run402 4.94.0 → 4.96.0

package/README.md

@@ -61,7 +61,7 @@ Every mode (and `run402 deploy`) verifies the files the manifest references befo
 
 ### repos — host-blind encrypted git repos (zero deploy ceremony)
 
-One noun, fourteen verbs (`repo` singular resolves identically). `run402 gitvault <verb>` answers `COMMAND_MOVED`/`COMMAND_REMOVED`.
+One noun, seventeen verbs: KyGit is the brand, a vault is the resource, a repo is what you have.
 
 ```bash
 run402 init                                   # once per machine
@@ -76,13 +76,13 @@ run402 repos list --org org_1a2b3c
 run402 repos delete --project prj_xyz --force # refuses without --force while the vault holds generations
 ```
 
-A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. Every mutating `repos` verb (`create`, `rename`, `delete`, `snapshot`, `policy`, `mirror`, `gc`, `handoff`, `resume`, `invite`, `join`) is CLI/OpenClaw-only by design — no MCP tool exists or will exist for them (one-shot recovery receipts, immutable generations, irreversible delete, single-use bearer keys). Three READ-ONLY tools do exist — `repos_view`, `repos_list_heads`, `repos_fsck` — teaching only `repos` spellings. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `snapshot`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
+A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. Every mutating `repos` verb (`create`, `rename`, `delete`, `capture`, `policy`, `mirror`, `gc`, `handoff`, `resume`, `invite`, `join`) is CLI/OpenClaw-only by design — no MCP tool exists or will exist for them (one-shot recovery receipts, immutable generations, irreversible delete, single-use bearer keys). Three READ-ONLY tools do exist — `repos_view`, `repos_list_heads`, `repos_fsck` — teaching only `repos` spellings. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `capture`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
 
 **Handoff / resume.** `run402 repos handoff [--note-file <path>]` captures the actual working tree (staged/unstaged/untracked, like `git stash push -u`) into the vault and mints a single-use bearer key (`kgh1_…`, printed to stdout exactly once); `run402 repos resume <kgh1_…>` claims it on another machine, clones fresh, and reapplies the exact dirty state with `git stash apply --index`. No shared keystore, no shared wallet — the key is the whole handoff. On a wallet with no active tier, `resume` first folds the same cold-start chain `create` does (wallet → faucet → one x402 prototype payment); `--no-init` opts out, and the claim itself never waits on it. Sensitive untracked files (`.env`, `*.pem`, SSH/AWS/GPG dirs, …) are excluded from capture by default (`--include-sensitive <glob>` re-admits one). See the reference `run402.com/llms-cli.txt` for the full note-schema and flag reference.
 
 **Invite / join.** The second claim kind beside handoff/resume: a Handoff passes the work on and the sender stops; an Invite grows the team while the sender keeps working. `run402 repos invite [--room <key>] [--note-file <path>]` captures the checkpoint exactly like `handoff` — the inviter's own worktree, index, branch, refs, and access are all untouched — registers the inviter's presence in a coordination room (the project's default room, or `--room <key>` for a named org room), mints a single-use bearer key (`kgi1_…`, printed to stdout exactly once), and posts ONE room message naming the checkpoint (never the key). `run402 repos join <kgi1_…>` folds the SAME cold-start chain `resume` does before the claim, clones fresh, restores the exact dirty state, pins the invite's room locally, registers its own presence, posts ONE arrival message, and reports the inviter (name, labels, liveness), the room's other live presences, and the last few messages. `run402 messages wait` is the room's blocking read from there — the agent's ear, never an error on silence. Neither `invite` nor `join` has an MCP tool, same reasoning as `handoff`/`resume`.
 
-**Named addressing.** `run402 org slug <slug>` (owner-only, small one-time fee) sets an org's globally-unique, address-form slug, after which `run402::<slug>/<name>` addresses any repo under it — `git push` to a name that doesn't exist yet push-to-creates it. `run402 repos rename <name> [--project <id>]` claims the per-org-unique `<name>` half explicitly (no fee); `repos create` claims one automatically, best-effort, when the org already has a slug. Also CLI/SDK-only — no MCP tool.
+**Named addressing.** `run402 orgs slug <slug>` (owner-only, small one-time fee) sets an org's globally-unique, address-form slug, after which `run402::<slug>/<name>` addresses any repo under it — `git push` to a name that doesn't exist yet push-to-creates it. `run402 repos rename <name> [--project <project_id>]` claims the per-org-unique `<name>` half explicitly (no fee); `repos create` claims one automatically, best-effort, when the org already has a slug. Also CLI/SDK-only — no MCP tool.
 
 ### Wallet
 
@@ -144,11 +144,11 @@ reconciliation.
 ### Database
 
 ```bash
-run402 projects sql <id> "CREATE TABLE items (id serial PRIMARY KEY, …)"
-run402 projects validate-expose <id> --file manifest.json # check auth manifest, no mutation
-run402 projects apply-expose <id> --file manifest.json   # declare what's reachable
-run402 projects rest <id> items "select=*&order=id.desc&limit=10"
-run402 projects schema <id>                              # introspect tables + RLS
+run402 projects sql <project_id> "CREATE TABLE items (id serial PRIMARY KEY, …)"
+run402 projects validate-expose <project_id> --file manifest.json # check auth manifest, no mutation
+run402 projects apply-expose <project_id> --file manifest.json   # declare what's reachable
+run402 projects rest <project_id> items "select=*&order=id.desc&limit=10"
+run402 projects schema <project_id>                              # introspect tables + RLS
 ```
 
 ### Static sites
@@ -223,18 +223,18 @@ The returned `cdn_url` is content-addressed (`pr-<public_id>.run402.com/_blob/<k
 ### Functions
 
 ```bash
-run402 functions deploy <id> my-fn --file fn.ts \
+run402 functions deploy <project_id> my-fn --file fn.ts \
   --timeout 30 --memory 256 \
   --schedule "*/15 * * * *" \
   --deps "stripe,zod@^3"
-run402 functions logs <id> my-fn --tail 100 --request-id req_abc123 --follow
-run402 functions logs --request-id req_abc123 --project <id>   # <name> optional with --request-id: every function is searched
-run402 functions logs my-fn --project <id> --all               # include the Lambda INIT_START / REPORT lines
-run402 logs --request-id req_abc123 --project <id>             # the x-run402-request-id response header, no function name needed
-run402 functions invoke my-fn --project <id> --body-file request.json
-run402 functions invoke paid-fn --project <id> --body-file request.json --idempotency-key paid:call:123 --wait
-run402 functions rebuild <id> my-fn      # refresh ONE function onto the current runtime
-run402 functions rebuild <id> --all      # refresh every function in the project
+run402 functions logs <project_id> my-fn --tail 100 --request-id req_abc123 --follow
+run402 functions logs --request-id req_abc123 --project <project_id>   # <name> optional with --request-id: every function is searched
+run402 functions logs my-fn --project <project_id> --all               # include the Lambda INIT_START / REPORT lines
+run402 logs --request-id req_abc123 --project <project_id>             # the x-run402-request-id response header, no function name needed
+run402 functions invoke my-fn --project <project_id> --body-file request.json
+run402 functions invoke paid-fn --project <project_id> --body-file request.json --idempotency-key paid:call:123 --wait
+run402 functions rebuild <project_id> my-fn      # refresh ONE function onto the current runtime
+run402 functions rebuild <project_id> --all      # refresh every function in the project
 ```
 
 Log reads are app-first: every entry carries `origin: "app" | "platform"`, the Lambda runtime lines (INIT_START, START/END/REPORT RequestId, billed duration) are hidden by default (`--app`), `--platform` shows only them and `--all` the raw stream; `hidden` counts what was dropped and a `hint` explains an empty result. `--request-id` accepts `req_`, `fnrun_`, and `fnatt_` ids, `--since` takes an ISO timestamp or epoch ms, and `run402 logs` rejects unknown flags.
@@ -258,9 +258,9 @@ import { db, adminDb, auth, email, ai } from "@run402/functions";
 ### Secrets
 
 ```bash
-run402 secrets set <id> OPENAI_API_KEY --file ./.secrets/openai-key
-printf %s "$OPENAI_API_KEY" | run402 secrets set <id> OPENAI_API_KEY --stdin
-run402 secrets list <id>
+run402 secrets set <project_id> OPENAI_API_KEY --file ./.secrets/openai-key
+printf %s "$OPENAI_API_KEY" | run402 secrets set <project_id> OPENAI_API_KEY --stdin
+run402 secrets list <project_id>
 run402 deploy --manifest run402.deploy.json   # manifest uses secrets.require, not values
 ```
 
@@ -323,7 +323,7 @@ run402 doctor                    # { ok, blocking[], warnings[], checks[] }
 run402 doctor --refresh          # live npm check for a newer run402
 ```
 
-`ok` is structural: `true` exactly when `blocking[]` is empty. Every check carries `severity: "blocking" | "advisory" | "info"`; advisory findings (an unbound contact passkey, a degraded recovery posture on another org, a stale CLI, gitvault gaps) land in `warnings[]` without changing `ok` or the exit code. The `tier` check's `status` is a fixed vocabulary (`ok | inactive | frozen | past_due | dormant | purged | missing | unknown | error`, never a tier name; see `value.tier` / `value.lifecycle`), and a wallet whose own org holds no tier but can reach another org's projects reports `missing` as advisory (`TIER_MISSING_ON_OWN_ORG`).
+`ok` is structural: `true` exactly when `blocking[]` is empty. Every check carries `severity: "blocking" | "advisory" | "info"`; advisory findings (an unbound contact passkey, a degraded recovery posture on another org, a stale CLI, vault gaps) land in `warnings[]` without changing `ok` or the exit code. The `tier` check's `status` is a fixed vocabulary (`ok | inactive | frozen | past_due | dormant | purged | missing | unknown | error`, never a tier name; see `value.tier` / `value.lifecycle`), and a wallet whose own org holds no tier but can reach another org's projects reports `missing` as advisory (`TIER_MISSING_ON_OWN_ORG`).
 
 ## State
 
@@ -355,13 +355,13 @@ A person signs in; the agent is your wallet (`run402 status` shows the wallet's
 - `run402 whoami` — principal, memberships, `session.grade`, and the write approvals cached on this machine.
 - `run402 approve --action <capability> (--org <org_id> | --project <project_id>)` — passkey-signed write approval for one action on one target; a person without a wallet needs it to provision, deploy, or write secrets (an interactive `provision`/`deploy` opens it for you).
 - `run402 logout` — revoke the session server-side and clear it and every write approval locally.
-- `run402 org list` — your orgs joined with the account overview (tier, lifecycle, quotas, allowance, advisories).
+- `run402 orgs list` — your orgs joined with the account overview (tier, lifecycle, quotas, allowance, advisories).
 
 Not exposed as MCP tools by design — MCP authenticates as the agent (wallet), and a person's session must not become its ambient authority.
 
 ## Active project (sticky default)
 
-After `provision`, the new project becomes the active one. `run402 projects use <id>` switches it. Most commands that take `<id>` default to the active project when omitted.
+After `provision`, the new project becomes the active one. `run402 projects use <project_id>` switches it. Most commands that take `<project_id>` default to the active project when omitted.
 
 ## Help
 

package/cli.mjs

@@ -7,7 +7,7 @@
 import { readFileSync } from "node:fs";
 import * as nodeModule from "node:module";
 
-// gitvault-startup-amortization (D2): on-disk V8 compile cache for the
+// vault-startup-amortization (D2): on-disk V8 compile cache for the
 // lazily-imported subcommand graphs. Feature-guarded (Node 22.8+) and
 // try/caught — absence or an unwritable cache dir degrade silently.
 try {
@@ -72,13 +72,13 @@ AUTHORITY — who may act, and with what credential
   credentials Manage local credential material (project-keys)
   delegates   Scoped deploy credentials for agents (create, list, revoke, rotate)
   grants      Per-project capability grants for agent/CI principals (create, revoke)
-  org         Org membership, invites & audit (whoami, list, member, invite, audit)
+  orgs        Organizations, members, invites & audit (list, get, members, invite, audit)
   identity    Public proof-backed external agent identity links
   auth        Manage project user authentication (magic link, passwords, settings)
   ci          Link GitHub Actions OIDC deploy bindings
   login       Sign in as a person (browser passkey; --device for a read-only session)
   logout      End your sign-in session and clear it from this machine
-  whoami      Who this CLI acts as: principal, memberships, session grade
+  whoami      Who this CLI acts as: principal, memberships, session grade (--set-name sets your name)
   approve     Write approval for one action on one target (provision, deploy, secrets)
 
 DELIVER — reach a human when something happens
@@ -94,10 +94,7 @@ PLATFORM — everything else, and the things still finding a home
   contracts   KMS signers ($0.04/day rental + $0.000005/sign)
   jobs        Submit and inspect platform-managed jobs
   transfer    Project transfer to a wallet, an email, or an owned org (init, preview, list, accept, cancel)
-  cloud       Cloud portability archive export (archives create/download/status)
-  archives    Inspect and verify portable project archives locally
-  gitvault    RETIRED — moved to repos (repo-surface-consolidation); every spelling answers COMMAND_MOVED/COMMAND_REMOVED
-  source-access RETIRED — moved into repos (recovery-bundle + access); every spelling answers COMMAND_MOVED
+  archives    Portable project archives (create, status, download --target cloud; inspect, verify; import --target core)
   buzz        Buzz human/community/agent control-plane workflows
   apps        Browse and manage the app marketplace
   ai          AI translation and moderation tools
@@ -105,7 +102,6 @@ PLATFORM — everything else, and the things still finding a home
   cdn         CloudFront CDN diagnostics (wait-fresh) for public asset URLs
   cache       Inspect and invalidate the SSR origin cache (inspect, invalidate)
   agent       Manage agent identity (contact info)
-  core        Local Run402 Core import helpers
   dev         Run Astro dev with Run402 env + credentials in scope
 
 Global options (any command):
@@ -122,8 +118,8 @@ Examples:
   run402 deploy --manifest app.json
   run402 snapshots list --project prj_...
   run402 branches create --project prj_... --ttl-days 7 --json
-  run402 cloud archives create --project prj_... --wait --output ./project.r402ar --json
-  run402 core projects import ./project.r402ar --name imported-project --env-file ./required.env --json
+  run402 archives create --project <project_id> --target cloud --wait --output ./project.r402ar --json
+  run402 archives import ./project.r402ar --target core --name imported-project --env-file ./required.env --json
   run402 jobs submit --file job.json
   run402 projects list
   run402 projects sql "SELECT * FROM users LIMIT 5" --project <project_id>
@@ -234,14 +230,6 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  // `repo` singular resolves identically to `repos` (design D1 — agents type
-  // what `gh repo` already taught them). Its own case block, not a
-  // fall-through, so cli-conventions-gate's per-line family scanner sees it.
-  case "repo": {
-    const { run } = await import("./lib/repos.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "snapshots": {
     const { run } = await import("./lib/snapshots.mjs");
     await run(sub, rest);
@@ -257,21 +245,11 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "cloud": {
-    const { run } = await import("./lib/cloud.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "archives": {
     const { run } = await import("./lib/archives.mjs");
     await run(sub, rest);
     break;
   }
-  case "core": {
-    const { run } = await import("./lib/core.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "deploy": {
     const { run } = await import("./lib/deploy.mjs");
     await run([sub, ...rest].filter(Boolean));
@@ -287,8 +265,8 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "org": {
-    const { run } = await import("./lib/org.mjs");
+  case "orgs": {
+    const { run } = await import("./lib/orgs.mjs");
     await run(sub, rest);
     break;
   }
@@ -337,11 +315,6 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "gitvault": {
-    const { run } = await import("./lib/gitvault.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "escalations": {
     const { run } = await import("./lib/escalations.mjs");
     await run(sub, rest);
@@ -460,11 +433,6 @@ switch (cmd) {
     await run([sub, ...rest].filter(Boolean));
     break;
   }
-  case "source-access": {
-    const { run } = await import("./lib/source-access.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "auth": {
     const { run } = await import("./lib/auth.mjs");
     await run(sub, rest);

package/core-dist/keystore.js

@@ -190,7 +190,7 @@ export function removeProject(projectId, path) {
  * bucket, not "unknown") and PERMANENTLY shadows every later wallet-scoped
  * activation for every caller that reads through this module: `resolveProjectId`
  * / `resolveProject` (cli/lib/config.mjs), `projects current`, and every
- * gitvault-verb target resolution. The failure it causes: `repos create`
+ * vault-verb target resolution. The failure it causes: `repos create`
  * calls `projects.provision`, whose `creds.setActiveProject` correctly
  * persists the new project under the real wallet's scoped bucket AND the
  * flat fallback, yet every CLI read of "the active project" resolves the

package/git-remote-run402.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * `git-remote-run402` — the THIN CLIENT (gitvault-persistent-helper).
+ * `git-remote-run402` — the THIN CLIENT (vault-persistent-helper).
  *
  * git spawns a fresh helper process per remote operation, so everything warm
  * dies per command — Node boot, the SDK graph, the signer, the paid stack,
@@ -10,7 +10,7 @@
  * when that is impossible does it load the full session module and run
  * in-process — which is byte-identical to the pre-daemon behavior.
  *
- * INVARIANTS (spec: gitvault-client-surface, "A resident helper engine…"):
+ * INVARIANTS (spec: vault-client-surface, "A resident helper engine…"):
  *   - The daemon is never load-bearing: any failure to use it — absent,
  *     busy, stale, mismatched, dying mid-handshake — falls back silently to
  *     the in-process path. The handshake completes BEFORE this client
@@ -35,7 +35,7 @@ import net from "node:net";
 import { spawn } from "node:child_process";
 import { daemonSocketPath, daemonRunnerPath, DAEMON_PROTOCOL_VERSION, cliVersion, forwardableEnv } from "./lib/daemon-path.mjs";
 
-// gitvault-startup-amortization (D2): on-disk V8 compile cache for every
+// vault-startup-amortization (D2): on-disk V8 compile cache for every
 // module loaded from here on. Feature-guarded (Node 22.8+) and try/caught
 // (a read-only install dir degrades silently).
 try {
@@ -201,11 +201,11 @@ if (invokedDirectly) {
     process.exitCode = code;
   } else {
     // Fallback: today's in-process path, byte-identical. Fire the prewarm
-    // BEFORE the heavy graph evaluates (gitvault-startup-amortization D1),
+    // BEFORE the heavy graph evaluates (vault-startup-amortization D1),
     // and leave a daemon behind for next time.
     if (daemonEnabled) spawnDaemon();
-    const { prewarmGitvaultConnection } = await import("./sdk/dist/node/gitvault-prewarm.js");
-    prewarmGitvaultConnection();
+    const { prewarmVaultConnection } = await import("./sdk/dist/node/vault-prewarm.js");
+    prewarmVaultConnection();
     const { runHelperSession } = await import("./lib/remote-helper-session.mjs");
     process.exitCode = await runHelperSession(argv);
   }

package/lib/admin.mjs

@@ -17,12 +17,12 @@ Subcommands:
                                          (\`reactivated: true\` in the response).
                                          Replaces the v1.56 per-project pin.
 
-  archive [--project <id>] [--reason "..."]  Moderate-archive a single project. Sets
+  archive [--project <project_id>] [--reason "..."]  Moderate-archive a single project. Sets
                                          projects.archived_at = NOW(). Independent
                                          of organization lifecycle; the rest of the
                                          organization's projects keep serving.
 
-  reactivate [--project <id>]            Un-archive a project (flips archived_at
+  reactivate [--project <project_id>]            Un-archive a project (flips archived_at
                                          back to NULL). In v1.57 this no longer
                                          touches organization-level lifecycle — to
                                          reactivate a grace-state account, use
@@ -65,7 +65,7 @@ Examples:
   archive: `run402 admin archive — Moderate-archive a single project
 
 Usage:
-  run402 admin archive [--project <id>] [--reason "..."]
+  run402 admin archive [--project <project_id>] [--reason "..."]
 
 Legacy (still supported):
   run402 admin archive <project_id> [--reason "..."]
@@ -87,7 +87,7 @@ Examples:
   reactivate: `run402 admin reactivate — Un-archive a project
 
 Usage:
-  run402 admin reactivate [--project <id>]
+  run402 admin reactivate [--project <project_id>]
 
 Legacy (still supported):
   run402 admin reactivate <project_id>
@@ -143,7 +143,7 @@ async function leasePerpetual(args) {
 }
 
 async function archive(args) {
-  // Canonical: --project <id>; legacy leading prj_... positional kept.
+  // Canonical: --project <project_id>; legacy leading prj_... positional kept.
   const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAGS_BY_SUB.archive.values });
   let reason;
   for (let i = 0; i < rest.length; i++) {

package/lib/ai.mjs

@@ -24,7 +24,7 @@ Examples:
 
 Notes:
   - [project_id] defaults to the active project when omitted (set with
-    'run402 projects use <id>'). Project IDs start with 'prj_'; any first
+    'run402 projects use <project_id>'). Project IDs start with 'prj_'; any first
     positional that doesn't is treated as the next argument instead.
   - translate requires the AI Translation add-on on the project
   - moderate is free for all projects
@@ -47,7 +47,7 @@ Options:
   --to <lang>         Target language code (required, e.g. es, ja, fr)
   --from <lang>       Source language code (optional; auto-detected if omitted)
   --context <hint>    Optional translation hint (e.g. "formal business email")
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Requires the AI Translation add-on on the project
@@ -71,7 +71,7 @@ Arguments:
   <text>              Text to check (quote it to preserve spaces)
 
 Options:
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Free for all projects; uses the project's service key
@@ -91,7 +91,7 @@ Arguments:
                       Must start with 'prj_'; any other first positional is an error.
 
 Options:
-  --project <id>      Project ID (alternative to the positional argument)
+  --project <project_id>      Project ID (alternative to the positional argument)
 
 Notes:
   - Reports translation word quota and usage; only meaningful with the
@@ -111,7 +111,7 @@ async function translate(args) {
   args = normalizeArgv(args);
   assertKnownFlags(args, TRANSLATE_VALUE_FLAGS, TRANSLATE_VALUE_FLAGS);
 
-  // --project <id> wins over positional, mirroring previous behavior.
+  // --project <project_id> wins over positional, mirroring previous behavior.
   const projectOpt = flagValue(args, "--project");
   const to = flagValue(args, "--to");
   const from = flagValue(args, "--from");

package/lib/apps.mjs

@@ -12,13 +12,13 @@ Subcommands:
   browse  [--tag <tag>]                   Browse public apps
   fork    <version_id> --name <name> [--subdomain <name>]
                                            Fork a published app into your own project
-  publish [--project <id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed]
+  publish [--project <project_id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed]
                                            Publish a project as an app
-  versions [--project <id>]                List published versions of a project
+  versions [--project <project_id>]                List published versions of a project
   inspect <version_id>                     Inspect a published app version
-  update  <version_id> [--project <id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed] [--no-fork]
+  update  <version_id> [--project <project_id>] [--description <desc>] [--tags <t1,t2>] [--visibility <v>] [--fork-allowed] [--no-fork]
                                            Update a published version
-  delete  <version_id> [--project <id>]    Delete a published version
+  delete  <version_id> [--project <project_id>]    Delete a published version
 
 Legacy (still supported): the old positional forms keep working, e.g.
   run402 apps fork <version_id> <name>
@@ -72,13 +72,13 @@ Examples:
   publish: `run402 apps publish — Publish a project as an app
 
 Usage:
-  run402 apps publish [--project <id>] [options]
+  run402 apps publish [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 apps publish <project_id> [options]
 
 Options (project):
-  --project <id>      Project ID to publish (defaults to the active project)
+  --project <project_id>      Project ID to publish (defaults to the active project)
 
 Options:
   --description <d>   Human-readable description of the app
@@ -93,7 +93,7 @@ Examples:
   update: `run402 apps update — Update a published version's metadata
 
 Usage:
-  run402 apps update <version_id> [--project <id>] [options]
+  run402 apps update <version_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 apps update <project_id> <version_id> [options]
@@ -127,7 +127,7 @@ Examples:
   versions: `run402 apps versions — List published versions of a project
 
 Usage:
-  run402 apps versions [--project <id>]
+  run402 apps versions [--project <project_id>]
 
 Legacy (still supported):
   run402 apps versions <project_id>
@@ -138,7 +138,7 @@ Examples:
   delete: `run402 apps delete — Delete a published version
 
 Usage:
-  run402 apps delete <version_id> [--project <id>]
+  run402 apps delete <version_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 apps delete <project_id> <version_id>