run402 4.94.0 → 4.96.0

package/lib/rooms-context.mjs

@@ -39,16 +39,16 @@ export const PRESENCE_ENV = "RUN402_PRESENCE_ID";
 /**
  * `r402.room` from `cwd`'s LOCAL git config (kygit-handoff design D10) —
  * best-effort, `null` on any absence or failure. Checks a real vault
- * checkout's pin first (`readPinnedGitvaultRepo`, gated on `r402.repoId`
+ * checkout's pin first (`readPinnedVaultRepo`, gated on `r402.repoId`
  * being present), then falls back to the bare room/org pin `rooms join
  * <key>` writes in a directory with NO vault at all (add-room-invite design
- * D10) — `readPinnedGitvaultRepo` would otherwise see that pin as absent,
+ * D10) — `readPinnedVaultRepo` would otherwise see that pin as absent,
  * since it never sets `r402.repoId`.
  */
-async function readGitvaultPinnedRoom(cwd) {
+async function readVaultPinnedRoom(cwd) {
   try {
-    const { readPinnedGitvaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
-    const pinned = await readPinnedGitvaultRepo(cwd);
+    const { readPinnedVaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
+    const pinned = await readPinnedVaultRepo(cwd);
     const room = typeof pinned?.room === "string" ? pinned.room.trim() : "";
     if (room.length > 0) return room;
     const bare = await readPinnedRoomBinding(cwd);
@@ -102,11 +102,11 @@ export async function resolveRoom({ org, room, project } = {}) {
   //    (`--room` alone works whenever the org resolves, and fails with
   //    ORG_REQUIRED — naming every way to supply one — when it does not.)
   //    kygit-handoff design D10: `r402.room` in this checkout's LOCAL git
-  //    config — written by `resume` and every other gitvault pin site — is
+  //    config — written by `resume` and every other vault pin site — is
   //    the LAST room-key source before falling to the project default,
   //    below the binding file's own `room` key.
   const bindingRoom = findBindingKey(process.cwd(), "room");
-  const roomKey = room ?? bindingRoom?.value ?? (await readGitvaultPinnedRoom(process.cwd()));
+  const roomKey = room ?? bindingRoom?.value ?? (await readVaultPinnedRoom(process.cwd()));
   if (roomKey) {
     const resolved = await resolveOrg({ org, project }, { cmd: "rooms" });
     return {

package/lib/rooms.mjs

@@ -53,8 +53,8 @@ Usage:
   run402 rooms leave [<presence_id>]
 
 Addressing:
-  --project <id>    That project's DEFAULT room (the room key IS the project id)
-  --org <id> --room <key>   A named org room
+  --project <project_id>    That project's DEFAULT room (the room key IS the project id)
+  --org <org_id> --room <key>   A named org room
   (omit both)       Resolved from RUN402_ROOM, a .run402.json binding, or the
                     wallet profile's selected org
 

package/lib/sdk-errors.mjs

@@ -82,7 +82,7 @@ export function reportSdkError(err) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: err?.message || "Local project credentials are not cached.",
-      hint: "This is a local credential-cache miss, not proof that the project does not exist. Use a principal-auth command, or import keys with `run402 credentials project-keys import --project <id> --service-key-stdin` for credential-required operations.",
+      hint: "This is a local credential-cache miss, not proof that the project does not exist. Use a principal-auth command, or import keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin` for credential-required operations.",
       details: err?.details,
       next_actions: err?.nextActions,
       retryable: err?.retryable ?? false,

package/lib/secrets.mjs

@@ -10,10 +10,10 @@ Usage:
   run402 secrets <subcommand> [args...]
 
 Subcommands:
-  set    <key> (--value <v> | --file <path> | --stdin) [--project <id>]
+  set    <key> (--value <v> | --file <path> | --stdin) [--project <project_id>]
                                Set a secret on a project
-  list   [--project <id>]      List all secrets for a project
-  delete <key> [--project <id>]  Delete a secret from a project
+  list   [--project <project_id>]      List all secrets for a project
+  delete <key> [--project <project_id>]  Delete a secret from a project
 
 Legacy (still supported):
   run402 secrets set <prj_id> <key> <value>
@@ -38,9 +38,9 @@ const SUB_HELP = {
   set: `run402 secrets set — Set a secret on a project
 
 Usage:
-  run402 secrets set <key> --value <v> [--project <id>]
-  run402 secrets set <key> --file <path> [--project <id>]
-  run402 secrets set <key> --stdin [--project <id>]
+  run402 secrets set <key> --value <v> [--project <project_id>]
+  run402 secrets set <key> --file <path> [--project <project_id>]
+  run402 secrets set <key> --stdin [--project <project_id>]
 
 Legacy (still supported):
   run402 secrets set <prj_id> <key> <value>
@@ -50,7 +50,7 @@ Arguments:
   <key>               Secret key name (exposed as process.env.<key>)
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
   --value <v>         Inline secret value (alternative to the legacy positional)
   --file <path>       Read the secret value from a file instead of inline
                       Use --file - or --file /dev/stdin to read from stdin
@@ -71,13 +71,13 @@ Examples:
   list: `run402 secrets list — List all secrets for a project
 
 Usage:
-  run402 secrets list [--project <id>]
+  run402 secrets list [--project <project_id>]
 
 Legacy (still supported):
   run402 secrets list <prj_id>
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Notes:
   - Returns secret keys and timestamps only; raw values and value-derived hashes are never returned
@@ -88,7 +88,7 @@ Examples:
   delete: `run402 secrets delete — Delete a secret from a project
 
 Usage:
-  run402 secrets delete <key> [--project <id>]
+  run402 secrets delete <key> [--project <project_id>]
 
 Legacy (still supported):
   run402 secrets delete <prj_id> <key>
@@ -97,7 +97,7 @@ Arguments:
   <key>               Secret key name to remove
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Examples:
   run402 secrets delete STRIPE_KEY --project prj_abc123
@@ -147,7 +147,7 @@ async function set(projectId, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <key>.",
-      hint: "run402 secrets set <key> --value <v> [--project <id>]",
+      hint: "run402 secrets set <key> --value <v> [--project <project_id>]",
     });
   }
   const values = positionals.slice(1);
@@ -235,7 +235,7 @@ async function deleteSecret(projectId, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <key>.",
-      hint: "run402 secrets delete <key> [--project <id>]",
+      hint: "run402 secrets delete <key> [--project <project_id>]",
     });
   }
   if (positionals.length > 1) {

package/lib/sites.mjs

@@ -13,8 +13,8 @@ const SMALL_DIR_THRESHOLD = 5;
 const HELP = `run402 sites - Deploy and manage static sites
 
 Usage:
-  run402 sites deploy --manifest <file> [--project <id>]
-  run402 sites deploy-dir <path> --project <id>
+  run402 sites deploy --manifest <file> [--project <project_id>]
+  run402 sites deploy-dir <path> --project <project_id>
   cat manifest.json | run402 sites deploy
 
 Subcommands:
@@ -23,12 +23,12 @@ Subcommands:
 
 Options (deploy):
   --manifest <file>     Path to manifest JSON file (or read from stdin)
-  --project <id>        Project ID (defaults to active project)
+  --project <project_id>        Project ID (defaults to active project)
   --help, -h            Show this help message
 
 Options (deploy-dir):
   <path>                Positional: local directory to deploy
-  --project <id>        Project ID (defaults to active project)
+  --project <project_id>        Project ID (defaults to active project)
   --quiet               Suppress progress events on stderr
   --dry-run             Plan-only: print the diff envelope and exit
   --confirm-prune       Required when <path> has fewer files than the
@@ -58,7 +58,7 @@ Notes:
     (CAS-backed): only bytes the gateway doesn't already have are uploaded.
     Re-deploys of an unchanged tree make no S3 PUTs.
   - To check status of an in-flight deploy, use 'run402 deploy events <op>'
-    or 'run402 deploy list --project <id>'.
+    or 'run402 deploy list --project <project_id>'.
   - deploy-dir walks the directory, skips .git / node_modules / .DS_Store,
     and auto-detects binary files. Symlinks are rejected.
   - Progress events are emitted as JSON-line objects on stderr by default
@@ -71,12 +71,12 @@ const SUB_HELP = {
   deploy: `run402 sites deploy - Deploy a static site from a manifest
 
 Usage:
-  run402 sites deploy --manifest <file> [--project <id>]
-  cat manifest.json | run402 sites deploy [--project <id>]
+  run402 sites deploy --manifest <file> [--project <project_id>]
+  cat manifest.json | run402 sites deploy [--project <project_id>]
 
 Options:
   --manifest <file>   Path to manifest JSON file (or read from stdin)
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Manifest format (JSON):
   {
@@ -99,14 +99,14 @@ Examples:
   "deploy-dir": `run402 sites deploy-dir - Deploy a static site from a local directory
 
 Usage:
-  run402 sites deploy-dir <path> [--project <id>] [--quiet]
+  run402 sites deploy-dir <path> [--project <project_id>] [--quiet]
                                   [--dry-run] [--confirm-prune]
 
 Arguments:
   <path>              Local directory to deploy (positional, required)
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
   --quiet             Suppress progress events on stderr (events are on by
                       default — see Progress events below)
   --dry-run           Plan the deploy and print a JSON envelope describing
@@ -196,7 +196,7 @@ async function deploy(args) {
     fail({
       code: "BAD_USAGE",
       message: `Unexpected argument for sites deploy: ${extra[0]}`,
-      hint: "Use `run402 sites deploy --manifest <file> [--project <id>]`.",
+      hint: "Use `run402 sites deploy --manifest <file> [--project <project_id>]`.",
     });
   }
   const opts = { manifest: null, project: undefined, target: undefined, quiet: false };
@@ -252,7 +252,7 @@ async function deployDir(args) {
     fail({
       code: "BAD_USAGE",
       message: `Unexpected argument for sites deploy-dir: ${positionals[1]}`,
-      hint: "Use `run402 sites deploy-dir <path> --project <id>`.",
+      hint: "Use `run402 sites deploy-dir <path> --project <project_id>`.",
     });
   }
   const opts = {
@@ -282,7 +282,7 @@ async function deployDir(args) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <path>.",
-      hint: "run402 sites deploy-dir <path> --project <id>",
+      hint: "run402 sites deploy-dir <path> --project <project_id>",
     });
   }
   const projectId = resolveProjectId(opts.project);
@@ -325,7 +325,7 @@ async function deployDir(args) {
   if (opts.dryRun) {
     try {
       const { plan } = await getSdk()._applyEngine.plan({
-        project: projectId,
+        project_id: projectId,
         site: { replace: fileSet },
       }, { dryRun: true });
       console.log(JSON.stringify({

package/lib/snapshots.mjs

@@ -15,14 +15,14 @@ import {
 const HELP = `run402 snapshots — Project database restore points
 
 Usage:
-  run402 snapshots create [--project <id>] [--json]
-  run402 snapshots list [--project <id>] [--kind <kind>] [--limit <n>] [--after <cursor>] [--json]
-  run402 snapshots get <snapshot-id> [--project <id>] [--json]
-  run402 snapshots restore <snapshot-id> [--project <id>] [--include-auth] [--confirm <token>] [--json]
-  run402 snapshots delete <snapshot-id> [--project <id>] [--json]
+  run402 snapshots create [--project <project_id>] [--json]
+  run402 snapshots list [--project <project_id>] [--kind <kind>] [--limit <n>] [--after <cursor>] [--json]
+  run402 snapshots get <snapshot_id> [--project <project_id>] [--json]
+  run402 snapshots restore <snapshot_id> [--project <project_id>] [--include-auth] [--confirm <token>] [--json]
+  run402 snapshots delete <snapshot_id> [--project <project_id>] [--json]
 
 Legacy (still supported): a leading prj_... positional selects the project,
-e.g. run402 snapshots restore prj_abc123 <snapshot-id>. --project defaults to
+e.g. run402 snapshots restore prj_abc123 <snapshot_id>. --project defaults to
 the active project.
 
 Restore is a two-step handshake. First call without --confirm to get a
@@ -82,7 +82,7 @@ async function list(args) {
 }
 
 async function get(args) {
-  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots get [project-id] <snapshot-id>");
+  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots get [project_id] <snapshot_id>");
   try {
     const snapshot = await getSdk().snapshots.get(projectId, snapshotId);
     console.log(JSON.stringify({ snapshot }, null, 2));
@@ -92,7 +92,7 @@ async function get(args) {
 }
 
 async function restore(args) {
-  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots restore [project-id] <snapshot-id> [--confirm <token>]");
+  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots restore [project_id] <snapshot_id> [--confirm <token>]");
   const includeAuth = args.includes("--include-auth");
   const confirm = flagValue(args, "--confirm");
   try {
@@ -115,7 +115,7 @@ async function restore(args) {
 }
 
 async function deleteSnapshot(args) {
-  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots delete [project-id] <snapshot-id>");
+  const { projectId, snapshotId } = resolveProjectAndSnapshot(args, "run402 snapshots delete [project_id] <snapshot_id>");
   try {
     await getSdk().snapshots.delete(projectId, snapshotId);
     console.log(JSON.stringify({ ok: true, project_id: projectId, snapshot_id: snapshotId, deleted: true }, null, 2));
@@ -125,7 +125,7 @@ async function deleteSnapshot(args) {
 }
 
 function resolveProjectAndSnapshot(args, usage) {
-  // Canonical: `<snapshot-id> [--project <id>]`; legacy `<prj_id> <snapshot-id>`
+  // Canonical: `<snapshot_id> [--project <project_id>]`; legacy `<prj_id> <snapshot_id>`
   // still works (requireRestPositional keeps a lone snapshot id that happens to
   // start with prj_ from being eaten as the project selector).
   const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES, requireRestPositional: true });

package/lib/subdomains.mjs

@@ -10,8 +10,8 @@ Usage:
 
 Subcommands:
   add    <name> [--project <project_id>] [--release <release_id> | --deployment <deployment_id>]   Add a subdomain
-  delete <name> --confirm [--project <id>]                              Release a subdomain. Requires --confirm.
-  list   [--project <id>]                                               List subdomains for a project
+  delete <name> --confirm [--project <project_id>]                              Release a subdomain. Requires --confirm.
+  list   [--project <project_id>]                                               List subdomains for a project
 
 Options default to the active project. With neither --release nor
 --deployment, add binds the project's live release.
@@ -39,10 +39,10 @@ Arguments:
                       hyphens). Creates <name>.run402.com.
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
-  --release <id>      Release ID (rel_...) to point at. With neither flag,
+  --project <project_id>      Project ID (defaults to the active project)
+  --release <release_id>      Release ID (rel_...) to point at. With neither flag,
                       the project's live release is bound.
-  --deployment <id>   Legacy deployment ID (dpl_...); rel_.../op_... ids are
+  --deployment <deployment_id>   Legacy deployment ID (dpl_...); rel_.../op_... ids are
                       accepted too.
 
 Notes:
@@ -57,10 +57,10 @@ Examples:
   list: `run402 subdomains list — List a project's subdomains
 
 Usage:
-  run402 subdomains list [--project <id>]
+  run402 subdomains list [--project <project_id>]
 
 Options:
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Examples:
   run402 subdomains list
@@ -69,7 +69,7 @@ Examples:
   delete: `run402 subdomains delete — Release a subdomain
 
 Usage:
-  run402 subdomains delete <name> --confirm [--project <id>]
+  run402 subdomains delete <name> --confirm [--project <project_id>]
 
 Arguments:
   <name>              Subdomain name to release
@@ -77,7 +77,7 @@ Arguments:
 Options:
   --confirm           Required: releasing a subdomain is irreversible and
                       makes it available for any other project to add
-  --project <id>      Project ID (defaults to the active project)
+  --project <project_id>      Project ID (defaults to the active project)
 
 Examples:
   run402 subdomains delete myapp --confirm
@@ -117,7 +117,7 @@ async function add(args) {
     fail({
       code: "BAD_USAGE",
       message: "Pass either --release or --deployment, not both.",
-      hint: "run402 subdomains add <name> [--release <id> | --deployment <id>]",
+      hint: "run402 subdomains add <name> [--release <release_id> | --deployment <deployment_id>]",
     });
   }
   const projectId = resolveProjectId(opts.project);
@@ -147,7 +147,7 @@ async function deleteSubdomain(allArgs) {
     fail({
       code: "BAD_USAGE",
       message: "Missing <name>.",
-      hint: "run402 subdomains delete <name> --confirm [--project <id>]",
+      hint: "run402 subdomains delete <name> --confirm [--project <project_id>]",
     });
   }
   if (positionals.length > 1) {
@@ -186,7 +186,7 @@ async function list(args) {
     fail({
       code: "BAD_USAGE",
       message: `Unexpected argument for subdomains list: ${rest[0]}`,
-      hint: "Use `run402 subdomains list --project <id>`.",
+      hint: "Use `run402 subdomains list --project <project_id>`.",
     });
   }
   const projectId = resolveProjectId(project);

package/lib/subscriptions.mjs

@@ -35,7 +35,7 @@ import {
 const HELP = `run402 subscriptions — which events go where
 
 Usage:
-  run402 subscriptions add --binding <binding_id> [--project <id>] [--source app|platform] [--type a,b] [--class a,b]
+  run402 subscriptions add --binding <binding_id> [--project <project_id>] [--source app|platform] [--type a,b] [--class a,b]
   run402 subscriptions list
   run402 subscriptions rm <subscription_id>
 
@@ -68,7 +68,7 @@ function splitCsv(value) {
  *  alias for anyone who learned it from that help text. */
 export const SUBSCRIPTIONS_ADD_VALUE_FLAGS = ["--binding", "--contact", "--project", "--source", "--type", "--class"];
 export const SUBSCRIPTIONS_ADD_USAGE =
-  "run402 subscriptions add --binding <binding_id> [--project <id>] [--source app|platform] [--type a,b] [--class a,b]";
+  "run402 subscriptions add --binding <binding_id> [--project <project_id>] [--source app|platform] [--type a,b] [--class a,b]";
 export { HELP as SUBSCRIPTIONS_HELP };
 
 async function rulesAdd(args) {

package/lib/transfer.mjs

@@ -140,7 +140,7 @@ async function init(args) {
   const projectFlag = flagValue(parsedArgs, "--project");
   const projectId = await resolveProjectId(projectFlag);
   if (!projectId) {
-    fail({ code: "NO_PROJECT", message: "No project id. Pass --project <id> or set an active project with 'run402 projects use <id>'." });
+    fail({ code: "NO_PROJECT", message: "No project id. Pass --project <project_id> or set an active project with 'run402 projects use <project_id>'." });
   }
   const billingPolicy = flagValue(parsedArgs, "--billing-policy");
   if (billingPolicy !== null && !BILLING_POLICIES.has(billingPolicy)) {

package/lib/up.mjs

@@ -13,15 +13,15 @@ import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.
 const HELP = `run402 up — Provision/link/deploy the current app
 
 Usage:
-  run402 up [repo-or-path] [--name <name>] [--project <id>] [--manifest <path>] [--dir <path>] [--tier <tier>] [-y|--yes] [--check|--print-spec|--print-manifest|--plan|--require-plan <id>|--repo-only] [--nested] [--verify] [--human|--json-stream] [--quiet]
-  run402 up verify [repo-or-path] [--project <id>] [--manifest <path>] [--dir <path>] [--human|--json-stream]
+  run402 up [repo-or-path] [--name <name>] [--project <project_id>] [--manifest <path>] [--dir <path>] [--tier <tier>] [-y|--yes] [--check|--print-spec|--print-manifest|--plan|--require-plan <plan_id>|--repo-only] [--nested] [--verify] [--human|--json-stream] [--quiet]
+  run402 up verify [repo-or-path] [--project <project_id>] [--manifest <path>] [--dir <path>] [--human|--json-stream]
 
 Options:
   repo-or-path        Local app directory or public Git repository URL. Defaults
                       to the current directory.
   --name <name>       Project display name when up needs to create a project.
                       Not a deploy manifest field and never renames a project.
-  --project <id>      Explicit project id. All supplied selectors must agree.
+  --project <project_id>      Explicit project id. All supplied selectors must agree.
   --manifest <path>   Manifest path. Defaults to run402.json, then
                       run402.deploy.json, then app.json in --dir/current directory.
   --dir <path>        Workspace directory to inspect (default: current dir).
@@ -39,7 +39,7 @@ Options:
                       uploads, or local writes.
   --plan              Ask the gateway for a reviewed deploy plan. No upload,
                       commit, project provisioning, or workspace link write.
-  --require-plan <id> Apply only if this reviewed plan still matches.
+  --require-plan <plan_id> Apply only if this reviewed plan still matches.
   --plan-fingerprint <fingerprint>
                       Optional fingerprint returned by --plan. Only valid
                       with --require-plan.
@@ -84,12 +84,12 @@ Options:
 Repo composition (D4): against a local directory (not a git URL source), up
 composes git init (only when the app root is not already a repository) +
 provision + a run402 remote scaffold (origin is never claimed) + a first
-gitvault push — one command, the fly-launch shape. The app root is the
+vault push — one command, the fly-launch shape. The app root is the
 manifest's directory; an app root that lies INSIDE another repository is
 left untouched (result.repo.status "skipped", reason
 "inside_other_repository", toplevel named) and result.repo.next_actions
 carries create_nested_repo — re-run with --nested to give the app its own
-encrypted remote (result.repo.gitvault.nested true, enclosing_toplevel,
+encrypted remote (result.repo.vault.nested true, enclosing_toplevel,
 excluded_in_enclosing). The scaffold and first push are best-effort: a git
 or vault hiccup never turns an otherwise-successful deploy into a failure,
 and is reported under result.repo (default apply) or result (--repo-only)
@@ -104,7 +104,7 @@ coordination only. RUN402_AGENT_NAME=<name> sets the name, overriding an
 existing one; RUN402_CLIENT=<name> declares the client when it is not
 auto-detected. A detected client that was not applied (the principal is
 already named) is still reported. Change the name any time with
-'run402 org whoami --set-name <name>'. Reported under result.identity
+'run402 whoami --set-name <name>'. Reported under result.identity
 (source, detected, detection).
   --json              Emit one final JSON object on stdout (default; compatibility no-op).
   --human             Emit the legacy human success/blocking summary on stdout.
@@ -138,12 +138,12 @@ Works for both app manifests (run402.json) and deploy manifests
 (run402.deploy.json / app.json) that declare a top-level verify block.
 
 Usage:
-  run402 up verify [repo-or-path] [--project <id>] [--manifest <path>] [--dir <path>] [--name <name>] [--human|--json-stream]
+  run402 up verify [repo-or-path] [--project <project_id>] [--manifest <path>] [--dir <path>] [--name <name>] [--human|--json-stream]
 
 Options:
   repo-or-path        Local app directory or public Git repository URL. Defaults
                       to the current directory.
-  --project <id>      Existing project id. Defaults to .run402/project.json,
+  --project <project_id>      Existing project id. Defaults to .run402/project.json,
                       manifest project id, then active project.
   --manifest <path>   Manifest path. Defaults to run402.json, then
                       run402.deploy.json, then app.json.
@@ -395,7 +395,7 @@ export async function run(args = []) {
             createdRepository = await gitInitIfNeeded(workDir);
             result.result.repo = await composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested });
           } catch (err) {
-            result.result.repo = { status: "failed", first_push: null, first_push_error: { code: err?.code ?? "GITVAULT_SETUP_FAILED", message: err?.message ?? String(err) }, ...repoNextActionsOf(err) };
+            result.result.repo = { status: "failed", first_push: null, first_push_error: { code: err?.code ?? "VAULT_SETUP_FAILED", message: err?.message ?? String(err) }, ...repoNextActionsOf(err) };
           }
         }
       }
@@ -658,13 +658,13 @@ function looksLikeGitRemoteUrl(source) {
  *
  * `-b main`, not whatever `init.defaultBranch` (or the pre-2.28 hardcoded
  * `master`) happens to be — the docs teach `git push origin main`, and the
- * gitvault remote helper's own dangling-HEAD hazard note (a first push of
+ * vault remote helper's own dangling-HEAD hazard note (a first push of
  * any OTHER branch leaves HEAD naming a ref that does not exist yet) is
  * exactly what a mismatched default branch here would walk `up` straight
  * into. `-b` needs git 2.28+ (2020); an older git falls back to the same
  * result by a different route — `symbolic-ref` on a still-empty repository
  * has no existing ref to disturb, so it is exactly as safe as `-b main`
- * would have been. Mirrors `Gitvault.scaffoldRemote`'s identical fallback.
+ * would have been. Mirrors `Repos.scaffoldRemote`'s identical fallback.
  */
 async function gitInitIfNeeded(dir) {
   const { hardenedGit } = await import("#sdk/node");
@@ -685,20 +685,20 @@ async function gitInitIfNeeded(dir) {
 /**
  * Remote scaffold + first push, against an already-known project. Best-effort
  * in every branch — the same non-fatal discipline `projects provision`'s own
- * fold-in follows (`gitvault-scaffold.mjs`): a git or vault hiccup here must
+ * fold-in follows (`vault-scaffold.mjs`): a git or vault hiccup here must
  * never turn an otherwise-successful `up` into a failure.
  */
 async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested = false }) {
   const { resolveOwningOrgId } = await import("./org-context.mjs");
-  const { scaffoldGitvaultRemote } = await import("./gitvault-scaffold.mjs");
+  const { scaffoldVaultRemote } = await import("./vault-scaffold.mjs");
   const orgId = await resolveOwningOrgId(projectId);
   // `--nested`: an app root INSIDE another repository (a monorepo workspace)
   // becomes its own repository with the encrypted remote — the enclosing
   // checkout only gains one local `.git/info/exclude` line. Without it the
   // scaffold is skipped there and the result's `next_actions` name
   // `run402 up --nested` (the caller's own spelling of the way out).
-  const scaffold = await scaffoldGitvaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false, nested, nestedCommand: "run402 up --nested" });
-  if (createdRepository && scaffold.gitvault) scaffold.gitvault.created_repository = true;
+  const scaffold = await scaffoldVaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false, nested, nestedCommand: "run402 up --nested" });
+  if (createdRepository && scaffold.vault) scaffold.vault.created_repository = true;
   const out = { ...scaffold, first_push: null, first_push_error: null };
   if (scaffold.status !== "scaffolded") {
     // Nothing was scaffolded (the app root is inside another repository, or
@@ -707,7 +707,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     return out;
   }
   if (!orgId) {
-    out.first_push_error = { code: "GITVAULT_ORG_UNRESOLVED", message: `could not resolve the owning org for ${projectId} — the first push was skipped` };
+    out.first_push_error = { code: "VAULT_ORG_UNRESOLVED", message: `could not resolve the owning org for ${projectId} — the first push was skipped` };
     return out;
   }
   // Read BEFORE the push decision: an unborn HEAD is what decides the lane.
@@ -717,7 +717,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
   // a repository the agent `git init`ed itself and never committed to (an
   // UNBORN HEAD): there is no clean tree to keep, only untracked files, and
   // the strict lane would refuse SNAPSHOT_DIRTY_TREE on every first push.
-  const freshRepository = createdRepository || scaffold.gitvault?.created_repository === true || out.local_git.unborn === true;
+  const freshRepository = createdRepository || scaffold.vault?.created_repository === true || out.local_git.unborn === true;
   try {
     let vaultCreated = null;
     // A fresh repository has, by definition, nothing committed yet — every
@@ -726,7 +726,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     // first commit the dirty-tree lane produces (disclosed under
     // first_push.snapshot); a repository WITH commits keeps the clean-tree
     // rule and its refusal is reported, never overridden.
-    const pushed = await sdk.gitvault.push({
+    const pushed = await sdk.repos.capture({
       project_id: projectId,
       org_id: orgId,
       repo_dir: workDir,
@@ -736,14 +736,14 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     out.first_push = {
       generation: pushed.generation,
       form: pushed.form,
-      gitvault_commit: pushed.gitvault_commit,
+      vault_commit: pushed.vault_commit,
       vault_created: vaultCreated,
       snapshot: pushed.snapshot ? { id: pushed.snapshot.oid, kind: pushed.snapshot.kind, backup_status: "succeeded" } : null,
       note: "Vault backup does not create a local branch commit or stage files. Local HEAD and dirty state are independent.",
       ...(freshRepository ? { captured_dirty: true, modified_captured: pushed.snapshot?.modified_captured ?? null, untracked_captured: pushed.snapshot?.untracked_captured ?? null } : {}),
     };
   } catch (err) {
-    out.first_push_error = { code: err?.body?.code ?? err?.code ?? "GITVAULT_PUSH_FAILED", message: err?.message ?? String(err) };
+    out.first_push_error = { code: err?.body?.code ?? err?.code ?? "VAULT_PUSH_FAILED", message: err?.message ?? String(err) };
     Object.assign(out, repoNextActionsOf(err));
   }
   return out;

package/lib/{gitvault-capabilities.mjs → vault-capabilities.mjs}

@@ -1,11 +1,11 @@
 /**
- * gitvault-capabilities.mjs — the capability ledger for the GitVault
- * marketing surface (openspec/changes/gitvault-page-truth-gate, design D1).
+ * vault-capabilities.mjs — the capability ledger for the KyGit
+ * marketing surface (openspec/changes/kygit-page-truth-gate, design D1).
  *
  * THIS FILE IS MARKETING-CLAIM GROUND TRUTH. run402-private's page-truth
- * gate (`scripts/check-gitvault-page-truth.mjs`) resolves the PUBLISHED
+ * gate (`scripts/check-kygit-page-truth.mjs`) resolves the PUBLISHED
  * `run402` package, reads these flags out of the generated
- * `cli/gitvault-surface.json`, and fails the GitVault product page's build
+ * `cli/vault-surface.json`, and fails the KyGit product page's build
  * when a claim marker contradicts what is asserted here. It lives NEXT TO
  * `command-manifest.mjs` so the change that flips a capability (ships a
  * feature, retires a spelling) is the SAME change that flips the fact this
@@ -13,12 +13,12 @@
  * behavior and this file in the same change, never one without the other.
  */
 
-export const GITVAULT_CAPABILITIES = {
+export const VAULT_CAPABILITIES = {
   // `repos access repair` / `repos access revoke-key` /
   // `repos access declare-exposure` (rev 42, D193-D203) drive a real epoch
   // rotation against the gateway — revocation is a live, shipped feature.
   revocation_live: true,
-  // `Gitvault#reconcileEnvelopeRecipients` (gitvault-human-envelopes task
+  // `Repos#reconcileEnvelopeRecipients` (vault-human-envelopes task
   // 4.1's ADD-path workaround) runs automatically after every successful
   // `push()`/`deploy()` and wraps the vault's current epoch key to every org
   // member who has published an encryption key but has no `key_envelope` on
@@ -34,7 +34,7 @@ export const GITVAULT_CAPABILITIES = {
   // fail-closed before allocation; chain-copy dual-write; attested finalize
   // with `storage_verification: "client_attested"`; degraded reads from the
   // destination; fsck absence check) — shipped end to end in the same
-  // change that flips this flag (gitvault-byo-primary-bucket, Phase 3).
+  // change that flips this flag (vault-byo-primary-bucket, Phase 3).
   byo_live: true,
   // `repos recover` materializes a git repository from a mirror source,
   // offline, with no server call.
@@ -42,15 +42,15 @@ export const GITVAULT_CAPABILITIES = {
   // `repos create` allocates the vault IMMEDIATELY — the moment the repo
   // starts existing — not lazily deferred to first push.
   allocation: "create_immediate",
-  // `repos snapshot` refuses to capture a dirty working tree
+  // `repos capture` refuses to capture a dirty working tree
   // (`SNAPSHOT_DIRTY_TREE`) by default; `--allow-dirty` opts in explicitly.
-  snapshot_dirty_default: "refuse",
+  capture_dirty_default: "refuse",
   // kygit-handoff (design D10): `repos handoff` / `repos resume` mint and
   // claim a real single-use bearer key against a live gateway route —
   // shipped, not aspirational.
   handoff_live: true,
   // `repos handoff` captures dirty work by DEFAULT (the opposite default
-  // from `snapshot_dirty_default` above) — two verbs, two defaults, one
+  // from `capture_dirty_default` above) — two verbs, two defaults, one
   // capture path (design D1).
   handoff_dirty_default: "capture",
   // kygit-invite (design D10): `repos invite` / `repos join` mint and claim
@@ -59,8 +59,4 @@ export const GITVAULT_CAPABILITIES = {
   // while the inviter keeps working.
   invite_live: true,
   join_live: true,
-  // Both remote door spellings resolve identically (design D8):
-  // `run402::` (canonical, plumbing) and `kygit::` (rendered by
-  // `@kychee/kygit` once it sets `RUN402_REMOTE_SCHEME=kygit`).
-  remote_schemes: ["run402", "kygit"],
 };