@run402/sdk 4.94.0 → 4.96.0

package/dist/node/{gitvault-keystore.d.ts → vault-keystore.d.ts}

@@ -1,10 +1,10 @@
 /**
- * gitvault — the principal keystore (protocol rev 41 §5.1; task 5.2).
+ * vault — the principal keystore (protocol rev 41 §5.1; task 5.2).
  *
  * Layout (under the active profile's config dir, beside the project-key cache
  * `core/src/keystore.ts` manages — `RUN402_CONFIG_DIR` / `RUN402_WALLET` aware):
  *
- *   <config>/gitvault/
+ *   <config>/vault/
  *     identity.json                 Ed25519 seed + X25519 private key (0600)
  *     repos/<repo_id>.json          K_repo, trust pin, dual pins, last ref transaction (0600)
  *     repos/<repo_id>.lock/         per-repo lock (mkdir-atomic, 0700)
@@ -19,16 +19,16 @@
  * is a named finding, never silent.
  *
  * Transitions (protocol §5.1 partial-loss table) are DERIVED by
- * {@link GitvaultKeystore.assess} and acted on by explicit methods — the
+ * {@link VaultKeystore.assess} and acted on by explicit methods — the
  * keystore never guesses:
  *   - repo file lost + identity intact  → `restoreRepoFromEnvelope` (own envelope)
  *   - signing key lost, K_repo held     → `read_only` (clear report)
  *   - stale pin                         → `stale_pin` (re-verify from genesis; 5.4)
  *   - whole keystore lost               → `VAULT_UNRECOVERABLE` (§0, verbatim)
  */
-import type { GitvaultEncryptionKeypair, GitvaultKeyEnvelope, GitvaultRecoveryReceipt, GitvaultSigningKeypair, GitvaultVaultGenesis } from "../namespaces/gitvault.types.js";
+import type { VaultEncryptionKeypair, VaultKeyEnvelope, VaultRecoveryReceipt, VaultSigningKeypair, VaultGenesis } from "../namespaces/vault.types.js";
 /** `identity.json` — the principal's two private keys. Either half MAY be absent after partial loss. */
-export interface GitvaultIdentityFile {
+export interface VaultIdentityFile {
     version: 1;
     /** Ed25519 32-byte seed, lowercase hex. Absent ⇒ the signing key is lost (read-only principal). */
     signing_seed_hex?: string;
@@ -53,18 +53,18 @@ export interface GitvaultIdentityFile {
     created_at: string;
 }
 /** The dual pins (protocol §6.4): the newest authenticated head and its generation. */
-export interface GitvaultHeadPin {
+export interface VaultHeadPin {
     generation: string;
     head_sha256: string;
     pinned_at: string;
 }
 /** `repos/<repo_id>.json` — everything per-vault the principal must not lose. */
-export interface GitvaultRepoFile {
+export interface VaultRepoFile {
     version: 1;
     repo_id: string;
     org_id: string;
     project_id: string;
-    /** Raw 32-byte secret for {@link GitvaultRepoFile.epoch} (`K_repo`/`K_1` pre-rotation, `K_e` after one), lowercase hex. */
+    /** Raw 32-byte secret for {@link VaultRepoFile.epoch} (`K_repo`/`K_1` pre-rotation, `K_e` after one), lowercase hex. */
     k_repo_hex: string;
     /** The current epoch — `0000000000000001` until this vault's first rotation (D194, rev 42); advances on every rotation this principal drove or opened its own envelope for. */
     epoch: string;
@@ -83,13 +83,13 @@ export interface GitvaultRepoFile {
     /** Trust pin: the admitted genesis stored-bytes hash. */
     genesis_sha256: string;
     /** `highest_authenticated` (§6.4): chain-verified; a listing below it is `GENERATION_REGRESSION`. `null` until the first head is authenticated. */
-    head_pin: GitvaultHeadPin | null;
+    head_pin: VaultHeadPin | null;
     /** `highest_materialized` (§6.4): decrypted + applied — the ONLY push base. Absent/`null` ⇒ never materialized. */
-    materialized_pin?: GitvaultHeadPin | null;
+    materialized_pin?: VaultHeadPin | null;
     /** The verified-prefix watermark of a budget-interrupted verification (§9.3 — resumable). Absent/`null` when none is pending. */
-    verified_prefix?: GitvaultHeadPin | null;
+    verified_prefix?: VaultHeadPin | null;
     /**
-     * gitvault-clone-scaling (bench P3): the newest checkpoint coverage this
+     * vault-clone-scaling (bench P3): the newest checkpoint coverage this
      * checkout has LOCALLY learned — from pushing a checkpoint-form head,
      * walking past a checkpoint head, a genesis-anchored walk that saw none
      * (proving coverage = genesis), or a restore's checkpoint apply. Feeds
@@ -99,24 +99,24 @@ export interface GitvaultRepoFile {
      */
     checkpoint_covers_through?: string | null;
     /**
-     * gitvault-object-host-predial (design D1): the object-store ORIGINS
+     * vault-object-host-predial (design D1): the object-store ORIGINS
      * (`scheme://host` — never a path, query, key, or credential) this
      * checkout has observed a presigned or edge URL actually served bytes
      * from, most-recently-observed first, deduped, capped at
-     * {@link GITVAULT_OBJECT_STORE_ORIGINS_CAP}. Same locally-learned,
+     * {@link VAULT_OBJECT_STORE_ORIGINS_CAP}. Same locally-learned,
      * monotonic-in-usefulness pattern as {@link checkpoint_covers_through}:
      * absent/`null`/`[]` means nothing is known yet (a first-ever session,
      * byte-identical to before this field existed) and is never protocol
-     * state — it feeds the connection prewarm ONLY (`predialGitvaultObjectStore`
-     * in `gitvault-prewarm.ts`), never verification, never a source of truth
+     * state — it feeds the connection prewarm ONLY (`predialVaultObjectStore`
+     * in `vault-prewarm.ts`), never verification, never a source of truth
      * for where an object actually lives. A stale entry (bucket migrated)
      * costs at most one harmless background dial and is overwritten by the
      * next observed fetch.
      */
     object_store_origins?: string[];
     /**
-     * TOFU pins for {@link GitvaultVault.reconcileEnvelopeRecipients}
-     * (gitvault-human-envelopes design D4 point 3): `principal_id ->` the
+     * TOFU pins for {@link Vault.reconcileEnvelopeRecipients}
+     * (vault-human-envelopes design D4 point 3): `principal_id ->` the
      * `ek_` fingerprint this repo last wrapped a `key_envelope` for (or
      * observed already covering the vault). A later reconcile whose org
      * directory reports a DIFFERENT fingerprint for the same `principal_id`
@@ -127,9 +127,9 @@ export interface GitvaultRepoFile {
     /**
      * The MOST RECENT `recipient_pin_manifest` this principal itself built,
      * signed, and successfully admitted (D197) — via {@link
-     * GitvaultVault.publishPinManifestUpdate} or {@link
-     * GitvaultVault.rotateEpoch}'s `pending_confirmations` fold. Read-side
-     * short-circuit ONLY: {@link GitvaultVault} `readPinManifestObject`
+     * Vault.publishPinManifestUpdate} or {@link
+     * Vault.rotateEpoch}'s `pending_confirmations` fold. Read-side
+     * short-circuit ONLY: {@link Vault} `readPinManifestObject`
      * consults this before a network `object-reads` round trip, and uses it
      * ONLY when `pin_manifest_version` + `stored_bytes_sha256` match the
      * receipt it is resolving — never as a substitute for verification of a
@@ -151,9 +151,9 @@ export interface GitvaultRepoFile {
         }[];
     } | null;
     /**
-     * gitvault-multi-writer rev 47 (protocol §4.15) — the writer-set analog of
+     * vault-multi-writer rev 47 (protocol §4.15) — the writer-set analog of
      * {@link head_pin}: the chain-replayed writer state as of THIS repo's own
-     * `head_pin`/`verified_prefix` generation, persisted so `GitvaultVault.verifyToNewest`
+     * `head_pin`/`verified_prefix` generation, persisted so `Vault.verifyToNewest`
      * never has to re-walk the writer set from genesis on every call. Advances
      * in lockstep with `head_pin`/`verified_prefix` — always at the SAME
      * generation, never ahead or behind. `null` until the first `verifyToNewest`
@@ -174,7 +174,7 @@ export interface GitvaultRepoFile {
         pinned_at: string;
     } | null;
     /**
-     * gitvault-multi-writer rev 47 — THIS principal's own relationship to the
+     * vault-multi-writer rev 47 — THIS principal's own relationship to the
      * chain-verified `writer_set_pin` above, as of the last time it was
      * computed (`repos view`/`doctor`/reconcile — task 5.7). `"pending"`: a
      * claimed handoff or a directory publish is waiting on the actual
@@ -187,7 +187,7 @@ export interface GitvaultRepoFile {
      */
     writer_status?: "pending" | "active" | "not_admitted" | "removed" | null;
     /**
-     * gitvault-multi-writer rev 47 (task 5.6) — set by `resume()` the moment a
+     * vault-multi-writer rev 47 (task 5.6) — set by `resume()` the moment a
      * handoff claim response's `writer_admission_grant` is verified and
      * persisted, BEFORE the recipient's own `add_writer_key{"handoff"}`
      * activation push lands on-chain; cleared once that push is admitted
@@ -210,33 +210,33 @@ export interface GitvaultRepoFile {
     updated_at: string;
 }
 /** One `audit.log` line. */
-export interface GitvaultAuditEntry {
+export interface VaultAuditEntry {
     at: string;
-    event: GitvaultAuditEvent;
+    event: VaultAuditEvent;
     repo_id?: string;
     details?: Record<string, unknown>;
 }
-export type GitvaultAuditEvent = "keystore_opened" | "identity_created" | "identity_principal_bound" | "repo_saved" | "repo_restored_from_envelope" | "recovery_receipt_stored" | "permission_finding" | "lock_acquired" | "lock_released" | "lock_stale_reclaimed" | "transition_assessed" | "journal_stage" | "epoch_rotation_recorded";
+export type VaultAuditEvent = "keystore_opened" | "identity_created" | "identity_principal_bound" | "repo_saved" | "repo_restored_from_envelope" | "recovery_receipt_stored" | "permission_finding" | "lock_acquired" | "lock_released" | "lock_stale_reclaimed" | "transition_assessed" | "journal_stage" | "epoch_rotation_recorded";
 /** A permission-audit finding (never fatal by default; surfaced to doctor). */
-export interface GitvaultPermissionFinding {
+export interface VaultPermissionFinding {
     path: string;
     problem: "world_or_group_accessible" | "symlink" | "not_owned_by_user" | "missing";
     mode?: string;
 }
 /** The §5.1 partial-loss transition the keystore is in for one vault. */
-export type GitvaultKeystoreState = {
+export type VaultKeystoreState = {
     state: "ready";
-    repo: GitvaultRepoFile;
+    repo: VaultRepoFile;
 } | {
     state: "repo_state_lost_identity_intact";
     next_action: "restore_from_envelope";
 } | {
     state: "read_only";
-    repo: GitvaultRepoFile;
+    repo: VaultRepoFile;
     reason: "signing_key_lost";
 } | {
     state: "stale_pin";
-    repo: GitvaultRepoFile;
+    repo: VaultRepoFile;
     next_action: "reverify_from_genesis";
 } | {
     state: "unrecoverable";
@@ -244,26 +244,36 @@ export type GitvaultKeystoreState = {
     statement: string;
     doctor_text: string;
 };
-export interface GitvaultKeystoreOptions {
-    /** Override the keystore root (tests). Defaults to `<config dir>/gitvault`. */
+export interface VaultKeystoreOptions {
+    /** Override the keystore root (tests). Defaults to `<config dir>/vault`. */
     rootDir?: string;
     /** Clock injection (tests). */
     now?: () => Date;
-    /** When true, a permission finding on open throws `GITVAULT_KEYSTORE_PERMISSIONS` instead of only auditing. */
+    /** When true, a permission finding on open throws `VAULT_KEYSTORE_PERMISSIONS` instead of only auditing. */
     strictPermissions?: boolean;
 }
-export interface GitvaultLockOptions {
+export interface VaultLockOptions {
     /** How long a lock is considered live before it is reclaimed as stale (ms). Default 10 min. */
     staleAfterMs?: number;
-    /** Total wait budget before `GITVAULT_KEYSTORE_LOCKED` (ms). Default 30 s. */
+    /** Total wait budget before `VAULT_KEYSTORE_LOCKED` (ms). Default 30 s. */
     timeoutMs?: number;
 }
 /** The local object cache's recency window (design D3: "genesis + newest N=8 heads + newest carriers"). */
-export declare const GITVAULT_OBJECT_CACHE_WINDOW = 8;
-/** gitvault-object-host-predial (design D1): the max persisted object-store origins per repo — small on purpose, this is a predial hint, not an inventory. */
-export declare const GITVAULT_OBJECT_STORE_ORIGINS_CAP = 4;
-/** Default keystore root: `<active profile config dir>/gitvault`. */
-export declare function getGitvaultKeystoreRoot(): string;
+export declare const VAULT_OBJECT_CACHE_WINDOW = 8;
+/** vault-object-host-predial (design D1): the max persisted object-store origins per repo — small on purpose, this is a predial hint, not an inventory. */
+export declare const VAULT_OBJECT_STORE_ORIGINS_CAP = 4;
+/**
+ * Default keystore root: `<active profile config dir>/vault`.
+ *
+ * This is the one place the keystore path is first resolved, so it is also
+ * where a keystore still at `<config>/gitvault` moves to `<config>/vault`:
+ * one same-directory `rename`, which is atomic, and only when `vault` does
+ * not exist yet. Nothing reads the earlier path after that. A move another
+ * process already made is not an error; any other refusal throws
+ * `VAULT_KEYSTORE_MOVE_FAILED` naming both paths, because answering with an
+ * empty `vault` directory would make a live keystore look lost.
+ */
+export declare function getVaultKeystoreRoot(): string;
 /**
  * Atomic, no-follow, fsynced write: `O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW` on a
  * temp sibling, fsync, rename over the target, fsync the directory.
@@ -271,13 +281,13 @@ export declare function getGitvaultKeystoreRoot(): string;
 export declare function writeFileAtomic0600(path: string, text: string): void;
 /** No-follow read: a symlinked keystore file is a refusal, not a read. */
 export declare function readFileNoFollow(path: string): string | null;
-export declare class GitvaultKeystore {
+export declare class VaultKeystore {
     readonly rootDir: string;
     private readonly now;
     private readonly strictPermissions;
-    constructor(options?: GitvaultKeystoreOptions);
+    constructor(options?: VaultKeystoreOptions);
     /** Open (creating the directory skeleton) and run the permission audit. */
-    static open(options?: GitvaultKeystoreOptions): GitvaultKeystore;
+    static open(options?: VaultKeystoreOptions): VaultKeystore;
     get identityPath(): string;
     get reposDir(): string;
     get receiptsDir(): string;
@@ -286,14 +296,14 @@ export declare class GitvaultKeystore {
     repoPath(repoId: string): string;
     recoveryReceiptPath(repoId: string): string;
     /** Audit every keystore path that exists; findings are recorded in `audit.log` and returned. */
-    auditPermissions(): GitvaultPermissionFinding[];
+    auditPermissions(): VaultPermissionFinding[];
     /** Append one JSON line to `audit.log` (0600, created no-follow). */
-    audit(event: GitvaultAuditEvent, repoId?: string, details?: Record<string, unknown>): void;
+    audit(event: VaultAuditEvent, repoId?: string, details?: Record<string, unknown>): void;
     /** Read the audit log (newest last). */
-    readAuditLog(): GitvaultAuditEntry[];
-    readIdentity(): GitvaultIdentityFile | null;
+    readAuditLog(): VaultAuditEntry[];
+    readIdentity(): VaultIdentityFile | null;
     /** Create the identity if absent; never overwrites an existing one. */
-    ensureIdentity(): GitvaultIdentityFile;
+    ensureIdentity(): VaultIdentityFile;
     /**
      * Record (idempotently) which principal this identity enrolled as. A
      * DIFFERENT already-recorded principal is refused — a deliberate migration
@@ -301,16 +311,16 @@ export declare class GitvaultKeystore {
      */
     bindIdentityPrincipal(principalId: string): void;
     /** The signing keypair, or `null` when the signing seed is lost (read-only principal). */
-    signingKeypair(identity?: GitvaultIdentityFile): GitvaultSigningKeypair | null;
+    signingKeypair(identity?: VaultIdentityFile): VaultSigningKeypair | null;
     /** The encryption keypair, or `null` when the X25519 private key is lost. */
-    encryptionKeypair(identity?: GitvaultIdentityFile): GitvaultEncryptionKeypair | null;
+    encryptionKeypair(identity?: VaultIdentityFile): VaultEncryptionKeypair | null;
     private requireIdentity;
-    readRepo(repoId: string): GitvaultRepoFile | null;
+    readRepo(repoId: string): VaultRepoFile | null;
     listRepoIds(): string[];
     /**
-     * gitvault-offline-clone-resolve (design D1/D2/D6, task 1.1): the
-     * keystore's project→repo lookup that lets {@link resolveGitvaultAddress}
-     * (`gitvault-address.ts`) answer an id-form address WITHOUT the network
+     * vault-offline-clone-resolve (design D1/D2/D6, task 1.1): the
+     * keystore's project→repo lookup that lets {@link resolveVaultAddress}
+     * (`vault-address.ts`) answer an id-form address WITHOUT the network
      * `findVaultByProject` round trip. D2's completeness argument: decrypting
      * anything requires exactly this repo file (`k_repo_hex`), so "this
      * keystore holds a matching file" is exactly the set of clones that can
@@ -328,7 +338,7 @@ export declare class GitvaultKeystore {
      * old `repo_id` on THIS machine. D3: the most-recently-modified file (by
      * filesystem mtime — D6 rules out a maintained on-disk index for v1) wins;
      * a wrong pick is indistinguishable from an ordinary stale pin and heals
-     * through the same {@link recoverStaleGitvaultPin} first-use-refusal path.
+     * through the same {@link recoverStaleVaultPin} first-use-refusal path.
      *
      * Cheap by construction (D6): one directory listing plus one JSON read per
      * candidate — no maintained project→repo index. NEVER throws: a corrupt,
@@ -338,17 +348,17 @@ export declare class GitvaultKeystore {
      * corruption is the right, attributable failure). Returns `null` on no
      * match, an empty keystore, or a not-yet-created `repos/` directory.
      */
-    findRepoByProject(projectId: string, orgId?: string): GitvaultRepoFile | null;
+    findRepoByProject(projectId: string, orgId?: string): VaultRepoFile | null;
     /** Save (create or replace) a repo file under the per-repo lock. */
-    saveRepo(repo: Omit<GitvaultRepoFile, "version" | "updated_at">): GitvaultRepoFile;
+    saveRepo(repo: Omit<VaultRepoFile, "version" | "updated_at">): VaultRepoFile;
     /** Update the dual pins / last ref transaction without touching key material. */
-    updateRepo(repoId: string, patch: Partial<Pick<GitvaultRepoFile, "head_pin" | "materialized_pin" | "verified_prefix" | "last_ref_transaction" | "epoch" | "envelope_recipient_pins" | "k_repo_hex" | "epoch_keys" | "known_pin_manifest" | "checkpoint_covers_through" | "object_store_origins" | "writer_set_pin" | "writer_status" | "pending_writer_admission">>): GitvaultRepoFile;
+    updateRepo(repoId: string, patch: Partial<Pick<VaultRepoFile, "head_pin" | "materialized_pin" | "verified_prefix" | "last_ref_transaction" | "epoch" | "envelope_recipient_pins" | "k_repo_hex" | "epoch_keys" | "known_pin_manifest" | "checkpoint_covers_through" | "object_store_origins" | "writer_set_pin" | "writer_status" | "pending_writer_admission">>): VaultRepoFile;
     /**
-     * gitvault-object-host-predial (design D1/D4, task 1.2): record that
+     * vault-object-host-predial (design D1/D4, task 1.2): record that
      * `origins` (already-normalized `scheme://host` strings) were observed
      * serving THIS repo's objects — the transport's write-through-on-change
      * hook. Most-recently-observed wins ties over anything already recorded;
-     * deduped; capped at {@link GITVAULT_OBJECT_STORE_ORIGINS_CAP}. A true
+     * deduped; capped at {@link VAULT_OBJECT_STORE_ORIGINS_CAP}. A true
      * no-op (no lock taken, no write, `updated_at` untouched) when the
      * resulting set is IDENTICAL — in order — to what is already on disk, so
      * the steady state (every session re-observes the same one or two
@@ -377,7 +387,7 @@ export declare class GitvaultKeystore {
         sha256: string;
         bytes: Uint8Array;
     } | null;
-    /** Writes the head, then evicts anything more than {@link GITVAULT_OBJECT_CACHE_WINDOW} generations behind it. */
+    /** Writes the head, then evicts anything more than {@link VAULT_OBJECT_CACHE_WINDOW} generations behind it. */
     writeCachedHead(repoId: string, generation: string, sha256: string, bytes: Uint8Array): void;
     readCachedCarrier(repoId: string, objectId: string): {
         sha256: string;
@@ -387,7 +397,7 @@ export declare class GitvaultKeystore {
     /** Writes the carrier (keyed by `object_id`, tagged with the generation that referenced it), then sweeps the window. */
     writeCachedCarrier(repoId: string, objectId: string, generation: string, sha256: string, bytes: Uint8Array): void;
     /**
-     * Drop heads and carriers more than {@link GITVAULT_OBJECT_CACHE_WINDOW}
+     * Drop heads and carriers more than {@link VAULT_OBJECT_CACHE_WINDOW}
      * generations behind `latestGeneration` — genesis is exempt (kept
      * forever). Runs inline on every cache write; also callable directly
      * (`sweepObjectCache`, wired into `repos gc`) as a periodic backstop that
@@ -409,22 +419,22 @@ export declare class GitvaultKeystore {
     recordEpochRotation(repoId: string, input: {
         new_epoch: string;
         new_k_repo_hex: string;
-    }): GitvaultRepoFile;
-    saveRecoveryReceipt(receipt: GitvaultRecoveryReceipt): void;
-    readRecoveryReceipt(repoId: string): GitvaultRecoveryReceipt | null;
+    }): VaultRepoFile;
+    saveRecoveryReceipt(receipt: VaultRecoveryReceipt): void;
+    readRecoveryReceipt(repoId: string): VaultRecoveryReceipt | null;
     /**
      * Run `fn` holding the per-repo lock (`repos/<repo_id>.lock/`, mkdir-atomic).
      * A lock older than `staleAfterMs` whose recorded pid is dead is reclaimed
      * (audited). Re-entrant for the same process+repo.
      */
-    withRepoLock<T>(repoId: string, fn: () => T, options?: GitvaultLockOptions): T;
+    withRepoLock<T>(repoId: string, fn: () => T, options?: VaultLockOptions): T;
     private readonly held;
     private reclaimStaleLock;
     /**
      * Derive the partial-loss transition for one vault. `expectedGenesisSha256`
      * (from a freshly listed genesis, 5.4) turns a pin mismatch into `stale_pin`.
      */
-    assess(repoId: string, expectedGenesisSha256?: string): GitvaultKeystoreState;
+    assess(repoId: string, expectedGenesisSha256?: string): VaultKeystoreState;
     /**
      * §5.1 "repo file lost + identity intact → restore K_repo from own envelope".
      * The genesis is checked (signature + key bindings against the stored
@@ -432,12 +442,12 @@ export declare class GitvaultKeystore {
      * is opened; the restored file is marked `restored_from_envelope`.
      */
     restoreRepoFromEnvelope(input: {
-        genesis: GitvaultVaultGenesis;
-        envelope: GitvaultKeyEnvelope;
+        genesis: VaultGenesis;
+        envelope: VaultKeyEnvelope;
         /** A surviving receipt (on disk or supplied) authenticates the genesis; without one the restore is labeled unauthenticated salvage. */
-        recovery_receipt?: GitvaultRecoveryReceipt | null;
+        recovery_receipt?: VaultRecoveryReceipt | null;
         /**
-         * gitvault-agent-envelopes D4: the caller verified genesis's creator
+         * vault-agent-envelopes D4: the caller verified genesis's creator
          * fingerprints against the control plane's SIGNED allocation record. That
          * is platform-attested consistency, NOT independent authentication — the
          * platform serves both sides of the comparison — so it labels the restore
@@ -447,7 +457,7 @@ export declare class GitvaultKeystore {
          */
         allocation_attested?: boolean;
         /**
-         * gitvault-multi-writer (rev 47): the vault's CURRENTLY admitted writers,
+         * vault-multi-writer (rev 47): the vault's CURRENTLY admitted writers,
          * resolved by the caller from the chain-verified writer set (the admitted
          * heads' `add_writer_key` / `writer_set_update` transitions). A
          * non-creator envelope may be wrapped by ANY admitted writer — whichever
@@ -460,7 +470,7 @@ export declare class GitvaultKeystore {
             signing_pubkey: string;
         }[];
     }): Promise<{
-        repo: GitvaultRepoFile;
+        repo: VaultRepoFile;
         trust: "receipt" | "platform_attested" | "unauthenticated_salvage";
         continuity: "first_seen" | "pinned";
         independently_verified: boolean;
@@ -473,4 +483,4 @@ export declare class GitvaultKeystore {
         encryption_key_present: boolean;
     } | null;
 }
-//# sourceMappingURL=gitvault-keystore.d.ts.map
+//# sourceMappingURL=vault-keystore.d.ts.map

package/dist/node/vault-keystore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-keystore.d.ts","sourceRoot":"","sources":["../../src/node/vault-keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2BH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EAEpB,mBAAmB,EACnB,YAAY,EACb,MAAM,8BAA8B,CAAC;AAItC,wGAAwG;AACxG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,wHAAwH;IACxH,UAAU,EAAE,MAAM,CAAC;IACnB,+KAA+K;IAC/K,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3C,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,mJAAmJ;IACnJ,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,mHAAmH;IACnH,gBAAgB,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACvC,iIAAiI;IACjI,eAAe,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE;QAAE,oBAAoB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACpJ;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpN;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACzE;;;;;;;;;;;OAWG;IACH,wBAAwB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzI,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrD,uKAAuK;IACvK,UAAU,EAAE,SAAS,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,sBAAsB,CAAC;IACpG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,kBAAkB,GAClB,0BAA0B,GAC1B,YAAY,GACZ,6BAA6B,GAC7B,yBAAyB,GACzB,oBAAoB,GACpB,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,qBAAqB,GACrB,eAAe,GACf,yBAAyB,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,2BAA2B,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GACvC;IAAE,KAAK,EAAE,iCAAiC,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GAClF;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GACvE;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GACjF;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,4GAA4G;IAC5G,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAUD,2GAA2G;AAC3G,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,2JAA2J;AAC3J,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAchD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAqCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBpE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5D;AAsBD,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAEhC,OAAO,GAAE,oBAAyB;IAM9C,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa;IAW9D,IAAI,YAAY,IAAI,MAAM,CAAgD;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAAwC;IAC9D,IAAI,WAAW,IAAI,MAAM,CAA2C;IACpE,IAAI,UAAU,IAAI,MAAM,CAA0C;IAClE,IAAI,YAAY,IAAI,MAAM,CAA4C;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIhC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAO3C,gGAAgG;IAChG,gBAAgB,IAAI,sBAAsB,EAAE;IAyB5C,qEAAqE;IACrE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAevF,wCAAwC;IACxC,YAAY,IAAI,eAAe,EAAE;IAQjC,YAAY,IAAI,iBAAiB,GAAG,IAAI;IAUxC,uEAAuE;IACvE,cAAc,IAAI,iBAAiB;IAuBnC;;;;OAIG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAUhD,0FAA0F;IAC1F,cAAc,CAAC,QAAQ,GAAE,iBAA0C,GAAG,mBAAmB,GAAG,IAAI;IAShG,6EAA6E;IAC7E,iBAAiB,CAAC,QAAQ,GAAE,iBAA0C,GAAG,sBAAsB,GAAG,IAAI;IAStG,OAAO,CAAC,eAAe;IAQvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAU9C,WAAW,IAAI,MAAM,EAAE;IAKvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAsB1E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG,aAAa;IAS5E,iFAAiF;IACjF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,OAAO,GAAG,yBAAyB,GAAG,YAAY,GAAG,YAAY,GAAG,oBAAoB,GAAG,2BAA2B,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,eAAe,GAAG,0BAA0B,CAAC,CAAC,GAAG,aAAa;IAUhX;;;;;;;;;;;;;OAaG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAoC1E,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,kBAAkB;IAE1B,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,eAAe;IAGvB,OAAO,CAAC,iBAAiB;IASzB,2FAA2F;IAC3F,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAG/E,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAI3E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI;IAGhG,+GAA+G;IAC/G,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAK5F,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMrH,wHAAwH;IACxH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAKjH;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB;IAsBxB,+MAA+M;IAC/M,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMtC;;;;;;;OAOG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa;IAcxG,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAOxD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;IAOhE;;;;OAIG;IACH,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,gBAAqB,GAAG,CAAC;IAqC/E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,OAAO,CAAC,gBAAgB;IA0BxB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAyB1E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,YAAY,CAAC;QACtB,QAAQ,EAAE,gBAAgB,CAAC;QAC3B,uIAAuI;QACvI,gBAAgB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;QAC/C;;;;;;;;WAQG;QACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B;;;;;;;;WAQG;QACH,gBAAgB,CAAC,EAAE,SAAS;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACjF,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,KAAK,EAAE,SAAS,GAAG,mBAAmB,GAAG,yBAAyB,CAAC;QAAC,UAAU,EAAE,YAAY,GAAG,QAAQ,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,CAAC;IAwE9K,qEAAqE;IACrE,eAAe,IAAI;QAAE,mBAAmB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;CAazJ"}