run402 4.94.0 → 4.96.0

package/lib/command-manifest.mjs

@@ -13,13 +13,13 @@
  *   positionals            canonical positional ATTRIBUTES (post-conventions).
  *                          A variadic list of the SAME kind counts as one.
  *   projectScoped          command operates on a project and accepts
- *                          `--project <id>` (precedence: --project > legacy
+ *                          `--project <project_id>` (precedence: --project > legacy
  *                          leading prj_ positional > active project)
  *   orgScoped              command acts ON an organization and resolves it
  *                          through the ONE shared chain (cli-org-context):
  *                          an optional leading <org_id> positional, else
  *                          --org, else RUN402_ORG, else the .run402.json
- *                          binding, else `org use`. The gate drives every
+ *                          binding, else `orgs use`. The gate drives every
  *                          such entry through --org AND RUN402_ORG with no
  *                          positional and fails on any "Missing <org_id>".
  *                          Any entry with an `org_id` positional MUST be
@@ -151,7 +151,6 @@ export const COMMAND_MANIFEST = [
   { path: ["projects", "delete"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
   { path: ["projects", "promote-user"], positionals: [p("email")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["user@example.com"] },
   { path: ["projects", "demote-user"], positionals: [p("email")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["user@example.com"] },
-  { path: ["projects", "export"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
 
   // ── snapshots ────────────────────────────────────────────────────────────
   { path: ["snapshots", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
@@ -171,13 +170,13 @@ export const COMMAND_MANIFEST = [
   { path: ["admin", "archive"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["--reason", "gate"] },
   { path: ["admin", "reactivate"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
 
-  // ── cloud / archives / core ──────────────────────────────────────────────
-  { path: ["cloud", "archives", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
-  { path: ["cloud", "archives", "download"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1", "--output", "__OUT_FILE__"] },
-  { path: ["cloud", "archives", "status"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1"] },
+  // ── archives ─────────────────────────────────────────────────────────────
+  { path: ["archives", "create"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [] },
+  { path: ["archives", "download"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1", "--output", "__OUT_FILE__"] },
+  { path: ["archives", "status"], positionals: [p("archive_id")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["arc_gate1"] },
   { path: ["archives", "inspect"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__"] },
   { path: ["archives", "verify"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__"] },
-  { path: ["core", "projects", "import"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__", "--name", "gate-import"] },
+  { path: ["archives", "import"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__", "--name", "gate-import"] },
 
   // ── deploy (unified deploy v2) ───────────────────────────────────────────
   // Bare `run402 deploy` IS the deploy (a verb); the family's subcommands
@@ -209,31 +208,30 @@ export const COMMAND_MANIFEST = [
   { path: ["transfer", "accept"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "cancel"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
 
-  // ── org ──────────────────────────────────────────────────────────────────
-  { path: ["org", "create"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "get"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "rename"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--name", "Gate"] },
-  { path: ["org", "payout-wallet"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
+  // ── orgs ──────────────────────────────────────────────────────────────────
+  { path: ["orgs", "create"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "get"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "rename"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--name", "Gate"] },
+  { path: ["orgs", "payout-wallet"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
   // `--org` (not a positional org_id
   // like rename/payout-wallet above) goes through resolveOrg's SHAPE
   // validation (a real UUID) — "org_gate1" fails that locally, so this needs
-  // the same UUID-shaped fixture `org use` below already established.
-  { path: ["org", "slug"], positionals: [p("slug")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["acme", "--org", "11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "whoami"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "audit"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "use"], positionals: [p("org_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "current"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "clear"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "bind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--org", "11111111-2222-3333-4444-555555555555"] },
-  { path: ["org", "unbind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["org", "member", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "member", "add"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
-  { path: ["org", "member", "role"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1", "--role", "viewer"] },
-  { path: ["org", "member", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
-  { path: ["org", "invite", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
-  { path: ["org", "invite", "create"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--email", "gate@example.com"] },
-  { path: ["org", "invite", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
+  // the same UUID-shaped fixture `orgs use` below already established.
+  { path: ["orgs", "slug"], positionals: [p("slug")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["acme", "--org", "11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "audit"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "use"], positionals: [p("org_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "current"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "clear"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "bind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--org", "11111111-2222-3333-4444-555555555555"] },
+  { path: ["orgs", "unbind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
+  { path: ["orgs", "members", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "members", "add"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "0x1111111111111111111111111111111111111111"] },
+  { path: ["orgs", "members", "role"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1", "--role", "viewer"] },
+  { path: ["orgs", "members", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
+  { path: ["orgs", "invite", "list"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG] },
+  { path: ["orgs", "invite", "create"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--email", "gate@example.com"] },
+  { path: ["orgs", "invite", "rm"], positionals: [p("org_id", { required: false })], projectScoped: false, orgScoped: true, legacyPositionalProject: false, minimalArgs: [GATE_ORG, "--principal", "prn_gate1"] },
 
   // ── grants ───────────────────────────────────────────────────────────────
   { path: ["grants", "create"], positionals: [p("wallet")], projectScoped: true, legacyPositionalProject: true, minimalArgs: ["0x1111111111111111111111111111111111111111", "--capability", "deploy"] },
@@ -245,8 +243,8 @@ export const COMMAND_MANIFEST = [
   { path: ["delegates", "revoke"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
   { path: ["delegates", "rotate"], legacyPositionalProject: false, positionals: [p("delegate_id")], projectScoped: true, minimalArgs: ["dlg_gate1"] },
 
-  // ── events / errors (flat, merged runners) ───────────────────────────────
-  { path: ["events"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },
+  // ── events / live ────────────────────────────────────────────────────────
+  { path: ["events", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["live"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--tables", "cells", "--once"], runStyle: "merged" },
   { path: ["deliveries", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["deliveries", "get"], positionals: [p("notification_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["n_1"], runStyle: "sub" },
@@ -283,12 +281,6 @@ export const COMMAND_MANIFEST = [
   { path: ["claims", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["claims", "release"], positionals: [p("claim_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["clm_1"], runStyle: "sub" },
 
-  // ── gitvault — no manifest entries ──────────────────────
-  // `cli/lib/gitvault.mjs`'s dispatcher handles every `gitvault <verb>` and
-  // answers a structural COMMAND_MOVED (or, for `push`/`reconcile`,
-  // COMMAND_REMOVED) redirect that dispatches nothing — see
-  // RESERVED_SUBCOMMANDS below, and "gitvault" in SKIPPED_FAMILIES.
-
   // ── repos (the consolidated 15-verb family) ─
   // Every verb needs a real principal keystore and, for most, an allocated
   // repo and a local git working tree, so the gate runs structural checks
@@ -301,7 +293,7 @@ export const COMMAND_MANIFEST = [
   // name, with `--repo`/`--project` addressing.
   { path: ["repos", "rename"], positionals: [p("new_name")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["my-notes"], runStyle: "sub", skipBehavioral: "claims a per-org-unique repo name against a live project" },
   { path: ["repos", "delete"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [], runStyle: "sub", skipBehavioral: "irreversibly deletes a project after reading its live non-repo-resource state and vault generation count" },
-  { path: ["repos", "snapshot"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "captures the cwd git working tree and publishes a signed head" },
+  { path: ["repos", "capture"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "captures the cwd git working tree and publishes a signed head" },
   // kygit-handoff: `handoff` captures a stash-shaped checkpoint and mints a
   // single-use bearer key through a live gateway call; `resume` claims one
   // (a real membership mutation) and writes into a fresh working tree.
@@ -322,12 +314,13 @@ export const COMMAND_MANIFEST = [
   { path: ["repos", "access", "repair"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--recipient-state-version", "0", "--recipient-revocation-version", "0"], runStyle: "sub", skipBehavioral: "owner+step-up-gated epoch rotation (D193-D203, rev 42) — samples a fresh epoch key and re-seals a live vault's recipients" },
   { path: ["repos", "access", "revoke-key"], positionals: [p("principal_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["prin_00000000000000000000000000000000"], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares a recipient's key revoked (org-scoped watermark) and drives a real epoch rotation off it" },
   { path: ["repos", "access", "declare-exposure"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares this vault's epoch secret exposed, forcing every subsequent ordinary push to refuse until a rotation lands" },
-  { path: ["repos", "access", "sync"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "gitvault-multi-writer (rev 47): on-demand writer-admission reconcile — resolves pending candidates' signing keys via the live org encryption-key directory and publishes a real add_writer_key head per candidate" },
+  { path: ["repos", "access", "sync"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "vault-multi-writer (rev 47): on-demand writer-admission reconcile — resolves pending candidates' signing keys via the live org encryption-key directory and publishes a real add_writer_key head per candidate" },
   { path: ["repos", "recover"], positionals: [p("source")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["s3://example-mirror-bucket", "--out", "__SCRATCH_DIR__/recover-out"], runStyle: "sub", skipBehavioral: "materializes a git repository from a mirror source, offline, with no server call" },
   // Principal-scoped (one bundle covers every vault you can read), so no
   // --project — deliberately unlike its eleven vault-scoped siblings.
   { path: ["repos", "recovery-bundle"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--out", "-"], runStyle: "sub", skipBehavioral: "exports the caller's live member recovery bundle (stamps recovery-posture export evidence server-side)" },
-  { path: ["errors"], positionals: [p("fingerprint_id", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "merged" },
+  { path: ["errors", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
+  { path: ["errors", "get"], positionals: [p("fingerprint_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["fp_gate1"], runStyle: "sub" },
 
   // ── jobs ─────────────────────────────────────────────────────────────────
   { path: ["jobs", "submit"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--file", "__FIXTURE_FILE__"] },
@@ -478,14 +471,14 @@ export const COMMAND_MANIFEST = [
   { path: ["service", "health"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["cache", "inspect"], positionals: [p("url")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["https://example.com/"] },
   { path: ["cache", "invalidate"], positionals: [p("url", { required: false })], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--all", "--host", "example.com"] },
-  // projectScoped: --project targets the gitvault
+  // projectScoped: --project targets the vault
   // check only (see doctor.mjs's own HELP) — every other check stays
   // wallet/machine-wide, but the gate's contract is "accepts --project
   // without rejecting it," which this satisfies.
   { path: ["doctor"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--no-scan"], runStyle: "merged" },
   { path: ["webhook-secret", "rotate"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  // `run402 logs [<function>] --request-id <id>`: the optional positional is
-  // the function name (`run402 errors` samples print it that way); it is
+  // `run402 logs [<function>] --request-id <request_id>`: the optional positional is
+  // the function name (`run402 errors list` samples print it that way); it is
   // never a project id.
   { path: ["logs"], positionals: [p("function", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--request-id", "req_gate123"], runStyle: "merged" },
 ];
@@ -502,20 +495,6 @@ export const SKIPPED_FAMILIES = {
   // Split into `deliveries` / `contacts` / `subscriptions`; every subcommand
   // answers COMMAND_REMOVED naming its successor.
   "notifications": "reserved group; split by legible-cli-surface",
-  // The gitvault dispatcher answers COMMAND_MOVED/COMMAND_REMOVED for every
-  // `gitvault <verb>` (see RESERVED_SUBCOMMANDS below for the per-verb list)
-  // — the family stays dispatched in cli.mjs (so the redirect fires instead
-  // of UNKNOWN_COMMAND) but has zero manifest entries, since a redirect
-  // dispatches nothing.
-  "gitvault": "retired; every subcommand answers COMMAND_MOVED/COMMAND_REMOVED naming its `repos`/git successor",
-  // Shipped in exactly one release (v4.54.0, live for hours) before the
-  // one-noun review caught it: a gateway route namespace is not a CLI noun.
-  // Both verbs answer COMMAND_MOVED into the repos family for one release,
-  // then the spelling is reserved and answers nothing.
-  "source-access": "retired same-day; `export` -> `repos recovery-bundle`, `status` -> `repos access` (member_custody block)",
-  // `repo` singular resolves identically to `repos` — same
-  // module, same case block in cli.mjs, so it needs no manifest of its own.
-  "repo": "alias for `repos`, resolves identically (design D1)",
 };
 
 /**
@@ -531,23 +510,5 @@ export const SKIPPED_FAMILIES = {
  * which the family list cannot express.
  */
 export const RESERVED_SUBCOMMANDS = {
-  "source-access:export": "moved to `repos recovery-bundle` — the artifact `repos recover --bundle` consumes belongs to the repos family",
-  "source-access:status": "moved to `repos access` — your own wrapper custody rides its member_custody block; the org advisory is `doctor --only recovery_posture`",
   "escalations:contacts": "merged into `contacts` — the ladder and Telegram channels are one question",
-  // Every `gitvault <verb>` spelling. Nine
-  // answer COMMAND_MOVED naming their `repos` successor; `push` and
-  // `reconcile` answer COMMAND_REMOVED (no equivalent successor for either —
-  // `push`'s one-release alias window is over, `reconcile` was a workaround
-  // with no permanent replacement, only a read at `repos access`).
-  "gitvault:init": "moved to `repos create --project <id>`",
-  "gitvault:status": "moved to `repos view`",
-  "gitvault:snapshot": "moved to `repos snapshot`",
-  "gitvault:policy": "moved to `repos policy`",
-  "gitvault:compact": "moved to `repos gc`",
-  "gitvault:prune": "moved to `repos gc`",
-  "gitvault:verify": "moved to `repos fsck`",
-  "gitvault:mirror": "moved to `repos mirror`",
-  "gitvault:recover": "moved to `repos recover`",
-  "gitvault:push": "removed — its one-release deprecation-alias window is over; `git push` / `repos snapshot`",
-  "gitvault:reconcile": "removed — a workaround with no permanent successor; read `repos access` instead",
 };

package/lib/config.mjs

@@ -101,11 +101,11 @@ export function findProject(id) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: `No local project credentials cached for ${idStr}.`,
-      hint: "Use a principal-auth command, or import project keys with `run402 credentials project-keys import --project <id> --service-key-stdin`.",
+      hint: "Use a principal-auth command, or import project keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin`.",
       details: { project_id: idStr, source: "local_cache", cache_path: projectCredentialsFile(), wallet: activeProfile(), profile: activeProfile() },
       next_actions: [{
         type: "run_command",
-        command: `run402 credentials project-keys status --project ${idStr || "<id>"}`,
+        command: `run402 credentials project-keys status --project ${idStr || "<project_id>"}`,
         why: "Inspect the local project-key cache without revealing secrets.",
       }],
     });
@@ -119,7 +119,7 @@ export function resolveProject(id) {
     fail({
       code: "PROJECT_REQUIRED",
       message: "no project specified and no active project set.",
-      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or run: run402 projects use <id>",
+      hint: "Pass --project <project_id>, set RUN402_PROJECT_ID, or run: run402 projects use <project_id>",
       next_actions: [selectProjectAction()],
     });
   }
@@ -132,7 +132,7 @@ export function resolveProjectId(id) {
     fail({
       code: "PROJECT_REQUIRED",
       message: "no project specified and no active project set.",
-      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or run: run402 projects use <id>",
+      hint: "Pass --project <project_id>, set RUN402_PROJECT_ID, or run: run402 projects use <project_id>",
       next_actions: [selectProjectAction()],
     });
   }

package/lib/contacts.mjs

@@ -12,7 +12,7 @@
  * "how can this human be reached" — not the mechanisms, which really are
  * different and are not pretended otherwise.
  *
- * `rm <id>` takes a bare id and works out which backend owns it, because both
+ * `rm <contact_id>` takes a bare id and works out which backend owns it, because both
  * are UUIDs and a caller holding one from `contacts list` should not have to
  * know which subsystem minted it. That costs one extra read and removes a
  * `--kind` flag nobody could answer without looking it up.
@@ -44,7 +44,7 @@ Usage:
   run402 contacts list
   run402 contacts add <email> [--level <1-10>] [--name <display>]
   run402 contacts connect telegram [--label <name>]
-  run402 contacts rm <id>
+  run402 contacts rm <contact_id>
   run402 contacts preferences
   run402 contacts preferences set <key>=<value> [<key>=<value> ...]
   run402 contacts test [--source app|platform] [--type <event_type>]
@@ -339,7 +339,7 @@ async function removeContact(args) {
   assertKnownFlags(a, ["--org", "--help", "-h"], ["--org"]);
   const positionals = positionalArgs(a, ["--org"]);
   requirePositionalCount(positionals, ["--org"], {
-    min: 1, max: 1, command: "run402 contacts rm", missing: "<id>",
+    min: 1, max: 1, command: "run402 contacts rm", missing: "<contact_id>",
   });
   const id = positionals[0];
   const sdk = getSdk();

package/lib/contracts.mjs

@@ -53,7 +53,7 @@ const SUB_HELP = {
   "provision-signer": `run402 contracts provision-signer — Provision a KMS-backed signer
 
 Usage:
-  run402 contracts provision-signer --chain <chain> [--project <id>] [options]
+  run402 contracts provision-signer --chain <chain> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts provision-signer <project_id> --chain <chain> [options]
@@ -69,7 +69,7 @@ Options:
   "set-recovery": `run402 contracts set-recovery — Set or clear the signer recovery address
 
 Usage:
-  run402 contracts set-recovery <signer_id> [--project <id>] [options]
+  run402 contracts set-recovery <signer_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts set-recovery <project_id> <signer_id> [options]
@@ -77,7 +77,7 @@ Legacy (still supported):
   "set-alert": `run402 contracts set-alert — Set the low-balance alert threshold
 
 Usage:
-  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <id>]
+  run402 contracts set-alert <signer_id> --threshold-wei <n> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts set-alert <project_id> <signer_id> --threshold-wei <n>
@@ -85,7 +85,7 @@ Legacy (still supported):
   call: `run402 contracts call — Submit a contract write call
 
 Usage:
-  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <id>]
+  run402 contracts call <signer_id> --to 0x... --abi <json> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts call <project_id> <signer_id> --to 0x... --abi <json>
@@ -98,7 +98,7 @@ Returns the deterministic CREATE address synchronously — known from (signer, n
 before the tx confirms. Cost: chain gas at-cost + $0.000005 KMS sign fee.
 
 Usage:
-  run402 contracts deploy <signer_id> --bytecode 0x... [--project <id>] [options]
+  run402 contracts deploy <signer_id> --bytecode 0x... [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 contracts deploy <project_id> <signer_id> --bytecode 0x... [options]
@@ -125,7 +125,7 @@ Usage:
   drain: `run402 contracts drain — Drain native balance to a destination address
 
 Usage:
-  run402 contracts drain <signer_id> --to 0x... --confirm [--project <id>]
+  run402 contracts drain <signer_id> --to 0x... --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts drain <project_id> <signer_id> --to 0x... --confirm
@@ -133,7 +133,7 @@ Legacy (still supported):
   delete: `run402 contracts delete — Schedule the KMS key for deletion
 
 Usage:
-  run402 contracts delete <signer_id> --confirm [--project <id>]
+  run402 contracts delete <signer_id> --confirm [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts delete <project_id> <signer_id> --confirm
@@ -141,7 +141,7 @@ Legacy (still supported):
   "get-signer": `run402 contracts get-signer — Get signer metadata + live balance
 
 Usage:
-  run402 contracts get-signer <signer_id> [--project <id>]
+  run402 contracts get-signer <signer_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts get-signer <project_id> <signer_id>
@@ -156,7 +156,7 @@ Examples:
   "list-signers": `run402 contracts list-signers — List all KMS signers for a project
 
 Usage:
-  run402 contracts list-signers [--project <id>]
+  run402 contracts list-signers [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts list-signers <project_id>
@@ -173,7 +173,7 @@ Examples:
   status: `run402 contracts status — Get a contract call's status and receipt
 
 Usage:
-  run402 contracts status <call_id> [--project <id>]
+  run402 contracts status <call_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 contracts status <project_id> <call_id>
@@ -502,7 +502,7 @@ async function deleteSigner(projectId, signerId, args) {
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") { console.log(HELP); process.exit(0); }
   if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
-  // Project selection (CLI-wide convention): `--project <id>` wins, else a
+  // Project selection (CLI-wide convention): `--project <project_id>` wins, else a
   // legacy leading `prj_...` positional, else the active project. The signer /
   // call id stays positional (`cwlt_...` / `ccall_...`). Computed lazily so
   // unknown subcommands (and the anonymous `read`) never trip project

package/lib/credentials.mjs

@@ -26,18 +26,18 @@ Usage:
   run402 credentials <subcommand> [args...]
 
 Project credentials (on the gateway — named, revocable, rotatable):
-  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>] [--import]
+  issue --kind <anon|service> --name <name> [--project <project_id>] [--expires <iso8601>] [--import]
                                 Mint one. The secret is printed ONCE.
                                 --import also writes it into this machine's
                                 local key cache (the cold-restart re-key path).
-  list [--project <id>] [--include-revoked]
+  list [--project <project_id>] [--include-revoked]
                                 List credentials (metadata only, never secrets)
-  status [--project <id>]       Are you still on the retiring legacy key?
-  rotate <credential_id> [--project <id>]
+  status [--project <project_id>]       Are you still on the retiring legacy key?
+  rotate <credential_id> [--project <project_id>]
                                 Replace in one step; new secret printed ONCE
-  revoke <credential_id> [--project <id>] [--reason <text>]
+  revoke <credential_id> [--project <project_id>] [--reason <text>]
                                 Revoke immediately, freeing the name
-  token [--project <id>] [--kind <anon|service>]
+  token [--project <project_id>] [--kind <anon|service>]
                                 Mint a SHORT-LIVED token. Works with only a
                                 delegate — the unattended recovery path.
 
@@ -68,12 +68,12 @@ Usage:
 
 Subcommands:
   list                                List cached project-key entries, redacted
-  status --project <id>               Show one cached entry, redacted
-  import --project <id> --service-key-stdin
-  import --project <id> --service-key-env <env>
-  import --project <id> --anon-key-env <env>   Rotate only the anon key
-  export --project <id> --reveal       Print cached keys, including secrets
-  remove --project <id>                Remove one cached key entry
+  status --project <project_id>               Show one cached entry, redacted
+  import --project <project_id> --service-key-stdin
+  import --project <project_id> --service-key-env <env>
+  import --project <project_id> --anon-key-env <env>   Rotate only the anon key
+  export --project <project_id> --reveal       Print cached keys, including secrets
+  remove --project <project_id>                Remove one cached key entry
 
 Notes:
   - This is a LOCAL CACHE surface. It is not project inventory.
@@ -89,7 +89,7 @@ const SUB_HELP = {
   issue: `run402 credentials issue — mint a named project credential
 
 Usage:
-  run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]
+  run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]
                            [--expires <iso8601>]
 
 --kind    "anon" is the tenant-facing key; "service" is the privileged one.
@@ -112,14 +112,14 @@ can NEVER do this; use 'run402 credentials token' instead.
   list: `run402 credentials list — list a project's credentials
 
 Usage:
-  run402 credentials list [--project <id>] [--include-revoked]
+  run402 credentials list [--project <project_id>] [--include-revoked]
 
 Metadata only — never a secret or a secret hash. Only project.read is needed.
 `,
   status: `run402 credentials status — are you still on the retiring legacy key?
 
 Usage:
-  run402 credentials status [--project <id>]
+  run402 credentials status [--project <project_id>]
 
 Returns state "legacy" while the project still depends on the derived
 anon/service keys, or "rotatable" once it holds credentials it can revoke
@@ -133,7 +133,7 @@ date the platform has not committed to.
   rotate: `run402 credentials rotate — replace a credential in one step
 
 Usage:
-  run402 credentials rotate <credential_id> [--project <id>]
+  run402 credentials rotate <credential_id> [--project <project_id>]
 
 Mints a replacement and revokes the old one in a single transaction, keeping
 the name. The NEW secret is printed once.
@@ -146,7 +146,7 @@ compromised.
   revoke: `run402 credentials revoke — revoke a credential immediately
 
 Usage:
-  run402 credentials revoke <credential_id> [--project <id>] [--reason <text>]
+  run402 credentials revoke <credential_id> [--project <project_id>] [--reason <text>]
 
 Takes effect for every subsequent request and frees the name for reuse.
 Requires owner membership plus step-up.
@@ -154,7 +154,7 @@ Requires owner membership plus step-up.
   token: `run402 credentials token — mint a short-lived project token
 
 Usage:
-  run402 credentials token [--project <id>] [--kind <anon|service>]
+  run402 credentials token [--project <project_id>] [--kind <anon|service>]
 
 The cold-restart recovery path, and the ONE credential call an agent can make
 with no human present: a delegate is accepted here. There is no step-up because
@@ -214,7 +214,7 @@ function requireProjectFlag(projectId, usage) {
   if (!projectId) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --project <id>.",
+      message: "Missing --project <project_id>.",
       hint: usage,
     });
   }
@@ -227,7 +227,7 @@ function requireCachedProject(projectId) {
     fail({
       code: "PROJECT_CREDENTIAL_NOT_FOUND",
       message: `No local project credentials cached for ${projectId}.`,
-      hint: "Import keys with `run402 credentials project-keys import --project <id> --service-key-stdin` if this operation truly requires local project credentials.",
+      hint: "Import keys with `run402 credentials project-keys import --project <project_id> --service-key-stdin` if this operation truly requires local project credentials.",
       details: { project_id: projectId, ...provenance() },
       next_actions: [{
         type: "run_command",
@@ -256,7 +256,7 @@ async function status(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys status: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys status --project <project_id>");
   console.log(JSON.stringify(redactedEntry(id, getProject(id)), null, 2));
 }
 
@@ -311,7 +311,7 @@ async function importKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys import: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <id> --service-key-stdin");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys import --project <project_id> --service-key-stdin");
   // Resolve --anon-key-env before requiring a service key, so a missing service
   // key can report against the flags actually passed and an anon-only rotation
   // can reuse the cached service key.
@@ -346,12 +346,12 @@ async function exportKey(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys export: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <id> --reveal");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys export --project <project_id> --reveal");
   if (!parsed.includes("--reveal")) {
     fail({
       code: "REVEAL_REQUIRED",
       message: "Exporting full project keys requires --reveal.",
-      hint: "Use `run402 credentials project-keys status --project <id>` for redacted output.",
+      hint: "Use `run402 credentials project-keys status --project <project_id>` for redacted output.",
       details: { project_id: id, ...provenance() },
     });
   }
@@ -364,7 +364,7 @@ async function remove(args) {
   if (rest.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for project-keys remove: ${rest[0]}` });
   }
-  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <id>");
+  const id = requireProjectFlag(projectId, "run402 credentials project-keys remove --project <project_id>");
   const existed = Boolean(getProject(id));
   removeProject(id, projectCredentialsFile());
   console.log(JSON.stringify({ project_id: id, removed: existed, ...provenance() }, null, 2));
@@ -423,7 +423,7 @@ async function issue(args) {
   requirePositionalCount(rest, ISSUE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]",
+    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <project_id>] [--import]",
     missing: "",
   });
   if (kind !== "anon" && kind !== "service") {
@@ -454,7 +454,7 @@ async function issue(args) {
   try {
     const res = await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined });
     if (importToCache && res?.secret) {
-      // The cold-restart re-key path (gitvault-deploy-lane 6.5a): the minted
+      // The cold-restart re-key path (vault-deploy-lane 6.5a): the minted
       // secret goes straight into the local cache the deploy and data-plane
       // commands read, so a fresh machine re-keys in one command per kind
       // instead of the four-command issue-then-project-keys-import dance.
@@ -485,7 +485,7 @@ async function listCredentials(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials list [--project <id>]",
+    command: "run402 credentials list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -503,7 +503,7 @@ async function credentialStatus(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 credentials status [--project <id>]",
+    command: "run402 credentials status [--project <project_id>]",
     missing: "",
   });
   try {
@@ -527,7 +527,7 @@ async function rotate(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project"], {
     min: 1,
     max: 1,
-    command: "run402 credentials rotate <credential_id> [--project <id>]",
+    command: "run402 credentials rotate <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -545,7 +545,7 @@ async function revoke(args) {
   const [credentialId] = requirePositionalCount(rest, ["--project", "--reason"], {
     min: 1,
     max: 1,
-    command: "run402 credentials revoke <credential_id> [--project <id>]",
+    command: "run402 credentials revoke <credential_id> [--project <project_id>]",
     missing: "Missing <credential_id>. Find it with: run402 credentials list",
   });
   try {
@@ -564,7 +564,7 @@ async function token(args) {
   requirePositionalCount(rest, ["--project", "--kind"], {
     min: 0,
     max: 0,
-    command: "run402 credentials token [--project <id>]",
+    command: "run402 credentials token [--project <project_id>]",
     missing: "",
   });
   if (kind && kind !== "anon" && kind !== "service") {

package/lib/daemon-path.mjs

@@ -1,11 +1,11 @@
 /**
- * Daemon identity + transport addressing (gitvault-persistent-helper D4/D5)
+ * Daemon identity + transport addressing (vault-persistent-helper D4/D5)
  * — the ONE module the thin client's fast path may import beside node
  * builtins (pinned by the import-graph gate test), so it must stay tiny.
  *
  * The socket lives INSIDE the client configuration directory — the same
  * 0700 trust boundary that already holds the wallet private key and the
- * gitvault keystore — and its path is keyed by CLI version, so a CLI
+ * vault keystore — and its path is keyed by CLI version, so a CLI
  * upgrade resolves a NEW path: the new client never reaches the old daemon,
  * which idles out on its own. Windows uses a named pipe whose name carries
  * a hash of the config dir (pipes have no filesystem home) plus the same
@@ -79,7 +79,7 @@ export function daemonSocketPath() {
 }
 
 export function daemonRunnerPath() {
-  return join(dirname(fileURLToPath(import.meta.url)), "gitvault-daemon-run.mjs");
+  return join(dirname(fileURLToPath(import.meta.url)), "vault-daemon-run.mjs");
 }
 
 /**