run402 4.94.0 → 4.96.0

package/gitvault-surface.json

@@ -1,89 +0,0 @@
-{
-  "surface_version": "4.94.0",
-  "verbs": [
-    "repos create",
-    "repos list",
-    "repos view",
-    "repos rename",
-    "repos delete",
-    "repos snapshot",
-    "repos handoff",
-    "repos resume",
-    "repos invite",
-    "repos join",
-    "repos policy",
-    "repos mirror",
-    "repos fsck",
-    "repos gc",
-    "repos access",
-    "repos access repair",
-    "repos access revoke-key",
-    "repos access declare-exposure",
-    "repos access sync",
-    "repos recover",
-    "repos recovery-bundle"
-  ],
-  "retired_spellings": [
-    {
-      "spelling": "gitvault init",
-      "successor": "moved to `repos create --project <id>`"
-    },
-    {
-      "spelling": "gitvault status",
-      "successor": "moved to `repos view`"
-    },
-    {
-      "spelling": "gitvault snapshot",
-      "successor": "moved to `repos snapshot`"
-    },
-    {
-      "spelling": "gitvault policy",
-      "successor": "moved to `repos policy`"
-    },
-    {
-      "spelling": "gitvault compact",
-      "successor": "moved to `repos gc`"
-    },
-    {
-      "spelling": "gitvault prune",
-      "successor": "moved to `repos gc`"
-    },
-    {
-      "spelling": "gitvault verify",
-      "successor": "moved to `repos fsck`"
-    },
-    {
-      "spelling": "gitvault mirror",
-      "successor": "moved to `repos mirror`"
-    },
-    {
-      "spelling": "gitvault recover",
-      "successor": "moved to `repos recover`"
-    },
-    {
-      "spelling": "gitvault push",
-      "successor": "removed — its one-release deprecation-alias window is over; `git push` / `repos snapshot`"
-    },
-    {
-      "spelling": "gitvault reconcile",
-      "successor": "removed — a workaround with no permanent successor; read `repos access` instead"
-    }
-  ],
-  "capabilities": {
-    "revocation_live": true,
-    "human_envelope_add_live": true,
-    "mirror_live": true,
-    "byo_live": true,
-    "recover_live": true,
-    "allocation": "create_immediate",
-    "snapshot_dirty_default": "refuse",
-    "handoff_live": true,
-    "handoff_dirty_default": "capture",
-    "invite_live": true,
-    "join_live": true,
-    "remote_schemes": [
-      "run402",
-      "kygit"
-    ]
-  }
-}

package/lib/cloud.mjs

@@ -1,256 +0,0 @@
-import { mkdirSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-
-import { getSdk } from "./sdk.mjs";
-import { fail, reportSdkError } from "./sdk-errors.mjs";
-import { assertAllowedValue, assertKnownFlags, flagValue, hasHelp, normalizeArgv, parseIntegerFlag, positionalArgs, resolveProjectSelector, failUnknownSubcommand } from "./argparse.mjs";
-
-const HELP = `run402 cloud — Run402 Cloud portability commands
-
-Usage:
-  run402 cloud archives create [--project <id>] [options]
-  run402 cloud archives download <archive-id> --output <file> [--project <id>] [--json]
-  run402 cloud archives status <archive-id> [--project <id>] [--json]
-
-Legacy (still supported): a leading prj_... positional selects the project,
-e.g. run402 cloud archives download <project-id> <archive-id> --output <file>.
---project defaults to the active project.
-
-Canonical agent path:
-  run402 cloud archives create prj_... \\
-    --scope portable-runtime-v1 --auth stubs --consistency pause-writes \\
-    --wait --output ./project.r402ar --json
-
-Options for create:
-  --scope <scope>          Archive scope. v1 supports portable-runtime-v1.
-  --auth <mode>            Auth export mode: stubs (default) or none.
-  --consistency <mode>     pause-writes (default) or cloud_write_pause_v1.
-  --idempotency-key <key>  Retry-safe creation key.
-  --wait                   Poll until the archive is ready.
-  --output <file>          Save archive bytes. Implies --wait.
-  --poll-interval <ms>     Poll interval while waiting (default 1000).
-  --timeout <ms>           Wait timeout (default 600000).
-  --json                   Emit final JSON on stdout.
-  --json-stream            Emit NDJSON progress events on stdout.
-`;
-
-const FLAG_VALUES = [
-  "--project",
-  "--scope",
-  "--auth",
-  "--consistency",
-  "--idempotency-key",
-  "--output",
-  "--poll-interval",
-  "--timeout",
-];
-const FLAGS = new Set([
-  ...FLAG_VALUES,
-  "--wait",
-  "--json",
-  "--json-stream",
-  "--help",
-  "-h",
-]);
-
-export async function run(sub, args = []) {
-  const all = [sub, ...args].filter(Boolean);
-  if (hasHelp(all)) {
-    console.log(HELP);
-    return;
-  }
-  if (sub !== "archives") {
-    failUnknownSubcommand("cloud", sub, {
-      next_actions: [{ type: "run_command", command: "run402 cloud archives --help" }],
-    });
-  }
-  const action = args[0];
-  const rest = args.slice(1);
-  if (action === "create") return create(rest);
-  if (action === "download") return download(rest);
-  if (action === "status") return status(rest);
-  failUnknownSubcommand("cloud archives", action, {
-    next_actions: [{ type: "run_command", command: "run402 cloud archives --help" }],
-  });
-}
-
-async function create(rawArgs) {
-  const args = normalizeArgv(rawArgs);
-  assertKnownFlags(args, [...FLAGS], FLAG_VALUES);
-  const { projectId, rest } = resolveProjectSelector(args, { valueFlags: FLAG_VALUES });
-  const extraPos = positionalArgs(rest, FLAG_VALUES);
-  if (extraPos.length > 0) {
-    fail({ code: "BAD_USAGE", message: `Unexpected argument for cloud archives create: ${extraPos[0]}` });
-  }
-  const scope = flagValue(args, "--scope") ?? "portable-runtime-v1";
-  const auth = flagValue(args, "--auth") ?? "stubs";
-  const consistency = flagValue(args, "--consistency") ?? "pause-writes";
-  assertAllowedValue(scope, ["portable-runtime-v1"], "--scope");
-  assertAllowedValue(auth, ["stubs", "none"], "--auth");
-  assertAllowedValue(consistency, ["pause-writes", "cloud_write_pause_v1"], "--consistency");
-
-  const output = flagValue(args, "--output");
-  const wait = args.includes("--wait") || Boolean(output);
-  const jsonStream = args.includes("--json-stream");
-  const idempotencyKey = flagValue(args, "--idempotency-key") ?? undefined;
-  const pollIntervalMs = parseIntegerFlag("--poll-interval", flagValue(args, "--poll-interval"), { min: 100, def: 1000 });
-  const timeoutMs = parseIntegerFlag("--timeout", flagValue(args, "--timeout"), { min: 1000, def: 600000 });
-  const emit = (event) => {
-    if (jsonStream) console.log(JSON.stringify(event));
-  };
-
-  try {
-    const sdk = getSdk();
-    const created = await sdk.archives.create(projectId, {
-      scope,
-      auth,
-      consistency,
-      idempotencyKey,
-    });
-    emit(progressEvent("archive_export_created", "create", projectId, created));
-
-    let archive = created;
-    let outputPath = null;
-    let bytesWritten = 0;
-    if (wait) {
-      archive = created.status === "ready"
-        ? created
-        : await sdk.archives.wait(projectId, created.archive_id, {
-            pollIntervalMs,
-            timeoutMs,
-            onProgress: emit,
-          });
-      if (archive.status !== "ready") {
-        const result = finalCreateResult({ projectId, created, archive, outputPath, bytesWritten });
-        printJson(result, jsonStream);
-        process.exit(1);
-      }
-      if (output) {
-        const download = await sdk.archives.download(projectId, archive.archive_id);
-        outputPath = resolve(output);
-        mkdirSync(dirname(outputPath), { recursive: true });
-        writeFileSync(outputPath, download.bytes);
-        bytesWritten = download.bytes.byteLength;
-        emit({
-          ...progressEvent("archive_export_downloaded", "download", projectId, archive),
-          context: { output_path: outputPath, bytes_written: bytesWritten },
-        });
-      }
-    }
-
-    const result = finalCreateResult({ projectId, created, archive, outputPath, bytesWritten });
-    if (jsonStream) {
-      console.log(JSON.stringify({
-        event: "archive_export_complete",
-        stage: "complete",
-        resource_type: "project_archive",
-        resource_id: archive.archive_id,
-        project_id: projectId,
-        status: archive.status === "ready" ? "complete" : archive.status,
-        completed_units: archive.status === "ready" ? 1 : 0,
-        total_units: 1,
-        code: null,
-        message: archive.status === "ready" ? "Archive export complete." : "Archive export did not complete.",
-        next_action: archive.next_action,
-        retryable: false,
-        result,
-      }));
-    } else {
-      console.log(JSON.stringify(result, null, 2));
-    }
-    if (archive.status !== "ready") process.exit(1);
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-async function download(rawArgs) {
-  const args = normalizeArgv(rawArgs);
-  assertKnownFlags(args, ["--project", "--output", "--json", "--help", "-h"], ["--project", "--output"]);
-  const { projectId, rest } = resolveProjectSelector(args, { valueFlags: ["--project", "--output"] });
-  const pos = positionalArgs(rest, ["--project", "--output"]);
-  const [archiveId] = pos;
-  const output = flagValue(args, "--output");
-  if (!archiveId || pos.length > 1 || !output) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 cloud archives download <archive-id> --output <file> [--project <id>] [--json]" });
-  }
-  try {
-    const download = await getSdk().archives.download(projectId, archiveId);
-    const outputPath = resolve(output);
-    mkdirSync(dirname(outputPath), { recursive: true });
-    writeFileSync(outputPath, download.bytes);
-    console.log(JSON.stringify({
-      ok: true,
-      project_id: projectId,
-      archive_id: archiveId,
-      output_path: outputPath,
-      bytes_written: download.bytes.byteLength,
-      sha256: download.archive.sha256,
-      verify_command: `run402 archives verify ${JSON.stringify(outputPath)} --json`,
-      import_command: `run402 core projects import ${JSON.stringify(outputPath)} --name imported-project --env-file ./required.env --json`,
-      archive: download.archive,
-    }, null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-async function status(rawArgs) {
-  const args = normalizeArgv(rawArgs);
-  assertKnownFlags(args, ["--project", "--json", "--help", "-h"], ["--project"]);
-  const { projectId, rest } = resolveProjectSelector(args, { valueFlags: ["--project"] });
-  const pos = positionalArgs(rest, ["--project"]);
-  const [archiveId] = pos;
-  if (!archiveId || pos.length > 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 cloud archives status <archive-id> [--project <id>] [--json]" });
-  }
-  try {
-    const archive = await getSdk().archives.get(projectId, archiveId);
-    console.log(JSON.stringify({ archive }, null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-function finalCreateResult({ projectId, created, archive, outputPath, bytesWritten }) {
-  return {
-    ok: archive.status === "ready",
-    project_id: projectId,
-    archive_id: archive.archive_id,
-    operation_id: archive.operation_id,
-    created_archive_id: created.archive_id,
-    archive_status: archive.status,
-    output_path: outputPath,
-    bytes_written: bytesWritten,
-    sha256: archive.sha256,
-    byte_count: archive.byte_count,
-    expires_at: archive.expires_at,
-    verify_command: outputPath ? `run402 archives verify ${JSON.stringify(outputPath)} --json` : null,
-    import_command: outputPath ? `run402 core projects import ${JSON.stringify(outputPath)} --name imported-project --env-file ./required.env --json` : null,
-    next_action: archive.next_action,
-    portability_report: archive.portability_report,
-    export_report: archive.export_report,
-    archive,
-  };
-}
-
-function progressEvent(event, stage, projectId, archive) {
-  return {
-    event,
-    stage,
-    resource_type: "project_archive",
-    resource_id: archive.archive_id,
-    project_id: projectId,
-    status: archive.status,
-    completed_units: archive.status === "ready" || archive.status === "failed" || archive.status === "expired" ? 1 : 0,
-    total_units: 1,
-    code: archive.status === "failed" ? archive.error?.code ?? "ARCHIVE_EXPORT_FAILED" : null,
-    message: `Archive export status: ${archive.status}`,
-    next_action: archive.next_action,
-    retryable: archive.status === "running",
-  };
-}
-
-function printJson(result, alreadyStreamed) {
-  if (!alreadyStreamed) console.log(JSON.stringify(result, null, 2));
-}

package/lib/core.mjs

@@ -1,123 +0,0 @@
-import { importArchiveToCore } from "#sdk/node";
-import { fail, reportSdkError } from "./sdk-errors.mjs";
-import { assertKnownFlags, flagValue, hasHelp, normalizeArgv, positionalArgs, failUnknownSubcommand } from "./argparse.mjs";
-
-const HELP = `run402 core — Local Run402 Core commands
-
-Usage:
-  run402 core projects import <archive-path> --name <project-name> [options]
-  run402 core projects apply  <archive-path> --name <project-name> [options]
-
-Options:
-  --name <name>             New Core project name (default imported-project)
-  --env-file <path>         Env file satisfying required archive secrets.
-  --secret KEY=VALUE        Inline secret value; repeatable. Overrides --env-file.
-  --core-url <url>          Core gateway URL (default RUN402_CORE_URL or http://127.0.0.1:4020)
-  --dry-run                 Verify and plan without creating a Core project.
-  --require-runnable        Block import unless required secrets are supplied.
-  --json                    Emit final JSON.
-  --json-stream             Emit NDJSON progress events and final result event.
-`;
-
-const FLAG_VALUES = ["--name", "--env-file", "--secret", "--core-url"];
-const FLAGS = new Set([...FLAG_VALUES, "--dry-run", "--require-runnable", "--json", "--json-stream", "--help", "-h"]);
-
-export async function run(sub, args = []) {
-  const all = [sub, ...args].filter(Boolean);
-  if (hasHelp(all)) {
-    console.log(HELP);
-    return;
-  }
-  if (sub !== "projects") {
-    failUnknownSubcommand("core", sub);
-  }
-  const action = args[0];
-  if (action === "import" || action === "apply") return importProject(args.slice(1));
-  failUnknownSubcommand("core projects", action, { extraSubcommands: ["apply"] });
-}
-
-async function importProject(rawArgs) {
-  const args = normalizeArgv(rawArgs);
-  assertKnownFlags(args, [...FLAGS], FLAG_VALUES);
-  const archivePath = positionalArgs(args, FLAG_VALUES)[0];
-  if (!archivePath) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 core projects import <archive-path> --name <project-name> [options]" });
-  }
-  const jsonStream = args.includes("--json-stream");
-  const secretValues = parseSecrets(args);
-  const name = flagValue(args, "--name") ?? "imported-project";
-  const coreUrl = flagValue(args, "--core-url") ?? undefined;
-  const startedEvent = {
-    event: "core_archive_import_started",
-    stage: "verify",
-    resource_type: "project_archive",
-    resource_id: archivePath,
-    status: "running",
-    completed_units: 0,
-    total_units: 1,
-    code: null,
-    message: "Verifying archive locally before Core import.",
-    next_action: { type: "none" },
-    retryable: false,
-    context: { archive_path: archivePath, core_url: coreUrl ?? null, project_name: name },
-  };
-  if (jsonStream) console.log(JSON.stringify(startedEvent));
-  try {
-    const result = await importArchiveToCore({
-      archivePath,
-      name,
-      coreUrl,
-      envFile: flagValue(args, "--env-file") ?? undefined,
-      secretValues,
-      dryRun: args.includes("--dry-run"),
-      requireRunnable: args.includes("--require-runnable"),
-    });
-    if (jsonStream) {
-      console.log(JSON.stringify({
-        event: "core_archive_import_complete",
-        stage: "complete",
-        resource_type: "project_archive",
-        resource_id: archivePath,
-        status: result.status,
-        completed_units: result.status === "imported" || result.status === "dry_run" ? 1 : 0,
-        total_units: 1,
-        code: firstDiagnosticCode(result),
-        message: `Core archive import status: ${result.status}`,
-        next_action: result.next_action,
-        retryable: result.status === "failed" && result.diagnostics.some((d) => d.retryable),
-        result,
-      }));
-    } else {
-      console.log(JSON.stringify({ ok: result.status === "imported" || result.status === "dry_run", import: result }, null, 2));
-    }
-    if (result.status !== "imported" && result.status !== "dry_run") process.exit(1);
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
-function parseSecrets(args) {
-  const out = {};
-  for (let i = 0; i < args.length; i += 1) {
-    if (args[i] !== "--secret") continue;
-    const value = args[i + 1];
-    if (!value || value.startsWith("--")) {
-      fail({ code: "BAD_FLAG", message: "--secret requires KEY=VALUE" });
-    }
-    const eq = value.indexOf("=");
-    if (eq <= 0) {
-      fail({ code: "BAD_FLAG", message: "--secret requires KEY=VALUE", details: { value } });
-    }
-    const key = value.slice(0, eq);
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      fail({ code: "BAD_FLAG", message: `Invalid secret env var name: ${key}` });
-    }
-    out[key] = value.slice(eq + 1);
-    i += 1;
-  }
-  return out;
-}
-
-function firstDiagnosticCode(result) {
-  return result.diagnostics.find((d) => d.severity === "blocking")?.code ?? null;
-}

package/lib/gitvault.mjs

@@ -1,163 +0,0 @@
-/**
- * `run402 gitvault` — retired from the CLI; every spelling answers a
- * structured error naming its `repos`/git successor.
- *
- * Every spelling answers a proper stderr JSON error envelope: typed
- * `next_actions`, non-zero exit, EMPTY stdout — never silence, never new
- * behavior. Renamed verbs answer `COMMAND_MOVED` naming their `repos`
- * successor; verbs with no behavioral successor answer `COMMAND_REMOVED`
- * (never a `COMMAND_MOVED` that would lie about equivalence). The freed
- * spellings are never re-pointed at different behavior.
- *
- * `gitvault` itself survives only as protocol/infrastructure language: the
- * SDK keeps `r.gitvault.*` ("gitvault is what the thing IS; repos is what
- * the user HAS"). This module's one surviving export,
- * `printKeystoreLocation`, is a shared print helper `cli/lib/repos.mjs`
- * still composes — moving it there instead would make repos.mjs restate
- * logic this file already owns for zero benefit.
- */
-import { fail } from "./sdk-errors.mjs";
-import { hasHelp } from "./argparse.mjs";
-
-export const HELP = `run402 gitvault — RETIRED (repo-surface-consolidation)
-
-Usage:
-  run402 gitvault <anything> — answers a structured error naming its repos/git successor; see below.
-
-Every "run402 gitvault <verb>" spelling has moved to "run402 repos <verb>",
-except "reconcile" and "push", which are REMOVED outright (see below). Each
-one answers a structured COMMAND_MOVED/COMMAND_REMOVED error for exactly one
-release; after that the spelling is reserved and answers nothing at all.
-
-Moved:
-  gitvault init       -> repos create --project <id>   (or repos create <name> for a NEW project)
-  gitvault status     -> repos view
-  gitvault snapshot   -> repos snapshot
-  gitvault policy     -> repos policy
-  gitvault compact    -> repos gc
-  gitvault prune      -> repos gc
-  gitvault verify     -> repos fsck
-  gitvault mirror     -> repos mirror
-  gitvault recover    -> repos recover
-
-Removed, no successor:
-  gitvault push       -> git push (its one-release alias window is over); repos snapshot is the capture lane
-  gitvault reconcile  -> repos access (read-only inspection; the workaround it approximated is gone, not renamed)
-
-Run \`run402 repos --help\` for the current surface.
-`;
-
-/** Renamed verbs: `gitvault <key>` -> the exact `repos` command that means the same thing now. */
-const MOVED = {
-  init: { command: "run402 repos create --project <id>", why: "repos create absorbs allocation — pass --project to adopt an existing project, or a name to provision a new one." },
-  status: { command: "run402 repos view", why: "repos view is the side-effect-free repo inspection command; it never materializes refs the way status --refs used to." },
-  snapshot: { command: "run402 repos snapshot", why: "same verb, new noun." },
-  policy: { command: "run402 repos policy", why: "same verb, new noun." },
-  compact: { command: "run402 repos gc", why: "gc is git gc's own two halves — checkpoint publication and prune planning — in one verb." },
-  prune: { command: "run402 repos gc", why: "gc is git gc's own two halves — checkpoint publication and prune planning — in one verb." },
-  verify: { command: "run402 repos fsck", why: "fsck is git fsck's own job: walk the object graph and fail closed on corruption." },
-  mirror: { command: "run402 repos mirror", why: "one flag-driven verb replaces the five mirror subcommands (set/remove/status/sync/verify)." },
-  recover: { command: "run402 repos recover", why: "same verb, new noun." },
-};
-
-/** Verbs with NO behavioral successor — a lying COMMAND_MOVED would be worse than an honest COMMAND_REMOVED. */
-const REMOVED = {
-  push: {
-    message: "`run402 gitvault push` was a deprecation-warning alias for exactly one release, and that release is over.",
-    hint: "`push` now means exactly one thing everywhere: `git push`. The capture lane is `run402 repos snapshot`.",
-    next_actions: [
-      { type: "use_moved_command", command: "git push", why: "Publish your branches and tags the ordinary way." },
-      { type: "use_moved_command", command: "run402 repos snapshot", why: "The capture lane: publish the protocol-owned deploy ref outside a deploy." },
-    ],
-  },
-  reconcile: {
-    message: "`run402 gitvault reconcile` is removed. It was a workaround — its own help text said so — a newly-wrapped member got the vault's entire history under a single fixed epoch, not real epoch rotation, and a temporary mechanism does not get a permanent verb.",
-    hint: "`run402 repos access` reports what the read surface has today (recipients, coverage, this machine's local TOFU pins). `repos access repair` will replace the mutating half once real epoch rotation ships — it does not exist yet either.",
-    next_actions: [{ type: "use_moved_command", command: "run402 repos access", why: "Inspect recipients and coverage — there is no equivalent mutating successor yet." }],
-  },
-};
-
-function movedResponse(sub) {
-  const m = MOVED[sub];
-  fail({
-    code: "COMMAND_MOVED",
-    message: `run402 gitvault ${sub} moved to ${m.command}.`,
-    hint: m.why,
-    details: { was: `gitvault ${sub}`, now: m.command },
-    next_actions: [{ type: "use_moved_command", command: m.command, why: m.why }],
-  });
-}
-
-function removedResponse(sub) {
-  const r = REMOVED[sub];
-  fail({
-    code: "COMMAND_REMOVED",
-    message: r.message,
-    hint: r.hint,
-    details: { was: `gitvault ${sub}` },
-    next_actions: r.next_actions,
-  });
-}
-
-/**
- * Where the keystore lives — for verbs whose payload is not a `view`.
- * Exported: `repos create` and `repos snapshot` print the same line after
- * allocating/publishing, and must not restate this logic.
- */
-export async function printKeystoreLocation() {
-  try {
-    const { getGitvaultKeystoreRoot } = await import("#sdk/node");
-    console.error(`keystore: ${getGitvaultKeystoreRoot()} — back this up; whole-keystore loss is terminal for repo history`);
-  } catch {
-    // Never let a diagnostic line fail a command that already succeeded.
-  }
-}
-
-export async function run(sub, args) {
-  const argv = Array.isArray(args) ? args : [];
-  if (!sub || hasHelp([sub, ...argv])) {
-    console.log(HELP);
-    process.exit(0);
-  }
-  switch (sub) {
-    case "init":
-      movedResponse("init");
-      break;
-    case "status":
-      movedResponse("status");
-      break;
-    case "snapshot":
-      movedResponse("snapshot");
-      break;
-    case "policy":
-      movedResponse("policy");
-      break;
-    case "compact":
-      movedResponse("compact");
-      break;
-    case "prune":
-      movedResponse("prune");
-      break;
-    case "verify":
-      movedResponse("verify");
-      break;
-    case "mirror":
-      movedResponse("mirror");
-      break;
-    case "recover":
-      movedResponse("recover");
-      break;
-    case "push":
-      removedResponse("push");
-      break;
-    case "reconcile":
-      removedResponse("reconcile");
-      break;
-    default:
-      fail({
-        code: "UNKNOWN_SUBCOMMAND",
-        message: `run402 gitvault ${sub}: unknown, and gitvault itself is retired.`,
-        hint: "Run `run402 repos --help` for the current surface.",
-      });
-  }
-}