run402 4.93.2 → 4.95.0

package/lib/pay.mjs

@@ -30,7 +30,7 @@ Examples:
   run402 pay https://seller.example/translate --method POST \
     --body '{"text":"hello"}' --max-usd 0.05 --idempotency-key translation:1
 
-The command uses the same allowance wallet and bounded x402 buyer as the SDK.
+The command uses the same wallet and bounded x402 buyer as the SDK.
 An unpriced URL is passed through with payment: null.
 On trusted Run402 PAYMENT_INTENT_PENDING, wait for Retry-After and repeat this
 identical command with the same payer and --idempotency-key. Never change the key.

package/lib/projects.mjs

@@ -1,8 +1,7 @@
 import { readFileSync } from "fs";
-import { allowanceAuthHeaders, resolveProjectId, getActiveProjectId, isCoreApiTarget } from "./config.mjs";
-import { loadLiveOperatorSession } from "../core-dist/operator-session.js";
+import { walletAuthHeaders, resolveProjectId, getActiveProjectId, isCoreApiTarget } from "./config.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
-import { withAutoApprove } from "./operator.mjs";
+import { withAutoApprove } from "./sign-in.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail, parseFlagJson } from "./sdk-errors.mjs";
 import { stampOrgFromProject } from "./org-context.mjs";
@@ -15,27 +14,26 @@ Usage:
 
 Subcommands:
   quote                                   Show pricing tiers
-  provision [--tier <tier>] [--name <n>] [--org <id>]  Provision a new Postgres project
-  use   <id>                              Set the active project (used as default for other commands)
-  list [--org <id>] [--all]               List your projects from the server (name, site_url, custom domains, org_id, active marker)
-  rename <id> --name <label>              Rename a project (fix an auto-generated name)
+  provision [--tier <tier>] [--name <n>] [--org <org_id>]  Provision a new Postgres project
+  use   <project_id>                      Set the active project (used as default for other commands)
+  list [--org <org_id>] [--all]               List your projects from the server (name, site_url, custom domains, org_id, active marker)
+  rename <project_id> --name <label>      Rename a project (fix an auto-generated name)
   tenant-payments [project_id] [--status <s>]  List redacted tenant x402 payments for priced routes
-  get   [id]                              Authoritative server read: status, org, tier, active deploy, mailbox, usage vs limits (live; no keys)
+  get   [project_id]                      Authoritative server read: status, org, tier, active deploy, mailbox, usage vs limits (live; no keys)
   current                                 Show the active project pointer and validation status
-  sql   "<query>" [--project <id>] [--file <path>] [--params '<json>']  Run a SQL query (supports parameterized queries)
-  rest  <table> [--query "<params>"] [--project <id>]  Query a table via the REST API (PostgREST)
-  usage [id]                              Show compute/storage usage for a project
-  costs [id] [--window <w>]               Show admin-only per-project revenue/cost/margin
-  schema [id]                             Inspect the database schema
-  apply-expose [id] <manifest_json>       Apply a declarative authorization manifest
-  apply-expose [id] --file <path>         Apply a manifest from a JSON file
-  validate-expose [id] <manifest_json>    Validate an authorization manifest without applying it
-  validate-expose [id] --file <path>      Validate a manifest file without mutating the project
-  get-expose   [id]                       Get the current authorization manifest
-  delete [id] --confirm                   Immediately and irreversibly delete a project (cascade purge) and remove from local state. Requires --confirm.
-  promote-user [id] <email>               Promote a user to project_admin role
-  demote-user  [id] <email>               Demote a user from project_admin role
-  export [id] [archive options]           Export a portable Run402 Core archive
+  sql   "<query>" [--project <project_id>] [--file <path>] [--params '<json>']  Run a SQL query (supports parameterized queries)
+  rest  <table> [--query "<params>"] [--project <project_id>]  Query a table via the REST API (PostgREST)
+  usage [project_id]              Show compute/storage usage for a project
+  costs [project_id] [--window <w>]       Show admin-only per-project revenue/cost/margin
+  schema [project_id]             Inspect the database schema
+  apply-expose [project_id] <manifest_json>       Apply a declarative authorization manifest
+  apply-expose [project_id] --file <path>         Apply a manifest from a JSON file
+  validate-expose [project_id] <manifest_json>    Validate an authorization manifest without applying it
+  validate-expose [project_id] --file <path>      Validate a manifest file without mutating the project
+  get-expose   [project_id]                       Get the current authorization manifest
+  delete [project_id] --confirm                   Immediately and irreversibly delete a project (cascade purge) and remove from local state. Requires --confirm.
+  promote-user [project_id] <email>               Promote a user to project_admin role
+  demote-user  [project_id] <email>               Demote a user from project_admin role
 
 Examples:
   run402 projects quote
@@ -60,7 +58,6 @@ Examples:
   run402 projects apply-expose prj_abc123 --file manifest.json
   run402 projects get-expose prj_abc123
   run402 projects delete prj_abc123 --confirm
-  run402 projects export prj_abc123 --wait --output ./project.r402ar --json
 
 Global options (any command):
   --wallet <name>   Use a named wallet (profile) for this command. Precedence:
@@ -68,23 +65,23 @@ Global options (any command):
                     'run402 wallets use' default > 'default'. See 'run402 wallets'.
 
 Notes:
-  - <id> is the project_id shown in 'run402 projects list' (prefix: 'prj_')
-  - Most commands that take <id> default to the active project when omitted
-    (set it with 'run402 projects use <id>'). Project IDs start with 'prj_';
+  - <project_id> is the project_id shown in 'run402 projects list' (prefix: 'prj_')
+  - Most commands that take <project_id> default to the active project when omitted
+    (set it with 'run402 projects use <project_id>'). Project IDs start with 'prj_';
     any first positional that doesn't is treated as the next argument instead.
   - 'list', 'get', and 'use' are SERVER-authoritative project identity flows.
     Local project keys live under 'run402 credentials project-keys ...'.
   - 'list' is a SERVER read, not the local key cache: it shows every project the
     active wallet can reach (membership-scoped), with name, site_url, custom
-    domains, and org_id. '--org <id>' filters to one org; '--all' reads the
-    cross-wallet inventory for every wallet controlling your operator email
-    (run 'run402 operator login' first for the union, else it falls back to the
-    current wallet's slice). The 'active' marker still comes from local state.
+    domains, and org_id. '--org <org_id>' filters to one org; '--all' reads every
+    project you can reach across all your orgs (as your sign-in session after
+    'run402 login', else as the current wallet). The 'active' marker still
+    comes from local state.
   - 'rename' fixes a project's display name. You must be an org admin (or hold a
     project:write grant) on the owning org; it works even if the project was
     never provisioned from this machine.
   - 'rest' uses PostgREST query syntax (table name + optional query string)
-  - 'provision' requires a funded allowance on Run402 Cloud. Against a
+  - 'provision' requires a funded wallet on Run402 Cloud. Against a
     configured Run402 Core target, it creates a local Core project without
     payment.
   - 'apply-expose' declares the full authorization surface (tables, views, RPCs)
@@ -109,17 +106,16 @@ const SUB_HELP = {
   list: `run402 projects list — List your projects from the server
 
 Usage:
-  run402 projects list [--org <id>] [--all]
+  run402 projects list [--org <org_id>] [--all]
 
 Options:
-  --org <id>          Filter to projects owned by one org (organization).
+  --org <org_id>          Filter to projects owned by one org (organization).
                       Authorize-before-reveal: a non-member or guessed id is a
                       403; a non-UUID id is a 400.
-  --all               Read the cross-wallet inventory across every wallet
-                      controlling your operator email. Run 'run402 operator
-                      login' first for the union; without a session it falls
-                      back to the current wallet's slice. Mutually exclusive
-                      with --org.
+  --all               Read every project you can reach across all your orgs
+                      (GET /agent/v1/me/projects). After 'run402 login' it
+                      reads as your sign-in session; without one, as the
+                      current wallet. Mutually exclusive with --org.
 
 Notes:
   - This is a SERVER read (membership-scoped), not the local keystore. Each row
@@ -137,10 +133,10 @@ Examples:
 	  rename: `run402 projects rename — Rename a project
 
 Usage:
-  run402 projects rename <id> --name <label>
+  run402 projects rename <project_id> --name <label>
 
 Arguments:
-  <id>                Project ID (prefix: 'prj_'). Required.
+  <project_id>                Project ID (prefix: 'prj_'). Required.
 
 Options:
   --name <label>      New display name (1-200 chars, no control characters).
@@ -185,20 +181,20 @@ Notes:
   provision: `run402 projects provision — Provision a new Postgres project
 
 Usage:
-  run402 projects provision [--tier <tier>] [--name <name>] [--org <id>] [--idempotency-key <key>]
+  run402 projects provision [--tier <tier>] [--name <name>] [--org <org_id>] [--idempotency-key <key>]
 
 Options:
   --tier <tier>       Tier for the new project (default: prototype)
   --name <name>       Human-readable name for the project
-  --org <id>          Provision into an EXISTING org (needs developer+ on it).
+  --org <org_id>          Provision into an EXISTING org (needs developer+ on it).
                       Omit for the cold-start path. Tier is org-governed.
   --idempotency-key <key>  Retry-safe key: re-running with the same key returns
                       the existing project instead of duplicating it. Auto-derived
                       from --name when omitted; an unnamed provision stays un-keyed.
 
 Notes:
-  - Payment is automatic via x402 on Run402 Cloud; requires a funded allowance.
-    Against a configured Run402 Core target, no Cloud tier/allowance/payment is
+  - Payment is automatic via x402 on Run402 Cloud; requires a funded wallet.
+    Against a configured Run402 Core target, no Cloud tier/wallet/payment is
     required.
   - The new project becomes the active project after provisioning
 
@@ -211,8 +207,8 @@ Examples:
   sql: `run402 projects sql — Run a SQL query against a project's database
 
 Usage:
-  run402 projects sql "<query>" [--project <id>] [options]
-  run402 projects sql --file <path> [--project <id>] [options]
+  run402 projects sql "<query>" [--project <project_id>] [options]
+  run402 projects sql --file <path> [--project <project_id>] [options]
 
 Legacy (still supported):
   run402 projects sql <prj_id> "<query>" [options]
@@ -221,7 +217,7 @@ Arguments:
   <query>             Inline SQL query (quote it to preserve spaces)
 
 Options:
-  --project <id>      Project ID (defaults to the active project; a leading
+  --project <project_id>      Project ID (defaults to the active project; a leading
                       prj_... positional is also still accepted)
   --file <path>       Read SQL from a file instead of an inline query
   --params '<json>'   JSON array of parameters for a parameterized query
@@ -234,10 +230,10 @@ Examples:
   costs: `run402 projects costs — Show admin-only per-project finance
 
 Usage:
-  run402 projects costs [id] [--window <24h|7d|30d|90d>]
+  run402 projects costs [project_id] [--window <24h|7d|30d|90d>]
 
 Arguments:
-  [id]                Project ID (defaults to the active project if omitted)
+  [project_id]                Project ID (defaults to the active project if omitted)
 
 Options:
   --window <w>        Finance window (default: 30d). One of: 24h, 7d, 30d, 90d
@@ -246,7 +242,7 @@ Environment:
   RUN402_ADMIN_COOKIE Optional admin OAuth cookie header, e.g. "run402_admin=..."
 
 Notes:
-  - Platform-admin only. The configured allowance wallet must be an admin
+  - Platform-admin only. The configured wallet must be an admin
     wallet, or RUN402_ADMIN_COOKIE must contain an admin OAuth cookie.
   - Project service keys are not enough for this endpoint.
   - Output is the gateway's per-project finance JSON: revenue, direct cost,
@@ -260,12 +256,12 @@ Examples:
   "validate-expose": `run402 projects validate-expose — Validate an authorization manifest without applying it
 
 Usage:
-  run402 projects validate-expose [id] <manifest_json> [options]
-  run402 projects validate-expose [id] --file <path> [options]
-  cat manifest.json | run402 projects validate-expose [id] [options]
+  run402 projects validate-expose [project_id] <manifest_json> [options]
+  run402 projects validate-expose [project_id] --file <path> [options]
+  cat manifest.json | run402 projects validate-expose [project_id] [options]
 
 Arguments:
-  [id]                Optional project ID. When omitted, the active project is
+  [project_id]                Optional project ID. When omitted, the active project is
                       used if one is set; otherwise validation is projectless.
   <manifest_json>     Inline auth/expose manifest JSON.
 
@@ -330,7 +326,7 @@ async function provision(args) {
       code: "BAD_USAGE",
       message: "--org must not be empty.",
       details: { field: "--org" },
-      hint: "Pass an org id (run402 org list), or omit --org for the cold-start path.",
+      hint: "Pass an org id (run402 orgs list), or omit --org for the cold-start path.",
     });
   }
   // Validate --name when provided. Omitted --name lets the server pick a
@@ -361,10 +357,10 @@ async function provision(args) {
       });
     }
   }
-  // Aggressive early exit when no agent allowance is configured — but only when
-  // there's also no operator (control-plane) session, since a wallet-less human
-  // provisions into an org via their operator approval instead of a wallet.
-  if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) allowanceAuthHeaders("/projects/v1");
+  // Aggressive early exit when no local wallet is configured — but only when
+  // there's also no sign-in session, since a wallet-less person provisions
+  // into an org via a write approval instead of a wallet.
+  if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) walletAuthHeaders("/projects/v1");
 
   const activeBefore = getActiveProjectId();
   try {
@@ -454,7 +450,7 @@ async function validateExpose(args = []) {
       fail({
         code: "BAD_USAGE",
         message: `Unexpected extra argument: ${arg}`,
-        hint: "run402 projects validate-expose [id] <manifest_json>",
+        hint: "run402 projects validate-expose [project_id] <manifest_json>",
       });
     }
   }
@@ -462,7 +458,7 @@ async function validateExpose(args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Provide either inline manifest JSON or --file <path>, not both.",
-      hint: "run402 projects validate-expose [id] --file manifest.json",
+      hint: "run402 projects validate-expose [project_id] --file manifest.json",
     });
   }
   if (migrationFile && migrationSql !== null) {
@@ -495,7 +491,7 @@ async function validateExpose(args = []) {
   }
   const activeProjectId = getActiveProjectId();
   const project = projectFlag || projectId || activeProjectId || undefined;
-  if (!project) allowanceAuthHeaders("/projects/v1/expose/validate");
+  if (!project) walletAuthHeaders("/projects/v1/expose/validate");
   const migration = migrationFile ? readFileSync(migrationFile, "utf-8") : migrationSql;
 
   try {
@@ -525,25 +521,24 @@ async function list(args = []) {
     fail({
       code: "BAD_USAGE",
       message: "--all and --org are mutually exclusive.",
-      hint: "--all reads the cross-wallet operator inventory; --org filters the membership-scoped list to one org.",
+      hint: "--all reads every project across all your orgs; --org filters the membership-scoped list to one org.",
     });
   }
 
-  // `--all` reads the operator email-union inventory across every wallet
-  // controlling your verified email. Pass the cached operator-session token
-  // when present (cross-wallet union); otherwise the SDK falls back to SIWX
-  // wallet auth and the gateway returns just this wallet's slice.
+  // `--all` reads every project the caller can reach across all its orgs.
+  // Pass the cached sign-in session token when present; otherwise the SDK
+  // uses the credential provider and the gateway returns this wallet's slice.
   const opts = {};
   if (all) {
     opts.all = true;
-    const session = loadLiveOperatorSession();
-    if (session) opts.token = session.operator_session_token;
+    const session = loadLiveControlPlaneSession();
+    if (session) opts.token = session.control_plane_session_token;
   } else if (org) {
     opts.org = org;
   }
 
   // Active marker comes from local state; the inventory itself is the server
-  // read (NOT the keystore), so it surfaces every project the wallet/email can
+  // read (NOT the keystore), so it surfaces every project the principal can
   // reach — including ones never provisioned from this machine.
   const activeId = getActiveProjectId();
 
@@ -574,7 +569,7 @@ async function rename(projectId, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing --name.",
-      hint: "run402 projects rename <id> --name \"My Site\"",
+      hint: "run402 projects rename <project_id> --name \"My Site\"",
     });
   }
   try {
@@ -652,7 +647,7 @@ function commandMoved(name) {
   fail({
     code: "COMMAND_MOVED",
     message: `run402 projects ${name} moved to the explicit local credential-cache surface.`,
-    hint: "Use `run402 credentials project-keys status/export --project <id>`.",
+    hint: "Use `run402 credentials project-keys status/export --project <project_id>`.",
     details: {
       old_command: `projects ${name}`,
       new_command: name === "keys" ? "credentials project-keys export --reveal" : "credentials project-keys status",
@@ -661,12 +656,12 @@ function commandMoved(name) {
     next_actions: [
       {
         type: "run_command",
-        command: "run402 credentials project-keys status --project <id>",
+        command: "run402 credentials project-keys status --project <project_id>",
         why: "Inspect cached key presence without revealing secrets.",
       },
       {
         type: "run_command",
-        command: "run402 credentials project-keys export --project <id> --reveal",
+        command: "run402 credentials project-keys export --project <project_id> --reveal",
         why: "Reveal cached project keys only when you explicitly need secret material.",
       },
     ],
@@ -736,7 +731,7 @@ async function rest(projectId, restArgs = []) {
   if (!table) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing <table> argument. Usage: run402 projects rest <table> [--query \"<query>\"] [--project <id>]",
+      message: "Missing <table> argument. Usage: run402 projects rest <table> [--query \"<query>\"] [--project <project_id>]",
       hint: "Run 'run402 projects schema' to list tables.",
     });
   }
@@ -889,10 +884,6 @@ const FLAGS_BY_SUB = {
     values: ["--project", "--file", "--migration-file", "--migration-sql"],
   },
   delete: { known: ["--project", "--confirm"], values: ["--project"] },
-  export: {
-    known: ["--project", "--scope", "--auth", "--consistency", "--idempotency-key", "--output", "--poll-interval", "--timeout", "--wait", "--json", "--json-stream"],
-    values: ["--project", "--scope", "--auth", "--consistency", "--idempotency-key", "--output", "--poll-interval", "--timeout"],
-  },
 };
 
 function validateFlags(sub, args) {
@@ -940,11 +931,6 @@ export async function run(sub, args) {
     case "validate-expose": await validateExpose(args); break;
     case "get-expose":   { const { projectId } = resolveProjectSelector(args, { rejectBareFirst: true }); await getExpose(projectId); break; }
     case "delete":    { const { projectId, rest } = resolveProjectSelector(args, { rejectBareFirst: true }); await deleteProject(projectId, rest); break; }
-    case "export": {
-      const { run } = await import("./cloud.mjs");
-      await run("archives", ["create", ...args]);
-      break;
-    }
     case "promote-user": { const { projectId, rest } = resolveProjectSelector(args); await promoteUser(projectId, rest[0]); break; }
     case "demote-user":  { const { projectId, rest } = resolveProjectSelector(args); await demoteUser(projectId, rest[0]); break; }
     default:

package/lib/redeem.mjs

@@ -2,14 +2,13 @@ import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, normalizeArgv, positionalArgs } from "./argparse.mjs";
 
-const HELP = `run402 redeem — Redeem a promo code for run402 credit
+const HELP = `run402 redeem — Redeem a promo code into your organization's allowance
 
 Usage:
   run402 redeem <code> [--json]
 
-A promo code credits your organization with run402 prepaid credit. That credit
-spends like any other prepaid balance — a tier purchase settles from it with no
-on-chain payment.
+A promo code adds to your organization's allowance, which spends like any
+other allowance — a tier purchase settles from it with no on-chain payment.
 
 Notes:
   - Order does not matter. This works as your very first authenticated call
@@ -17,7 +16,7 @@ Notes:
   - Codes are forgiving: case-insensitive and hyphens are optional, so
     'R402-K8F3-Q2W9' and 'r402k8f3q2w9' are the same code.
   - Retrying is safe. A repeat by the same organization returns the original
-    result with "already_redeemed": true and never credits twice.
+    result with "already_redeemed": true and never adds the amount twice.
   - Being in a grace state does not block you. Redeeming is how an owner funds
     a renewal, so it is never gated.
   - One gift per organization, per issuer: past the lifetime ceiling for a
@@ -64,10 +63,10 @@ export async function run(args = []) {
     // in a field a human skims past.
     console.error("");
     console.error(
-      `  Voucher    ${usd(data.amount_usd_micros)} credited` +
-        `${data.already_redeemed ? " (already redeemed " + data.redeemed_at + " — no second credit)" : ""}`,
+      `  Voucher    ${usd(data.amount_usd_micros)} added` +
+        `${data.already_redeemed ? " (already redeemed " + data.redeemed_at + " — not added twice)" : ""}`,
     );
-    console.error(`  Balance    ${usd(data.balance_usd_micros)} available`);
+    console.error(`  Allowance  ${usd(data.balance_usd_micros)}`);
     const next = Array.isArray(data.next_actions) ? data.next_actions.find((a) => a?.cli) : null;
     if (next?.cli) console.error(`\n  Next: ${next.cli}`);
     console.error("");

package/lib/remote-helper-session.mjs

@@ -146,7 +146,7 @@ const { getSdk } = await sdkModP;
 const { resolveWalletCore, enforceWalletExistsCore, WalletSelectionError } = await walletModP;
 const { gitvaultRemoteAddressForm, gitvaultSlugReleasedInfo, parseGitvaultRemoteUrl, gitvaultDegradedReadNote } = await isoModP;
 const { GITVAULT_R402_REF_NAMESPACE, hardenedGit, resolveGitInvocationRepo, readPinnedGitvaultRepo, pinGitvaultRepo, readGitvaultRestoreMarker, readGitvaultAutoGcThreshold, predialGitvaultObjectStore } = await nodeModP;
-const { allowanceFile, projectCredentialsFile, profileStateFile } = await configModP;
+const { walletFile, projectCredentialsFile, profileStateFile } = await configModP;
 
 /**
  * Per-session SDK construction cache (gitvault-first-op-premium task 2.2).
@@ -167,10 +167,10 @@ const { allowanceFile, projectCredentialsFile, profileStateFile } = await config
  * doc comment calls out as reasons a fresh instance mattered for tests that
  * mutate them between calls in one process) and INVALIDATED on the mtime of
  * the three files whose bytes actually determine signer/credential material
- * (allowance, project-credentials keystore, profile state) — a wallet
+ * (wallet, project-credentials keystore, profile state) — a wallet
  * rotation, `run402 init`, or any other on-disk change is picked up on the
  * very next call, no daemon restart required. A file that does not exist
- * yet (fresh wallet, no allowance) signs into the key as `null`, so its
+ * yet (fresh wallet, no local wallet) signs into the key as `null`, so its
  * LATER appearance also busts the cache. The in-process fallback host calls
  * this at most once per process anyway, so it degrades to exactly today's
  * behavior there — this only changes anything for the daemon.
@@ -189,7 +189,7 @@ function sdkCacheKey() {
   const wallet = process.env.RUN402_WALLET ?? "";
   const configDir = process.env.RUN402_CONFIG_DIR ?? "";
   const apiBase = process.env.RUN402_API_BASE ?? "";
-  const files = [mtimeOf(allowanceFile()), mtimeOf(projectCredentialsFile()), mtimeOf(profileStateFile())];
+  const files = [mtimeOf(walletFile()), mtimeOf(projectCredentialsFile()), mtimeOf(profileStateFile())];
   return `${wallet} ${configDir} ${apiBase} ${files.join(",")}`;
 }
 
@@ -214,7 +214,7 @@ const note = (line) => process.stderr.write(`git-remote-run402: ${line}\n`);
  * selection at all — a `.run402.json` binding, and even the global
  * `wallets use` default, would silently never reach it; only the
  * `RUN402_WALLET` env layer would work, so a bound checkout's `git push
- * run402 main` would use the WRONG wallet's (usually empty) allowance.
+ * run402 main` would use the WRONG (usually empty) wallet.
  *
  * Shares `resolveWalletCore`/`enforceWalletExistsCore` with the CLI
  * (`cli/lib/wallet-context.mjs`) — ONE implementation, minus the CLI's
@@ -253,19 +253,19 @@ function walletSourceLabel(resolved) {
 }
 
 /**
- * The allowance-missing/malformed family (`core/src/allowance.ts`'s own
+ * The wallet-missing/malformed family (`core/src/wallet.ts`'s own
  * throws) all end with "Back up the file and run 'run402 init' to recreate
  * it." — a remedy that assumes the resolved wallet is the one you meant.
  * That is only true when NOTHING selected a wallet (the bare default); when
  * an env var or a binding DID name one, the remedy is actively harmful —
- * `run402 init` recreates the DEFAULT wallet's allowance, a DIFFERENT
- * wallet than the one that was actually resolved and whose allowance is
+ * `run402 init` recreates the DEFAULT wallet's key file, a DIFFERENT
+ * wallet than the one that was actually resolved and whose key file is
  * actually missing/broken. Replace
  * it with the resolved wallet's name and how selection works, so the fix is
  * "correct the selection" rather than "recreate the wrong wallet".
  */
-function enrichAllowanceError(message) {
-  if (!resolvedWallet || !/allowance\.json/.test(message)) return message;
+function enrichWalletError(message) {
+  if (!resolvedWallet || !/wallet\.json/.test(message)) return message;
   const source = walletSourceLabel(resolvedWallet);
   const stripped = message.replace(/\s*Back up the file and run 'run402 init' to recreate it\.?/, "").trim();
   if (!source) {
@@ -276,13 +276,13 @@ function enrichAllowanceError(message) {
   return (
     `${stripped} Resolved wallet '${resolvedWallet.name}' via ${source} ` +
     "(order: RUN402_WALLET env > .run402.json binding > 'wallets use' default > default). " +
-    `Wrong wallet? Fix selection instead. Right wallet, just no allowance yet? 'run402 wallets new ${resolvedWallet.name}'.`
+    `Wrong wallet? Fix selection instead. Right wallet, just not created yet? 'run402 wallets new ${resolvedWallet.name}'.`
   );
 }
 
 function describeError(err) {
   const code = err?.code ?? err?.body?.code ?? null;
-  const message = enrichAllowanceError(err?.message ?? err?.body?.message ?? String(err));
+  const message = enrichWalletError(err?.message ?? err?.body?.message ?? String(err));
   // SLUG_RELEASED is never auto-followed — but the successor slug (design D6)
   // is exactly the fact a human/agent reading stderr needs to act on it.
   const released = gitvaultSlugReleasedInfo(err);