run402 4.93.1 → 4.94.0

package/lib/subscriptions.mjs

@@ -14,11 +14,11 @@
  * successor, and the report must stop firing because the pipeline carries
  * those events — never because the check was removed.
  *
- * HTTP paths unchanged (`/agent/v1/notifications/rules*`); the allowance auth
+ * HTTP paths unchanged (`/agent/v1/notifications/rules*`); the SIWX auth
  * headers are PATH-scoped and must keep naming the real route.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
-import { operatorProofs } from "./operator-proofs.mjs";
+import { walletAuthHeaders } from "./config.mjs";
+import { sessionProofs } from "./session-proofs.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -96,16 +96,16 @@ async function rulesAdd(args) {
   if (typeRaw !== null) input.eventTypes = splitCsv(typeRaw);
   if (classRaw !== null) input.classes = splitCsv(classRaw);
 
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
-    console.log(JSON.stringify(await getSdk().admin.rules.create(input, operatorProofs("/agent/v1/notifications/rules")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.rules.create(input, sessionProofs("/agent/v1/notifications/rules")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }
 }
 
 async function rulesList() {
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
     console.log(JSON.stringify(await getSdk().admin.rules.list(), null, 2));
   } catch (err) {
@@ -122,9 +122,9 @@ async function rulesRm(args) {
     command: "run402 notifications rules rm <rule_id>",
     missing: "Missing <rule_id>.",
   });
-  allowanceAuthHeaders("/agent/v1/notifications/rules");
+  walletAuthHeaders("/agent/v1/notifications/rules");
   try {
-    console.log(JSON.stringify(await getSdk().admin.rules.delete(ruleId, operatorProofs("/agent/v1/notifications/rules")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.rules.delete(ruleId, sessionProofs("/agent/v1/notifications/rules")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }

package/lib/tier.mjs

@@ -3,30 +3,33 @@ import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, normalizeArgv, positionalArgs, flagValue, failUnknownSubcommand } from "./argparse.mjs";
 import { setTierAction } from "./next-actions.mjs";
 
-const HELP = `run402 tier — Manage your Run402 tier subscription
+const HELP = `run402 tier — Manage your Run402 tier and its lease
 
 Usage:
   run402 tier <subcommand> [args...]
 
 Subcommands:
   status                Show current tier, expiry, pool usage, and function caps when returned
-  set <tier>            Subscribe, renew, or upgrade (prepaid credit first, else x402/MPP)
+  set <tier>            Start, renew, or upgrade the lease (the allowance first, else x402/MPP)
 
-Tiers: prototype ($0.10, perpetual, free with testnet faucet), hobby ($5/30d), team ($20/30d)
+Tiers: prototype ($0.10 once, the free tier: no lease, never expires; covered by the testnet faucet), hobby ($5/30d), team ($20/30d)
 
-Prepaid credit pays first. A promo code (run402 redeem <code>) or a top-up
-sits on the organization's balance; 'tier set' settles from it with no payment
-challenge and no USDC in the wallet, and the receipt says paid_with: "credit".
-Only a balance that falls short goes to x402 / MPP, and that error names the
+The organization's allowance pays first. A promo code (run402 redeem <code>)
+or a top-up adds to the allowance; 'tier set' settles from it with no payment
+challenge and no USDC in the wallet, and the receipt says paid_with: "allowance".
+Only an allowance that falls short goes to x402 / MPP, and that error names the
 exact shortfall a voucher or top-up would cover.
 
-Tier is per organization. A single subscription covers every project on
-the account; api_calls and storage_bytes are pooled across all of them.
+Tier is per organization. One tier covers every project on the account;
+api_calls and storage_bytes are pooled across all of them. Hobby and team
+are prepaid 30-day leases that end unless renewed; nothing charges again on
+its own.
 
-The server auto-detects the action based on your allowance state:
-  - No tier or expired  → subscribe
+The server auto-detects the action from the current tier state and reports
+it as action: start | renew | upgrade:
+  - No tier or expired  → start
   - Same tier, active   → renew (extends from expiry)
-  - Higher tier         → upgrade (prorated refund to allowance)
+  - Higher tier         → upgrade (prorated refund to the allowance)
   - Lower tier, active  → rejected (wait for expiry)
 
 Examples:
@@ -36,7 +39,7 @@ Examples:
 `;
 
 const SUB_HELP = {
-  status: `run402 tier status — Show current tier subscription state
+  status: `run402 tier status — Show current tier and lease state
 
 Usage:
   run402 tier status
@@ -49,12 +52,12 @@ Notes:
   - Newer gateways include function authoring caps such as max timeout,
     max memory, max scheduled functions, minimum cron interval, and current
     scheduled-function usage
-  - Use 'run402 tier set <tier>' to subscribe, renew, or upgrade
+  - Use 'run402 tier set <tier>' to start, renew, or upgrade the lease
 
 Examples:
   run402 tier status
 `,
-  set: `run402 tier set — Subscribe, renew, or upgrade your tier
+  set: `run402 tier set — Set your tier: start, renew, or upgrade the lease
 
 Usage:
   run402 tier set <tier> [--idempotency-key <key>]
@@ -63,23 +66,27 @@ Arguments:
   <tier>              One of: prototype, hobby, team
 
 Options:
-  --idempotency-key <key>  Retry-safe key: re-running the same subscribe/renew
+  --idempotency-key <key>  Retry-safe key: re-running the same start/renew
                            intent with this key does not double-charge. Use a
                            fresh key for a deliberate second renewal.
 
 Tiers:
-  prototype           $0.10, perpetual (free with testnet faucet)
+  prototype           $0.10 once, the free tier: no lease, never expires
+                      (covered by the testnet faucet)
   hobby               $5/30d
   team                $20/30d
 
 Notes:
-  Tier is per organization, not per project. A successful subscribe,
+  Tier is per organization, not per project. A successful start,
   renew, or upgrade applies immediately to every project on the account.
+  Hobby and team are prepaid 30-day leases that end unless renewed;
+  nothing charges again on its own.
 
-  Server auto-detects action based on current allowance state:
-    - No tier or expired -> subscribe
+  Server auto-detects the action from the current tier state and reports
+  it as action: start | renew | upgrade:
+    - No tier or expired -> start
     - Same tier, active  -> renew (extends from expiry)
-    - Higher tier        -> upgrade (prorated refund to allowance)
+    - Higher tier        -> upgrade (prorated refund to the allowance)
     - Lower tier, active -> rejected (wait for expiry)
   Pays via x402 micropayments.
 
@@ -131,7 +138,7 @@ async function set(args = []) {
       next_actions: [setTierAction()],
     });
   }
-  // Caller-supplied idempotency key makes a retried subscribe/renew safe from
+  // Caller-supplied idempotency key makes a retried start/renew safe from
   // double-charge. Not auto-derived: the SDK cannot tell a retry from a new
   // renewal intent (that boundary is the caller's).
   const idempotencyKey = flagValue(parsedArgs, "--idempotency-key") ?? undefined;

package/lib/transfer.mjs

@@ -1,4 +1,4 @@
-import { allowanceAuthHeaders, resolveProjectId } from "./config.mjs";
+import { walletAuthHeaders, resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -14,21 +14,21 @@ import {
 const HELP = `run402 transfer — Project transfer, one noun for wallet, email, and owned-org recipients
 
 Usage:
-  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-collaborator developer]
+  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <project_id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-member developer]
   run402 transfer preview <transfer_id>
   run402 transfer list [--incoming | --outgoing] [--limit N] [--after <cursor>]
-  run402 transfer accept <transfer_id>
-  run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]
+  run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]
   run402 transfer cancel <transfer_id> [--reason <text>]
 
 Subcommands:
-  init        Initiate ownership change. --to <wallet> = two-party wallet transfer
-              (completed by 'accept'); --to <email> = email->org transfer (completed by 'claim');
+  init        Initiate ownership change. --to <wallet> = two-party wallet transfer;
+              --to <email> = email-addressed transfer; both are completed by 'accept'.
               --to-org <org_id> = same-actor move to an owned org (completes immediately).
   preview     Fetch the safe review document (pending transfer — kind-agnostic)
   list        List pending transfers (incoming default, or --outgoing) — pending rows unioned
-  accept      Accept an incoming WALLET transfer (your wallet must be the to_wallet)
-  claim       Claim an incoming EMAIL transfer into an org (--into <id>; omit = new org)
+  accept      Accept an incoming transfer, whatever its address (wallet: your wallet must be
+              the to_wallet; email: your verified email must match; --org <org_id> picks the
+              receiving org, omit = new org)
   cancel      Cancel a pending transfer of any kind
 
 Notes:
@@ -44,24 +44,24 @@ const SUB_HELP = {
   init: `run402 transfer init — Initiate a project transfer
 
 Usage:
-  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-collaborator developer]
+  run402 transfer init (--to <wallet|email> | --to-org <org_id>) [--project <project_id>] [--billing-policy migrate] [--message <text>] [--kysigned <record_id>] [--retain-member developer]
 
 Options:
-  --project <id>         Project id (defaults to the active project)
-  --to <wallet|email>    Recipient (required). A wallet uses the two-party rail (completed by
-                         'accept'); an email uses the email->org rail (completed by 'claim').
+  --project <project_id> Project id (defaults to the active project)
+  --to <wallet|email>    Recipient (required). A wallet is accepted by that wallet's signature;
+                         an email is accepted by a principal whose verified email matches.
   --to-org <org_id>      Destination org you already own. Same-actor only in the first gateway
                          release; completes immediately and returns project keys.
   --billing-policy <p>   Billing policy (wallet rail). Phase 1A only allows 'migrate' (default).
   --message <text>       Optional note shown to the recipient in preview + emails.
   --kysigned <record_id> Optional KySigned record id (wallet rail; Phase 1A: informational only).
-  --retain-collaborator <role>  Email recipients only (v1.91): keep a 'developer' membership in
-                         the recipient's org after the transfer. The recipient must accept it at
-                         claim (--accept-retained-collaborator); omit for full severance.
+  --retain-member <role> Email recipients only: keep a 'developer' membership in the
+                         recipient's org after the transfer. The recipient must accept it at
+                         accept (--accept-retained-member); omit for full severance.
 
 Notes:
   - Caller's wallet/session must currently own or admin the project (gateway re-checks fresh DB).
-  - Owner-side mutations on the project are frozen until accept/claim/cancel/expiry.
+  - Owner-side mutations on the project are frozen until accept/cancel/expiry.
     Owned-org moves complete immediately and do not create a pending window.
   - The project lease stays with your organization; it is NOT refunded.
 `,
@@ -88,16 +88,23 @@ Options:
   --limit N         Page size (default 50).
   --after <cursor>  Opaque keyset cursor (next_cursor from a prior page).
 `,
-  accept: `run402 transfer accept — Accept an incoming WALLET transfer
+  accept: `run402 transfer accept — Accept an incoming transfer, whatever its address
 
 Usage:
-  run402 transfer accept <transfer_id>
+  run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]
 
-Your wallet must equal the transfer's to_wallet. The accept transaction
-atomically: flips ownership, revokes the previous owner's CI bindings on the
-project, enqueues notifications to both parties, and stamps a
-'secrets_rotation_advised' advisory on the project. (Email transfers complete
-via 'claim', not 'accept'.)
+The one completion. A wallet-addressed transfer is accepted by the to_wallet's
+signature; an email-addressed transfer by a principal whose verified email
+matches, into an org you own (--org) or, omitted, a brand-new org. Either way
+the accept transaction atomically: flips ownership, revokes the previous
+owner's CI bindings on the project, enqueues notifications to both parties,
+stamps a 'secrets_rotation_advised' advisory on the project, and returns the
+project keys (saved to your keystore).
+
+Options:
+  --org <org_id>           Email-addressed only: the org to receive the project (omit = new org).
+  --accept-retained-member Email-addressed only: accept the sender's retained-developer-membership
+                           offer (see 'transfer preview' retain_member). Omit = full severance.
 `,
   cancel: `run402 transfer cancel — Cancel a pending transfer
 
@@ -108,19 +115,6 @@ Cancels a pending transfer of any kind. You must be authorized for the row's
 kind (a wallet signing party, or an owner/admin of the offering org / the
 addressed-email principal). Already-processed transfers return 409
 TRANSFER_ALREADY_PROCESSED.
-`,
-  claim: `run402 transfer claim — Claim an incoming EMAIL transfer
-
-Usage:
-  run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]
-
-Claims an email-addressed transfer into an org you own. Omit --into to claim into
-a brand-new org. This is the email analog of 'accept'.
-
-Options:
-  --into <org_id>       Org to claim into (omit = brand-new org).
-  --accept-retained-collaborator Accept the sender's v1.91 retained-developer-membership offer
-                                 (see 'transfer preview' retain_collaborator). Omit = full severance.
 `,
 };
 
@@ -129,7 +123,7 @@ const RETAIN_ROLES = new Set(["developer"]);
 
 async function init(args) {
   const parsedArgs = normalizeArgv(args);
-  const valueFlags = ["--project", "--to", "--to-org", "--billing-policy", "--message", "--kysigned", "--retain-collaborator"];
+  const valueFlags = ["--project", "--to", "--to-org", "--billing-policy", "--message", "--kysigned", "--retain-member"];
   assertKnownFlags(parsedArgs, [...valueFlags, "--help", "-h"], valueFlags);
   const extra = positionalArgs(parsedArgs, valueFlags);
   if (extra.length > 0) {
@@ -158,27 +152,27 @@ async function init(args) {
   }
   const message = flagValue(parsedArgs, "--message");
   const kysigned = flagValue(parsedArgs, "--kysigned");
-  const retainCollaborator = flagValue(parsedArgs, "--retain-collaborator");
+  const retainMember = flagValue(parsedArgs, "--retain-member");
 
   // One noun, three recipient shapes. --to keeps wallet/email auto-detection;
   // --to-org is explicit because org ids are not human-recipient addresses.
   const recipientKind = toOrg ? "org" : (to.includes("@") ? "email" : "wallet");
 
-  // --retain-collaborator (v1.91) is an email-only opt-in: the sender keeps a
-  // developer membership in the recipient's org (recipient must accept at claim).
-  if (retainCollaborator !== null) {
+  // --retain-member is an email-only opt-in: the sender keeps a developer
+  // membership in the recipient's org (the recipient must accept it at accept).
+  if (retainMember !== null) {
     if (recipientKind !== "email") {
       fail({
         code: "BAD_FLAG",
-        message: "--retain-collaborator applies only to email recipients.",
-        details: { flag: "--retain-collaborator" },
+        message: "--retain-member applies only to email recipients.",
+        details: { flag: "--retain-member" },
       });
     }
-    if (!RETAIN_ROLES.has(retainCollaborator)) {
+    if (!RETAIN_ROLES.has(retainMember)) {
       fail({
         code: "BAD_FLAG",
-        message: `Unsupported --retain-collaborator role: ${retainCollaborator}. Allowed: ${[...RETAIN_ROLES].join(", ")}.`,
-        details: { flag: "--retain-collaborator", value: retainCollaborator, allowed: [...RETAIN_ROLES] },
+        message: `Unsupported --retain-member role: ${retainMember}. Allowed: ${[...RETAIN_ROLES].join(", ")}.`,
+        details: { flag: "--retain-member", value: retainMember, allowed: [...RETAIN_ROLES] },
       });
     }
   }
@@ -198,7 +192,7 @@ async function init(args) {
   }
 
   // All recipient shapes initiate on the unified transfer endpoint — sign that path.
-  allowanceAuthHeaders(`/projects/v1/${projectId}/transfers`);
+  walletAuthHeaders(`/projects/v1/${projectId}/transfers`);
 
   try {
     let res;
@@ -213,7 +207,7 @@ async function init(args) {
         projectId,
         toEmail: to,
         message: message ?? undefined,
-        retainCollaborator: retainCollaborator ? { role: retainCollaborator } : undefined,
+        retainMember: retainMember ? { role: retainMember } : undefined,
       });
     } else {
       res = await getSdk().admin.transfers.initiate({
@@ -239,7 +233,7 @@ async function preview(args) {
   }
   const transferId = positionals[0];
   // Preview is kind-agnostic — one route serves wallet, email, and future org transfers.
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}`);
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}`);
 
   try {
     const data = await getSdk().admin.transfers.preview(transferId);
@@ -274,7 +268,7 @@ async function list(args) {
 
   // Incoming/outgoing are kind-agnostic — each returns the union of pending
   // wallet/email/future-org rows, tagged with recipient_kind.
-  allowanceAuthHeaders(`/agent/v1/transfers/${direction}`);
+  walletAuthHeaders(`/agent/v1/transfers/${direction}`);
 
   try {
     const result =
@@ -300,16 +294,24 @@ async function list(args) {
 
 async function accept(args) {
   const parsedArgs = normalizeArgv(args);
-  assertKnownFlags(parsedArgs, ["--help", "-h"]);
-  const positionals = positionalArgs(parsedArgs);
+  const valueFlags = ["--org"];
+  assertKnownFlags(parsedArgs, [...valueFlags, "--accept-retained-member", "--help", "-h"], valueFlags);
+  const positionals = positionalArgs(parsedArgs, valueFlags);
   if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer accept <transfer_id>" });
+    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]" });
   }
   const transferId = positionals[0];
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/accept`);
+  const orgId = flagValue(parsedArgs, "--org");
+  // Email-addressed rows only: accept the sender's retained-developer-membership
+  // offer (see the preview's `retain_member` block). Absent = full severance.
+  const acceptRetain = parsedArgs.includes("--accept-retained-member");
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}/accept`);
 
   try {
-    const data = await getSdk().admin.transfers.accept(transferId);
+    const data = await getSdk().admin.transfers.accept(transferId, {
+      orgId: orgId ?? undefined,
+      acceptRetainedMember: acceptRetain || undefined,
+    });
     console.log(JSON.stringify(data, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -327,7 +329,7 @@ async function cancel(args) {
   const transferId = positionals[0];
   const reason = flagValue(parsedArgs, "--reason");
   // Cancel is kind-agnostic — one route serves wallet and email transfers.
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/cancel`);
+  walletAuthHeaders(`/agent/v1/transfers/${transferId}/cancel`);
 
   try {
     const data = await getSdk().admin.transfers.cancel(transferId, { reason: reason ?? undefined });
@@ -337,32 +339,6 @@ async function cancel(args) {
   }
 }
 
-async function claim(args) {
-  const parsedArgs = normalizeArgv(args);
-  const valueFlags = ["--into"];
-  assertKnownFlags(parsedArgs, [...valueFlags, "--accept-retained-collaborator", "--help", "-h"], valueFlags);
-  const positionals = positionalArgs(parsedArgs, valueFlags);
-  if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer claim <transfer_id> [--into <org_id>] [--accept-retained-collaborator]" });
-  }
-  const transferId = positionals[0];
-  const into = flagValue(parsedArgs, "--into");
-  // v1.91: accept the sender's retained-developer-membership offer (see the
-  // preview's `retain_collaborator` block). Absent = full severance (default).
-  const acceptRetain = parsedArgs.includes("--accept-retained-collaborator");
-  allowanceAuthHeaders(`/agent/v1/transfers/${transferId}/claim`);
-
-  try {
-    const data = await getSdk().admin.transfers.claim(transferId, {
-      organizationId: into ?? undefined,
-      acceptRetainedCollaborator: acceptRetain || undefined,
-    });
-    console.log(JSON.stringify(data, null, 2));
-  } catch (err) {
-    reportSdkError(err);
-  }
-}
-
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") {
     console.log(HELP);
@@ -385,9 +361,6 @@ export async function run(sub, args) {
     case "accept":
       await accept(args);
       return;
-    case "claim":
-      await claim(args);
-      return;
     case "cancel":
       await cancel(args);
       return;

package/lib/up.mjs

@@ -7,7 +7,7 @@ import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
 import { createUpdateCheckScheduler, emitUpdateNotice } from "./update-check.mjs";
-import { allowanceAuthHeaders, isCoreApiTarget, updateProject } from "./config.mjs";
+import { walletAuthHeaders, isCoreApiTarget, updateProject } from "./config.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 
 const HELP = `run402 up — Provision/link/deploy the current app
@@ -27,7 +27,7 @@ Options:
   --dir <path>        Workspace directory to inspect (default: current dir).
   --tier <tier>       Bootstrap tier if no active Cloud tier exists
                       (prototype, hobby, team; default prototype).
-  -y, --yes           Approve recursive prerequisites/local writes (allowance,
+  -y, --yes           Approve recursive prerequisites/local writes (wallet,
                       tier, project creation, workspace link) for non-interactive runs.
   --check             Validate the manifest/config locally and print the
                       preflight, including the site inventory by content type
@@ -53,7 +53,7 @@ Options:
   --propagation-budget-s <n>
                       Maximum wall-clock seconds to wait for fresh edge
                       propagation during app HTTP verification (default 120).
-  --verify            After a deploy apply, wait for gateway/edge release
+  --verify            After the deploy, wait for gateway/edge release
                       coherence and attach the report to the final result.
   --no-propagation-wait
                       Return propagation_pending immediately when the edge is
@@ -373,7 +373,7 @@ export async function run(args = []) {
             ? undefined
             : undefined,
       });
-      // Cache the activated deployment id so `run402 subdomains claim` can
+      // Cache the activated deployment id so `run402 subdomains add` can
       // pass it as an optimization (the gateway binds the live release
       // without it). Best-effort: a keystore hiccup never fails `up`.
       {
@@ -773,12 +773,12 @@ async function readLocalGitState(workDir) {
  * inside `up`'s mental model" entry point to the same outcome.
  */
 async function runRepoOnly({ sdk, workDir, createdRepository, nested = false, opts, tier, idempotencyKey }) {
-  // `sdk.up()`'s action graph auto-approves prerequisites (allowance, tier)
+  // `sdk.up()`'s action graph auto-approves prerequisites (wallet, tier)
   // for a cold start; calling projects.provision directly bypasses that, so
   // this mirrors the SAME gate `run402 projects provision` itself uses —
-  // fail with the actionable NO_ALLOWANCE guidance rather than an opaque
+  // fail with the actionable NO_WALLET guidance rather than an opaque
   // auth error from the gateway.
-  if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) allowanceAuthHeaders("/projects/v1");
+  if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) walletAuthHeaders("/projects/v1");
   const name = flagValue(opts, "--name") ?? undefined;
   const provisioned = await sdk.projects.provision({ tier, name, idempotencyKey });
   createdRepository = await gitInitIfNeeded(workDir);

package/lib/wallet-context.mjs

@@ -25,7 +25,7 @@ import { join } from "node:path";
 import { fail } from "./sdk-errors.mjs";
 import { isValidProfileName } from "../core-dist/config.js";
 import { getDefaultWallet, profileExists, readMeta, profileDir } from "../core-dist/profiles.js";
-import { readAllowance } from "../core-dist/allowance.js";
+import { readWallet } from "../core-dist/wallet.js";
 import { describeRejectedValue } from "../core-dist/redact.js";
 // The binding file is a CHECKOUT-LEVEL CONTRACT read by more than one surface,
 // so its reader lives in core — `run402-mcp` ships core/dist but not cli/, and
@@ -301,12 +301,12 @@ function shortAddr(a) {
   return typeof a === "string" && a.length >= 12 ? `${a.slice(0, 6)}…${a.slice(-4)}` : a;
 }
 
-/** Best-effort address for display: meta.json (no key) first, allowance second. */
+/** Best-effort address for display: meta.json (no key) first, wallet second. */
 function walletAddress(name) {
   const meta = readMeta(name);
   if (meta?.address) return meta.address;
   try {
-    return readAllowance(join(profileDir(name), "allowance.json"))?.address ?? null;
+    return readWallet(join(profileDir(name), "wallet.json"))?.address ?? null;
   } catch {
     return null;
   }

package/lib/wallet-context.test.mjs

@@ -67,8 +67,8 @@ describe("splitWalletFlag", () => {
     assert.deepEqual(r.walletFlag, { flag: "--wallet", value: "kychon" });
   });
   it("strips --wallet=<value> mid-args", () => {
-    const r = splitWalletFlag(["deploy", "apply", "--wallet=foo", "--manifest", "x"]);
-    assert.deepEqual(r.argv, ["deploy", "apply", "--manifest", "x"]);
+    const r = splitWalletFlag(["deploy", "--wallet=foo", "--manifest", "x"]);
+    assert.deepEqual(r.argv, ["deploy", "--manifest", "x"]);
     assert.equal(r.walletFlag.value, "foo");
   });
   it("leaves --profile to `repos`, which owns it as the AWS credential profile", () => {
@@ -238,7 +238,7 @@ describe("enforceWalletExists — fail closed", () => {
   });
   it("no-op for an existing wallet", () => {
     ensureProfileDir("client-a");
-    writeFileSync(join(tmp, "profiles", "client-a", "allowance.json"), "{}");
+    writeFileSync(join(tmp, "profiles", "client-a", "wallet.json"), "{}");
     assert.doesNotThrow(() => enforceWalletExists({ name: "client-a", source: "binding" }, "deploy"));
   });
   it("fails closed for a missing wallet on a normal command", () => {