@forgezero/vault 0.1.25 → 0.1.27

package/README.md

@@ -291,17 +291,17 @@ const signed = await vault.runtime.sign(signer.runtimeKey, transactionDigest);
 
 ## Three paths, and why they stay explicit
 
-Platform API logic already holds the requested realm master seed, so it opens the scoped envelope directly through an injected internal backend — no HTTP call, API key or local replica. A tenant on managed compute uses the local agent and its memory-only project scope. A tenant elsewhere signs HTTPS with an API-key seed. These share vault semantics and never silently fall through from a stronger posture to a weaker one.
+Platform API logic opens its own scoped Vault data directly through an injected internal backend — no HTTP call, API key or local replica. A tenant on managed compute uses the local agent and its memory-only project scope. A tenant elsewhere signs HTTPS with an API-key seed. These share Vault semantics and never silently fall through from a stronger posture to a weaker one.
 
 ```text
-PLATFORM API      resident realm seed -> direct scoped envelope
-MANAGED TENANT   local unix socket    -> agent RAM scope
-EXTERNAL TENANT  scoped API-key seed  -> signed HTTPS
+PLATFORM API      resident custody key -> direct scoped envelope
+MANAGED TENANT   local unix socket     -> agent RAM scope
+EXTERNAL TENANT  scoped API-key seed   -> signed HTTPS
 ```
 
 ## Current implementation boundary
 
-All three trust paths now have code: the platform opens its resident realm seed directly, an enrolled tenant agent derives its project binding and keeps every environment in that project in RAM, and createVault automatically uses either the local socket or a hybrid signer derived from an API-key seed. Live SEV-SNP report acquisition and an end-to-end production deployment are still gates; installation alone is not presented as proof.
+All three trust paths now have code: the platform opens its resident custody key directly, an enrolled tenant agent derives its project binding and keeps every environment in that project in RAM, and createVault automatically uses either the local socket or a hybrid signer derived from an API-key seed. Live SEV-SNP report acquisition and an end-to-end production deployment are still gates; installation alone is not presented as proof.
 
 ## 1. Install
 
@@ -371,9 +371,9 @@ Each names what to do next.
 
 ```text
 NO_CREDENTIAL   neither the socket nor FORGEZERO_API_KEY was found
-VAULT_LOCKED    the realm has no seed in memory; a custodian must unlock
+VAULT_LOCKED    the account Vault is locked; a custodian must unlock it
 MANAGED_ONLY    getAll needs the agent socket
-NO_NODE         no vault node is currently available
+NO_NODE         no Vault node is currently available
 ```
 
 ## API keys — the key is a seed, not a password

package/dist/index.d.ts

@@ -313,4 +313,4 @@ export declare function systemdCredentials(options?: SystemdCredentialOptions):
     readonly name: 'systemd';
     get(reference: string, field: string): Promise<string>;
 };
-export declare const VERSION = "0.1.25";
+export declare const VERSION = "0.1.27";

package/dist/index.js

@@ -572,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.25";
+var VERSION = "0.1.27";
 export {
   vaultCredentials,
   systemdCredentials,

package/dist/providers.js

@@ -572,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.25";
+var VERSION = "0.1.27";
 
 // src/providers.ts
 var MISSING = new Set(["ENTRY_NOT_FOUND", "VERSION_NOT_FOUND"]);

package/dist/schema.js

@@ -572,7 +572,7 @@ function systemdCredentials(options = {}) {
     }
   };
 }
-var VERSION = "0.1.25";
+var VERSION = "0.1.27";
 
 // src/schema.ts
 function managedSchemas(vault, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/vault",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -46,7 +46,7 @@
     "@types/bun": "latest"
   },
   "dependencies": {
-    "@forgezero/runtime": "^0.1.19"
+    "@forgezero/runtime": "^0.1.21"
   },
   "peerDependencies": {
     "@noble/ciphers": "^2.2.0",