run402 4.93.2 → 4.95.0

package/lib/whoami.mjs

@@ -0,0 +1,102 @@
+/**
+ * `run402 whoami` — who this CLI acts as: the principal, its org memberships,
+ * and the sign-in session (`session.grade`: `browser` | `loopback` | `device`,
+ * or `null` for a wallet caller) from `GET /agent/v1/whoami`, plus the write
+ * approvals cached on this machine. See sign-in.mjs. `--set-name <name>`
+ * sets the principal's display name (`PATCH /agent/v1/me`) and prints the
+ * updated identity.
+ */
+
+import { fail, reportSdkError } from "./sdk-errors.mjs";
+import { getSdk } from "./sdk.mjs";
+import { normalizeArgv, hasHelp, assertKnownFlags, flagValue, positionalArgs } from "./argparse.mjs";
+import { loadLiveControlPlaneSession, clearControlPlaneSession } from "../core-dist/control-plane-session.js";
+import { readApprovals } from "../core-dist/write-approvals.js";
+
+const HELP = `run402 whoami — who this CLI acts as
+
+Usage:
+  run402 whoami
+  run402 whoami --set-name <name>
+
+Calls GET /agent/v1/whoami. With a live sign-in session ('run402 login') it
+reads as that session and reports session.grade: loopback (full), browser, or
+device (read-only). Without one it reads as the active wallet and session is
+null. The output also lists the write approvals cached on this machine
+('run402 approve'), each with its action, target, and expiry.
+
+--set-name <name> sets this principal's display name (PATCH /agent/v1/me,
+1-64 characters): the name promotion credit, \`run402 up\`'s room presence,
+and audit surfaces show. \`up\` sets a detected default when it is empty. It
+is sent with the active wallet, and the output is the updated identity.
+For local wallet/profile state use 'run402 status'.
+`;
+
+/** Live cached write approvals: action, target, expiry. Never the token. */
+function cachedApprovals(nowMs = Date.now()) {
+  try {
+    return readApprovals()
+      .filter((a) => a.expires_at > nowMs)
+      .map((a) => ({
+        action: a.action,
+        org_id: a.org_id ?? null,
+        project_id: a.project_id ?? null,
+        expires_at: new Date(a.expires_at).toISOString(),
+      }));
+  } catch {
+    return [];
+  }
+}
+
+export async function run(args = []) {
+  args = normalizeArgv(args);
+  if (hasHelp(args)) {
+    console.log(HELP);
+    process.exit(0);
+  }
+  assertKnownFlags(args, ["--help", "-h", "--set-name"], ["--set-name"]);
+  const extra = positionalArgs(args, ["--set-name"]);
+  if (extra.length > 0) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for whoami: ${extra[0]}`, hint: "Use `run402 whoami` or `run402 whoami --set-name <name>`." });
+  }
+  const setName = flagValue(args, "--set-name");
+  if (setName !== null && setName.trim() === "") {
+    fail({
+      code: "BAD_USAGE",
+      message: "--set-name must not be empty.",
+      details: { field: "--set-name" },
+      hint: "Pass a 1-64 character display name.",
+    });
+  }
+  const sdk = getSdk();
+  if (setName !== null) {
+    try {
+      const updated = await sdk.orgs.setDisplayName(setName.trim());
+      console.log(JSON.stringify({ ...updated, write_approvals: cachedApprovals() }, null, 2));
+    } catch (err) {
+      reportSdkError(err);
+    }
+    return;
+  }
+  const session = loadLiveControlPlaneSession();
+  let who;
+  try {
+    who = session
+      ? await sdk.session.whoami({ token: session.control_plane_session_token })
+      : await sdk.orgs.whoami();
+  } catch (err) {
+    // A cached session the gateway no longer honours (revoked or expired
+    // server-side): drop it so the next command does not replay a dead token.
+    if (session && err && err.status === 401) {
+      clearControlPlaneSession();
+      return fail({
+        code: "SESSION_INVALID",
+        message: "The cached sign-in session is no longer valid (revoked or expired).",
+        hint: "Run 'run402 login' to sign in again.",
+        next_actions: [{ type: "authenticate", command: "run402 login" }],
+      });
+    }
+    return reportSdkError(err);
+  }
+  console.log(JSON.stringify({ ...who, write_approvals: cachedApprovals() }, null, 2));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.93.2",
+  "version": "4.95.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/core-dist/config.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { existsSync, renameSync, mkdirSync, chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, renameSync, mkdirSync, chmodSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { describeRejectedValue } from "./redact.js";
 export const DEFAULT_API_BASE = "https://api.run402.com";
@@ -118,7 +118,7 @@ export function getProfilesDir() {
  * The effective config directory for the *active* wallet. The `default` wallet
  * resolves to the base dir (zero migration for existing single-wallet
  * installs); any named wallet resolves to `{base}/profiles/<name>`. Because
- * keystore, allowance, and meta paths all derive from this, switching the
+ * keystore, wallet, and meta paths all derive from this, switching the
  * profile env var moves the whole wallet bundle atomically — and the SDK/MCP
  * inherit profile selection for free.
  */
@@ -232,27 +232,61 @@ export function isCoreApiTarget() {
         return true;
     return false;
 }
-export function getAllowancePath() {
-    if (process.env.RUN402_ALLOWANCE_PATH)
-        return process.env.RUN402_ALLOWANCE_PATH;
-    const dir = getConfigDir();
-    const newPath = join(dir, "allowance.json");
-    const oldPath = join(dir, "wallet.json");
-    // Auto-migrate from wallet.json → allowance.json. renameSync preserves the
-    // source file's mode, so a legacy world-readable wallet.json (mode 0644)
-    // would otherwise carry that mode forward and leave the private key
-    // world-readable on a shared machine. Tighten to 0600 after the rename.
-    if (!existsSync(newPath) && existsSync(oldPath)) {
-        mkdirSync(dir, { recursive: true });
-        renameSync(oldPath, newPath);
+/**
+ * The file that holds a wallet's key, in the base config dir (the `default`
+ * wallet) and in each `profiles/<name>/` directory.
+ */
+export const WALLET_FILE_NAME = "wallet.json";
+/** The name the wallet key file had before it was `wallet.json`. */
+const PREVIOUS_WALLET_FILE_NAME = "allowance.json";
+const walletFilesMovedFor = new Set();
+/**
+ * One-time local move of the wallet key file to its current name: in the base
+ * config dir and every `profiles/<name>/` directory, `allowance.json` is
+ * renamed to `wallet.json` (an atomic same-directory rename) when
+ * `wallet.json` is absent, then tightened to 0600. A directory that already
+ * holds `wallet.json` is left untouched. Runs once per base dir per process;
+ * nothing reads the previous name afterwards.
+ */
+export function moveWalletFiles() {
+    const base = getConfigBaseDir();
+    if (walletFilesMovedFor.has(base))
+        return;
+    walletFilesMovedFor.add(base);
+    const dirs = [base];
+    try {
+        for (const entry of readdirSync(join(base, "profiles"), { withFileTypes: true })) {
+            if (entry.isDirectory())
+                dirs.push(join(base, "profiles", entry.name));
+        }
+    }
+    catch {
+        // No profiles directory yet.
+    }
+    for (const dir of dirs) {
+        const from = join(dir, PREVIOUS_WALLET_FILE_NAME);
+        const to = join(dir, WALLET_FILE_NAME);
+        if (existsSync(to) || !existsSync(from))
+            continue;
+        try {
+            renameSync(from, to);
+        }
+        catch {
+            continue;
+        }
         try {
-            chmodSync(newPath, 0o600);
+            chmodSync(to, 0o600);
         }
         catch {
             // Best-effort (e.g. Windows / exotic filesystems). Read-time self-heal
-            // in readAllowance() is the backstop.
+            // in readWallet() is the backstop.
         }
     }
-    return newPath;
+}
+export function getWalletPath() {
+    if (process.env.RUN402_WALLET_PATH)
+        return process.env.RUN402_WALLET_PATH;
+    moveWalletFiles();
+    return join(getConfigDir(), WALLET_FILE_NAME);
 }
 //# sourceMappingURL=config.js.map

package/sdk/core-dist/control-plane-session.js

@@ -10,6 +10,14 @@ export function getControlPlaneSessionPath() {
     return (process.env.RUN402_CONTROL_PLANE_SESSION_PATH ||
         join(getConfigBaseDir(), "control-plane-session.json"));
 }
+/**
+ * Read a wire grade. An unknown or absent value is treated as `device` (the
+ * read-only grade) so a cache the client cannot classify never claims more
+ * authority than the gateway will grant.
+ */
+function toGrade(raw) {
+    return raw === "browser" || raw === "loopback" || raw === "device" ? raw : "device";
+}
 /** Tighten 0600 if group/other-readable, warning once. Best-effort, POSIX-only. */
 function selfHealPermissions(p) {
     if (process.platform === "win32")
@@ -50,20 +58,20 @@ export function readControlPlaneSession(path) {
         return null;
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new Error("control-plane-session.json must contain a JSON object. Delete it and run 'run402 operator login --loopback' to recreate it.");
+        throw new Error("control-plane-session.json must contain a JSON object. Delete it and run 'run402 login' to recreate it.");
     }
     const data = parsed;
     if (typeof data.control_plane_session_token !== "string" ||
         data.control_plane_session_token.length === 0) {
-        throw new Error("control-plane-session.json missing valid 'control_plane_session_token'. Run 'run402 operator login --loopback' to refresh it.");
+        throw new Error("control-plane-session.json missing valid 'control_plane_session_token'. Run 'run402 login' to refresh it.");
     }
     if (typeof data.expires_at !== "number" || !Number.isFinite(data.expires_at)) {
-        throw new Error("control-plane-session.json missing valid 'expires_at'. Run 'run402 operator login --loopback' to refresh it.");
+        throw new Error("control-plane-session.json missing valid 'expires_at'. Run 'run402 login' to refresh it.");
     }
     return {
         control_plane_session_token: data.control_plane_session_token,
         token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
-        provenance: typeof data.provenance === "string" ? data.provenance : "loopback_pkce",
+        grade: toGrade(data.grade),
         principal_id: typeof data.principal_id === "string" ? data.principal_id : "",
         amr: Array.isArray(data.amr) ? data.amr.filter((a) => typeof a === "string") : [],
         expires_at: data.expires_at,
@@ -79,7 +87,7 @@ export function saveControlPlaneSession(data, path) {
     renameSync(tmp, p);
     chmodSync(p, 0o600);
 }
-/** Delete the cached control-plane session — local half of `operator logout`. Idempotent. */
+/** Delete the cached sign-in session — local half of `run402 logout`. Idempotent. */
 export function clearControlPlaneSession(path) {
     const p = path ?? getControlPlaneSessionPath();
     try {
@@ -105,10 +113,27 @@ export function controlPlaneSessionFromTokenResponse(resp, nowMs = Date.now()) {
     return {
         control_plane_session_token: resp.control_plane_session_token,
         token_type: resp.token_type ?? "Bearer",
-        provenance: resp.provenance ?? "loopback_pkce",
+        grade: toGrade(resp.grade),
         principal_id: resp.principal_id ?? "",
         amr: Array.isArray(resp.amr) ? resp.amr.filter((a) => typeof a === "string") : [],
         expires_at: nowMs + (typeof resp.expires_in === "number" ? resp.expires_in : 0) * 1000,
     };
 }
+/**
+ * Delete the session caches of the retired email-scoped session
+ * (`{base}/operator-session.json`) and the retired approval cache file
+ * (`{base}/write-auth-session.json`). Neither is read any more; `run402 login`
+ * and `run402 logout` call this so a stale token does not linger on disk.
+ * Best-effort and idempotent.
+ */
+export function clearRetiredSessionCaches() {
+    for (const name of ["operator-session.json", "write-auth-session.json"]) {
+        try {
+            rmSync(join(getConfigBaseDir(), name), { force: true });
+        }
+        catch {
+            // Best-effort: a failed unlink never blocks login or logout.
+        }
+    }
+}
 //# sourceMappingURL=control-plane-session.js.map

package/sdk/core-dist/keystore.js

@@ -3,7 +3,7 @@ import { dirname, join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { getLegacyProjectsPath, getProjectCredentialsPath } from "./config.js";
 import { clearActiveProjectId as clearProfileActiveProjectId, getActiveProjectId as getProfileActiveProjectId, recordMigration, setActiveProjectId as setProfileActiveProjectId, } from "./profile-state.js";
-import { readAllowance } from "./allowance.js";
+import { readWallet } from "./wallet.js";
 function withFileLock(path, fn, { retries = 200, delayMs = 20 } = {}) {
     const lockDir = path + ".lock";
     mkdirSync(dirname(path), { recursive: true });
@@ -99,7 +99,7 @@ function migrateLegacyProjectsJson(targetPath) {
         // Scoped the same way every other write in this module now is (see
         // `currentPrincipal`'s doc comment) — an unscoped write here is exactly
         // what poisons the "unknown"-principal bucket for good on a machine that
-        // migrates before its wallet allowance exists yet.
+        // migrates before its wallet exists yet.
         setProfileActiveProjectId(legacy.active_project_id, undefined, { principal: currentPrincipal() });
     }
     recordMigration("projects_json_import", {
@@ -174,7 +174,7 @@ export function removeProject(projectId, path) {
 }
 /**
  * The active-project scope's `principal`, derived from the CURRENT wallet's
- * allowance — matching exactly what `NodeCredentialsProvider.setActiveProject`
+ * wallet — matching exactly what `NodeCredentialsProvider.setActiveProject`
  * (sdk/src/node/credentials.ts) writes after `projects.provision` /
  * `projects.use`. Without this, every reader here used the profile-state
  * module's own default (empty) scope, which resolves to a FIXED
@@ -185,7 +185,7 @@ export function removeProject(projectId, path) {
  * `profile-state.ts#getActiveProjectId` happens to agree), but once the
  * "unknown" bucket is EVER populated by any principal-less write — the
  * one-time legacy `projects.json` migration below, or any provision/`use`
- * call made before this machine had a wallet allowance — it never gets
+ * call made before this machine had a wallet — it never gets
  * updated again (real wallet operations write to the principal-keyed
  * bucket, not "unknown") and PERMANENTLY shadows every later wallet-scoped
  * activation for every caller that reads through this module: `resolveProjectId`
@@ -197,13 +197,13 @@ export function removeProject(projectId, path) {
  * stale "unknown"-bucket entry first and never falls through to the
  * freshly-updated flat value.
  *
- * Best-effort: an unreadable/malformed allowance degrades to `null` (the
+ * Best-effort: an unreadable/malformed wallet degrades to `null` (the
  * "unknown" bucket callers tolerate), never a
- * throw — this is a read-scoping concern, not an allowance-validity one.
+ * throw — this is a read-scoping concern, not a wallet-validity one.
  */
 function currentPrincipal() {
     try {
-        return readAllowance()?.address ?? null;
+        return readWallet()?.address ?? null;
     }
     catch {
         return null;

package/sdk/core-dist/profiles.js

@@ -3,7 +3,7 @@
  *
  * A "wallet" is a whole config directory. The reserved `default` wallet lives
  * at the base config dir (zero migration for existing installs); every named
- * wallet lives under `{base}/profiles/<name>/` with its own `allowance.json`,
+ * wallet lives under `{base}/profiles/<name>/` with its own `wallet.json`,
  * `projects.json`, and this module's non-secret `meta.json`.
  *
  * Two levels of active state, mirroring the wallet → project model:
@@ -17,7 +17,7 @@
 import { readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, readdirSync, rmSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { randomBytes } from "node:crypto";
-import { getConfigBaseDir, getProfilesDir, DEFAULT_PROFILE, isValidProfileName, } from "./config.js";
+import { getConfigBaseDir, getProfilesDir, DEFAULT_PROFILE, isValidProfileName, moveWalletFiles, WALLET_FILE_NAME, } from "./config.js";
 import { describeRejectedValue } from "./redact.js";
 function atomicWrite(p, content, mode) {
     const dir = dirname(p);
@@ -114,17 +114,19 @@ export function writeMeta(name, meta) {
     atomicWrite(metaPath(name), JSON.stringify(meta, null, 2), 0o600);
 }
 // --- enumeration + lifecycle ---
-/** True when a wallet's `allowance.json` exists on disk. */
+/** True when a wallet's `wallet.json` exists on disk. */
 export function profileExists(name) {
-    return existsSync(join(profileDir(name), "allowance.json"));
+    moveWalletFiles();
+    return existsSync(join(profileDir(name), WALLET_FILE_NAME));
 }
 /**
- * All wallet names on disk: `default` (only if a root allowance.json exists)
+ * All wallet names on disk: `default` (only if a root wallet.json exists)
  * plus every valid directory under `profiles/`.
  */
 export function listProfileNames() {
+    moveWalletFiles();
     const names = [];
-    if (existsSync(join(getConfigBaseDir(), "allowance.json"))) {
+    if (existsSync(join(getConfigBaseDir(), WALLET_FILE_NAME))) {
         names.push(DEFAULT_PROFILE);
     }
     try {
@@ -184,7 +186,7 @@ export function renameProfile(oldName, newName) {
             /* best-effort */
         }
         const base = getConfigBaseDir();
-        for (const f of ["allowance.json", "projects.json", "meta.json"]) {
+        for (const f of [WALLET_FILE_NAME, "projects.json", "meta.json"]) {
             const src = join(base, f);
             if (existsSync(src))
                 renameSync(src, join(dest, f));

package/sdk/core-dist/{allowance-auth.js → wallet-auth.js}

@@ -1,12 +1,12 @@
 /**
- * Allowance auth helper — generates SIWX (Sign-In With X / EIP-4361) headers for Run402 API.
+ * SIWX auth helper — generates SIWX (Sign-In With X / EIP-4361) headers for Run402 API.
  * Uses @noble/curves (lighter than viem) for signing.
  */
 import { randomBytes } from "node:crypto";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { keccak_256 } from "@noble/hashes/sha3.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
-import { readAllowance } from "./allowance.js";
+import { readWallet } from "./wallet.js";
 import { getApiBase } from "./config.js";
 /**
  * EIP-55 mixed-case checksum encoding.
@@ -21,7 +21,7 @@ export function toChecksumAddress(address) {
     return checksummed;
 }
 /**
- * EIP-191 personal_sign: sign a message with the allowance's private key.
+ * EIP-191 personal_sign: sign a message with the wallet's private key.
  */
 function personalSign(privateKeyHex, address, message) {
     const msgBytes = new TextEncoder().encode(message);
@@ -86,11 +86,11 @@ export function formatSIWEMessage(opts, address) {
     return lines.join("\n");
 }
 export function buildSIWxAuthHeaders(opts) {
-    const message = formatSIWEMessage(opts, opts.allowance.address);
-    const signature = personalSign(opts.allowance.privateKey, opts.allowance.address, message);
+    const message = formatSIWEMessage(opts, opts.wallet.address);
+    const signature = personalSign(opts.wallet.privateKey, opts.wallet.address, message);
     const payload = {
         domain: opts.domain,
-        address: toChecksumAddress(opts.allowance.address),
+        address: toChecksumAddress(opts.wallet.address),
         statement: opts.statement,
         uri: opts.uri,
         version: opts.version ?? "1",
@@ -110,18 +110,18 @@ export function buildSIWxAuthHeaders(opts) {
 }
 /**
  * Get SIWX auth headers for the Run402 API.
- * Returns null if no allowance is configured.
+ * Returns null if no local wallet is configured.
  *
  * @param path - API path (e.g. "/projects/v1") used to build the SIWE uri field.
  */
-export function getAllowanceAuthHeaders(path, allowancePath) {
-    // readAllowance throws on a malformed-shape allowance file. The
-    // CLI's higher-level readAllowance wrapper surfaces this as a structured
-    // BAD_ALLOWANCE_FILE envelope; here we preserve the public contract that
+export function getWalletAuthHeaders(path, walletPath) {
+    // readWallet throws on a malformed-shape wallet file. The
+    // CLI's higher-level readWallet wrapper surfaces this as a structured
+    // BAD_WALLET_FILE envelope; here we preserve the public contract that
     // this helper returns SIWxAuthHeaders | null. Re-throw so callers above
     // the CLI's wrapper (e.g. SDK paid-fetch) can decide whether to swallow it.
-    const allowance = readAllowance(allowancePath);
-    if (!allowance || !allowance.address || !allowance.privateKey)
+    const localWallet = readWallet(walletPath);
+    if (!localWallet || !localWallet.address || !localWallet.privateKey)
         return null;
     const apiBase = getApiBase();
     const url = new URL(apiBase);
@@ -132,7 +132,7 @@ export function getAllowanceAuthHeaders(path, allowancePath) {
     const issuedAt = now.toISOString();
     const expirationTime = new Date(now.getTime() + 5 * 60 * 1000).toISOString();
     return buildSIWxAuthHeaders({
-        allowance,
+        wallet: localWallet,
         domain,
         uri,
         statement: "Sign in to Run402",
@@ -151,4 +151,4 @@ function messageChainId(chainId) {
 function payloadChainId(chainId) {
     return typeof chainId === "number" ? `eip155:${chainId}` : chainId;
 }
-//# sourceMappingURL=allowance-auth.js.map
+//# sourceMappingURL=wallet-auth.js.map

package/{core-dist/allowance.js → sdk/core-dist/wallet.js}

@@ -1,36 +1,36 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { randomBytes } from "node:crypto";
-import { getAllowancePath } from "./config.js";
+import { getWalletPath } from "./config.js";
 // 0x-prefixed 40-hex EVM address.
 const ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
 // 0x-prefixed 64-hex secp256k1 private key (32 bytes).
 const PRIVATE_KEY_RE = /^0x[a-fA-F0-9]{64}$/;
 /**
- * Load the agent allowance from disk.
+ * Load the agent wallet from disk.
  *
- * Returns `null` for the two "no allowance configured" cases:
+ * Returns `null` for the two "no local wallet configured" cases:
  *   - the file does not exist
  *   - the file exists but is not parseable JSON (preserve existing UX —
- *     consumers print "no_allowance" and tell the user to run init)
+ *     consumers print "no_wallet" and tell the user to run init)
  *
  * Throws a structured `Error` when the file parses as JSON but the
  * shape is wrong (missing/wrong-type/wrong-length fields). Without this guard
  * downstream callers crash with raw stack traces:
- *   - `cli/lib/status.mjs` reaches for `allowance.address.toLowerCase()`
+ *   - `cli/lib/status.mjs` reaches for `wallet.address.toLowerCase()`
  *     and crashes with `TypeError: Cannot read properties of undefined`.
- *   - `core/src/allowance-auth.ts` passes a malformed `privateKey` to
+ *   - `core/src/wallet-auth.ts` passes a malformed `privateKey` to
  *     `@noble/curves` which throws "expected 32 bytes, got N".
  *
- * The CLI's `cli/lib/config.mjs:readAllowance()` wrapper and the MCP
+ * The CLI's `cli/lib/config.mjs:readWallet()` wrapper and the MCP
  * `src/tools/{status,init}.ts` callers translate the throw into their own
- * structured envelopes (`code: BAD_ALLOWANCE_FILE`).
+ * structured envelopes (`code: BAD_WALLET_FILE`).
  */
 /**
- * If an allowance file is readable by group or other (any of the low 0o077
+ * If a wallet file is readable by group or other (any of the low 0o077
  * bits set), tighten it to 0600 and warn once on stderr. This self-heals the
  * historical case where a legacy world-readable `wallet.json` (mode 0644) was
- * migrated to `allowance.json` via a mode-preserving rename, leaving the
+ * migrated to `wallet.json` via a mode-preserving rename, leaving the
  * private key exposed on a shared machine. Best-effort: POSIX-only and silent
  * on platforms without meaningful Unix modes (e.g. Windows).
  */
@@ -48,8 +48,8 @@ function selfHealPermissions(p) {
         // Best-effort; never block a read on a chmod/stat failure.
     }
 }
-export function readAllowance(path) {
-    const p = path ?? getAllowancePath();
+export function readWallet(path) {
+    const p = path ?? getWalletPath();
     if (!existsSync(p))
         return null;
     selfHealPermissions(p);
@@ -66,31 +66,31 @@ export function readAllowance(path) {
     }
     catch {
         // Preserve historical UX — completely unparseable input reads as "no
-        // allowance configured" rather than as an error. Consumers already handle
+        // wallet configured" rather than as an error. Consumers already handle
         // null with a friendly "run 'run402 init'" message.
         return null;
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new Error(`allowance.json must contain a JSON object (got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}). Back up the file and run 'run402 init' to recreate it.`);
+        throw new Error(`wallet.json must contain a JSON object (got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}). Back up the file and run 'run402 init' to recreate it.`);
     }
     const data = parsed;
     if (typeof data.address !== "string" || !ADDRESS_RE.test(data.address)) {
-        throw new Error("allowance.json missing valid 'address' (expected 0x-prefixed 40-hex string). " +
+        throw new Error("wallet.json missing valid 'address' (expected 0x-prefixed 40-hex string). " +
             "Back up the file and run 'run402 init' to recreate it.");
     }
     if (typeof data.privateKey !== "string" || !PRIVATE_KEY_RE.test(data.privateKey)) {
-        throw new Error("allowance.json missing valid 'privateKey' (expected 0x-prefixed 64-hex string). " +
+        throw new Error("wallet.json missing valid 'privateKey' (expected 0x-prefixed 64-hex string). " +
             "Back up the file and run 'run402 init' to recreate it.");
     }
     return data;
 }
-export function saveAllowance(data, path) {
-    const p = path ?? getAllowancePath();
+export function saveWallet(data, path) {
+    const p = path ?? getWalletPath();
     const dir = dirname(p);
     mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `.allowance.${randomBytes(4).toString("hex")}.tmp`);
+    const tmp = join(dir, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
     writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
     renameSync(tmp, p);
     chmodSync(p, 0o600);
 }
-//# sourceMappingURL=allowance.js.map
+//# sourceMappingURL=wallet.js.map