#1387 Account/scope gates fire before argument, type and repo validation — 'swamp vault create env my-vault' (the command's own example, an invalid type) returns a paywall instead of 'Unknown vault type'

Summary

The account/scope gates run as the first statement of the command action, before argument validation, before type resolution, and before the repo check. Any mistake in the command — an invalid vault type, a typo, a wrong directory — is reported as "this is a team feature that requires a free swamp-club.com account". The command's own documented example triggers it.

Where (source)

• src/cli/commands/vault_create.ts:85-88 — the gate is the first thing in .action(), ahead of createContext (:90), requireInitializedRepoUnlocked (:94), the name prompt, and the type validation in libswamp/vaults/create.ts:131-151.
• src/cli/commands/datastore_setup.ts:231-235 — same shape, ahead of the registry lookup (:260), the --config JSON parse (:269-275), --hydration-strategy validation (:291-298) and --timeout parse (:300-302).
• src/cli/commands/datastore_setup.ts:365-584 — the interactive path is the mirror-image mistake: the gate sits at :580-584, after the entire wizard (storage choice at :411, bucket/prefix/region/endpoint at :425-443, extension search + config JSON at :465-528).

Deterministic repro

With no credentials (SWAMP_HOME pointed at an empty dir):

swamp vault create env my-vault

env is not a registered vault type — the only built-in is local_encryption (src/domain/vaults/vault_types.ts:44-52). This is also the command's own documented example, verbatim from vault_create.ts:61. Observed:

Error: Non-local vaults are a team feature that requires a free swamp-club.com account.
...
Your token should include the vault:* scope.

Expected (and what you get once any credential is present):

Error: Unknown vault type: env. Available types: local_encryption. Use 'swamp vault type search' to see available types.

The same paywall is returned for a plain typo:

swamp vault create local_encrpytion my-vault      # -> paywall, not "Unknown vault type"

and for not being in a swamp repo at all:

swamp vault create aws-secrets-manager v --repo-dir /tmp   # -> paywall, not "Not a swamp repository"

The renamed-type helper is masked the same way: swamp vault create aws prod-secrets (which appears in the shipped skill docs) should produce "The type 'aws' has been renamed to '@swamp/aws-sm'" from create.ts:133-142, and instead produces the paywall.

Impact

The first thing a new user does is copy the example out of --help. That example is swamp vault create env my-vault, and it now returns a paywall for a vault type that does not exist — which reads as "swamp wants me to pay to create a vault" rather than "that is not a real type, try local_encryption". Every typo in this command family lands in the same place, and the message actively misdirects: it names an account and a scope, neither of which would fix anything.

The interactive datastore setup failure is the inverse and arguably worse: the user answers the whole wizard — bucket, prefix, region, endpoint, or an extension search plus a hand-written config JSON — and only then is told they need an account. All input is discarded.

Expected

• Move the gates after argument/type/repo validation, so a malformed command is reported as malformed. The gate is a policy check on a valid request; it should not pre-empt "this request is not valid".
• In the interactive path, gate before prompting rather than after, matching the non-interactive path at datastore_setup.ts:231.
• Fix the vault create example so it names a real type.

Environment

• Verified against source main @ 10943ef. Gate shipped in a519305 (#1934), 2026-07-23; installed stable 20260722.210030.0-sha.7ff1e2f0 predates it, which is why this does not reproduce on the current release binary.
• macOS 14.