@run402/sdk 4.94.0 → 4.96.0

package/dist/node/{gitvault-degraded-read.js → vault-degraded-read.js}

@@ -1,12 +1,12 @@
 /**
- * gitvault-byo-primary-bucket — degraded read mode (design D4, task 3.4,
+ * vault-byo-primary-bucket — degraded read mode (design D4, task 3.4,
  * MIRROR HALF ONLY). Turns a gateway chain/payload read that fails with a
  * NETWORK-CLASS error into a transparent fallback served from the vault's
  * client-side mirror, so `git fetch`/`clone` keep working while run402 is
  * down.
  *
  * This is deliberately NOT a second implementation of anything: the fallback
- * reuses `r402s-recover` (`gitvault-recover.ts`'s `recoverGitvaultMirror`)
+ * reuses `r402s-recover` (`vault-recover.ts`'s `recoverVaultMirror`)
  * verbatim — the SAME chain-verification, absence adjudication, and
  * decrypt/materialize machinery `run402 repos recover` already ships. The
  * module doc there says it plainly: "recovery is the keyed offline subset
@@ -18,10 +18,10 @@
  *
  * Local trust: this module never touches the LIVE vault's own keystore pins
  * (`head_pin` / `verified_prefix` / `materialized_pin`, written by
- * `GitvaultVault.verifyToNewest`/`materialize` against the live transport) —
- * a degraded read runs an entirely separate engine (`recoverGitvaultMirror`,
+ * `Vault.verifyToNewest`/`materialize` against the live transport) —
+ * a degraded read runs an entirely separate engine (`recoverVaultMirror`,
  * which only ever calls `keystore.readIdentity`/`readRecoveryReceipt`, never
- * `keystore.updateRepo`) against a `GitvaultMirrorBackend`. So "local trust
+ * `keystore.updateRepo`) against a `VaultMirrorBackend`. So "local trust
  * pins advance only as far as the copy chain-verifies" holds by
  * construction: there is no code path here that could advance a live pin
  * past what the mirror copy itself proved.
@@ -31,10 +31,10 @@
  * doc's own D194 citation ("admission is irreducibly live-server").
  */
 import { isRun402Error } from "../errors.js";
-import { readByoConfig } from "./gitvault-byo-config.js";
-import { formatMirrorDestination, readMirrorConfig } from "./gitvault-mirror-config.js";
-import { openGitvaultMirrorBackend } from "./gitvault-mirror-backend.js";
-import { recoverGitvaultMirror } from "./gitvault-recover.js";
+import { readByoConfig } from "./vault-byo-config.js";
+import { formatMirrorDestination, readMirrorConfig } from "./vault-mirror-config.js";
+import { openVaultMirrorBackend } from "./vault-mirror-backend.js";
+import { recoverVaultMirror } from "./vault-recover.js";
 /**
  * Trigger discipline (design D4): a chain/payload read falls back ONLY on a
  * genuinely network-class failure — the underlying `fetch` threw before a
@@ -43,24 +43,24 @@ import { recoverGitvaultMirror } from "./gitvault-recover.js";
  * mirror, so it is excluded even when it happens to arrive with no `.status`
  * (see below).
  *
- * Two wrinkles in how a gitvault read actually fails, both handled here:
+ * Two wrinkles in how a vault read actually fails, both handled here:
  *
- * 1. Most gitvault byte reads (`getGenerationBytes`/`getObjectBytes` in
- *    `gitvault-publication.ts`, and this file's own mirror backend) call the
+ * 1. Most vault byte reads (`getGenerationBytes`/`getObjectBytes` in
+ *    `vault-publication.ts`, and this file's own mirror backend) call the
  *    injected `fetch` DIRECTLY rather than the kernel's typed
  *    `client.request()` — a raw connection/DNS failure therefore propagates
  *    UNBRANDED (a plain `TypeError`, never a `Run402Error`). That is, in
  *    practice, the primary shape a real "run402 is unreachable" outage
  *    takes, so an unbranded throw is treated as network-class.
  * 2. When those SAME call sites DO get a response but it is not `ok`, they
- *    throw via `gitvault-publication.ts`'s own local `fail()` helper — a
+ *    throw via `vault-publication.ts`'s own local `fail()` helper — a
  *    `LocalError` whose real HTTP status rides in `details.status`, never on
  *    `e.status` itself (`LocalError` always passes `status: null` to the
  *    `Run402Error` constructor). This function reads BOTH places so a 5xx
  *    reaching through either path is classified alike, and a 4xx through
  *    either path is excluded alike.
  */
-export function isNetworkClassGitvaultReadError(e) {
+export function isNetworkClassVaultReadError(e) {
     if (!isRun402Error(e))
         return true;
     if (e.kind === "network_error")
@@ -71,10 +71,10 @@ export function isNetworkClassGitvaultReadError(e) {
     // response, no status: network-class.
     if (e.kind === "payment_attempt_error" && e.code === "X402_INITIAL_REQUEST_FAILED" && e.toJSON().category === "network")
         return true;
-    const status = gitvaultReadErrorStatus(e);
+    const status = vaultReadErrorStatus(e);
     return typeof status === "number" && status >= 500;
 }
-function gitvaultReadErrorStatus(e) {
+function vaultReadErrorStatus(e) {
     if (typeof e.status === "number")
         return e.status;
     const details = e.details;
@@ -89,7 +89,7 @@ function gitvaultReadErrorStatus(e) {
  * The small seam design D4 calls out: which client-side destination a
  * degraded read should serve from, for one vault.
  *
- * Precedence (gitvault-byo-primary-bucket task 3.4): the opt-in customer
+ * Precedence (vault-byo-primary-bucket task 3.4): the opt-in customer
  * MIRROR wins when BOTH a mirror and a BYO write config are configured
  * locally on THIS machine. A BYO vault's own primary destination is
  * ALWAYS a complete `r402s-recover` source on its own (task 3.3's whole
@@ -105,13 +105,13 @@ function gitvaultReadErrorStatus(e) {
 export function resolveDegradedReadSource(keystore, repoId) {
     const config = readMirrorConfig(keystore, repoId);
     if (config) {
-        const backend = openGitvaultMirrorBackend(config.destination, repoId, config.credential);
+        const backend = openVaultMirrorBackend(config.destination, repoId, config.credential);
         return { kind: "mirror", backend, destination: formatMirrorDestination(config.destination), credential_kind: config.credential?.kind ?? null };
     }
     const byo = readByoConfig(keystore, repoId);
     if (!byo)
         return null;
-    const backend = openGitvaultMirrorBackend(byo.destination, repoId, byo.credential);
+    const backend = openVaultMirrorBackend(byo.destination, repoId, byo.credential);
     return { kind: "byo", backend, destination: formatMirrorDestination(byo.destination), credential_kind: byo.credential?.kind ?? null };
 }
 /**
@@ -128,12 +128,12 @@ export function resolveDegradedReadSource(keystore, repoId) {
  * `code`/`status`/`kind` survive for the caller exactly as they would
  * without this wrapper. Only the caller's own stderr hint may change.
  * With a fallback source, this degrades via the SHIPPED `r402s-recover`
- * engine (`recoverGitvaultMirror`) against it, returning
+ * engine (`recoverVaultMirror`) against it, returning
  * `{ degraded: true, result }` — a genuine recovery failure (an incomplete
  * or unreadable mirror) propagates from THAT call as its own honest error,
  * never silently swallowed back into the original gateway failure.
  */
-export async function tryGitvaultDegradedRead(options) {
+export async function tryVaultDegradedRead(options) {
     let lastErr;
     const RETRY_ATTEMPTS = 2; // the live attempt, plus one bounded retry
     for (let attempt = 0; attempt < RETRY_ATTEMPTS; attempt++) {
@@ -141,7 +141,7 @@ export async function tryGitvaultDegradedRead(options) {
             return { degraded: false, live: await options.attemptLive() };
         }
         catch (e) {
-            if (!isNetworkClassGitvaultReadError(e))
+            if (!isNetworkClassVaultReadError(e))
                 throw e;
             lastErr = e;
         }
@@ -153,7 +153,7 @@ export async function tryGitvaultDegradedRead(options) {
         : resolveDegradedReadSource(options.keystore, options.repo_id);
     if (!source)
         throw lastErr;
-    const recovered = await recoverGitvaultMirror({ backend: source.backend, out_dir: options.out_dir, keystore: options.keystore });
+    const recovered = await recoverVaultMirror({ backend: source.backend, out_dir: options.out_dir, keystore: options.keystore });
     return {
         degraded: true,
         result: {
@@ -167,4 +167,4 @@ export async function tryGitvaultDegradedRead(options) {
         },
     };
 }
-//# sourceMappingURL=gitvault-degraded-read.js.map
+//# sourceMappingURL=vault-degraded-read.js.map

package/dist/node/vault-degraded-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-degraded-read.js","sourceRoot":"","sources":["../../src/node/vault-degraded-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAA2B,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,4BAA4B,CAAC,CAAU;IACrD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC5C,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,sCAAsC;IACtC,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAK,CAAuB,CAAC,IAAI,KAAK,6BAA6B,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5J,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAA+C;IAC3E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAI,OAAmC,CAAC,MAAM,CAAC;QACtD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAyBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAuB,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IACjJ,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;AACxI,CAAC;AA8BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAuC;IAEvC,IAAI,OAAgB,CAAC;IACrB,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,2CAA2C;IACrE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC;IACpC,MAAM,MAAM,GAAsC,OAAO,CAAC,OAAO;QAC/D,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QAC9G,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC;IAE3B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9H,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;YACvG,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,SAAS,CAAC,oBAAoB;YAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;SACzD;KACF,CAAC;AACJ,CAAC"}

package/dist/node/{gitvault-deploy.d.ts → vault-deploy.d.ts}

@@ -1,9 +1,9 @@
 /**
- * gitvault — push-gated deploy (protocol rev 41 §6.5; task 5.6, lane supplied
- * by change `gitvault-deploy-lane`).
+ * vault — push-gated deploy (protocol rev 41 §6.5; task 5.6, lane supplied
+ * by change `vault-deploy-lane`).
  *
  * Every deploy has a commit, and the artifacts it ships CORRESPOND to it:
- *   1. snapshot (§6.6) → the `gitvault_commit`, printed ALWAYS, never sent,
+ *   1. snapshot (§6.6) → the `vault_commit`, printed ALWAYS, never sent,
  *      plus a digest over the captured file set;
  *   2. a fresh `capture_id` before BOTH lanes;
  *   3. the deploy lane collects artifacts from the work tree and produces the
@@ -42,65 +42,65 @@
  * journaled snapshot and presenting the capture receipt to the
  * override-completion route — equality on EVERY field or no clear.
  */
-import type { GitvaultActivationToken, GitvaultCaptureReceipt, GitvaultHeadTarget } from "../namespaces/gitvault.types.js";
-import { GitvaultKeystore } from "./gitvault-keystore.js";
-import { GitvaultVault } from "./gitvault-publication.js";
-import { type GitvaultCapturedSetDrift, type GitvaultSnapshot, type GitvaultSnapshotOptions } from "./gitvault-snapshot.js";
-export declare const GITVAULT_DEPLOY_OUTCOMES: readonly ["DEPLOYED_AND_VAULTED", "DEPLOY_BLOCKED_PUSH_FAILED", "DEPLOY_FAILED_VAULTED", "DEPLOY_FAILED_UNVAULTED", "DEPLOYED_UNVAULTED_OVERRIDE"];
-export type GitvaultDeployOutcome = (typeof GITVAULT_DEPLOY_OUTCOMES)[number];
+import type { VaultActivationToken, VaultCaptureReceipt, VaultHeadTarget } from "../namespaces/vault.types.js";
+import { VaultKeystore } from "./vault-keystore.js";
+import { Vault } from "./vault-publication.js";
+import { type VaultCapturedSetDrift, type VaultSnapshot, type VaultSnapshotOptions } from "./vault-snapshot.js";
+export declare const VAULT_DEPLOY_OUTCOMES: readonly ["DEPLOYED_AND_VAULTED", "DEPLOY_BLOCKED_PUSH_FAILED", "DEPLOY_FAILED_VAULTED", "DEPLOY_FAILED_UNVAULTED", "DEPLOYED_UNVAULTED_OVERRIDE"];
+export type VaultDeployOutcome = (typeof VAULT_DEPLOY_OUTCOMES)[number];
 /** A serializable error summary (never plaintext, never presigned URLs). */
-export interface GitvaultDeployError {
+export interface VaultDeployError {
     code: string;
     message: string;
     retryable: boolean;
     details?: unknown;
 }
-export interface GitvaultDeployNextAction {
+export interface VaultDeployNextAction {
     action: string;
     /** Present when the action needs a capability the caller may lack. */
     requires?: string;
 }
-interface GitvaultDeployResultBase {
-    outcome: GitvaultDeployOutcome;
-    /** The snapshot commit — ALWAYS present; the `gitvault_commit` line is derived from it. */
-    gitvault_commit: string;
-    gitvault_commit_line: string;
-    snapshot: GitvaultSnapshot;
+interface VaultDeployResultBase {
+    outcome: VaultDeployOutcome;
+    /** The snapshot commit — ALWAYS present; the `vault_commit` line is derived from it. */
+    vault_commit: string;
+    vault_commit_line: string;
+    snapshot: VaultSnapshot;
     capture_id: string;
     snapshot_oid_hmac: string;
     /** The canonical plan digest — null when the build failed before a plan existed. */
     apply_plan_sha256: string | null;
     operation_id: string | null;
-    next_actions: GitvaultDeployNextAction[];
+    next_actions: VaultDeployNextAction[];
 }
-export type GitvaultDeployResult = (GitvaultDeployResultBase & {
+export type VaultDeployResult = (VaultDeployResultBase & {
     outcome: "DEPLOYED_AND_VAULTED";
     generation: string;
     head_sha256: string;
-    capture_receipt: GitvaultCaptureReceipt;
-    activation_token: GitvaultActivationToken;
+    capture_receipt: VaultCaptureReceipt;
+    activation_token: VaultActivationToken;
     commit: unknown;
-}) | (GitvaultDeployResultBase & {
+}) | (VaultDeployResultBase & {
     outcome: "DEPLOY_BLOCKED_PUSH_FAILED";
-    push_error: GitvaultDeployError;
+    push_error: VaultDeployError;
     previous_release_keeps_serving: true;
-}) | (GitvaultDeployResultBase & {
+}) | (VaultDeployResultBase & {
     outcome: "DEPLOY_FAILED_VAULTED";
     generation: string;
     head_sha256: string;
-    capture_receipt: GitvaultCaptureReceipt | null;
-    deploy_error: GitvaultDeployError;
-}) | (GitvaultDeployResultBase & {
+    capture_receipt: VaultCaptureReceipt | null;
+    deploy_error: VaultDeployError;
+}) | (VaultDeployResultBase & {
     outcome: "DEPLOY_FAILED_UNVAULTED";
-    push_error: GitvaultDeployError;
-    deploy_error: GitvaultDeployError;
-}) | (GitvaultDeployResultBase & {
+    push_error: VaultDeployError;
+    deploy_error: VaultDeployError;
+}) | (VaultDeployResultBase & {
     outcome: "DEPLOYED_UNVAULTED_OVERRIDE";
-    push_error: GitvaultDeployError;
-    override_journal: GitvaultOverrideJournal;
+    push_error: VaultDeployError;
+    override_journal: VaultOverrideJournal;
     commit: unknown;
 });
-export interface GitvaultDeployLanePlanInput {
+export interface VaultDeployLanePlanInput {
     /**
      * The work tree the snapshot was captured from — collect artifacts from
      * HERE. It is the mutable tree on purpose (a materialization of the snapshot
@@ -112,29 +112,29 @@ export interface GitvaultDeployLanePlanInput {
     capture_id: string;
     snapshot_oid_hmac: string;
 }
-export interface GitvaultDeployLanePlan {
+export interface VaultDeployLanePlan {
     plan_id: string;
     /** The apply operation the token is minted for (the gateway creates it at plan time under the vault gate). */
     operation_id: string;
     /** The canonical `apply_plan_canonical/v1` digest (opaque 32-byte commitment, hex). */
     apply_plan_sha256: string;
 }
-export interface GitvaultDeployLaneCommitInput {
+export interface VaultDeployLaneCommitInput {
     plan_id: string;
     operation_id: string;
     /** Present on the vaulted path. */
-    activation_token?: GitvaultActivationToken;
+    activation_token?: VaultActivationToken;
     /** Present on the override path — requires `gitvault.override_unvaulted` server-side. */
     allow_unvaulted?: {
         reason: string;
     };
 }
 /** The apply-v1 plan → commit pair, abstracted so the deploy logic is testable without a gateway. */
-export interface GitvaultDeployLane {
-    plan(input: GitvaultDeployLanePlanInput): Promise<GitvaultDeployLanePlan>;
-    commit(input: GitvaultDeployLaneCommitInput): Promise<unknown>;
+export interface VaultDeployLane {
+    plan(input: VaultDeployLanePlanInput): Promise<VaultDeployLanePlan>;
+    commit(input: VaultDeployLaneCommitInput): Promise<unknown>;
 }
-export interface GitvaultOverrideJournal {
+export interface VaultOverrideJournal {
     version: 1;
     repo_id: string;
     operation_id: string;
@@ -143,36 +143,36 @@ export interface GitvaultOverrideJournal {
     snapshot: {
         ref: string;
         oid: string;
-        head_target: GitvaultHeadTarget;
+        head_target: VaultHeadTarget;
     };
     snapshot_oid_hmac: string;
     /** `pending` → committed unvaulted, not yet pushed; `published` → pushed, completion not yet accepted; `completed` → advisory cleared server-side. */
     publication_state: "pending" | "published" | "completed";
     generation: string | null;
     head_sha256: string | null;
-    capture_receipt: GitvaultCaptureReceipt | null;
+    capture_receipt: VaultCaptureReceipt | null;
     reason: string;
     created_at: string;
     updated_at: string;
 }
-export declare function overrideJournalDir(keystore: GitvaultKeystore): string;
-export declare function overrideJournalPath(keystore: GitvaultKeystore, operationId: string): string;
-export declare function writeOverrideJournal(keystore: GitvaultKeystore, journal: GitvaultOverrideJournal): void;
-export declare function readOverrideJournal(keystore: GitvaultKeystore, operationId: string): GitvaultOverrideJournal | null;
+export declare function overrideJournalDir(keystore: VaultKeystore): string;
+export declare function overrideJournalPath(keystore: VaultKeystore, operationId: string): string;
+export declare function writeOverrideJournal(keystore: VaultKeystore, journal: VaultOverrideJournal): void;
+export declare function readOverrideJournal(keystore: VaultKeystore, operationId: string): VaultOverrideJournal | null;
 /** Every override journal not yet `completed` — the doctor-visible advisory list. */
-export declare function listPendingOverrideJournals(keystore: GitvaultKeystore, repoId?: string): GitvaultOverrideJournal[];
-export interface GitvaultCaptureReceiptMatch {
+export declare function listPendingOverrideJournals(keystore: VaultKeystore, repoId?: string): VaultOverrideJournal[];
+export interface VaultCaptureReceiptMatch {
     equal: boolean;
     mismatched_fields: string[];
 }
 /** Compare a capture receipt against an operation's journaled binding on EVERY field: repo, capture_id, plan digest, snapshot commitment, head hash. */
-export declare function matchCaptureReceipt(receipt: GitvaultCaptureReceipt, expected: {
+export declare function matchCaptureReceipt(receipt: VaultCaptureReceipt, expected: {
     repo_id: string;
     capture_id: string;
     apply_plan_sha256: string | null;
     snapshot_oid_hmac: string;
     head_sha256: string;
-}): GitvaultCaptureReceiptMatch;
+}): VaultCaptureReceiptMatch;
 /**
  * `authorization_epoch` is compared BYTEWISE against the epoch the client last
  * saw installed (a DR gate mints a fresh one). Any difference — one nibble is
@@ -180,7 +180,7 @@ export declare function matchCaptureReceipt(receipt: GitvaultCaptureReceipt, exp
  */
 export declare function checkAuthorizationEpoch(tokenEpoch: string, installedEpoch: string): void;
 /** Verify a minted activation token binds exactly this deploy (before it is ever presented to a commit). */
-export declare function checkActivationTokenBinding(token: GitvaultActivationToken, expected: {
+export declare function checkActivationTokenBinding(token: VaultActivationToken, expected: {
     repo_id: string;
     operation_id: string;
     generation: string;
@@ -189,12 +189,12 @@ export declare function checkActivationTokenBinding(token: GitvaultActivationTok
     apply_plan_sha256: string;
     snapshot_oid_hmac: string;
 }): string[];
-export interface GitvaultDeployOptions {
-    vault: GitvaultVault;
-    lane: GitvaultDeployLane;
+export interface VaultDeployOptions {
+    vault: Vault;
+    lane: VaultDeployLane;
     /** The work tree to snapshot. */
     repo_dir: string;
-    snapshot?: Omit<GitvaultSnapshotOptions, "dir">;
+    snapshot?: Omit<VaultSnapshotOptions, "dir">;
     /** The unvaulted override — requires `gitvault.override_unvaulted` server-side; refused otherwise. */
     allow_unvaulted?: {
         reason: string;
@@ -202,7 +202,7 @@ export interface GitvaultDeployOptions {
     /** Test/replay hook: pin the capture id. */
     capture_id?: string;
     now?: () => Date;
-    /** Called with the `gitvault_commit` line as soon as the snapshot exists — the CLI prints it. */
+    /** Called with the `vault_commit` line as soon as the snapshot exists — the CLI prints it. */
     onCommitLine?: (line: string) => void;
 }
 /**
@@ -211,7 +211,7 @@ export interface GitvaultDeployOptions {
  * `revocation_outstanding` / `exposure_outstanding` — any subset, never
  * mutually exclusive); this decodes them into the exact `repos access`
  * command that remedies each one. Shared with the namespace-level `push()`
- * enrichment (`gitvault.ts#enrichEpochRotationRequired`) — same three
+ * enrichment (`repos.ts#enrichEpochRotationRequired`) — same three
  * causes, same three commands, one place either could drift from.
  */
 export declare function epochRotationRequiredNextActions(e: unknown): {
@@ -228,8 +228,8 @@ export declare function epochRotationRequiredNextActions(e: unknown): {
  */
 export declare const SNAPSHOT_MOVED_DURING_DEPLOY = "SNAPSHOT_MOVED_DURING_DEPLOY";
 /** What `SNAPSHOT_MOVED_DURING_DEPLOY` carries in `details`. */
-export interface GitvaultSnapshotMovedDetails extends GitvaultCapturedSetDrift {
-    gitvault_commit: string;
+export interface VaultSnapshotMovedDetails extends VaultCapturedSetDrift {
+    vault_commit: string;
     capture_id: string;
     captured_digest: string;
     observed_digest: string;
@@ -243,13 +243,13 @@ export interface GitvaultSnapshotMovedDetails extends GitvaultCapturedSetDrift {
  * capture; nothing is committed), and for `OVERRIDE_NOT_AUTHORIZED`; every
  * other path resolves to one of the five outcomes.
  */
-export declare function runGitvaultDeploy(options: GitvaultDeployOptions): Promise<GitvaultDeployResult>;
-export interface GitvaultOverrideDrainReport {
-    completed: GitvaultOverrideJournal[];
+export declare function runVaultDeploy(options: VaultDeployOptions): Promise<VaultDeployResult>;
+export interface VaultOverrideDrainReport {
+    completed: VaultOverrideJournal[];
     /** Still pending, with the reason the drain could not complete them this time. */
     remaining: Array<{
-        journal: GitvaultOverrideJournal;
-        error: GitvaultDeployError;
+        journal: VaultOverrideJournal;
+        error: VaultDeployError;
     }>;
 }
 /**
@@ -258,8 +258,8 @@ export interface GitvaultOverrideDrainReport {
  * field + the read-back head hash, present it for completion. Partial matches
  * never clear; the advisory persists until equality.
  */
-export declare function drainOverrideJournals(vault: GitvaultVault, options?: {
+export declare function drainOverrideJournals(vault: Vault, options?: {
     now?: () => Date;
-}): Promise<GitvaultOverrideDrainReport>;
+}): Promise<VaultOverrideDrainReport>;
 export {};
-//# sourceMappingURL=gitvault-deploy.d.ts.map
+//# sourceMappingURL=vault-deploy.d.ts.map

package/dist/node/vault-deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-deploy.d.ts","sourceRoot":"","sources":["../../src/node/vault-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAuB,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpI,OAAO,EAAE,aAAa,EAAyC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,KAAK,EAAiE,MAAM,wBAAwB,CAAC;AAC9G,OAAO,EAAwJ,KAAK,qBAAqB,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAItQ,eAAO,MAAM,qBAAqB,oJAMxB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,qBAAqB;IAC7B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,qBAAqB,EAAE,CAAC;CACvC;AAED,MAAM,MAAM,iBAAiB,GACzB,CAAC,qBAAqB,GAAG;IAAE,OAAO,EAAE,sBAAsB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,mBAAmB,CAAC;IAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,GACrM,CAAC,qBAAqB,GAAG;IAAE,OAAO,EAAE,4BAA4B,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,8BAA8B,EAAE,IAAI,CAAA;CAAE,CAAC,GACvI,CAAC,qBAAqB,GAAG;IAAE,OAAO,EAAE,uBAAuB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAA;CAAE,CAAC,GACpL,CAAC,qBAAqB,GAAG;IAAE,OAAO,EAAE,yBAAyB,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,YAAY,EAAE,gBAAgB,CAAA;CAAE,CAAC,GAC9H,CAAC,qBAAqB,GAAG;IAAE,OAAO,EAAE,6BAA6B,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAIhK,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8GAA8G;IAC9G,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,yFAAyF;IACzF,eAAe,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAID,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,eAAe,CAAA;KAAE,CAAC;IACrE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sJAAsJ;IACtJ,iBAAiB,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAElE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAGjG;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAG7G;AAED,qFAAqF;AACrF,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAc5G;AAID,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,wJAAwJ;AACxJ,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,wBAAwB,CAQ/N;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAOxF;AAED,4GAA4G;AAC5G,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAQzP;AAID,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC7C,sGAAsG;IACtG,eAAe,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAcD;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAO9F;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,gEAAgE;AAChE,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAiDD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+H5F;AAID,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,kFAAkF;IAClF,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8B/H"}

package/dist/node/{gitvault-deploy.js → vault-deploy.js}

@@ -1,9 +1,9 @@
 /**
- * gitvault — push-gated deploy (protocol rev 41 §6.5; task 5.6, lane supplied
- * by change `gitvault-deploy-lane`).
+ * vault — push-gated deploy (protocol rev 41 §6.5; task 5.6, lane supplied
+ * by change `vault-deploy-lane`).
  *
  * Every deploy has a commit, and the artifacts it ships CORRESPOND to it:
- *   1. snapshot (§6.6) → the `gitvault_commit`, printed ALWAYS, never sent,
+ *   1. snapshot (§6.6) → the `vault_commit`, printed ALWAYS, never sent,
  *      plus a digest over the captured file set;
  *   2. a fresh `capture_id` before BOTH lanes;
  *   3. the deploy lane collects artifacts from the work tree and produces the
@@ -45,12 +45,12 @@
 import { existsSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { LocalError, isRun402Error } from "../errors.js";
-import { formatGitvaultTimestamp, hexToBytes, newHex32 } from "../namespaces/gitvault.crypto.js";
-import { readFileNoFollow, writeFileAtomic0600 } from "./gitvault-keystore.js";
-import { captureBinding, deployRefTransaction } from "./gitvault-publication.js";
-import { GITVAULT_DEPLOY_REF, capturedSetDigest, capturedSetUnchanged, captureSnapshot, deriveCapturedSet, diffCapturedSets, gitvaultCommitLine, snapshotCommitment } from "./gitvault-snapshot.js";
+import { formatVaultTimestamp, hexToBytes, newHex32 } from "../namespaces/vault.crypto.js";
+import { readFileNoFollow, writeFileAtomic0600 } from "./vault-keystore.js";
+import { captureBinding, deployRefTransaction } from "./vault-publication.js";
+import { VAULT_DEPLOY_REF, capturedSetDigest, capturedSetUnchanged, captureSnapshot, deriveCapturedSet, diffCapturedSets, vaultCommitLine, snapshotCommitment } from "./vault-snapshot.js";
 // ─── Outcomes ────────────────────────────────────────────────────────────────
-export const GITVAULT_DEPLOY_OUTCOMES = [
+export const VAULT_DEPLOY_OUTCOMES = [
     "DEPLOYED_AND_VAULTED",
     "DEPLOY_BLOCKED_PUSH_FAILED",
     "DEPLOY_FAILED_VAULTED",
@@ -62,7 +62,7 @@ export function overrideJournalDir(keystore) {
 }
 export function overrideJournalPath(keystore, operationId) {
     if (!/^[A-Za-z0-9_.-]{1,128}$/.test(operationId))
-        throw new LocalError("operation_id is not a safe file name", "resolving override journal path", { code: "GITVAULT_BAD_ID" });
+        throw new LocalError("operation_id is not a safe file name", "resolving override journal path", { code: "VAULT_BAD_ID" });
     return join(overrideJournalDir(keystore), `${operationId}.json`);
 }
 export function writeOverrideJournal(keystore, journal) {
@@ -148,7 +148,7 @@ function code(e) {
  * `revocation_outstanding` / `exposure_outstanding` — any subset, never
  * mutually exclusive); this decodes them into the exact `repos access`
  * command that remedies each one. Shared with the namespace-level `push()`
- * enrichment (`gitvault.ts#enrichEpochRotationRequired`) — same three
+ * enrichment (`repos.ts#enrichEpochRotationRequired`) — same three
  * causes, same three commands, one place either could drift from.
  */
 export function epochRotationRequiredNextActions(e) {
@@ -196,7 +196,7 @@ async function assertCapturedSetUnchanged(snapshot, context) {
         return;
     const details = {
         ...drift,
-        gitvault_commit: snapshot.oid,
+        vault_commit: snapshot.oid,
         capture_id: context.capture_id,
         captured_digest: snapshot.captured_digest,
         observed_digest: capturedSetDigest(now),
@@ -218,20 +218,20 @@ async function assertCapturedSetUnchanged(snapshot, context) {
  * capture; nothing is committed), and for `OVERRIDE_NOT_AUTHORIZED`; every
  * other path resolves to one of the five outcomes.
  */
-export async function runGitvaultDeploy(options) {
+export async function runVaultDeploy(options) {
     const { vault, lane } = options;
     const now = options.now ?? (() => new Date());
     const repo = vault.repoFile();
     const kRepo = hexToBytes(repo.k_repo_hex);
     // 1. snapshot — refusals propagate; nothing has been sent anywhere.
     const snapshot = await captureSnapshot({ dir: options.repo_dir, ...(options.snapshot ?? {}) });
-    const commitLine = gitvaultCommitLine(snapshot);
+    const commitLine = vaultCommitLine(snapshot);
     options.onCommitLine?.(commitLine);
     // 2. fresh capture id before both lanes; the keyed snapshot commitment (the platform never sees the oid).
     const captureId = options.capture_id ?? newHex32();
     const snapshotOidHmac = snapshotCommitment(kRepo, vault.repoId, repo.epoch, snapshot.oid);
     const base = (fields) => ({
-        outcome: "DEPLOY_FAILED_UNVAULTED", gitvault_commit: snapshot.oid, gitvault_commit_line: commitLine, snapshot, capture_id: captureId, snapshot_oid_hmac: snapshotOidHmac,
+        outcome: "DEPLOY_FAILED_UNVAULTED", vault_commit: snapshot.oid, vault_commit_line: commitLine, snapshot, capture_id: captureId, snapshot_oid_hmac: snapshotOidHmac,
         apply_plan_sha256: null, operation_id: null, next_actions: [], ...fields,
     });
     // 3. the deploy lane collects artifacts from the work tree; step 5 below
@@ -274,7 +274,7 @@ export async function runGitvaultDeploy(options) {
     if (!pub) {
         const push_error = summarize(pushError);
         if (!planned) {
-            return { ...common, outcome: "DEPLOY_FAILED_UNVAULTED", push_error, deploy_error: summarize(planError), next_actions: [{ action: "fix the build, then redeploy" }, { action: "retry the push (run402 repos snapshot)" }] };
+            return { ...common, outcome: "DEPLOY_FAILED_UNVAULTED", push_error, deploy_error: summarize(planError), next_actions: [{ action: "fix the build, then redeploy" }, { action: "retry the push (run402 repos capture)" }] };
         }
         if (options.allow_unvaulted) {
             // Correspondence is checked BEFORE the journal is written: an override
@@ -284,9 +284,9 @@ export async function runGitvaultDeploy(options) {
             // journal BEFORE the commit so a crash leaves the advisory + the exact snapshot to resume
             const journal = {
                 version: 1, repo_id: vault.repoId, operation_id: planned.operation_id, capture_id: captureId, apply_plan_sha256: planned.apply_plan_sha256,
-                snapshot: { ref: GITVAULT_DEPLOY_REF, oid: snapshot.oid, head_target: snapshot.head }, snapshot_oid_hmac: snapshotOidHmac,
+                snapshot: { ref: VAULT_DEPLOY_REF, oid: snapshot.oid, head_target: snapshot.head }, snapshot_oid_hmac: snapshotOidHmac,
                 publication_state: "pending", generation: null, head_sha256: null, capture_receipt: null, reason: options.allow_unvaulted.reason,
-                created_at: formatGitvaultTimestamp(now()), updated_at: formatGitvaultTimestamp(now()),
+                created_at: formatVaultTimestamp(now()), updated_at: formatVaultTimestamp(now()),
             };
             writeOverrideJournal(vault.keystore, journal);
             let commit;
@@ -298,7 +298,7 @@ export async function runGitvaultDeploy(options) {
                     rmSync(overrideJournalPath(vault.keystore, planned.operation_id), { force: true }); // nothing activated; no advisory to drain
                     throw e;
                 }
-                return { ...common, outcome: "DEPLOY_FAILED_UNVAULTED", push_error, deploy_error: summarize(e), next_actions: [{ action: "retry the push (run402 repos snapshot) — the override journal is kept and will drain" }, { action: "retry the deploy" }] };
+                return { ...common, outcome: "DEPLOY_FAILED_UNVAULTED", push_error, deploy_error: summarize(e), next_actions: [{ action: "retry the push (run402 repos capture) — the override journal is kept and will drain" }, { action: "retry the deploy" }] };
             }
             return { ...common, outcome: "DEPLOYED_UNVAULTED_OVERRIDE", push_error, override_journal: journal, commit, next_actions: [{ action: "run any run402 CLI command later: the override journal drains by pushing this exact snapshot and presenting its capture receipt for completion" }] };
         }
@@ -312,7 +312,7 @@ export async function runGitvaultDeploy(options) {
                 // (never attempted automatically here: the two D194 counters a
                 // rotation must be fenced against have no client-visible read for
                 // ANY of the three causes below, so a blind retry inside the deploy
-                // lane would only ever fail — see GitvaultVault.rotateEpoch's doc
+                // lane would only ever fail — see Vault.rotateEpoch's doc
                 // comment for the confirmed gateway gap).
                 ...(code(pushError) === "EPOCH_ROTATION_REQUIRED" ? epochRotationRequiredNextActions(pushError) : []),
             ],
@@ -323,7 +323,7 @@ export async function runGitvaultDeploy(options) {
         return { ...common, outcome: "DEPLOY_FAILED_VAULTED", ...vaulted, deploy_error: summarize(planError), next_actions: [{ action: "fix the build, then redeploy (the attempted tree is in the vault at generation " + pub.generation + ")" }] };
     }
     if (!pub.capture_receipt) {
-        return { ...common, outcome: "DEPLOY_FAILED_VAULTED", ...vaulted, deploy_error: { code: "GITVAULT_CAPTURE_RECEIPT_MISSING", message: "admission returned no capture receipt for a head carrying a capture binding; no activation token can be exchanged", retryable: true }, next_actions: [{ action: "retry the deploy" }] };
+        return { ...common, outcome: "DEPLOY_FAILED_VAULTED", ...vaulted, deploy_error: { code: "VAULT_CAPTURE_RECEIPT_MISSING", message: "admission returned no capture receipt for a head carrying a capture binding; no activation token can be exchanged", retryable: true }, next_actions: [{ action: "retry the deploy" }] };
     }
     // Correspondence, before the token is even minted: an unspent token is
     // harmless, but refusing after the mint would leave one bound to a deploy
@@ -334,7 +334,7 @@ export async function runGitvaultDeploy(options) {
         token = await vault.transport.exchangeActivationToken({ repo_id: vault.repoId, operation_id: planned.operation_id, capture_receipt: pub.capture_receipt });
         const problems = checkActivationTokenBinding(token, { repo_id: vault.repoId, operation_id: planned.operation_id, generation: pub.generation, head_sha256: pub.head_sha256, capture_id: captureId, apply_plan_sha256: planned.apply_plan_sha256, snapshot_oid_hmac: snapshotOidHmac });
         if (problems.length > 0)
-            throw new LocalError(`the minted activation token does not bind this deploy (${problems.join(", ")}); refusing to present it`, "checking activation token", { code: "GITVAULT_TOKEN_BINDING_MISMATCH", details: { problems } });
+            throw new LocalError(`the minted activation token does not bind this deploy (${problems.join(", ")}); refusing to present it`, "checking activation token", { code: "VAULT_TOKEN_BINDING_MISMATCH", details: { problems } });
         // the mint validates the receipt's epoch against the installed one, so a minted token's epoch
         // must equal the receipt's — a difference means the epoch moved under us.
         checkAuthorizationEpoch(token.authorization_epoch, pub.capture_receipt.authorization_epoch);
@@ -371,18 +371,18 @@ export async function drainOverrideJournals(vault, options = {}) {
                     protocol_refs: "allow",
                     capture_binding: captureBinding(j.capture_id, j.apply_plan_sha256, j.snapshot_oid_hmac),
                 });
-                j = { ...j, publication_state: "published", generation: pub.generation, head_sha256: pub.head_sha256, capture_receipt: pub.capture_receipt, updated_at: formatGitvaultTimestamp(now()) };
+                j = { ...j, publication_state: "published", generation: pub.generation, head_sha256: pub.head_sha256, capture_receipt: pub.capture_receipt, updated_at: formatVaultTimestamp(now()) };
                 writeOverrideJournal(vault.keystore, j);
             }
             if (!j.capture_receipt || !j.head_sha256)
-                throw new LocalError("the journaled publication has no capture receipt to present", "draining override journal", { code: "GITVAULT_CAPTURE_RECEIPT_MISSING" });
+                throw new LocalError("the journaled publication has no capture receipt to present", "draining override journal", { code: "VAULT_CAPTURE_RECEIPT_MISSING" });
             const match = matchCaptureReceipt(j.capture_receipt, { repo_id: j.repo_id, capture_id: j.capture_id, apply_plan_sha256: j.apply_plan_sha256, snapshot_oid_hmac: j.snapshot_oid_hmac, head_sha256: j.head_sha256 });
             if (!match.equal)
-                throw new LocalError(`the capture receipt does not match the journaled operation on ${match.mismatched_fields.join(", ")}; the advisory persists`, "draining override journal", { code: "GITVAULT_OVERRIDE_COMPLETION_MISMATCH", details: match });
+                throw new LocalError(`the capture receipt does not match the journaled operation on ${match.mismatched_fields.join(", ")}; the advisory persists`, "draining override journal", { code: "VAULT_OVERRIDE_COMPLETION_MISMATCH", details: match });
             const res = await vault.transport.submitOverrideCompletion({ repo_id: j.repo_id, operation_id: j.operation_id, capture_receipt: j.capture_receipt });
             if (!res.cleared)
-                throw new LocalError("the platform did not clear the override advisory", "draining override journal", { code: "GITVAULT_OVERRIDE_COMPLETION_REFUSED" });
-            j = { ...j, publication_state: "completed", updated_at: formatGitvaultTimestamp(now()) };
+                throw new LocalError("the platform did not clear the override advisory", "draining override journal", { code: "VAULT_OVERRIDE_COMPLETION_REFUSED" });
+            j = { ...j, publication_state: "completed", updated_at: formatVaultTimestamp(now()) };
             writeOverrideJournal(vault.keystore, j);
             report.completed.push(j);
         }
@@ -392,4 +392,4 @@ export async function drainOverrideJournals(vault, options = {}) {
     }
     return report;
 }
-//# sourceMappingURL=gitvault-deploy.js.map
+//# sourceMappingURL=vault-deploy.js.map