run402 4.94.0 → 4.96.0

package/lib/functions.mjs

@@ -31,7 +31,7 @@ export function parseLogSinceFlag(since) {
   return new Date(ms).toISOString();
 }
 
-/** `--request-id <id>` must be a req_ / fnrun_ / fnatt_ correlation id. */
+/** `--request-id <request_id>` must be a req_ / fnrun_ / fnatt_ correlation id. */
 export function assertLogRequestIdFlag(requestId) {
   if (requestId !== undefined && !FUNCTION_LOG_REQUEST_ID_RE.test(requestId)) {
     fail({
@@ -77,29 +77,29 @@ Usage:
   run402 functions <subcommand> [args...]
 
 Subcommands:
-  deploy <name> --file <file> [--project <id>] [--timeout <s>] [--memory <mb>] [--deps <pkg,...>] [--schedule <cron>]
+  deploy <name> --file <file> [--project <project_id>] [--timeout <s>] [--memory <mb>] [--deps <pkg,...>] [--schedule <cron>]
                                        Deploy a function to a project
-  invoke <name> [--project <id>] [--method <M>] [--body <json> | --body-file <path>] [--idempotency-key <key>] [--wait] [--timeout-ms <ms>] [--poll-interval-ms <ms>] [--raw]
+  invoke <name> [--project <project_id>] [--method <M>] [--body <json> | --body-file <path>] [--idempotency-key <key>] [--wait] [--timeout-ms <ms>] [--poll-interval-ms <ms>] [--raw]
                                        Invoke a deployed function. Default
                                        wraps the SDK result as JSON on stdout.
                                        --raw prints the response body verbatim
                                        (string body → text + newline, JSON
                                        body → pretty-printed JSON).
-  logs   [<name>] [--project <id>] [--tail <n>] [--since <ts>] [--request-id <id>] [--app|--platform|--all] [--follow]
+  logs   [<name>] [--project <project_id>] [--tail <n>] [--since <ts>] [--request-id <request_id>] [--app|--platform|--all] [--follow]
                                        Get function logs (app output by default;
                                        omit <name> with --request-id to search
                                        every function)
   runs   <action> ...                  Create, inspect, cancel, redrive, and
                                        wait for durable function runs
-  update <name> [--project <id>] [--schedule <cron>] [--schedule-remove] [--timeout <s>] [--memory <mb>]
+  update <name> [--project <project_id>] [--schedule <cron>] [--schedule-remove] [--timeout <s>] [--memory <mb>]
                                        Update function schedule or config without re-deploying
-  rebuild [<name>] [--all] [--project <id>]
+  rebuild [<name>] [--all] [--project <project_id>]
                                        Refresh function(s) onto the current platform
                                        runtime (re-bundles from stored source; no
                                        source change). Pass <name> for one function
                                        or --all for every function in the project.
-  list   [--project <id>]              List all functions for a project
-  delete <name> [--project <id>]       Delete a function
+  list   [--project <project_id>]              List all functions for a project
+  delete <name> [--project <project_id>]       Delete a function
 
 Legacy (still supported): a leading prj_... positional selects the project,
 e.g. run402 functions deploy prj_abc123 stripe-webhook --file handler.ts
@@ -138,7 +138,7 @@ const SUB_HELP = {
   deploy: `run402 functions deploy — Deploy a function to a project
 
 Usage:
-  run402 functions deploy <name> --file <file> [--project <id>] [options]
+  run402 functions deploy <name> --file <file> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 functions deploy <project_id> <name> --file <file> [options]
@@ -147,7 +147,7 @@ Arguments:
   <name>              Function name (used in the invoke URL path)
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
   --file <file>       Required: path to the function source file
   --timeout <s>       Runtime timeout in seconds
   --memory <mb>       Memory in MB
@@ -183,7 +183,7 @@ Examples:
   invoke: `run402 functions invoke — Invoke a deployed function
 
 Usage:
-  run402 functions invoke <name> [--project <id>] [options]
+  run402 functions invoke <name> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 functions invoke <project_id> <name> [options]
@@ -192,7 +192,7 @@ Arguments:
   <name>              Function name
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
   --method <M>        HTTP method (default POST)
   --body <json>       Inline JSON request body (ignored for GET/HEAD). The CLI
                       validates it before sending; shell-corrupted JSON fails.
@@ -232,8 +232,8 @@ Examples:
   logs: `run402 functions logs — Fetch or tail function logs
 
 Usage:
-  run402 functions logs <name> [--project <id>] [options]
-  run402 functions logs --request-id <id> [--project <id>] [options]
+  run402 functions logs <name> [--project <project_id>] [options]
+  run402 functions logs --request-id <request_id> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 functions logs <project_id> <name> [options]
@@ -244,11 +244,11 @@ Arguments:
                       and each entry carries its "function".
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
   --tail <n>          Number of most-recent entries (default 50, max 1000).
                       Bounds the read BEFORE the origin filter below.
   --since <ts>        ISO timestamp or epoch ms; only entries after this
-  --request-id <id>   Only entries correlated to this req_ (the
+  --request-id <request_id>   Only entries correlated to this req_ (the
                       x-run402-request-id response header), fnrun_, or fnatt_ id
   --app               Only the function's own output (default). Lambda runtime
                       lines (INIT_START, START/END/REPORT RequestId, billed
@@ -274,12 +274,12 @@ Examples:
   runs: `run402 functions runs — Manage durable function runs
 
 Usage:
-  run402 functions runs create <function_name> --event-type <type> --idempotency-key <key> [--project <id>] [options]
-  run402 functions runs list <function_name> [--project <id>] [options]
-  run402 functions runs get <run_id> [--project <id>]
-  run402 functions runs logs <run_id> [--project <id>] [--tail <n>] [--since <ts>]
-  run402 functions runs cancel <run_id> [--project <id>]
-  run402 functions runs redrive <run_id> [--project <id>] [options]
+  run402 functions runs create <function_name> --event-type <type> --idempotency-key <key> [--project <project_id>] [options]
+  run402 functions runs list <function_name> [--project <project_id>] [options]
+  run402 functions runs get <run_id> [--project <project_id>]
+  run402 functions runs logs <run_id> [--project <project_id>] [--tail <n>] [--since <ts>]
+  run402 functions runs cancel <run_id> [--project <project_id>]
+  run402 functions runs redrive <run_id> [--project <project_id>] [options]
 
 Legacy (still supported): a leading prj_... positional selects the project,
 e.g. run402 functions runs get <project_id> <run_id>
@@ -313,7 +313,7 @@ Examples:
   update: `run402 functions update — Update function config without re-deploying
 
 Usage:
-  run402 functions update <name> [--project <id>] [options]
+  run402 functions update <name> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 functions update <project_id> <name> [options]
@@ -322,7 +322,7 @@ Arguments:
   <name>              Function name
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
   --schedule <cron>   New cron schedule (pass '' to clear)
   --schedule-remove   Explicitly remove the schedule
   --timeout <s>       Runtime timeout in seconds
@@ -339,8 +339,8 @@ Examples:
   rebuild: `run402 functions rebuild — Refresh function(s) onto the current platform runtime
 
 Usage:
-  run402 functions rebuild <name> [--project <id>]
-  run402 functions rebuild --all [--project <id>]
+  run402 functions rebuild <name> [--project <project_id>]
+  run402 functions rebuild --all [--project <project_id>]
 
 Legacy (still supported):
   run402 functions rebuild <project_id> <name>
@@ -350,7 +350,7 @@ Arguments:
   <name>              Function name to rebuild (omit when using --all)
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
   --all               Rebuild every function in the project
 
 What it does:
@@ -382,13 +382,13 @@ Examples:
   list: `run402 functions list — List all functions for a project
 
 Usage:
-  run402 functions list [--project <id>]
+  run402 functions list [--project <project_id>]
 
 Legacy (still supported):
   run402 functions list <project_id>
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
 
 Examples:
   run402 functions list --project prj_abc123
@@ -396,7 +396,7 @@ Examples:
   delete: `run402 functions delete — Delete a function from a project
 
 Usage:
-  run402 functions delete <name> [--project <id>]
+  run402 functions delete <name> [--project <project_id>]
 
 Legacy (still supported):
   run402 functions delete <project_id> <name>
@@ -405,7 +405,7 @@ Arguments:
   <name>              Function name to delete
 
 Options:
-  --project <id>      Target project ID (defaults to the active project)
+  --project <project_id>      Target project ID (defaults to the active project)
 
 Examples:
   run402 functions delete stripe-webhook --project prj_abc123
@@ -532,7 +532,7 @@ function validateInvokeJsonBody(value, source, projectId, name) {
 }
 
 async function logs(projectId, name, args) {
-  const usage = "run402 functions logs <name> [--project <id>] [--tail <n>] [--since <ts>] [--request-id <id>] [--app|--platform|--all] [--follow]  |  run402 functions logs --request-id <id> [--project <id>]";
+  const usage = "run402 functions logs <name> [--project <project_id>] [--tail <n>] [--since <ts>] [--request-id <request_id>] [--app|--platform|--all] [--follow]  |  run402 functions logs --request-id <request_id> [--project <project_id>]";
   assertRequiredProject(projectId, usage);
   assertKnownFlags(
     args,
@@ -921,7 +921,7 @@ async function update(projectId, name, args) {
 
 const UNLOCKED_DEPS_HINT =
   "Function was deployed before dependency locking — redeploy from source " +
-  "(run402 functions deploy <id> <name> --file <file>) to refresh its runtime instead.";
+  "(run402 functions deploy <project_id> <name> --file <file>) to refresh its runtime instead.";
 
 // Annotate a `rebuild --all` batch with an actionable hint on per-function
 // CANNOT_REBUILD_UNLOCKED_DEPS refusals. The batch endpoint returns 200 with
@@ -1031,7 +1031,7 @@ export async function run(sub, args) {
     console.log(SUB_HELP[sub] || HELP);
     process.exit(0);
   }
-  // Project selection (CLI-wide convention): `--project <id>` wins, else a
+  // Project selection (CLI-wide convention): `--project <project_id>` wins, else a
   // legacy leading `prj_...` positional, else the active project. Computed
   // lazily so unknown subcommands never trip project resolution.
   const select = () => resolveProjectSelector(args);

package/lib/grants.mjs

@@ -15,9 +15,9 @@ Usage:
   run402 grants <subcommand> [args...]
 
 Subcommands:
-  create <wallet> --capability <cap> [--project <id>] [--policy <json>] [--expires <iso8601>]
+  create <wallet> --capability <cap> [--project <project_id>] [--policy <json>] [--expires <iso8601>]
                                  Issue a capability grant (owner of the project's org)
-  revoke <grant_id> [--project <id>]
+  revoke <grant_id> [--project <project_id>]
                                  Revoke a capability grant
 
 Legacy (still supported):
@@ -40,7 +40,7 @@ const SUB_HELP = {
   create: `run402 grants create — issue a per-project capability grant
 
 Usage:
-  run402 grants create <wallet> --capability <cap> [--project <id>] [--policy <json>] [--expires <iso8601>]
+  run402 grants create <wallet> --capability <cap> [--project <project_id>] [--policy <json>] [--expires <iso8601>]
 
 Legacy (still supported):
   run402 grants create <project_id> <wallet> <capability> [options]
@@ -49,7 +49,7 @@ Arguments:
   <wallet>       EVM address or named wallet the grant is issued to
 
 Options:
-  --project <id>      Project to grant access to (defaults to the active project)
+  --project <project_id>      Project to grant access to (defaults to the active project)
   --capability <cap>  e.g. deploy, functions:write (alternative to the legacy positional)
   --policy <json>     Capability-scoping policy object (gateway-interpreted)
   --expires <iso8601> Expiry timestamp; omit for a non-expiring grant
@@ -59,7 +59,7 @@ Requires you to be an owner of the project's org.
   revoke: `run402 grants revoke — revoke a per-project capability grant
 
 Usage:
-  run402 grants revoke <grant_id> [--project <id>]
+  run402 grants revoke <grant_id> [--project <project_id>]
 
 Legacy (still supported):
   run402 grants revoke <project_id> <grant_id>
@@ -81,7 +81,7 @@ async function create(args) {
   const pos = requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
     min: expected,
     max: expected,
-    command: "run402 grants create <wallet> --capability <cap> [--project <id>] [--policy <json>] [--expires <iso8601>]",
+    command: "run402 grants create <wallet> --capability <cap> [--project <project_id>] [--policy <json>] [--expires <iso8601>]",
     missing: capabilityFlag ? "Missing <wallet>." : "Missing <wallet> and/or <capability>.",
   });
   const wallet = pos[0];
@@ -107,7 +107,7 @@ async function revoke(args) {
   const [grantId] = requirePositionalCount(rest, ["--project"], {
     min: 1,
     max: 1,
-    command: "run402 grants revoke <grant_id> [--project <id>]",
+    command: "run402 grants revoke <grant_id> [--project <project_id>]",
     missing: "Missing <grant_id>.",
   });
   try {

package/lib/image.mjs

@@ -17,7 +17,7 @@ Options:
   --org <org_id>      The paying organization when the wallet belongs to more
                       than one (Lightning rail); x402 ignores it. Omitted, it
                       is the current org (RUN402_ORG, the .run402.json binding,
-                      run402 org use, or the active project's owning org)
+                      run402 orgs use, or the active project's owning org)
   --help, -h          Show this help message
 
 Examples:
@@ -53,7 +53,7 @@ Options:
   --org <org_id>      The paying organization when the wallet belongs to more
                       than one (Lightning rail); x402 ignores it. Omitted, it
                       is the current org (RUN402_ORG, the .run402.json binding,
-                      run402 org use, or the active project's owning org)
+                      run402 orgs use, or the active project's owning org)
 
 Notes:
   - Requires a funded wallet (run402 init && run402 wallets fund)
@@ -112,7 +112,7 @@ export async function run(sub, args) {
 
   // The paying organization rides the ONE shared org chain (--org, then
   // RUN402_ORG / RUN402_ROOM / RUN402_PROJECT_ID, then the .run402.json
-  // binding, then `org use` / the active project's owning org). Only the
+  // binding, then `orgs use` / the active project's owning org). Only the
   // Lightning rail reads it — a multi-org principal is refused
   // ORGANIZATION_SELECTION_REQUIRED without one — and x402 ignores it, so
   // resolving it is never a reason to refuse an x402 purchase: `optional`
@@ -150,12 +150,12 @@ function reportOrgSelectionError(err, org) {
       code,
       message: err.message,
       hint:
-        `Pass --org <org_id> (one of: ${ids.join(", ") || "run402 org list"}) or select a current organization with ` +
-        "run402 org use <org_id>. Only the Lightning rail needs it; x402 ignores it.",
+        `Pass --org <org_id> (one of: ${ids.join(", ") || "run402 orgs list"}) or select a current organization with ` +
+        "run402 orgs use <org_id>. Only the Lightning rail needs it; x402 ignores it.",
       details: { ...details, organization_ids: ids, org_source: org?.source ?? null, org_source_detail: org?.sourceDetail ?? null },
       next_actions: err.nextActions ?? [
         nextAction("edit_request", { command: 'run402 image generate "<prompt>" --org <org_id>', why: "Name the paying organization on this call." }),
-        nextAction("edit_request", { command: "run402 org use <org_id>", why: "Select a current organization for this profile." }),
+        nextAction("edit_request", { command: "run402 orgs use <org_id>", why: "Select a current organization for this profile." }),
       ],
     });
   }
@@ -165,7 +165,7 @@ function reportOrgSelectionError(err, org) {
       message: err.message,
       hint:
         `The paying organization ${org.orgId} came from ${org.sourceDetail} (${org.source}) and this principal holds no billing role there. ` +
-        "Pass --org <org_id> for an organization you can bill, or run: run402 org use <org_id>",
+        "Pass --org <org_id> for an organization you can bill, or run: run402 orgs use <org_id>",
       details: { ...details, org_source: org.source, org_source_detail: org.sourceDetail },
       next_actions: err.nextActions,
     });

package/lib/init.mjs

@@ -49,9 +49,9 @@ Options:
                   client (claude-code, codex, cursor, or grok; RUN402_CLIENT=<name>
                   declares one that is not auto-detected) and otherwise writes
                   nothing; RUN402_AGENT_NAME=<name> sets or overrides it. Change
-                  it any time with \`run402 org whoami --set-name <name>\`.
+                  it any time with \`run402 whoami --set-name <name>\`.
   --git-remote    Also 'git init' the current directory when it is not a
-                  repository yet, so the gitvault remote can be added there.
+                  repository yet, so the vault remote can be added there.
                   Opt-in on purpose: init is often run outside a project
                   directory and must never create a repository somewhere you
                   did not ask it to. Inside an EXISTING repository the remote
@@ -62,14 +62,14 @@ Output:
   tier, projects_saved, active_project_id, next_step }. Progress lines
   (Config / Wallet / Balance / Tier / Next) go to stderr so a human
   re-running interactively sees what's happening while a script piping stdout
-  to jq stays clean. The summary also carries { gitvault } (the scaffolded
-  remote), or { gitvault: null, gitvault_skipped } naming why no remote was
-  added, or { gitvault: null, gitvault_error } when it could not be added.
+  to jq stays clean. The summary also carries { vault } (the scaffolded
+  remote), or { vault: null, vault_skipped } naming why no remote was
+  added, or { vault: null, vault_error } when it could not be added.
   \`projects_saved\` counts projects with LOCAL keys; \`active_project_id\` is the
-  project the gitvault scaffold acted on.
+  project the vault scaffold acted on.
 
   init scaffolds the git remote only. It does NOT allocate the vault — that is
-  \`run402 repos create --project <id>\`, which mints key material and a
+  \`run402 repos create --project <project_id>\`, which mints key material and a
   recovery receipt and therefore stays an explicit step.
 
 Steps (idempotent when re-run with the same rail; pass --switch-rail to change rails):
@@ -215,13 +215,13 @@ function errorMessage(err) {
 }
 
 /**
- * Which project the gitvault scaffold acts on — and why it may act on none.
+ * Which project the vault scaffold acts on — and why it may act on none.
  *
  * The CLI-wide resolution order (`RUN402_PROJECT_ID`, then the active
  * project), not `getActiveProjectId()` alone. Reading only the active project
  * meant an agent that had exported `RUN402_PROJECT_ID` — the normal way to
  * address a project without mutating machine state — got a silent no-op: no
- * remote, no allocation, and no `gitvault` key in the summary at all, with
+ * remote, no allocation, and no `vault` key in the summary at all, with
  * nothing anywhere saying `run402 projects use` was a prerequisite
  * (dogfood #1, finding A). A command that exits 0 having done nothing is worse
  * than an error, so the no-project case names itself.
@@ -375,7 +375,7 @@ export async function run(args = []) {
     ...(voucherCode ? { voucher: null } : {}),
     tier: null,
     projects_saved: 0,
-    /** The project init acted on — the input to the gitvault scaffold decision. */
+    /** The project init acted on — the input to the vault scaffold decision. */
     active_project_id: null,
     next_actions: [],
     next_step: null,
@@ -637,17 +637,17 @@ export async function run(args = []) {
   // local keys, so it is legitimately not counted here; `active_project_id`
   // below is the field that says which project init actually acted on, and
   // reading `projects_saved: 0` as "init did nothing" is what made the
-  // gitvault skip look silent (dogfood #1, finding A).
+  // vault skip look silent (dogfood #1, finding A).
   summary.projects_saved = Object.keys(store.projects).length;
   line("Projects", `${summary.projects_saved} saved`);
 
-  // 5b. gitvault git remote (gitvault-client-surface, task 5.7).
+  // 5b. vault git remote (vault-client-surface, task 5.7).
   //
   // Purely LOCAL git. No vault is allocated and no key material is written
   // here — the spec is explicit that neither exists until first capture, so the
   // cold-start path gains no prompt and no new failure mode. Allocation happens
-  // on the first `git push origin <branch>` or `run402 gitvault snapshot` (D2,
-  // repo-first-onramp) — NOT on deploy: `applyWithGitvault` only ever reads an
+  // on the first `git push origin <branch>` or `run402 repos capture` (D2,
+  // repo-first-onramp) — NOT on deploy: `applyWithVault` only ever reads an
   // EXISTING vault's policy (D3) and never allocates one that does not exist,
   // so a project with no vault deploys exactly as it always did.
   //
@@ -664,11 +664,11 @@ export async function run(args = []) {
   const { projectId: activeProjectId, skipped: noProjectSkip } = resolveScaffoldProject();
   summary.active_project_id = activeProjectId;
   if (noProjectSkip) {
-    summary.gitvault = null;
-    summary.gitvault_skipped = noProjectSkip;
-    line("Gitvault", "skipped — no project selected (run402 projects use <project_id>)");
+    summary.vault = null;
+    summary.vault_skipped = noProjectSkip;
+    line("Vault", "skipped — no project selected (run402 projects use <project_id>)");
   } else {
-    summary.gitvault = null;
+    summary.vault = null;
     try {
       // Dynamic import: the scaffold is the only thing here that needs the
       // Node SDK's hardened git runner, and a top-level import would drag it
@@ -681,43 +681,43 @@ export async function run(args = []) {
         insideRepo = false;
       }
       if (!insideRepo && !scaffoldGitRemote) {
-        summary.gitvault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
-        line("Gitvault", "skipped — not a git repository (--git-remote creates one)");
+        summary.vault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
+        line("Vault", "skipped — not a git repository (--git-remote creates one)");
       } else {
         const orgId = await resolveOwningOrgId(activeProjectId);
         if (!orgId) {
-          summary.gitvault_skipped = `could not resolve the owning org for ${activeProjectId} — the run402 remote was not added`;
-          line("Gitvault", "skipped — owning org unresolved");
+          summary.vault_skipped = `could not resolve the owning org for ${activeProjectId} — the run402 remote was not added`;
+          line("Vault", "skipped — owning org unresolved");
         } else {
-          const remote = await getSdk().gitvault.scaffoldRemote({
+          const remote = await getSdk().repos.scaffoldRemote({
             repo_dir: process.cwd(),
             org_id: orgId,
             project_id: activeProjectId,
           });
           // `allocated: false` is stated, not left to be inferred: this was
           // local git only, and no vault exists for the project yet.
-          summary.gitvault = { ...remote, allocated: false };
+          summary.vault = { ...remote, allocated: false };
           if (remote.already_present && remote.existing_url !== remote.url) {
             // Left exactly as it was. Name the URL that is actually in place
             // rather than implying the remote now points at this project.
-            line("Gitvault", `remote '${remote.name}' already points at ${remote.existing_url} — left unchanged (${remote.reason})`);
+            line("Vault", `remote '${remote.name}' already points at ${remote.existing_url} — left unchanged (${remote.reason})`);
           } else if (remote.already_present) {
-            line("Gitvault", `remote '${remote.name}' already set (${remote.url})`);
+            line("Vault", `remote '${remote.name}' already set (${remote.url})`);
           } else {
             // D1: `origin` when it was free, `run402` when it was already
             // taken by something else — `remote.reason` says which happened.
-            line("Gitvault", `${remote.created_repository ? "initialized a repository and added" : "added"} remote '${remote.name}' -> ${remote.url} (${remote.reason})`);
+            line("Vault", `${remote.created_repository ? "initialized a repository and added" : "added"} remote '${remote.name}' -> ${remote.url} (${remote.reason})`);
           }
         }
       }
     } catch (err) {
       const reason = errorMessage(err);
-      summary.gitvault = null;
-      summary.gitvault_error = {
-        code: err?.body?.code ?? err?.code ?? "GITVAULT_SCAFFOLD_FAILED",
+      summary.vault = null;
+      summary.vault_error = {
+        code: err?.body?.code ?? err?.code ?? "VAULT_SCAFFOLD_FAILED",
         message: reason,
       };
-      line("Gitvault", `remote not added: ${reason}`);
+      line("Vault", `remote not added: ${reason}`);
     }
   }
 
@@ -736,7 +736,7 @@ export async function run(args = []) {
     if (rows.length === 1) {
       line("Org", `${rows[0].org_id}${rows[0].display_name ? ` (${rows[0].display_name})` : ""}`);
     } else if (rows.length > 1) {
-      line("Org", `${rows.length} organizations — run402 org list`);
+      line("Org", `${rows.length} organizations — run402 orgs list`);
     }
   } catch {
     // Best-effort, exactly like the billing read: a listing failure must never

package/lib/jobs.mjs

@@ -48,13 +48,13 @@ const SUB_HELP = {
   submit: `run402 jobs submit — Submit a managed job request
 
 Usage:
-  run402 jobs submit --file <path> [--project <id>]
-  run402 jobs submit --stdin [--project <id>]
+  run402 jobs submit --file <path> [--project <project_id>]
+  run402 jobs submit --stdin [--project <project_id>]
 
 Options:
   --file <path>     Read the JSON submit request from a file
   --stdin           Read the JSON submit request from stdin
-  --project <id>    Project ID (defaults to the active project)
+  --project <project_id>    Project ID (defaults to the active project)
 
 Example request:
   {
@@ -72,36 +72,36 @@ Example request:
   get: `run402 jobs get — Get a managed job run
 
 Usage:
-  run402 jobs get <job_id> [--project <id>]
+  run402 jobs get <job_id> [--project <project_id>]
 
 Options:
-  --project <id>    Project ID (defaults to the active project)
+  --project <project_id>    Project ID (defaults to the active project)
 `,
   logs: `run402 jobs logs — Read managed job logs
 
 Usage:
-  run402 jobs logs <job_id> [--project <id>] [--tail <n>] [--since <iso>]
+  run402 jobs logs <job_id> [--project <project_id>] [--tail <n>] [--since <iso>]
 
 Options:
-  --project <id>    Project ID (defaults to the active project)
+  --project <project_id>    Project ID (defaults to the active project)
   --tail <n>        Maximum entries to return (gateway max: 1000)
   --since <iso>     Only include logs at or after this ISO-8601 timestamp
 `,
   cancel: `run402 jobs cancel — Cancel a managed job run
 
 Usage:
-  run402 jobs cancel <job_id> [--project <id>]
+  run402 jobs cancel <job_id> [--project <project_id>]
 
 Options:
-  --project <id>    Project ID (defaults to the active project)
+  --project <project_id>    Project ID (defaults to the active project)
 `,
   purge: `run402 jobs purge — Purge all managed job runs for a project
 
 Usage:
-  run402 jobs purge [--project <id>]
+  run402 jobs purge [--project <project_id>]
 
 Options:
-  --project <id>    Project ID (defaults to the active project)
+  --project <project_id>    Project ID (defaults to the active project)
 
 Deletes all project-scoped managed-job run records. Queued/running jobs are
 included in the purge; known active runner instances are terminated first.
@@ -110,7 +110,7 @@ Prints { deleted_jobs, cancelled_active_jobs, terminated_instances }.
   artifacts: `run402 jobs artifacts — Download outputs from a completed managed job
 
 Usage:
-  run402 jobs artifacts get <job_id> <file> --output <path> [--project <id>]
+  run402 jobs artifacts get <job_id> <file> --output <path> [--project <project_id>]
 
 Actions:
   get <job_id> <file>   Download the named artifact to a local file
@@ -121,14 +121,14 @@ recorded filenames on a given run.
   "artifacts get": `run402 jobs artifacts get — Download a completed job's artifact
 
 Usage:
-  run402 jobs artifacts get <job_id> --file <name> --output <path> [--project <id>]
+  run402 jobs artifacts get <job_id> --file <name> --output <path> [--project <project_id>]
 
 Legacy (still supported):
-  run402 jobs artifacts get <job_id> <file> --output <path> [--project <id>]
+  run402 jobs artifacts get <job_id> <file> --output <path> [--project <project_id>]
 
 Options:
   --output, -o <path>   Local destination path (required)
-  --project <id>        Project ID (defaults to the active project)
+  --project <project_id>        Project ID (defaults to the active project)
 
 The job must be completed and the filename must be in its recorded artifact
 set (see the 'artifacts' map from 'run402 jobs get <job_id>'); otherwise the

package/lib/live.mjs

@@ -23,7 +23,7 @@ Usage:
 Options:
   --tables <names>  Comma-separated live table names (tables with "live": true in the
                     expose manifest). Required.
-  --project <id>    Project to read (defaults to the active project)
+  --project <project_id>    Project to read (defaults to the active project)
   --cursor <c>      Resume from a cursor (a previous "cursor" or a change's cursor)
   --as <audience>   anon (project anon key; public-policy tables) or service (service
                     key; every hint, including owner-scoped ones). Default anon.

package/lib/logs.mjs

@@ -33,11 +33,11 @@ import {
 const HELP = `run402 logs — Fetch function logs by request id
 
 Usage:
-  run402 logs --request-id <id> [<function> | --function <name>] [--project <id>] [options]
-  run402 logs --function <name> [--project <id>] [options]
+  run402 logs --request-id <request_id> [<function> | --function <name>] [--project <project_id>] [options]
+  run402 logs --function <name> [--project <project_id>] [options]
 
 Required (one of):
-  --request-id <id>       A req_... id (the x-run402-request-id response header),
+  --request-id <request_id>       A req_... id (the x-run402-request-id response header),
                           or a fnrun_... / fnatt_... durable-run id. Without
                           --function, every function in the project is scanned.
   --function <name>       Limit to one function. Alone (no --request-id) this
@@ -45,7 +45,7 @@ Required (one of):
                           <function> means the same thing.
 
 Optional:
-  --project <id>          Project id (default: \$RUN402_PROJECT_ID, else the active project)
+  --project <project_id>          Project id (default: \$RUN402_PROJECT_ID, else the active project)
   --tail <n>              Max entries per function BEFORE the origin filter (default 100, max 1000)
   --since <ts>            ISO timestamp or epoch ms; only entries at or after this
   --app                   Only the function's own output (default). Lambda runtime
@@ -77,7 +77,7 @@ Tip: the request id appears in:
   - The 'x-run402-request-id' response header on every function response
   - The 'requestId' field of any R402_SSR_RUNTIME_ERROR envelope
   - The 'request_id' field in deploy / cache invalidate result envelopes
-  - The 'samples' of 'run402 errors' (each sample names a runnable logs command)
+  - The 'samples' of 'run402 errors list' (each sample names a runnable logs command)
 `;
 
 const VALUE_FLAGS = ["--request-id", "--function", "--project", "--tail", "--since"];
@@ -103,7 +103,7 @@ export async function run(sub, args = []) {
     fail({
       code: "BAD_USAGE",
       message: `Unexpected argument: ${positionals[1]}`,
-      hint: "run402 logs [<function>] --request-id <id> [--project <id>]",
+      hint: "run402 logs [<function>] --request-id <request_id> [--project <project_id>]",
       details: { argument: positionals[1] },
     });
   }
@@ -119,7 +119,7 @@ export async function run(sub, args = []) {
   if (!requestId && !fnName) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --request-id <id> (or --function <name> for a plain tail).",
+      message: "Missing --request-id <request_id> (or --function <name> for a plain tail).",
       hint: "Pass the request id from the 'x-run402-request-id' response header.",
     });
   }
@@ -130,7 +130,7 @@ export async function run(sub, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing project id.",
-      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or 'run402 projects use <id>'.",
+      hint: "Pass --project <project_id>, set RUN402_PROJECT_ID, or 'run402 projects use <project_id>'.",
     });
   }