run402 4.93.2 → 4.94.0

package/lib/buzz.test.mjs

@@ -84,7 +84,7 @@ describe("run402 buzz CLI", () => {
           return {
             buzz_human_adoption_offer_id: `buzzhao_${"1".repeat(32)}`,
             status: "available",
-            handoff_url: `https://console.run402.com/buzz/adoptions/buzzhao_${"1".repeat(32)}`,
+            offer_url: `https://console.run402.com/buzz/adoptions/buzzhao_${"1".repeat(32)}`,
           };
         },
       },

package/lib/ci.mjs

@@ -34,7 +34,7 @@ Subcommands:
 `;
 
 const SUB_HELP = {
-  link: `run402 ci link github — Link GitHub Actions OIDC for deploy apply
+  link: `run402 ci link github — Link GitHub Actions OIDC for run402 deploy
 
 Usage:
   run402 ci link github [--project <id>] [--manifest <path>] [--repo <owner/repo>] [--branch <name> | --environment <name>] [--repository-id <id>] [--workflow <path>] [--expires-at <iso>] [--route-scope <pattern> ...] [--force]
@@ -245,7 +245,7 @@ ${environmentLine}    steps:
       - name: Deploy to run402
         # Redirect stdin from /dev/null: a CI runner's stdin is a FIFO/file that
         # older run402 CLIs counted as a second manifest source alongside --manifest.
-        run: npx --yes run402@${RUN402_VERSION} deploy apply --manifest ${shellQuote(manifest)} --project ${shellQuote(projectId)} < /dev/null
+        run: npx --yes run402@${RUN402_VERSION} deploy --manifest ${shellQuote(manifest)} --project ${shellQuote(projectId)} < /dev/null
 `;
 }
 
@@ -328,8 +328,8 @@ async function linkGithub(args) {
     signedDelegation = signCiDelegation(values, { apiBase: API });
   } catch (err) {
     fail({
-      code: "NO_ALLOWANCE",
-      message: err?.message || "No local allowance configured.",
+      code: "NO_WALLET",
+      message: err?.message || "No local wallet configured.",
       hint: "Run: run402 init",
     });
   }

package/lib/cold-start.mjs

@@ -1,11 +1,11 @@
 /**
  * `cold-start.mjs` — the minimal x402/Base-Sepolia cold-start chain
- * (kygit-handoff design D5): allowance → faucet → one x402 prototype
+ * (kygit-handoff design D5): wallet → faucet → one x402 prototype
  * payment. `repos create` (and so `kygit create`) folds this in when it is
  * refused `NO_ACTIVE_TIER`, so `kygit create` on a genuinely fresh machine
  * ends with a vault, no human signup, no cloud dashboard.
  *
- * This is the SAME shape `run402 init` already walks (allowance create →
+ * This is the SAME shape `run402 init` already walks (create the wallet →
  * balance check → faucet → tier), factored down to the x402/Base-Sepolia
  * default rail only (MPP/Tempo is `init`'s own separate concern — an agent
  * hitting NO_ACTIVE_TIER mid-`repos create` gets the default rail, not a
@@ -15,7 +15,7 @@
  * create` needs when it discovers there is no tier and nothing else has
  * set one up yet.
  *
- * add-room-invite design D9 splits the funded-wallet half (allowance →
+ * add-room-invite design D9 splits the funded-wallet half (wallet →
  * faucet-if-empty → brief settlement poll) out as {@link ensureFundedWallet}
  * — `rooms join <key>` needs exactly that half, with NO tier purchase and NO
  * project creation (the claim itself is the one x402 payment that funds the
@@ -23,42 +23,42 @@
  * `ensureFundedWallet` followed by the tier step — so every EXISTING caller
  * (`repos create`/`resume`/`join`) is unchanged.
  */
-import { readAllowance, saveAllowance } from "./config.mjs";
+import { readWallet, saveWallet } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 
 const USDC_ABI = [{ name: "balanceOf", type: "function", stateMutability: "view", inputs: [{ name: "account", type: "address" }], outputs: [{ name: "", type: "uint256" }] }];
 const USDC_SEPOLIA = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
 
 /**
- * Allowance → faucet-if-empty → brief settlement poll. NO tier purchase, no
+ * Wallet → faucet-if-empty → brief settlement poll. NO tier purchase, no
  * project creation — the caller decides what (if anything) to pay for next.
  *
  * @param {(line: string) => void} announce Called once per step, so the
  *   caller can print each one it took (client-surface spec: "announcing
  *   each step").
- * @returns {Promise<{allowance_created: boolean, faucet_requested: boolean, address: string}>}
+ * @returns {Promise<{wallet_created: boolean, faucet_requested: boolean, address: string}>}
  */
 export async function ensureFundedWallet(announce = () => {}) {
-  const out = { allowance_created: false, faucet_requested: false, address: "" };
+  const out = { wallet_created: false, faucet_requested: false, address: "" };
 
-  let allowance = readAllowance();
-  if (!allowance) {
+  let localWallet = readWallet();
+  if (!localWallet) {
     const { generatePrivateKey, privateKeyToAccount } = await import("viem/accounts");
     const privateKey = generatePrivateKey();
     const account = privateKeyToAccount(privateKey);
-    allowance = { address: account.address, privateKey, created: new Date().toISOString(), funded: false, rail: "x402" };
-    saveAllowance(allowance);
-    out.allowance_created = true;
-    announce(`allowance created: ${allowance.address}`);
+    localWallet = { address: account.address, privateKey, created: new Date().toISOString(), funded: false, rail: "x402" };
+    saveWallet(localWallet);
+    out.wallet_created = true;
+    announce(`wallet created: ${localWallet.address}`);
   }
-  out.address = allowance.address;
+  out.address = localWallet.address;
 
   const { createPublicClient, http } = await import("viem");
   const { baseSepolia } = await import("viem/chains");
   const client = createPublicClient({ chain: baseSepolia, transport: http() });
   let balance = 0;
   try {
-    balance = Number(await client.readContract({ address: USDC_SEPOLIA, abi: USDC_ABI, functionName: "balanceOf", args: [allowance.address] }));
+    balance = Number(await client.readContract({ address: USDC_SEPOLIA, abi: USDC_ABI, functionName: "balanceOf", args: [localWallet.address] }));
   } catch {
     /* an RPC hiccup here is not fatal — the payment below will surface a real failure if the balance really is zero */
   }
@@ -67,19 +67,19 @@ export async function ensureFundedWallet(announce = () => {}) {
     // The faucet is throttled (0.25 USDC / 24h): a throttle refusal is
     // surfaced with its wait and NEVER retried silently (client-surface
     // spec) — this call is not wrapped in a swallowing catch.
-    await getSdk().allowance.faucet(allowance.address);
+    await getSdk().wallets.faucet(localWallet.address);
     out.faucet_requested = true;
     announce("faucet requested — waiting briefly for on-chain confirmation");
     for (let i = 0; i < 30; i++) {
       await new Promise((r) => setTimeout(r, 1000));
       try {
-        balance = Number(await client.readContract({ address: USDC_SEPOLIA, abi: USDC_ABI, functionName: "balanceOf", args: [allowance.address] }));
+        balance = Number(await client.readContract({ address: USDC_SEPOLIA, abi: USDC_ABI, functionName: "balanceOf", args: [localWallet.address] }));
         if (balance > 0) break;
       } catch {
         /* keep polling */
       }
     }
-    saveAllowance({ ...allowance, funded: true, lastFaucet: new Date().toISOString() });
+    saveWallet({ ...localWallet, funded: true, lastFaucet: new Date().toISOString() });
   }
 
   return out;
@@ -91,13 +91,13 @@ export async function ensureFundedWallet(announce = () => {}) {
  * no edits.
  *
  * @param {(line: string) => void} announce Called once per step.
- * @returns {Promise<{allowance_created: boolean, faucet_requested: boolean, tier: object|null}>}
+ * @returns {Promise<{wallet_created: boolean, faucet_requested: boolean, tier: object|null}>}
  */
 export async function foldColdStartChain(announce = () => {}) {
   const funded = await ensureFundedWallet(announce);
 
-  announce("subscribing to the prototype tier (one x402 testnet payment, perpetual)");
+  announce("setting the prototype tier (one x402 testnet payment; the free tier, no lease)");
   const tier = await getSdk().tier.set("prototype");
   announce(`prototype tier active${tier?.status === "already_active" ? " (already active)" : ""}`);
-  return { allowance_created: funded.allowance_created, faucet_requested: funded.faucet_requested, tier };
+  return { wallet_created: funded.wallet_created, faucet_requested: funded.faucet_requested, tier };
 }

package/lib/command-manifest.mjs

@@ -107,6 +107,8 @@ export const COMMAND_MANIFEST = [
   { path: ["wallets", "unbind"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["wallets", "import"], positionals: [p("name")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["gate-import-wallet", "--key", "__FIXTURE_FILE__"] },
   { path: ["wallets", "rm"], positionals: [p("name")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["no-such-wallet", "--yes"] },
+  { path: ["wallets", "fund"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], skipBehavioral: "polls on-chain funding with sleeps" },
+  { path: ["wallets", "balance"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["wallets", "lightning"], positionals: [p("action", { required: false })], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["status"] },
 
   // ── credentials (gateway project credentials) ────────────────────────────
@@ -124,14 +126,6 @@ export const COMMAND_MANIFEST = [
   { path: ["credentials", "project-keys", "export"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--reveal"] },
   { path: ["credentials", "project-keys", "remove"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [] },
 
-  // ── allowance ────────────────────────────────────────────────────────────
-  { path: ["allowance", "status"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["allowance", "create"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], skipBehavioral: "creates a real local wallet key outside the gate's scratch profile" },
-  { path: ["allowance", "fund"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], skipBehavioral: "polls on-chain funding with sleeps" },
-  { path: ["allowance", "balance"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["allowance", "export"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["allowance", "checkout"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--amount", "5000000"] },
-  { path: ["allowance", "history"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
 
   // ── tier ─────────────────────────────────────────────────────────────────
   { path: ["tier", "status"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
@@ -186,18 +180,21 @@ export const COMMAND_MANIFEST = [
   { path: ["core", "projects", "import"], positionals: [p("archive_path")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["__FIXTURE_FILE__", "--name", "gate-import"] },
 
   // ── deploy (unified deploy v2) ───────────────────────────────────────────
-  { path: ["deploy", "apply"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--spec", "{}", "--check"], runStyle: "deployV2" },
+  // Bare `run402 deploy` IS the deploy (a verb); the family's subcommands
+  // follow. Dispatched flat through deploy.mjs so the gate exercises the
+  // same argv decision a person's shell does.
+  { path: ["deploy"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--spec", "{}", "--check"], runStyle: "flat" },
   { path: ["deploy", "rehearse"], positionals: [p("plan_id", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["plan_gate1"], runStyle: "deployV2" },
   { path: ["deploy", "promote"], positionals: [p("release_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["rel_gate1"], runStyle: "deployV2" },
   { path: ["deploy", "resume"], positionals: [p("operation_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["op_gate1"], runStyle: "deployV2" },
+  { path: ["deploy", "status"], positionals: [p("operation_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["op_gate1"], runStyle: "deployV2" },
   { path: ["deploy", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "deployV2" },
   { path: ["deploy", "events"], positionals: [p("operation_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["op_gate1"], runStyle: "deployV2" },
   { path: ["deploy", "verify"], positionals: [p("operation_id", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["op_gate1"], runStyle: "deployV2" },
-  { path: ["deploy", "release", "get"], positionals: [p("release_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["rel_gate1"], runStyle: "deployV2" },
-  { path: ["deploy", "release", "active"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "deployV2" },
-  { path: ["deploy", "release", "diff"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--from", "empty", "--to", "active"], runStyle: "deployV2" },
-  { path: ["deploy", "diagnose"], positionals: [p("url")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["https://example.com/"], runStyle: "deployV2" },
-  { path: ["deploy", "resolve"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--url", "https://example.com/"], runStyle: "deployV2" },
+  { path: ["deploy", "releases", "get"], positionals: [p("release_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["rel_gate1"], runStyle: "deployV2" },
+  { path: ["deploy", "releases", "active"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "deployV2" },
+  { path: ["deploy", "releases", "diff"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--from", "empty", "--to", "active"], runStyle: "deployV2" },
+  { path: ["deploy", "resolve"], positionals: [p("url", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["https://example.com/"], runStyle: "deployV2" },
 
   // ── ci ───────────────────────────────────────────────────────────────────
   { path: ["ci", "link"], positionals: [p("provider")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["github"] },
@@ -210,7 +207,6 @@ export const COMMAND_MANIFEST = [
   { path: ["transfer", "preview"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["transfer", "accept"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
-  { path: ["transfer", "claim"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "cancel"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
 
   // ── org ──────────────────────────────────────────────────────────────────
@@ -266,9 +262,11 @@ export const COMMAND_MANIFEST = [
   // add-room-invite design D9: `rooms join` is one verb, two forms — no
   // positional registers a presence (the behaviorally-tested path, unchanged
   // by the optional positional below since minimalArgs stays empty); a
-  // `kri1_…` positional claims a room seat first (a real x402 payment + an
+  // `kri1_…` positional redeems the key first (a real x402 payment + an
   // org-membership mutation), so that form is never behaviorally exercised
   // here — the same reasoning `repos join`'s own row states.
+  { path: ["rooms", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
+  { path: ["rooms", "get"], positionals: [p("room_key")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["run402-dev"], runStyle: "sub" },
   { path: ["rooms", "join"], positionals: [p("key", { required: false })], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["rooms", "invite"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "mints a single-use bearer key from a live room, registering the inviter's presence and posting a real room message — never run against the gate's own checkout" },
   { path: ["rooms", "leave"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
@@ -375,7 +373,7 @@ export const COMMAND_MANIFEST = [
   { path: ["sites", "deploy-dir"], positionals: [p("dir")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["__SCRATCH_DIR__"] },
 
   // ── subdomains ───────────────────────────────────────────────────────────
-  { path: ["subdomains", "claim"], positionals: [p("name")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["gate-sub"] },
+  { path: ["subdomains", "add"], positionals: [p("name")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["gate-sub"] },
   { path: ["subdomains", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["subdomains", "delete"], positionals: [p("name")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["gate-sub", "--confirm"] },
 
@@ -427,18 +425,16 @@ export const COMMAND_MANIFEST = [
   { path: ["email", "webhooks", "deliveries"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["email", "webhooks", "redrive"], positionals: [p("delivery_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["dlv_gate1"] },
 
-  // ── message / agent / operator ───────────────────────────────────────────
+  // ── message / agent / sign-in ────────────────────────────────────────────
   { path: ["feedback", "send"], positionals: [p("words", { variadic: true })], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["hello", "from", "the", "gate"] },
   { path: ["agent", "contact"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--name", "gate-agent"] },
   { path: ["agent", "status"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["agent", "verify-email"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["agent", "passkey"], positionals: [p("action")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["enroll"] },
-  { path: ["operator", "login"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], skipBehavioral: "opens a browser / loopback listener" },
-  { path: ["operator", "logout"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["operator", "overview"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["operator", "whoami"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["operator", "claim-wallet-org"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
-  { path: ["operator", "approve"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--action", "org.project.create", "--org", "org_gate1", "--no-open"] },
+  { path: ["login"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], runStyle: "flat", skipBehavioral: "opens a browser / loopback listener" },
+  { path: ["logout"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], runStyle: "flat" },
+  { path: ["whoami"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [], runStyle: "flat", skipBehavioral: "requires live principal authentication" },
+  { path: ["approve"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--action", "org.project.create", "--org", "org_gate1", "--no-open"], runStyle: "flat" },
 
   // ── auth ─────────────────────────────────────────────────────────────────
   { path: ["auth", "magic-link"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--email", "gate@example.com", "--redirect", "https://example.com/cb"] },
@@ -497,7 +493,6 @@ export const COMMAND_MANIFEST = [
 // Families deliberately absent from the manifest, consumed by the gate's
 // completeness check against cli.mjs's dispatch switch.
 export const SKIPPED_FAMILIES = {
-  "apply": "pure alias for `deploy apply` (covered by the deploy family)",
   "dev": "interactive wrapper that spawns `astro dev`",
   // RESERVED, not dispatched: every `run402 message …` fails with
   // COMMAND_REMOVED pointing at `feedback send` / `messages send` /
@@ -538,15 +533,6 @@ export const SKIPPED_FAMILIES = {
 export const RESERVED_SUBCOMMANDS = {
   "source-access:export": "moved to `repos recovery-bundle` — the artifact `repos recover --bundle` consumes belongs to the repos family",
   "source-access:status": "moved to `repos access` — your own wrapper custody rides its member_custody block; the org advisory is `doctor --only recovery_posture`",
-  "rooms:who": "renamed to `rooms join` — an interrogative must not name a write",
-  "rooms:send": "moved to `messages send` — the verb acts on a message",
-  // The routes and SDK methods for room list/get exist (agent-room-lifecycle);
-  // only these two SPELLINGS are held back, because they were freed from
-  // meaning "list/get MESSAGES" and a reused spelling changes meaning without
-  // ever failing. One major, then they may name the room.
-  "rooms:list": "moved to `messages list` — the verb acts on a message",
-  "rooms:get": "moved to `messages get` — the verb acts on a message",
-  "rooms:ack": "moved to `messages ack` — the verb acts on a message",
   "escalations:contacts": "merged into `contacts` — the ladder and Telegram channels are one question",
   // Every `gitvault <verb>` spelling. Nine
   // answer COMMAND_MOVED naming their `repos` successor; `push` and

package/lib/config.mjs

@@ -12,22 +12,22 @@ import {
   getLegacyProjectsPath,
   getProfileStatePath,
   getProjectCredentialsPath,
-  getAllowancePath,
+  getWalletPath,
   configureApiBase,
   isCoreApiTarget,
   readApiTargetConfig,
 } from "../core-dist/config.js";
-import { readAllowance as coreReadAllowance, saveAllowance as coreSaveAllowance } from "../core-dist/allowance.js";
+import { readWallet as coreReadWallet, saveWallet as coreSaveWallet } from "../core-dist/wallet.js";
 import { loadKeyStore, getProject, saveProject, updateProject, removeProject, saveKeyStore, getActiveProjectId, setActiveProjectId } from "../core-dist/keystore.js";
-import { getAllowanceAuthHeaders as coreGetAllowanceAuthHeaders } from "../core-dist/allowance-auth.js";
+import { getWalletAuthHeaders as coreGetWalletAuthHeaders } from "../core-dist/wallet-auth.js";
 import { fail } from "./sdk-errors.mjs";
 import { initializeWalletAction, selectProjectAction } from "./next-actions.mjs";
 
 // Wallet-dependent paths are exposed as getters (preferred — they always
 // reflect the active profile, even if some future code path imports this module
-// before wallet resolution). Production code (init/doctor/allowance) uses these.
+// before wallet resolution). Production code (init/doctor/wallet) uses these.
 export function configDir() { return getConfigDir(); }
-export function allowanceFile() { return getAllowancePath(); }
+export function walletFile() { return getWalletPath(); }
 export function projectCredentialsFile() { return getProjectCredentialsPath(); }
 export function profileStateFile() { return getProfileStatePath(); }
 export function legacyProjectsFile() { return getLegacyProjectsPath(); }
@@ -45,7 +45,7 @@ export function activeProfile() { return getActiveProfile(); }
 // module, and tests set RUN402_CONFIG_DIR before importing. New code should
 // prefer the getters above.
 export const CONFIG_DIR = getConfigDir();
-export const ALLOWANCE_FILE = getAllowancePath();
+export const WALLET_FILE = getWalletPath();
 export const PROJECTS_FILE = getProjectCredentialsPath();
 export const PROJECT_CREDENTIALS_FILE = getProjectCredentialsPath();
 export const PROFILE_STATE_FILE = getProfileStatePath();
@@ -54,40 +54,40 @@ export const PROFILE_STATE_FILE = getProfileStatePath();
 export const API = getApiBase();
 
 /**
- * Wraps core's `readAllowance()` and converts the malformed-shape throw
+ * Wraps core's `readWallet()` and converts the malformed-shape throw
  * into the canonical CLI failure envelope. Without this guard, every
- * CLI subcommand that touches the allowance leaks a Node stack trace and
- * source paths the moment a user has a malformed `allowance.json`.
+ * CLI subcommand that touches the wallet leaks a Node stack trace and
+ * source paths the moment a user has a malformed `wallet.json`.
  *
  * The unparseable-JSON case still returns `null` (matching the historical
- * "no_allowance" UX); only valid-JSON-but-wrong-shape becomes a structured
- * error with `code: BAD_ALLOWANCE_FILE`.
+ * "no_wallet" UX); only valid-JSON-but-wrong-shape becomes a structured
+ * error with `code: BAD_WALLET_FILE`.
  */
-export function readAllowance() {
+export function readWallet() {
   try {
-    return coreReadAllowance();
+    return coreReadWallet();
   } catch (err) {
     fail({
-      code: "BAD_ALLOWANCE_FILE",
-      message: err?.message ?? "allowance.json is malformed",
-      hint: "Back up ~/.config/run402/allowance.json and run 'run402 init' to recreate it.",
-      details: { path: allowanceFile() },
+      code: "BAD_WALLET_FILE",
+      message: err?.message ?? "wallet.json is malformed",
+      hint: "Back up ~/.config/run402/wallet.json and run 'run402 init' to recreate it.",
+      details: { path: walletFile() },
       next_actions: [initializeWalletAction()],
     });
   }
 }
 
-export function saveAllowance(data) {
-  coreSaveAllowance(data);
+export function saveWallet(data) {
+  coreSaveWallet(data);
 }
 
-export function allowanceAuthHeaders(path) {
-  const headers = coreGetAllowanceAuthHeaders(path);
+export function walletAuthHeaders(path) {
+  const headers = coreGetWalletAuthHeaders(path);
   if (!headers) {
     fail({
-      code: "NO_ALLOWANCE",
-      message: "No agent allowance found.",
-      hint: "Run: run402 allowance create",
+      code: "NO_WALLET",
+      message: "No local wallet found.",
+      hint: "Run: run402 init",
       next_actions: [initializeWalletAction()],
     });
   }

package/lib/contacts.mjs

@@ -18,11 +18,11 @@
  * `--kind` flag nobody could answer without looking it up.
  *
  * HTTP paths are unchanged (`/agent/v1/notifications/channels*`,
- * `/orgs/v1/:org_id/escalation-contacts*`); the allowance auth headers below
+ * `/orgs/v1/:org_id/escalation-contacts*`); the SIWX auth headers below
  * are PATH-scoped and must keep naming the real routes.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
-import { operatorProofs } from "./operator-proofs.mjs";
+import { walletAuthHeaders } from "./config.mjs";
+import { sessionProofs } from "./session-proofs.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -59,7 +59,7 @@ Two kinds, one question:
 Every row carries \`kind\`. \`rm\` takes either kind's id and works out which.
 
 Notes:
-  - Adding an address with no verified operator email is ACCEPTED with a
+  - Adding an address with no verified contact email is ACCEPTED with a
     reachability warning — you must be able to configure the chain before the
     humans are bound.
   - What actually landed is \`run402 deliveries\`.
@@ -69,7 +69,7 @@ async function preferences(args) {
   const parsedArgs = normalizeArgv(args);
   assertKnownFlags(parsedArgs, ["--help", "-h"]);
   const positionals = positionalArgs(parsedArgs);
-  allowanceAuthHeaders("/agent/v1/notifications/preferences");
+  walletAuthHeaders("/agent/v1/notifications/preferences");
 
   if (positionals.length === 0) {
     // GET preferences
@@ -104,7 +104,7 @@ async function preferences(args) {
     }
   }
   try {
-    const data = await getSdk().admin.setNotificationPreferences(patch, operatorProofs("/agent/v1/notifications/preferences"));
+    const data = await getSdk().admin.setNotificationPreferences(patch, sessionProofs("/agent/v1/notifications/preferences"));
     console.log(JSON.stringify(data, null, 2));
   } catch (err) {
     reportSdkError(err);
@@ -185,7 +185,7 @@ async function channelsConnect(args) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for notifications channels connect: ${positionals[1]}` });
   }
 
-  const proofs = operatorProofs("/agent/v1/notifications/channels/telegram");
+  const proofs = sessionProofs("/agent/v1/notifications/channels/telegram");
   let pending;
   try {
     pending = await getSdk().admin.channels.connectTelegram(label ? { label } : {}, proofs);
@@ -215,7 +215,7 @@ async function channelsConnect(args) {
 }
 
 async function channelsList() {
-  allowanceAuthHeaders("/agent/v1/notifications/channels");
+  walletAuthHeaders("/agent/v1/notifications/channels");
   try {
     console.log(JSON.stringify(await getSdk().admin.channels.list(), null, 2));
   } catch (err) {
@@ -232,9 +232,9 @@ async function channelsRevoke(args) {
     command: "run402 notifications channels revoke <binding_id>",
     missing: "Missing <binding_id>.",
   });
-  allowanceAuthHeaders("/agent/v1/notifications/channels/telegram");
+  walletAuthHeaders("/agent/v1/notifications/channels/telegram");
   try {
-    console.log(JSON.stringify(await getSdk().admin.channels.revokeTelegram(bindingId, operatorProofs("/agent/v1/notifications/channels/telegram")), null, 2));
+    console.log(JSON.stringify(await getSdk().admin.channels.revokeTelegram(bindingId, sessionProofs("/agent/v1/notifications/channels/telegram")), null, 2));
   } catch (err) {
     reportSdkError(err);
   }
@@ -280,7 +280,7 @@ async function test(args) {
   const source = flagValue(parsedArgs, "--source");
   if (source !== null) assertAllowedValue(source, ["app", "platform"], "--source");
   const eventType = flagValue(parsedArgs, "--type");
-  allowanceAuthHeaders("/agent/v1/notifications/test");
+  walletAuthHeaders("/agent/v1/notifications/test");
   const opts = {};
   if (source) opts.source = source;
   if (eventType) opts.eventType = eventType;
@@ -319,7 +319,7 @@ async function listContacts(args) {
   }
 
   try {
-    allowanceAuthHeaders("/agent/v1/notifications/channels");
+    walletAuthHeaders("/agent/v1/notifications/channels");
     const res = await sdk.admin.channels.list();
     for (const ch of res.telegram ?? []) {
       rows.push({ kind: "telegram", id: ch.binding_id ?? ch.id, ...ch });
@@ -354,7 +354,7 @@ async function removeContact(args) {
         return;
       }
     }
-    allowanceAuthHeaders("/agent/v1/notifications/channels");
+    walletAuthHeaders("/agent/v1/notifications/channels");
     const chans = await sdk.admin.channels.list();
     const chan = (chans.telegram ?? []).find((c) => (c.binding_id ?? c.id) === id);
     if (chan) {

package/lib/contracts.mjs

@@ -14,7 +14,7 @@ import {
 const HELP = `run402 contracts — KMS-backed Ethereum signers for smart-contract calls
 
   Pricing: $0.04/day per signer ($1.20/month) plus $0.000005 per contract call.
-  Signer creation requires $1.20 in cash credit (30 days of rent).
+  Signer creation requires $1.20 of allowance (30 days of rent).
   Non-custodial: see https://run402.com/humans/terms.html#non-custodial-kms-wallets
 
 Usage:

package/lib/credentials.mjs

@@ -48,7 +48,7 @@ Notes:
   - 'issue', 'rotate' and 'revoke' need owner membership on the project's org
     plus a fresh step-up, so a scoped agent credential can never escalate
     itself into a permanent root. Authenticate with a wallet (SIWX) or a
-    control-plane session ('run402 operator login --step-up').
+    sign-in session ('run402 login').
   - 'token' is the exception: a delegate can mint one with no human present.
   - Secrets are returned EXACTLY ONCE and are never recoverable. Full JSON goes
     to stdout so you can pipe it; the warnings go to stderr.
@@ -126,7 +126,7 @@ anon/service keys, or "rotatable" once it holds credentials it can revoke
 individually.
 
 There is deliberately NO deadline: retirement is gated on conditions (every
-tenant migrated, 30 consecutive days of zero legacy-key use, explicit operator
+tenant migrated, 30 consecutive days of zero legacy-key use, explicit staff
 approval), not a date. Read retirement.gated_on rather than planning against a
 date the platform has not committed to.
 `,

package/lib/daemon-path.mjs

@@ -4,7 +4,7 @@
  * builtins (pinned by the import-graph gate test), so it must stay tiny.
  *
  * The socket lives INSIDE the client configuration directory — the same
- * 0700 trust boundary that already holds the allowance private key and the
+ * 0700 trust boundary that already holds the wallet private key and the
  * gitvault keystore — and its path is keyed by CLI version, so a CLI
  * upgrade resolves a NEW path: the new client never reaches the old daemon,
  * which idles out on its own. Windows uses a named pipe whose name carries

package/lib/delegates.mjs

@@ -32,7 +32,7 @@ Notes:
   - A delegate can never be an owner, and is revocable and expiring.
   - The token is shown ONCE and is not recoverable. Store it immediately;
     if you lose it, 'rotate' issues a new one.
-  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy apply ...
+  - Use it with: RUN402_DELEGATE_TOKEN=<token> run402 deploy ...
   - JSON in, JSON out.
 
 Why this exists:

package/lib/deliveries.mjs

@@ -7,12 +7,12 @@
  * produces them, which is now `contacts` and `subscriptions`.
  *
  * HTTP paths are unchanged (`/agent/v1/notifications*`) — this is client
- * vocabulary, and the allowance auth headers below are PATH-scoped, so they
+ * vocabulary, and the SIWX auth headers below are PATH-scoped, so they
  * must keep naming the real route. Renaming them would ship broken auth
  * against a live path, which is exactly how the `feedback` rename nearly went
  * wrong.
  */
-import { allowanceAuthHeaders } from "./config.mjs";
+import { walletAuthHeaders } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -47,7 +47,7 @@ async function list(args) {
   if (extra.length > 0) {
     fail({ code: "BAD_USAGE", message: `Unexpected argument for notifications list: ${extra[0]}` });
   }
-  allowanceAuthHeaders("/agent/v1/notifications");
+  walletAuthHeaders("/agent/v1/notifications");
   const opts = {};
   const type = flagValue(parsedArgs, "--type");
   const since = flagValue(parsedArgs, "--since");
@@ -72,7 +72,7 @@ async function get(args) {
   if (positionals.length !== 1) {
     fail({ code: "BAD_USAGE", message: "Usage: run402 notifications get <id>" });
   }
-  allowanceAuthHeaders("/agent/v1/notifications");
+  walletAuthHeaders("/agent/v1/notifications");
   try {
     const data = await getSdk().admin.getNotification(positionals[0]);
     console.log(JSON.stringify(data, null, 2));

package/lib/deploy-rehearse-discovery.test.mjs

@@ -3,21 +3,21 @@ import assert from "node:assert/strict";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { discoverRehearseManifest } from "./deploy-v2.mjs";
+import { discoverDeployManifest } from "./deploy-v2.mjs";
 
-describe("deploy rehearse — manifest discovery (the way up does it)", () => {
+describe("deploy / deploy rehearse — manifest discovery (the way up does it)", () => {
   it("prefers run402.json, then run402.deploy.json, then app.json, then executable configs", () => {
     const dir = mkdtempSync(join(tmpdir(), "run402-rehearse-discover-"));
     try {
-      assert.equal(discoverRehearseManifest(dir), null);
+      assert.equal(discoverDeployManifest(dir), null);
       writeFileSync(join(dir, "run402.deploy.ts"), "export default {}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.deploy.ts"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.deploy.ts"));
       writeFileSync(join(dir, "app.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "app.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "app.json"));
       writeFileSync(join(dir, "run402.deploy.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.deploy.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.deploy.json"));
       writeFileSync(join(dir, "run402.json"), "{}");
-      assert.equal(discoverRehearseManifest(dir), join(dir, "run402.json"));
+      assert.equal(discoverDeployManifest(dir), join(dir, "run402.json"));
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }