run402 4.97.0 → 4.99.0

package/lib/repos.mjs

@@ -21,7 +21,7 @@ import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { withAutoApprove } from "./sign-in.mjs";
 import { walletAuthHeaders, isCoreApiTarget, readWallet, resolveProjectId } from "./config.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
-import { resolveOrgId, resolveOwningOrgId } from "./org-context.mjs";
+import { resolveOrgId } from "./org-context.mjs";
 import { resolveVaultTarget } from "./vault-target.mjs";
 import { nextAction, setOrgSlugAction, setRepoNameAction } from "./next-actions.mjs";
 import { resolveHarnessLabels, resolveSessionKey, resolveTaskLabel, persistSessionKey } from "./harness-context.mjs";
@@ -845,7 +845,7 @@ async function printCreateResult({ sdk, projectId, vault, adopted, name, verbose
   let address = null;
   let orgSlug = null;
   try {
-    const owningOrg = await resolveOwningOrgId(projectId);
+    const owningOrg = await getSdk().orgs.owningOrgOf(projectId);
     const orgRecord = owningOrg ? await sdk.org(owningOrg).get() : null;
     orgSlug = orgRecord?.slug ?? null;
     if (orgSlug && name) {
@@ -929,7 +929,7 @@ async function printCreateResult({ sdk, projectId, vault, adopted, name, verbose
 
 async function createAdopt(projectId, dir, a) {
   const sdk = getSdk();
-  const orgId = flagValue(a, "--org") ?? await resolveOwningOrgId(projectId);
+  const orgId = flagValue(a, "--org") ?? await getSdk().orgs.owningOrgOf(projectId);
   if (!orgId) {
     fail({
       code: "VAULT_ORG_UNRESOLVED",
@@ -1010,7 +1010,7 @@ async function createProvision(name, dir, a) {
     }
   }
 
-  const effectiveOrgId = orgId ?? (await resolveOwningOrgId(provisioned.project_id));
+  const effectiveOrgId = orgId ?? (await getSdk().orgs.owningOrgOf(provisioned.project_id));
   if (!effectiveOrgId) {
     fail({
       code: "VAULT_ORG_UNRESOLVED",
@@ -1278,7 +1278,7 @@ async function rename(args) {
     const result = await sdk.projects.setRepoName(projectId, repoName);
     let address = null;
     try {
-      const owningOrg = await resolveOwningOrgId(projectId);
+      const owningOrg = await getSdk().orgs.owningOrgOf(projectId);
       const orgSlug = owningOrg ? (await sdk.org(owningOrg).get()).slug : null;
       if (orgSlug) address = vaultRemoteUrlForRepo(orgSlug, result.repo_name);
     } catch {
@@ -1554,7 +1554,7 @@ async function capture(args) {
   const repoDir = process.cwd();
   const address = await detectSlugFormRemote(a, repoDir);
   const target = address ? { repo_dir: repoDir } : await vaultTarget(a);
-  const orgId = !address && !dryRun && target.project_id ? await resolveOwningOrgId(target.project_id) : null;
+  const orgId = !address && !dryRun && target.project_id ? await getSdk().orgs.owningOrgOf(target.project_id) : null;
   const opts = {
     ...target,
     ...(address ? { address } : {}),

package/lib/rooms.mjs

@@ -448,8 +448,7 @@ async function joinWithKey(key, a) {
     // Arrival state (design D10) — best-effort throughout: the redemption
     // already succeeded, and none of this may fail a completed join.
     try {
-      const { setSelectedOrgId } = await import("./org-context.mjs");
-      setSelectedOrgId(result.org_id);
+      await getSdk().orgs.use(result.org_id);
     } catch { /* best-effort */ }
 
     const cwd = process.cwd();

package/lib/sdk-errors.mjs

@@ -44,6 +44,32 @@ export function fail({ message, code, hint, details, next_actions, field, retrya
   process.exit(exit_code);
 }
 
+/**
+ * Report a refusal the Node SDK's local-state verbs threw (wallet selection,
+ * organization context, doctor/init argument checks): the same envelope
+ * `fail()` prints, fields taken from the error. Local refusals carry their
+ * own `hint` and `next_actions`; they never went through the HTTP-error
+ * rendering `reportSdkError` applies.
+ */
+export function failLocal(err) {
+  fail({
+    code: err?.code,
+    message: err?.message,
+    hint: err?.hint,
+    details: err?.details,
+    next_actions: err?.nextActions,
+  });
+}
+
+/**
+ * `failLocal` for a local refusal from a local-state verb, `reportSdkError`
+ * for anything else (a gateway error, a network error, a cache miss).
+ */
+export function reportLocalOrSdkError(err) {
+  if (err?.kind === "local_error" && err?.status === null && err?.code !== "PROJECT_CREDENTIAL_NOT_FOUND") failLocal(err);
+  reportSdkError(err);
+}
+
 /**
  * Parse a JSON-bearing CLI flag value, naming the flag in the failure envelope.
  *

package/lib/status.mjs

@@ -1,17 +1,12 @@
-import { readRemoteStatus } from "#sdk/node";
-import {
-  readWallet,
-  loadKeyStore,
-  getActiveProjectId,
-  apiBase,
-  apiBaseSource,
-  apiTargetKind,
-} from "./config.mjs";
+/**
+ * run402 status — the CLI edge of `r.status()` (`@run402/sdk/node`), which
+ * assembles the local view (wallet, rail, balances, tier, projects, active
+ * project, API target). This module prints it: JSON by default, or the
+ * compact `--human` rendering.
+ */
 import { getSdk } from "./sdk.mjs";
-import { fail } from "./sdk-errors.mjs";
+import { fail, reportLocalOrSdkError } from "./sdk-errors.mjs";
 import { assertKnownFlags, hasHelp, normalizeArgv } from "./argparse.mjs";
-import { getActiveProfile } from "../core-dist/config.js";
-import { readMeta } from "../core-dist/profiles.js";
 
 const HELP = `run402 status — Show full organization state in one shot
 
@@ -35,63 +30,6 @@ Run402 Cloud status requires a wallet; Core target status can still report
 local project state without one.
 `;
 
-// USDC / pathUSD constants (match wallet.mjs)
-const USDC_ABI = [{ name: "balanceOf", type: "function", stateMutability: "view", inputs: [{ name: "account", type: "address" }], outputs: [{ name: "", type: "uint256" }] }];
-const USDC_MAINNET = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-const USDC_SEPOLIA = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
-const PATH_USD = "0x20c0000000000000000000000000000000000000";
-const TEMPO_RPC = "https://rpc.moderato.tempo.xyz/";
-
-/**
- * Read the on-chain wallet balance in USD micros for the current rail.
- * For x402: read Base mainnet + Base Sepolia USDC and sum funded networks.
- * For mpp:  read pathUSD on Tempo Moderato.
- * Returns null if every read fails (e.g. offline or RPC down).
- */
-async function readWalletBalanceUsdMicros(rail, address) {
-  try {
-    const { createPublicClient, http, defineChain } = await import("viem");
-    if (rail === "mpp") {
-      const tempoModerato = defineChain({
-        id: 42431,
-        name: "Tempo Moderato",
-        nativeCurrency: { name: "pathUSD", symbol: "pathUSD", decimals: 6 },
-        rpcUrls: { default: { http: [TEMPO_RPC] } },
-      });
-      const client = createPublicClient({ chain: tempoModerato, transport: http() });
-      try {
-        const raw = await client.readContract({ address: PATH_USD, abi: USDC_ABI, functionName: "balanceOf", args: [address] });
-        return Number(raw);
-      } catch { return null; }
-    }
-    // x402 rail — read Base mainnet + Base Sepolia in parallel; sum any that succeed.
-    const { base, baseSepolia } = await import("viem/chains");
-    const mainnetClient = createPublicClient({ chain: base, transport: http() });
-    const sepoliaClient = createPublicClient({ chain: baseSepolia, transport: http() });
-    const [mainnet, sepolia] = await Promise.all([
-      mainnetClient.readContract({ address: USDC_MAINNET, abi: USDC_ABI, functionName: "balanceOf", args: [address] }).then(Number).catch(() => null),
-      sepoliaClient.readContract({ address: USDC_SEPOLIA, abi: USDC_ABI, functionName: "balanceOf", args: [address] }).then(Number).catch(() => null),
-    ]);
-    if (mainnet === null && sepolia === null) return null;
-    return (mainnet || 0) + (sepolia || 0);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Normalize a project entry to the agreed-on shape: always expose `project_id`
- * (matching `projects list`). The remote /wallets/v1/:wallet/projects endpoint
- * returns entries keyed as `id`, so we map them here and drop the raw `id`
- * field to avoid having two aliases for the same identity.
- */
-function normalizeProject(raw) {
-  if (!raw || typeof raw !== "object") return raw;
-  const projectId = raw.project_id || raw.id;
-  const { id: _dropId, project_id: _dropPid, ...rest } = raw;
-  return { project_id: projectId, ...rest };
-}
-
 export async function run(args = []) {
   args = normalizeArgv(args);
   if (hasHelp(args)) { console.log(HELP); process.exit(0); }
@@ -105,97 +43,19 @@ export async function run(args = []) {
       hint: "JSON is the default; drop --json to keep it, or keep --human alone for the rendered view.",
     });
   }
-  const localWallet = readWallet();
-  const target = {
-    api_base: apiBase(),
-    api_base_source: apiBaseSource(),
-    kind: apiTargetKind(),
-  };
-  if (!localWallet) {
-    const store = loadKeyStore();
-    const bare = {
-      wallet: null,
-      target,
-      projects: Object.keys(store.projects).map(id => ({ project_id: id })),
-      active_project: getActiveProjectId() || null,
-      hint: target.kind === "core" ? "Run: run402 projects provision --name my-app" : "Run: run402 init",
-    };
-    if (human) {
-      console.log(formatStatusHuman(bare));
-      return;
-    }
-    console.log(JSON.stringify(bare));
+  let result;
+  try {
+    result = await getSdk().status();
+  } catch (err) {
+    reportLocalOrSdkError(err);
     return;
   }
-
-  const wallet = localWallet.address.toLowerCase();
-  const rail = localWallet.rail || "x402";
-
-  // Parallel API calls: tier + allowance + server-side projects + on-chain wallet balance.
-  // projects.list() is the membership-scoped named inventory (project-findability);
-  // SIWX wallet auth is signed from the wallet. Best-effort — a missing
-  // wallet yields null and we fall back to the local keystore below.
-  const [status, walletBalance] = await Promise.all([
-    readRemoteStatus(getSdk(), wallet),
-    readWalletBalanceUsdMicros(rail, localWallet.address),
-  ]);
-  const { tier, billing, remote } = status;
-
-  // Local keystore
-  const store = loadKeyStore();
-  const activeId = getActiveProjectId();
-
-  const projects = remote?.projects
-    ? remote.projects.map(normalizeProject)
-    : Object.keys(store.projects).map(id => ({ project_id: id }));
-
-  // Which named wallet this state belongs to. `local_label` is the active
-  // profile (default for single-wallet installs); `server_label` is the
-  // cached server-side display name (null until set / when offline).
-  const walletName = getActiveProfile();
-  const walletMeta = readMeta(walletName);
-
-  // Balances are grouped under one object so the on-chain (wallet) and
-  // allowance numbers are unambiguous and rail-legible.
-  //   - on_chain_usd_micros / on_chain_token: on-chain USDC (x402) or pathUSD
-  //     (mpp) in the wallet, null if the RPC read failed
-  //   - allowance_usd_micros / held_usd_micros: the organization's Run402-held
-  //     allowance, rail-independent, null when no organization exists
-  const hasBilling = billing && billing.exists !== false;
-  const result = {
-    wallet: {
-      local_label: walletName,
-      server_label: walletMeta?.label ?? null,
-      address: localWallet.address,
-    },
-    rail,
-    remote_status: status.availability,
-    next_actions: status.next_actions,
-    projects_source: remote ? "remote" : "local_cache",
-    balances: {
-      on_chain_usd_micros: walletBalance,
-      on_chain_token: rail === "mpp" ? "pathUSD" : "USDC",
-      allowance_usd_micros: hasBilling ? billing.allowance_usd_micros : null,
-      held_usd_micros: hasBilling ? (billing.held_usd_micros ?? 0) : null,
-    },
-    tier: tier && tier.tier
-      ? { name: tier.tier, status: tier.status, expires: tier.lease_perpetual === true ? null : tier.lease_expires_at }
-      : null,
-    // v1.57: lifecycle state and the per-organization escape hatch moved to the
-    // organization. Surface them at the top level so agents don't have to
-    // dig into the projects array to read them.
-    organization_lifecycle_state: tier?.organization_lifecycle_state ?? null,
-    lease_perpetual: tier?.lease_perpetual ?? null,
-    projects,
-    active_project: activeId || null,
-    target,
-  };
-
   if (human) {
     console.log(formatStatusHuman(result));
     return;
   }
-  console.log(JSON.stringify(result, null, 2));
+  // The no-wallet view has always printed compact; the wallet view pretty.
+  console.log(result.wallet ? JSON.stringify(result, null, 2) : JSON.stringify(result));
 }
 
 function usdFromMicros(micros) {

package/lib/up.mjs

@@ -689,9 +689,8 @@ async function gitInitIfNeeded(dir) {
  * never turn an otherwise-successful `up` into a failure.
  */
 async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested = false }) {
-  const { resolveOwningOrgId } = await import("./org-context.mjs");
   const { scaffoldVaultRemote } = await import("./vault-scaffold.mjs");
-  const orgId = await resolveOwningOrgId(projectId);
+  const orgId = await getSdk().orgs.owningOrgOf(projectId);
   // `--nested`: an app root INSIDE another repository (a monorepo workspace)
   // becomes its own repository with the encrypted remote — the enclosing
   // checkout only gains one local `.git/info/exclude` line. Without it the

package/lib/vault-scaffold.mjs

@@ -24,13 +24,12 @@
  * throw.
  */
 import { getSdk } from "./sdk.mjs";
-import { resolveOwningOrgId } from "./org-context.mjs";
 
 /**
  * @param {object} options
  * @param {string} [options.repoDir] Working tree to scaffold. Defaults to `process.cwd()`.
  * @param {string} options.projectId The project the remote should point at.
- * @param {string} [options.orgId] Explicit owning org. Resolved via `resolveOwningOrgId` when omitted.
+ * @param {string} [options.orgId] Explicit owning org. Resolved via `r.orgs.owningOrgOf` when omitted.
  * @param {boolean} [options.createRepoIfMissing] Opt into `git init`-ing `repoDir` when it is not a repository yet.
  * @param {boolean} [options.nested] Scaffold `repoDir` as its OWN repository even when it lies inside another one (`Repos.scaffoldRemote`'s `nested`).
  * @param {string} [options.nestedCommand] The caller's own `--nested` spelling for the `create_nested_repo` next_action (default: the SDK's `run402 repos create --nested --project <project_id>`).
@@ -51,7 +50,7 @@ export async function scaffoldVaultRemote({ repoDir = process.cwd(), projectId,
       out.vault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
       return out;
     }
-    const resolvedOrgId = orgId ?? (await resolveOwningOrgId(projectId));
+    const resolvedOrgId = orgId ?? (await getSdk().orgs.owningOrgOf(projectId));
     if (!resolvedOrgId) {
       out.reason = "org_unresolved";
       out.vault_skipped = `could not resolve the owning org for ${projectId} — the run402 remote was not added`;

package/lib/vault-target.mjs

@@ -1,148 +1,21 @@
 /**
- * Shared "which vault does this repo mean" resolution for `run402 repos`
- * and `run402 doctor`'s vault check. When a verb runs standing inside a
- * repository that already names its own vault via a pinned repo id or a
- * run402/origin remote, targeting prefers that repo over the active-project
- * pointer — git muscle memory says a command run inside a repo acts on THAT
- * repo.
- *
- * Targeting order for a verb run standing inside a git repository, highest
- * first:
- *   1. an explicit --repo/--project flag (owned by each call site — this
- *      module supplies only the fallback chain beneath it, plus the
- *      mismatch warning against tier 3)
- *   2. the pinned `r402.repoId` in local git config — addresses the
- *      vault by repo_id directly, no network read at all
- *   3. the repo's run402/origin remote address — id-form is parsed
- *      directly out of the address string (free, no network); slug-form is
- *      resolved via the SDK (one read-only network call — `resolveAddress`,
- *      never a pin, never a push-to-create; this is a TARGETING read, not a
- *      publish)
- *   4. RUN402_PROJECT_ID env
- *   5. the profile's active project
- *
- * Outside a repository (or when repo detection itself fails), only tiers 4
- * and 5 apply.
- *
- * ARCHITECTURAL NOTE: this is CLI-edge policy (which flag/env/file wins),
- * not vault protocol behavior — the same class of concern
- * `wallet-context.mjs` owns for wallet selection. The protocol reads it
- * composes (`readPinnedVaultRepo`, `resolveAddress`) already live once in
- * the SDK; this module adds no protocol logic of its own.
+ * Vault verb targeting when standing inside a repository: the CLI edge of
+ * `resolveVaultTarget` (`@run402/sdk/node`), which owns the order — an
+ * explicit `--repo`/`--project` > this checkout's id-pin > its own
+ * `run402`/`origin` remote > `RUN402_PROJECT_ID` > the active project.
+ * `run402 repos view|snapshot|policy|mirror|fsck|gc|access` and the doctor's
+ * vault check compose it; a disagreeing explicit flag still wins, with one
+ * stderr warning naming both.
  */
-import { getActiveProjectId } from "./config.mjs";
+import { getSdk } from "./sdk.mjs";
+import { repoOwnVaultTarget as sdkRepoOwnVaultTarget, resolveVaultTarget as sdkResolveVaultTarget } from "#sdk/node";
 
-/**
- * Tiers 4/5 (RUN402_PROJECT_ID env, then the active project) — deliberately
- * NON-throwing, unlike `config.mjs#resolveProjectId`. `run402 doctor`'s
- * vault check needs to report "skipped" gracefully when nothing resolves
- * anywhere (its pre-existing, tested behavior); a `fail()`-triggered
- * `process.exit()` here would abort doctor's ENTIRE report, not just this
- * one check. Callers that DO want the historical PROJECT_REQUIRED failure
- * (vault.mjs's own verbs) get it by falling back to `resolveProjectId`
- * themselves when this returns `null` — see `vaultTarget` in vault.mjs.
- */
-function envOrActiveProjectId() {
-  return (process.env.RUN402_PROJECT_ID || "").trim() || getActiveProjectId() || null;
-}
-
-async function isInsideGitRepo(repoDir) {
-  try {
-    const { hardenedGit } = await import("#sdk/node");
-    await hardenedGit(repoDir, ["rev-parse", "--git-dir"]);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * The repo's OWN target, independent of any flag — the pin first, then the
- * `run402`/`origin` remote (in that order, mirroring `scaffoldRemote`'s own
- * naming precedence). `null` when the repo has neither, when this is not a
- * repository at all, or (slug-form only) the remote fails to resolve over
- * the network — a miss here is always ordinary, never thrown.
- */
+/** This repository's OWN vault address (pin, else `run402`/`origin` remote), or null. */
 export async function repoOwnVaultTarget(repoDir) {
-  if (!(await isInsideGitRepo(repoDir))) return null;
-
-  const { hardenedGit, readPinnedVaultRepo } = await import("#sdk/node");
-  const pinned = await readPinnedVaultRepo(repoDir);
-  if (pinned) return { repo_id: pinned.repo_id, project_id: null, source: "pin" };
-
-  const { parseVaultRemoteUrl, vaultRemoteAddressForm } = await import("#sdk");
-  for (const name of ["run402", "origin"]) {
-    let url;
-    try {
-      url = (await hardenedGit(repoDir, ["remote", "get-url", name])).text().trim();
-    } catch {
-      continue; // no such remote — try the other conventional name
-    }
-    if (!url) continue;
-    let address;
-    try {
-      address = parseVaultRemoteUrl(url);
-    } catch {
-      continue; // another scheme's remote — not a vault address
-    }
-    if (!address) continue; // exists, but isn't a run402 address — try the other name
-    if (vaultRemoteAddressForm(address) === "id") {
-      // id-form already carries both halves in the address string — no
-      // network read needed at all.
-      return { repo_id: null, project_id: address.project_id, source: "remote", remote_name: name };
-    }
-    try {
-      const { getSdk } = await import("./sdk.mjs");
-      const resolved = await getSdk().repos.resolveAddress(address);
-      return { repo_id: resolved.repo_id, project_id: resolved.project_id, source: "remote", remote_name: name };
-    } catch {
-      // Offline, SLUG_RELEASED, not-found, ... — nothing to target from this
-      // rung; a caller falls through to env/active project.
-      return null;
-    }
-  }
-  return null;
+  return sdkRepoOwnVaultTarget(getSdk().repos, repoDir);
 }
 
-/**
- * Resolve `{ repo_id?, project_id? }` for a vault verb that addresses a
- * vault the same way `--repo`/`--project` already do — pin beats remote
- * beats env beats active project, an explicit flag beats all of them.
- * `explicitProjectId`/`explicitRepoId` are the already-parsed flag values
- * (`undefined`/`null` when absent — this module owns no flag parsing), and
- * either, neither, or both may be set (mirroring `--repo`/`--project`
- * together being valid on the CLI today). `warn` receives the one-line
- * mismatch note when an explicit flag disagrees with the repo's OWN target;
- * the flag still wins either way. The pin carries no project_id to compare
- * for free, so only `--repo` is checked against it; only the remote tier
- * carries a project_id for free (id-form) or resolves one (slug-form), so
- * only `--project` is checked against it — matching the task's own wording
- * ("a mismatch between an explicit flag and the repo's remote").
- */
-export async function resolveVaultTarget({
-  repoDir = process.cwd(),
-  explicitProjectId,
-  explicitRepoId,
-  warn = (line) => console.error(line),
-} = {}) {
-  const needsOwn = explicitRepoId == null || explicitProjectId == null;
-  const own = needsOwn ? await repoOwnVaultTarget(repoDir) : null;
-
-  if (explicitRepoId != null && own?.source === "pin" && own.repo_id !== explicitRepoId) {
-    warn(`warning: --repo ${explicitRepoId} does not match this repo's pinned vault ${own.repo_id} — using --repo ${explicitRepoId}.`);
-  }
-  if (explicitProjectId != null && own?.source === "remote" && own.project_id && own.project_id !== explicitProjectId) {
-    warn(`warning: --project ${explicitProjectId} does not match this repo's '${own.remote_name}' remote project ${own.project_id} — using --project ${explicitProjectId}.`);
-  }
-
-  if (explicitRepoId != null || explicitProjectId != null) {
-    const result = {};
-    if (explicitRepoId != null) result.repo_id = explicitRepoId;
-    if (explicitProjectId != null) result.project_id = explicitProjectId;
-    return result;
-  }
-
-  if (own?.source === "pin") return { repo_id: own.repo_id };
-  if (own?.source === "remote" && own.project_id) return { project_id: own.project_id };
-  return { project_id: envOrActiveProjectId() };
+/** The vault a verb addresses from `repoDir`: `{ repo_id }` or `{ project_id }`. */
+export async function resolveVaultTarget(opts = {}) {
+  return sdkResolveVaultTarget(getSdk().repos, opts);
 }