocate one with 'run402 repos create --project <project_id>'. Keystore: ${gv.keystore.root}`
             : gv.durability_statement
               ? `Back up ${gv.keystore.root} anyway — ${gv.durability_statement} (covering_recipients: ${gv.covering_recipients})`
               : `Back up ${gv.keystore.root} — whole-machine or whole-keystore loss is terminal for vault history.`) + byoDisclosure,