@run402/sdk 4.94.0 → 4.96.0

package/dist/node/{gitvault-publication.d.ts → vault-publication.d.ts}

@@ -1,5 +1,5 @@
 /**
- * gitvault — publication (protocol rev 41 §6 + §4.4–4.7 + §5A client side;
+ * vault — publication (protocol rev 41 §6 + §4.4–4.7 + §5A client side;
  * task 5.4).
  *
  * What lives here:
@@ -13,12 +13,12 @@
  *     next_cursor coupling, strictly-above-anchor, gapless across pages,
  *     truthful total), chain linkage (`CHAIN_BROKEN`), and the transition
  *     fail-closed rule (`UPGRADE_REQUIRED`);
- *   - {@link GitvaultTransport} — the control-plane + bucket operations the
+ *   - {@link VaultTransport} — the control-plane + bucket operations the
  *     vault needs (extends task 5.3's creation transport) — and
- *     {@link createGitvaultHttpTransport}, the `fetch`-backed implementation
+ *     {@link createVaultHttpTransport}, the `fetch`-backed implementation
  *     over the SDK kernel (upload sessions → presigned PUT with
  *     `If-None-Match: *` → finalize);
- *   - {@link GitvaultVault} — discover/verify to newest with the RESUMABLE
+ *   - {@link Vault} — discover/verify to newest with the RESUMABLE
  *     verification budget, materialize (decrypt ref_state + retention_roots →
  *     the materialized pin), push (pack_set or a checkpoint-bearing head when
  *     the delta exceeds the 64-receipt budget, upload with receipt-compare,
@@ -34,27 +34,27 @@
  * transition is `UPGRADE_REQUIRED` (read-only past it, no publish).
  */
 import type { Client } from "../kernel.js";
-import { type GitvaultMirrorBackend } from "./gitvault-mirror-backend.js";
-import type { GitvaultMirrorCredential, GitvaultMirrorDestination } from "./gitvault-mirror-config.js";
-import { type GitvaultCheckpointStaleness } from "../namespaces/gitvault.js";
-import type { GitvaultActivationToken, GitvaultCaptureBinding, GitvaultCaptureReceipt, GitvaultCheckpointBlock, GitvaultCheckpointClaimSet, GitvaultCheckpointManifest, GitvaultDigestLabel, GitvaultHead, GitvaultHeadTarget, GitvaultHeadsListingPage, GitvaultHeadsListingRequest, GitvaultOpenReceipt, GitvaultRecipientConfirmationReceipt, GitvaultRefState, GitvaultRefTransaction, GitvaultRefUpdate, GitvaultRepairDescriptor, GitvaultRetentionCutoff, GitvaultRetentionCutoffReceipt, GitvaultRetentionRoot, GitvaultRetentionRoots, GitvaultRetentionRootsReceipt, GitvaultRotateEpochPayload, GitvaultRotationAttemptDescriptor, GitvaultRotationReason, GitvaultVaultGenesis } from "../namespaces/gitvault.types.js";
-import type { GitvaultCreationTransport } from "./gitvault-creation-journal.js";
-import { GitvaultKeystore, type GitvaultRepoFile } from "./gitvault-keystore.js";
-import type { GitvaultPruneIntentRecord } from "./gitvault-prune.js";
-export declare const GITVAULT_MAX_CANONICAL_REFS = 10000;
-export declare const GITVAULT_MAX_REF_UPDATES_PER_TRANSACTION = 1000;
-export declare const GITVAULT_MAX_RETENTION_ROOT_ENTRIES = 50000;
-export declare const GITVAULT_MAX_REPAIR_ADDED_ROOTS = 10000;
-export declare const GITVAULT_MAX_WAL_RECEIPTS_PER_HEAD = 64;
-export declare const GITVAULT_MAX_CHECKPOINT_PACKS = 4096;
-export declare const GITVAULT_MAX_CHECKPOINT_TOTAL_STORED_BYTES = 858993459200n;
-export declare const GITVAULT_MULTI_OBJECT_PACK_TARGET_BYTES = 201326592;
-export declare const GITVAULT_MAX_REF_STATE_OBJECT_BYTES = 33554432;
-export declare const GITVAULT_MAX_HEADS_PER_LISTING_PAGE = 1000;
-export declare const GITVAULT_VERIFICATION_BUDGET_HEADS = 100000;
-export declare const GITVAULT_RETENTION_MIN_DAYS = 90;
+import { type VaultMirrorBackend } from "./vault-mirror-backend.js";
+import type { VaultMirrorCredential, VaultMirrorDestination } from "./vault-mirror-config.js";
+import { type VaultCheckpointStaleness } from "../namespaces/repos.js";
+import type { VaultActivationToken, VaultCaptureBinding, VaultCaptureReceipt, VaultCheckpointBlock, VaultCheckpointClaimSet, VaultCheckpointManifest, VaultDigestLabel, VaultHead, VaultHeadTarget, VaultHeadsListingPage, VaultHeadsListingRequest, VaultOpenReceipt, VaultRecipientConfirmationReceipt, VaultRefState, VaultRefTransaction, VaultRefUpdate, VaultRepairDescriptor, VaultRetentionCutoff, VaultRetentionCutoffReceipt, VaultRetentionRoot, VaultRetentionRoots, VaultRetentionRootsReceipt, VaultRotateEpochPayload, VaultRotationAttemptDescriptor, VaultRotationReason, VaultGenesis } from "../namespaces/vault.types.js";
+import type { VaultCreationTransport } from "./vault-creation-journal.js";
+import { VaultKeystore, type VaultRepoFile } from "./vault-keystore.js";
+import type { VaultPruneIntentRecord } from "./vault-prune.js";
+export declare const VAULT_MAX_CANONICAL_REFS = 10000;
+export declare const VAULT_MAX_REF_UPDATES_PER_TRANSACTION = 1000;
+export declare const VAULT_MAX_RETENTION_ROOT_ENTRIES = 50000;
+export declare const VAULT_MAX_REPAIR_ADDED_ROOTS = 10000;
+export declare const VAULT_MAX_WAL_RECEIPTS_PER_HEAD = 64;
+export declare const VAULT_MAX_CHECKPOINT_PACKS = 4096;
+export declare const VAULT_MAX_CHECKPOINT_TOTAL_STORED_BYTES = 858993459200n;
+export declare const VAULT_MULTI_OBJECT_PACK_TARGET_BYTES = 201326592;
+export declare const VAULT_MAX_REF_STATE_OBJECT_BYTES = 33554432;
+export declare const VAULT_MAX_HEADS_PER_LISTING_PAGE = 1000;
+export declare const VAULT_VERIFICATION_BUDGET_HEADS = 100000;
+export declare const VAULT_RETENTION_MIN_DAYS = 90;
 /** Default admission-conflict retries before the push gives up (each retry re-verifies + re-applies to the winner). */
-export declare const GITVAULT_PUSH_CONFLICT_RETRIES = 5;
+export declare const VAULT_PUSH_CONFLICT_RETRIES = 5;
 /**
  * `run402@<version>/<entrypoint>` — the audit-provenance string named on
  * `self_open_attestation.reader_entrypoint` (D209) and
@@ -63,29 +63,29 @@ export declare const GITVAULT_PUSH_CONFLICT_RETRIES = 5;
  * authorization input; no wire grammar is promised for it (protocol-v0.md
  * §4.14, `rotate_epoch_payload.json`'s own field `$comment`).
  */
-export declare function gitvaultReaderEntrypoint(entrypoint: string): string;
+export declare function vaultReaderEntrypoint(entrypoint: string): string;
 export declare function generationToBigInt(generation: string): bigint;
 export declare function bigIntToGeneration(value: bigint): string;
 export declare function nextGeneration(generation: string): string;
-export type GitvaultRefMap = Record<string, string>;
+export type VaultRefMap = Record<string, string>;
 /** A tip that left the canonical map in this transaction — it enters `retention_roots` in the same generation. */
-export interface GitvaultDroppedTip {
+export interface VaultDroppedTip {
     ref: string;
     oid: string;
     reason: "deleted" | "force_displaced";
 }
-export interface GitvaultRefTransactionEvaluation {
-    refs: GitvaultRefMap;
-    dropped: GitvaultDroppedTip[];
+export interface VaultRefTransactionEvaluation {
+    refs: VaultRefMap;
+    dropped: VaultDroppedTip[];
 }
-export interface GitvaultEvaluateRefTransactionOptions {
+export interface VaultEvaluateRefTransactionOptions {
     /** Ancestry oracle: true iff `ancestor` is reachable from `descendant`. */
     isAncestor: (ancestor: string, descendant: string) => Promise<boolean> | boolean;
     /** `refuse` (default — user pushes): any `refs/run402/*` update is refused; `allow`: the protocol's own deploy-ref move. */
     protocol_refs?: "refuse" | "allow";
 }
 /** One failing update of a refused transaction (never a silent revert). */
-export interface GitvaultRefUpdateFailure {
+export interface VaultRefUpdateFailure {
     ref: string;
     reason: "expected_old_mismatch" | "non_fast_forward" | "tag_immutable" | "delete_requires_expected_old" | "noop";
     expected_old_oid: string | null;
@@ -97,16 +97,16 @@ export interface GitvaultRefUpdateFailure {
  * then per-update semantics collected into ONE `REF_EXPECTED_OLD_MISMATCH`
  * (every failing update listed), then the resulting-state cardinality.
  */
-export declare function evaluateRefTransaction(current: GitvaultRefMap, transaction: GitvaultRefTransaction, options: GitvaultEvaluateRefTransactionOptions): Promise<GitvaultRefTransactionEvaluation>;
+export declare function evaluateRefTransaction(current: VaultRefMap, transaction: VaultRefTransaction, options: VaultEvaluateRefTransactionOptions): Promise<VaultRefTransactionEvaluation>;
 /** §6.5 bound: ≤ 10 000 canonical refs and the serialized map ≤ 32 MiB. */
-export declare function assertRefMapCardinality(refs: GitvaultRefMap): void;
+export declare function assertRefMapCardinality(refs: VaultRefMap): void;
 /** The §4.4 deploy-ref move: force-with-lease `refs/run402/deploys/latest` → `oid` (creation when absent). */
-export declare function deployRefTransaction(current: GitvaultRefMap, oid: string): GitvaultRefTransaction;
+export declare function deployRefTransaction(current: VaultRefMap, oid: string): VaultRefTransaction;
 /** `effective_admitted_at = max(prepared_at, storage creation time of the winning admission record)` (§4.10). */
 export declare function effectiveAdmittedAt(preparedAt: string, recordStorageCreatedAt: string): string;
 /** A root may be removed iff `effective_admitted_at + 90 days < cutoff_at` (STRICT; §4.5a). */
 export declare function isRootEligibleForRemoval(effectiveAdmittedAtIso: string, cutoffAtIso: string, retentionDays?: number): boolean;
-export interface GitvaultEvolveRootsOptions {
+export interface VaultEvolveRootsOptions {
     /** The generation being built (`g+1`) — stamped as `dropped_at_generation` on new/renewed keys. */
     generation: string;
     /** Tips dropped or force-displaced by this generation's transaction. */
@@ -125,12 +125,12 @@ export interface GitvaultEvolveRootsOptions {
         effectiveAdmittedAt: (droppedAtGeneration: string) => string | null;
     };
 }
-export declare function compareRoots(a: GitvaultRetentionRoot, b: GitvaultRetentionRoot): number;
+export declare function compareRoots(a: VaultRetentionRoot, b: VaultRetentionRoot): number;
 /** roots(g+1) = roots(g) ∪ dropped (RENEWING an existing `(ref, oid)` key) ∖ {expired, only at a checkpoint with a ticket}. */
-export declare function evolveRetentionRoots(previous: GitvaultRetentionRoot[], options: GitvaultEvolveRootsOptions): GitvaultRetentionRoot[];
+export declare function evolveRetentionRoots(previous: VaultRetentionRoot[], options: VaultEvolveRootsOptions): VaultRetentionRoot[];
 /**
  * The client-local, protocol-owned namespace (design D4). Distinct from the
- * VAULT-side `refs/run402/*` (e.g. `GITVAULT_DEPLOY_REF`) that rides the wire
+ * VAULT-side `refs/run402/*` (e.g. `VAULT_DEPLOY_REF`) that rides the wire
  * as part of `ref_state` — `refs/r402/*` never rides the wire at all; it is
  * written directly into the local `.git` by the materializer and reconciled
  * on every later fetch/fsck. A push naming any ref under it is refused by the
@@ -138,14 +138,14 @@ export declare function evolveRetentionRoots(previous: GitvaultRetentionRoot[],
  * `git-remote-run402.mjs`'s `partitionProtectedRefPushes`) — this constant is
  * the ONE place the namespace string is spelled, shared by both sides.
  */
-export declare const GITVAULT_R402_REF_NAMESPACE = "refs/r402/";
+export declare const VAULT_R402_REF_NAMESPACE = "refs/r402/";
 /** Where a retained (branch-unreachable) deploy-capture tip gets its local ref (design D1/D2). */
-export declare const GITVAULT_RETAIN_REF_PREFIX = "refs/r402/retain/";
+export declare const VAULT_RETAIN_REF_PREFIX = "refs/r402/retain/";
 /**
  * D1's ref-identity choice, recorded here because the design doc's own
- * assumption did not hold: `GitvaultRetentionRoot` carries no per-capture
+ * assumption did not hold: `VaultRetentionRoot` carries no per-capture
  * stable id (only `{ref, oid, dropped_at_generation}`) — the capture id that
- * DOES exist (`GitvaultHead.capture_binding.capture_id`) lives on the head
+ * DOES exist (`VaultHead.capture_binding.capture_id`) lives on the head
  * that INTRODUCED a tip onto a canonical ref, not on the retention-root entry
  * recording its later displacement, and correlating the two would require
  * walking the chain further back than materialization already reads (D2
@@ -154,8 +154,8 @@ export declare const GITVAULT_RETAIN_REF_PREFIX = "refs/r402/retain/";
  * ever changes for the same history), and needs no correlation at all — the
  * ref name IS the tip's own identity.
  */
-export declare function gitvaultRetainedRefName(oid: string): string;
-export interface GitvaultRetainedRefsReconcileResult {
+export declare function vaultRetainedRefName(oid: string): string;
+export interface VaultRetainedRefsReconcileResult {
     /** `refs/r402/retain/<oid>` refs created or moved this call. */
     written: string[];
     /** `refs/r402/retain/*` refs removed this call — a root the vault no longer retains. */
@@ -194,14 +194,14 @@ export interface GitvaultRetainedRefsReconcileResult {
  * never a warning.
  */
 /**
- * Name prefix of the scratch directory {@link GitvaultVault.buildPacks}
+ * Name prefix of the scratch directory {@link Vault.buildPacks}
  * allocates INSIDE the repository's git common dir. Dotted and clearly named
  * so it can never be mistaken for `objects/`, `refs/`, or a pack directory.
  */
-export declare const GITVAULT_PACK_SCRATCH_PREFIX = ".run402-gitvault-packs-";
+export declare const VAULT_PACK_SCRATCH_PREFIX = ".run402-vault-packs-";
 /**
  * Allocate the pack-objects scratch directory on the OBJECT STORE's own
- * filesystem: `<git-common-dir>/.run402-gitvault-packs-XXXXXX`, never under
+ * filesystem: `<git-common-dir>/.run402-vault-packs-XXXXXX`, never under
  * `os.tmpdir()`.
  *
  * `git pack-objects <base>` writes its temporary pack under
@@ -216,11 +216,11 @@ export declare const GITVAULT_PACK_SCRATCH_PREFIX = ".run402-gitvault-packs-";
  */
 export declare function allocatePackScratchDir(repoDir: string): Promise<string>;
 export declare function reconcileRetainedTipRefs(repoDir: string, state: {
-    refs: GitvaultRefMap;
-    roots: readonly GitvaultRetentionRoot[];
-    head_target: GitvaultHeadTarget;
-}): Promise<GitvaultRetainedRefsReconcileResult>;
-export interface GitvaultListingProgress {
+    refs: VaultRefMap;
+    roots: readonly VaultRetentionRoot[];
+    head_target: VaultHeadTarget;
+}): Promise<VaultRetainedRefsReconcileResult>;
+export interface VaultListingProgress {
     /** The anchor (constant across the sequence). */
     after_generation: string;
     /** The highest generation delivered so far (== anchor before page 1). */
@@ -229,22 +229,22 @@ export interface GitvaultListingProgress {
     delivered: number;
 }
 /** Validate a listing request before it is sent (the request schema, D186). */
-export declare function validateHeadsListingRequest(request: GitvaultHeadsListingRequest): void;
+export declare function validateHeadsListingRequest(request: VaultHeadsListingRequest): void;
 /**
  * Validate one page against the request and the sequence so far. Returns the
  * advanced progress. Refusals: anchor not echoed / wrong vault / coupling
- * violation / retired member → `GITVAULT_LISTING_PAGE_INVALID`; an entry at or
+ * violation / retired member → `VAULT_LISTING_PAGE_INVALID`; an entry at or
  * below the anchor → `GENERATION_REGRESSION`; a gap within or across pages →
  * `CHAIN_BROKEN`; an untruthful final `total` → `CHAIN_BROKEN`.
  */
-export declare function verifyHeadsListingPage(page: GitvaultHeadsListingPage, request: GitvaultHeadsListingRequest, progress: GitvaultListingProgress, expectedRepoId?: string): GitvaultListingProgress;
+export declare function verifyHeadsListingPage(page: VaultHeadsListingPage, request: VaultHeadsListingRequest, progress: VaultListingProgress, expectedRepoId?: string): VaultListingProgress;
 /**
  * The continuation request for `page`, or `null` when the sequence is complete.
  * The anchor stays CONSTANT and `next_cursor` is echoed UNCHANGED — the cursor
  * is stored and echoed, never parsed or edited (a client that re-anchors or
  * edits a byte earns `INVALID_CURSOR` from the platform, D186).
  */
-export declare function nextListingRequest(request: GitvaultHeadsListingRequest, page: GitvaultHeadsListingPage): GitvaultHeadsListingRequest | null;
+export declare function nextListingRequest(request: VaultHeadsListingRequest, page: VaultHeadsListingPage): VaultHeadsListingRequest | null;
 /**
  * §6.4: the vault's newest generation may never fall BELOW the authenticated
  * pin. A listing (or a storage read) that says otherwise is a rollback, not a
@@ -252,25 +252,25 @@ export declare function nextListingRequest(request: GitvaultHeadsListingRequest,
  */
 export declare function checkGenerationRegression(listedNewestGeneration: string, pinnedGeneration: string): void;
 /** The parameters a maintenance open requests, and that the C1 record must echo. */
-export interface GitvaultOpenBindingRecord {
+export interface VaultOpenBindingRecord {
     base_head_sha256: string;
     prior_checkpoint_claim_set_sha256: string | null;
     r2_cap_size_bytes: string;
 }
 /** `SHA-256("r402s/v0/open-binding" ‖ lp(client_open_id) ‖ lp(base_head) ‖ lp_opt(prior) ‖ lp(cap))`. */
-export declare function openBindingDigest(clientOpenId: string, record: GitvaultOpenBindingRecord): string;
+export declare function openBindingDigest(clientOpenId: string, record: VaultOpenBindingRecord): string;
 /**
  * Recompute the binding from the record's OWN fields and compare it bytewise
  * with the signed issuance digest. The error registry has no dedicated code for
  * the fence inequality (D145), so the client surfaces
- * `GITVAULT_OPEN_BINDING_MISMATCH`; a same-`client_open_id` retry that carries a
+ * `VAULT_OPEN_BINDING_MISMATCH`; a same-`client_open_id` retry that carries a
  * DIFFERENT binding is the registry's `CLIENT_OPEN_ID_CONFLICT`.
  */
-export declare function checkOpenBinding(clientOpenId: string, record: GitvaultOpenBindingRecord, issuanceOpenBindingSha256: string, options?: {
+export declare function checkOpenBinding(clientOpenId: string, record: VaultOpenBindingRecord, issuanceOpenBindingSha256: string, options?: {
     retry?: boolean;
 }): void;
-export interface GitvaultChainLinkInput {
-    head: GitvaultHead;
+export interface VaultChainLinkInput {
+    head: VaultHead;
     stored_bytes: Uint8Array;
     /** The listing's hash for this generation. */
     listed_sha256: string;
@@ -281,7 +281,7 @@ export interface GitvaultChainLinkInput {
     writer_public_key: Uint8Array | string;
     writer_key_id: string;
     /**
-     * The predecessor's own `epoch` (D194, rev 42) — `GITVAULT_GENESIS_EPOCH`
+     * The predecessor's own `epoch` (D194, rev 42) — `VAULT_GENESIS_EPOCH`
      * for generation 1's predecessor (genesis). Drives the D193 epoch-
      * continuity check below; pure and keyless (no envelope is ever opened
      * here — only the head's own `epoch` FIELD is checked).
@@ -289,7 +289,7 @@ export interface GitvaultChainLinkInput {
     prev_epoch: string;
 }
 /** Verify one link: bytes hash to the listing, strict parse, generation, prev linkage, epoch pin, repo, writer signature. */
-export declare function checkChainLink(input: GitvaultChainLinkInput): void;
+export declare function checkChainLink(input: VaultChainLinkInput): void;
 /**
  * The transition fail-closed rule: a V0 client that encounters an ADMITTED
  * transition kind it cannot validate stops advancing — read-only at the
@@ -300,19 +300,19 @@ export declare function checkChainLink(input: GitvaultChainLinkInput): void;
  * rotation is ACTIVATED") — `checkChainLink`'s own D194 epoch-continuity
  * check already validates its structural admissibility, and
  * {@link parseRotateEpochPayload} / the caller's own envelope-open step
- * (`GitvaultVault.verifyToNewest`) handle it fully. `add_writer_key` is
- * EXEMPT as of rev 47 (gitvault-multi-writer) the same way — {@link
+ * (`Vault.verifyToNewest`) handle it fully. `add_writer_key` is
+ * EXEMPT as of rev 47 (vault-multi-writer) the same way — {@link
  * parseAddWriterKeyPayload} + `validateAddWriterKeyPayload`
- * (`gitvault-writer-state.js`) handle it fully, INSIDE `verifyToNewest`'s
+ * (`vault-writer-state.js`) handle it fully, INSIDE `verifyToNewest`'s
  * own loop, BEFORE this function ever runs on that head (so a transition
  * that fails writer validation never reaches here at all — this function
  * only ever sees ones that already passed). The other two kinds
  * (`add_envelope`, `transfer_binding`) remain genuinely unactivated and stay
  * fail-closed exactly as before.
  */
-export declare function assertNoTransition(head: GitvaultHead): void;
+export declare function assertNoTransition(head: VaultHead): void;
 /** One object to upload — identity fixed BEFORE the PUT; the receipt is compared against it. */
-export interface GitvaultUploadObject {
+export interface VaultUploadObject {
     /**
      * Storage path relative to the vault root (§3). CLIENT-LOCAL addressing only:
      * the control plane derives the bucket key from `object_kind` + the ledger
@@ -330,7 +330,7 @@ export interface GitvaultUploadObject {
     /** `wal_pack` only — §4.1: the ONLY receipt kind carrying `base_generation`. */
     base_generation?: string;
 }
-export interface GitvaultUploadReceipt {
+export interface VaultUploadReceipt {
     path: string;
     object_id: string | null;
     sha256: string;
@@ -341,10 +341,10 @@ export interface GitvaultUploadReceipt {
  * bucket path: heads and admission records have their own generation-addressed
  * routes, and every uploadable kind is named by `object_kind` + `object_id`
  * (or, for envelopes, `epoch` + `recipient_fingerprint`). This resolver maps
- * the SDK's internal `gitvaultPaths` strings onto that identity so the rest of
+ * the SDK's internal `vaultPaths` strings onto that identity so the rest of
  * the vault can keep addressing objects the way §3 describes them.
  */
-export type GitvaultWireRef = {
+export type VaultWireRef = {
     kind: "head";
     generation: string;
 } | {
@@ -352,10 +352,10 @@ export type GitvaultWireRef = {
     generation: string;
 } | {
     kind: "object";
-    read: GitvaultObjectReadRequest;
+    read: VaultObjectReadRequest;
 };
 /** One entry of a `POST …/object-reads` batch. */
-export interface GitvaultObjectReadRequest {
+export interface VaultObjectReadRequest {
     object_kind: string;
     object_id?: string;
     epoch?: string;
@@ -366,17 +366,17 @@ export interface GitvaultObjectReadRequest {
     pin_manifest_version?: string;
 }
 /** `null` for a path with no wire identity (e.g. a locally-held cutoff ticket). */
-export declare function gitvaultWireRefForPath(path: string): GitvaultWireRef | null;
+export declare function vaultWireRefForPath(path: string): VaultWireRef | null;
 /** The manifest entry for one upload — closed-key, exactly what the control plane validates. */
-export declare function gitvaultManifestEntry(object: GitvaultUploadObject): GitvaultObjectReadRequest & {
+export declare function vaultManifestEntry(object: VaultUploadObject): VaultObjectReadRequest & {
     sha256: string;
     size_bytes: string;
     base_generation?: string;
 };
-/** Mirrors the gateway's `GITVAULT_INLINE_UPLOAD_MAX_OBJECT_BYTES` (`services/gitvault/upload-sessions.ts`). */
-export declare const GITVAULT_INLINE_UPLOAD_MAX_OBJECT_BYTES = 262144;
-/** Mirrors the gateway's `GITVAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES`. */
-export declare const GITVAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES = 1048576;
+/** Mirrors the gateway's `VAULT_INLINE_UPLOAD_MAX_OBJECT_BYTES` (`services/vault/upload-sessions.ts`). */
+export declare const VAULT_INLINE_UPLOAD_MAX_OBJECT_BYTES = 262144;
+/** Mirrors the gateway's `VAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES`. */
+export declare const VAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES = 1048576;
 /**
  * The client-side mirror of the gateway's `isInlineUploadRequest` + per-object/
  * per-request cap check: every object must fit under the PER-OBJECT cap AND
@@ -387,32 +387,32 @@ export declare const GITVAULT_INLINE_UPLOAD_MAX_REQUEST_BYTES = 1048576;
  * already short-circuits before this is consulted, and `putObject` always
  * wraps exactly one object so it never hits this branch).
  *
- * Takes the narrowest shape that satisfies every call site (`GitvaultUploadObject[]`
+ * Takes the narrowest shape that satisfies every call site (`VaultUploadObject[]`
  * for `uploadObjects`, a single `{bytes}`-shaped array for `putObject`) so
  * neither caller needs to fabricate unrelated fields just to ask the
  * question.
  */
-export declare function gitvaultInlineUploadEligible(objects: readonly {
+export declare function vaultInlineUploadEligible(objects: readonly {
     bytes: Uint8Array;
 }[]): boolean;
 /**
  * The stable key both sides agree on, used to pair receipts back to
  * requests — MIRRORS the gateway's `keyEnvelopeLedgerId`/`pinManifestLedgerId`
- * (services/gitvault/epoch-rotation.ts) exactly; drift here breaks receipt
+ * (services/vault/epoch-rotation.ts) exactly; drift here breaks receipt
  * pairing at upload finalize for a rotation-attempt envelope or a pin
  * manifest.
  */
-export declare function gitvaultLedgerId(read: GitvaultObjectReadRequest): string;
-export interface GitvaultAdmitHeadRequest {
+export declare function vaultLedgerId(read: VaultObjectReadRequest): string;
+export interface VaultAdmitHeadRequest {
     repo_id: string;
     generation: string;
     stored_bytes: Uint8Array;
     stored_bytes_sha256: string;
 }
-export type GitvaultAdmitHeadResult = {
+export type VaultAdmitHeadResult = {
     outcome: "admitted";
     admission_record_sha256: string;
-    capture_receipt: GitvaultCaptureReceipt | null;
+    capture_receipt: VaultCaptureReceipt | null;
 } | {
     outcome: "conflict";
     winner: {
@@ -420,9 +420,9 @@ export type GitvaultAdmitHeadResult = {
         stored_bytes_sha256: string;
     };
 };
-export interface GitvaultRetentionCutoffIssued {
-    ticket: GitvaultRetentionCutoff;
-    receipt: GitvaultRetentionCutoffReceipt;
+export interface VaultRetentionCutoffIssued {
+    ticket: VaultRetentionCutoff;
+    receipt: VaultRetentionCutoffReceipt;
 }
 /**
  * Everything the vault needs from the control plane + bucket. Extends the
@@ -430,7 +430,7 @@ export interface GitvaultRetentionCutoffIssued {
  * idempotent from the state machines' point of view.
  */
 /** The `resource_binding` an upload session is charged against (§7.2 / §9.3). */
-export type GitvaultResourceBinding = {
+export type VaultResourceBinding = {
     kind: "ordinary_push";
 } | {
     kind: "maintenance_cycle";
@@ -440,7 +440,7 @@ export type GitvaultResourceBinding = {
     repair_attempt_id: string;
 };
 /** `POST …/maintenance-leases` — the owner's compact/prune reservation (§7.2). */
-export interface GitvaultMaintenanceLeaseRequest {
+export interface VaultMaintenanceLeaseRequest {
     repo_id: string;
     base_head_sha256: string;
     current_checkpoint_hash?: string | null;
@@ -449,7 +449,7 @@ export interface GitvaultMaintenanceLeaseRequest {
     p_before_c1_size_bytes?: string;
     p_before_c2_size_bytes?: string;
 }
-export interface GitvaultMaintenanceLease {
+export interface VaultMaintenanceLease {
     maintenance_lease_id: string;
     repo_id: string;
     base_head_sha256: string;
@@ -461,8 +461,8 @@ export interface GitvaultMaintenanceLease {
     expires_at: string | null;
     hard_deadline_at: string | null;
 }
-/** `POST …/compaction-grant`'s result (gitvault-checkpoint-cadence design D3). */
-export interface GitvaultCompactionGrant {
+/** `POST …/compaction-grant`'s result (vault-checkpoint-cadence design D3). */
+export interface VaultCompactionGrant {
     /**
      * The vault's server-measured `source_bytes` at grant time, capped — never
      * client-declared. NOTE the byte fields arrive as STRINGS on the wire (the
@@ -479,20 +479,20 @@ export interface GitvaultCompactionGrant {
     /** `pool_limit_bytes` + this grant's `granted_bytes` — the limit the preflight arithmetic should use while this grant is active. */
     effective_pool_limit_bytes: number | string;
 }
-export interface GitvaultTransport extends GitvaultCreationTransport {
+export interface VaultTransport extends VaultCreationTransport {
     /**
      * Read N independent carrier objects (ref_state, retention_roots, WAL/
      * checkpoint packs — anything `object-reads`-addressed, never a
-     * generation-addressed head/admission) in ONE presigned batch (gitvault-
+     * generation-addressed head/admission) in ONE presigned batch (vault-
      * client-round-trips design D2): one `object-reads` POST naming every
      * path, then the resulting GETs issued with bounded concurrency. Order in
      * the result array matches `paths`; a missing object is `null` at its
-     * index, the same "absent" reading {@link GitvaultCreationTransport.getObject}
+     * index, the same "absent" reading {@link VaultCreationTransport.getObject}
      * gives for one object. Callers that need exactly one object still use
-     * {@link GitvaultCreationTransport.getObject} — this is for the plural
+     * {@link VaultCreationTransport.getObject} — this is for the plural
      * case only, so a single-object caller never pays a batch's overhead.
      *
-     * `expected` (gitvault-small-object-inline design D3), when supplied, is
+     * `expected` (vault-small-object-inline design D3), when supplied, is
      * INDEX-ALIGNED with `paths`: `expected[i]`, if present, is the sha256 hex
      * the caller will itself check `paths[i]`'s bytes against. An
      * `object-reads`-backed implementation MAY use it to verify a
@@ -510,13 +510,13 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
     }): Promise<Array<Uint8Array | null>>;
     /**
      * OPTIONAL per-object settlement over the SAME batch shape as
-     * {@link getObjects} (gitvault-pipelined-restore D2): one presign POST,
+     * {@link getObjects} (vault-pipelined-restore D2): one presign POST,
      * the same bounded-concurrency GETs — counted ops identical — but the
      * result is one promise PER path, each settling when its own object's
      * bytes land, so a consumer can decrypt/verify/apply object i while later
      * objects are still downloading. Order and absence semantics match
      * `getObjects` (index-aligned; `null` for absent), including `expected`
-     * (gitvault-small-object-inline design D3 — see {@link getObjects}'s doc
+     * (vault-small-object-inline design D3 — see {@link getObjects}'s doc
      * comment). Every returned promise is pre-marked handled, so an abandoned
      * tail after a mid-batch failure never surfaces as an unhandled
      * rejection. A transport without this method degrades to the
@@ -530,7 +530,7 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
     }): Promise<Array<Promise<Uint8Array | null>>>;
     /**
      * Read the EXACT stored bytes of many generation-addressed heads in ONE
-     * POST (`…/head-reads`, gitvault-batched-head-reads).
+     * POST (`…/head-reads`, vault-batched-head-reads).
      *
      * Heads are the one hot read that cannot ride {@link getObjects}: that
      * batch is carrier-only by wire design and fails closed on a
@@ -550,14 +550,14 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         repo_id: string;
         generations: string[];
     }): Promise<Uint8Array[] | null>;
-    listHeads(request: GitvaultHeadsListingRequest & {
+    listHeads(request: VaultHeadsListingRequest & {
         repo_id: string;
-    }): Promise<GitvaultHeadsListingPage>;
+    }): Promise<VaultHeadsListingPage>;
     /**
      * Session → create-only presigned PUTs (`If-None-Match: *`) → finalize;
      * receipts in request order.
      *
-     * gitvault-byo-primary-bucket task 3.2 — `byo`, when present, marks this
+     * vault-byo-primary-bucket task 3.2 — `byo`, when present, marks this
      * vault as `storage_profile: "byo"` and names where the CLIENT itself
      * writes payload-kind objects directly (never through run402's own
      * bucket): the inline-upload fast path is skipped entirely (a BYO vault
@@ -570,36 +570,36 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      */
     uploadObjects(request: {
         repo_id: string;
-        objects: GitvaultUploadObject[];
-        resource_binding?: GitvaultResourceBinding;
+        objects: VaultUploadObject[];
+        resource_binding?: VaultResourceBinding;
         byo?: {
-            destination: GitvaultMirrorDestination;
-            credential?: GitvaultMirrorCredential;
+            destination: VaultMirrorDestination;
+            credential?: VaultMirrorCredential;
         };
-    }): Promise<GitvaultUploadReceipt[]>;
-    admitHead(request: GitvaultAdmitHeadRequest): Promise<GitvaultAdmitHeadResult>;
+    }): Promise<VaultUploadReceipt[]>;
+    admitHead(request: VaultAdmitHeadRequest): Promise<VaultAdmitHeadResult>;
     requestRetentionCutoff(request: {
         repo_id: string;
         base_head_sha256: string;
-    }): Promise<GitvaultRetentionCutoffIssued>;
+    }): Promise<VaultRetentionCutoffIssued>;
     exchangeActivationToken(request: {
         repo_id: string;
         operation_id: string;
-        capture_receipt: GitvaultCaptureReceipt;
-    }): Promise<GitvaultActivationToken>;
+        capture_receipt: VaultCaptureReceipt;
+    }): Promise<VaultActivationToken>;
     submitOverrideCompletion(request: {
         repo_id: string;
         operation_id: string;
-        capture_receipt: GitvaultCaptureReceipt;
+        capture_receipt: VaultCaptureReceipt;
     }): Promise<{
         cleared: boolean;
     }>;
     /** The vault record — policy, allocation generation, storage + maintenance state (§9.2). */
     getVaultRecord(request: {
         repo_id: string;
-    }): Promise<GitvaultVaultRecord>;
+    }): Promise<VaultRecord>;
     /**
-     * `GET …/state` (gitvault-composite-state-read design D1) — the pin-current
+     * `GET …/state` (vault-composite-state-read design D1) — the pin-current
      * fast path: the vault record, the newest generation, its head's exact
      * stored bytes, and both carriers (`ref_state`/`retention_roots`) resolved
      * to raw bytes here (inline decoded, or fetched from the presigned URL —
@@ -608,10 +608,10 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      * for a freshly allocated vault with no admitted generation yet (mirrors
      * `newest_generation: null`); a carrier can independently be `null` when
      * its stored bytes are absent (the same "absent" reading {@link
-     * GitvaultCreationTransport.getObject} gives for one object — the caller
+     * VaultCreationTransport.getObject} gives for one object — the caller
      * treats it identically, never a route-level distinction).
      *
-     * {@link GitvaultVault} verifies every field here EXACTLY as it does
+     * {@link Vault} verifies every field here EXACTLY as it does
      * walking the paginated listing — chain link from the caller's own pin,
      * carrier hashes against the head's own embedded receipts, and the writer
      * signature. This route bundles bytes; it never becomes the verifier. A
@@ -619,7 +619,7 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      * `carriers` and falls back to {@link listHeads} — that decision lives in
      * the vault, never here.
      *
-     * `since` (gitvault-delta-fetch): the caller's materialized generation.
+     * `since` (vault-delta-fetch): the caller's materialized generation.
      * A gateway that recognizes it MAY answer with a bounded `delta`
      * (intermediate heads + their WAL packs, inline under caps) — and MAY
      * ignore it entirely (older gateway, disqualified span); absence of
@@ -627,14 +627,14 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      * other stored byte: consumers hash-check before use, and a failed check
      * is a plain miss that the ordinary reads absorb.
      *
-     * `restore` (gitvault-restore-recipe design D2), ORTHOGONAL to `since` —
+     * `restore` (vault-restore-recipe design D2), ORTHOGONAL to `since` —
      * declares restore intent. A gateway that recognizes it AND can locate a
      * checkpoint boundary within its own bound MAY answer with `restore_plan`
      * (the heads from that boundary to newest, the boundary checkpoint's
      * claim set + manifest, and every pack the span references) — and MAY
      * ignore it entirely (older gateway, no locatable boundary, a transition
      * inside the span); absence of `restore_plan` is never an error. Plan
-     * bytes are UNTRUSTED exactly like `delta`'s: {@link GitvaultVault}
+     * bytes are UNTRUSTED exactly like `delta`'s: {@link Vault}
      * re-derives the full backward chain-link, claim-set signature,
      * cross-equality, per-pack receipt-hash, and AEAD-open obligations before
      * using anything here, and falls back to the ordinary backward walk on
@@ -644,14 +644,14 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         repo_id: string;
         since?: string;
         restore?: boolean;
-    }): Promise<GitvaultVaultState>;
+    }): Promise<VaultState>;
     /** Resolve a project's vault without local state (the cold-restart entry point). */
     findVaultByProject(request: {
         project_id: string;
-    }): Promise<GitvaultVaultRecord>;
+    }): Promise<VaultRecord>;
     /**
      * Resolve a vault by its address-form `org-slug/name` (repo-first-onramp
-     * task 4.3, design D6) — `GET /gitvault/v1/vaults?repo=<org-slug>/<name>`.
+     * task 4.3, design D6) — `GET /vaults/v1?repo=<org-slug>/<name>`.
      * `RESOURCE_NOT_FOUND` for no such org OR no such name within it (the two
      * collapse deliberately, so slug-namespace probing learns nothing extra);
      * `SLUG_RELEASED` (with `successor_slug`/`released_at`/`cooldown_until` on
@@ -661,8 +661,8 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
     findVaultByRepo(request: {
         org_slug: string;
         repo_name: string;
-    }): Promise<GitvaultVaultRecord>;
-    acquireMaintenanceLease(request: GitvaultMaintenanceLeaseRequest): Promise<GitvaultMaintenanceLease>;
+    }): Promise<VaultRecord>;
+    acquireMaintenanceLease(request: VaultMaintenanceLeaseRequest): Promise<VaultMaintenanceLease>;
     heartbeatMaintenanceLease(request: {
         repo_id: string;
         maintenance_lease_id: string;
@@ -680,13 +680,13 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         status: string;
     }>;
     /**
-     * `POST …/compaction-grant` (gitvault-checkpoint-cadence design D3) — a
+     * `POST …/compaction-grant` (vault-checkpoint-cadence design D3) — a
      * short-lived, TTL'd, at-most-one-per-project headroom grant that raises
      * the org's EFFECTIVE pooled storage limit by at most this vault's
      * server-measured `source_bytes`, so compaction's own transient ~2x
      * overshoot (the new checkpoint coexisting with the not-yet-pruned
      * history) can land without the routine manual override
-     * (`--force-headroom`). Rejects `GITVAULT_COMPACTION_GRANT_ACTIVE` (409)
+     * (`--force-headroom`). Rejects `VAULT_COMPACTION_GRANT_ACTIVE` (409)
      * when this project already holds an active grant — the caller reads
      * that as "another compaction is already in flight for this vault" and
      * skips its own cycle rather than racing it. An older gateway 404s/
@@ -695,7 +695,7 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      */
     openCompactionGrant(request: {
         repo_id: string;
-    }): Promise<GitvaultCompactionGrant>;
+    }): Promise<VaultCompactionGrant>;
     /**
      * `DELETE …/compaction-grant` — idempotent; `{closed: false}` when
      * nothing was active (already closed, already expired, or never
@@ -719,33 +719,33 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
     submitPruneIntent(request: {
         repo_id: string;
         intent_bytes: Uint8Array;
-    }): Promise<GitvaultPruneIntentRecord & {
+    }): Promise<VaultPruneIntentRecord & {
         stored: boolean;
     }>;
     /** `GET …/prune-intents/:id` — the intent's state and, once signed, its completion. */
     getPruneIntent(request: {
         repo_id: string;
         prune_intent_object_id: string;
-    }): Promise<GitvaultPruneIntentRecord | null>;
+    }): Promise<VaultPruneIntentRecord | null>;
     /**
-     * The org's directory of envelope-capable principals (gitvault-human-
+     * The org's directory of envelope-capable principals (vault-human-
      * envelopes design D7, `GET /orgs/v1/:org_id/encryption-keys`) — every
      * active human member who has published an encryption key. Read by
-     * {@link GitvaultVault.reconcileEnvelopeRecipients} to diff against a
+     * {@link Vault.reconcileEnvelopeRecipients} to diff against a
      * vault's current recipient set.
      */
     listOrgEncryptionKeys(request: {
         org_id: string;
-    }): Promise<GitvaultOrgEncryptionKeyDirectory>;
+    }): Promise<VaultOrgEncryptionKeyDirectory>;
     /**
      * The `ek_` fingerprints already covering this vault, at any epoch
-     * (`GET /gitvault/v1/vaults/:vault_id/envelope-recipients`, task 2.2) —
+     * (`GET /vaults/v1/:vault_id/envelope-recipients`, task 2.2) —
      * fingerprints only, never envelope bytes; the recipient-only rule on
      * envelope BYTES elsewhere is unaffected.
      */
     listEnvelopeRecipients(request: {
         repo_id: string;
-    }): Promise<GitvaultEnvelopeRecipientsResponse>;
+    }): Promise<VaultEnvelopeRecipientsResponse>;
     /**
      * `POST …/rotation-attempts` (D195) — the FIRST write of any rotation
      * attempt, BEFORE any `key_envelope` upload for it. `descriptor` is the
@@ -755,10 +755,10 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      */
     createRotationAttempt(request: {
         repo_id: string;
-        descriptor: GitvaultRotationAttemptDescriptor;
+        descriptor: VaultRotationAttemptDescriptor;
     }): Promise<{
         rotation_id: string;
-        descriptor: GitvaultRotationAttemptDescriptor;
+        descriptor: VaultRotationAttemptDescriptor;
         deduplicated: boolean;
     }>;
     /** `POST …/recipients/:principal_id/confirm` (D197) — first-seen pin confirmation; owner + step-up. */
@@ -766,14 +766,14 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         repo_id: string;
         principal_id: string;
         new_fingerprint: string;
-    }): Promise<GitvaultRecipientConfirmationReceipt>;
+    }): Promise<VaultRecipientConfirmationReceipt>;
     /** `POST …/recipients/:principal_id/repin` (D197) — re-pin ceremony; owner + step-up. */
     repinRecipient(request: {
         repo_id: string;
         principal_id: string;
         old_ek_fingerprint: string;
         new_fingerprint: string;
-    }): Promise<GitvaultRecipientConfirmationReceipt>;
+    }): Promise<VaultRecipientConfirmationReceipt>;
     /** `POST …/recipients/:principal_id/key-revocation` (D199) — declares `reason:"recipient_key_revoked"` admissible; owner + step-up. Returns the D194 counters this rotation must be fenced against — the ONE reason value with a client-visible counter read. */
     declareRecipientKeyRevoked(request: {
         repo_id: string;
@@ -802,7 +802,7 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
      * of the envelope this identity actually opened. Self-match only: the
      * gateway requires `principal_id` to equal the AUTHENTICATED caller,
      * never overridable — a mismatch is the ordinary 403
-     * `GITVAULT_ACCESS_DENIED`, not a `proof-of-open`-specific error.
+     * `VAULT_ACCESS_DENIED`, not a `proof-of-open`-specific error.
      * Idempotent on `(repo_id, principal_id, ek_fingerprint,
      * decryptable_to_generation)`: `deduplicated: true` means the gateway
      * returned the tuple's EXISTING receipt (HTTP `200`) rather than minting
@@ -817,25 +817,25 @@ export interface GitvaultTransport extends GitvaultCreationTransport {
         decryptable_to_generation: string;
         reader_entrypoint: string;
     }): Promise<{
-        receipt: GitvaultOpenReceipt;
+        receipt: VaultOpenReceipt;
         deduplicated: boolean;
     }>;
 }
 /**
  * One row of the org's envelope-capable-principal directory
- * ({@link GitvaultTransport.listOrgEncryptionKeys}).
+ * ({@link VaultTransport.listOrgEncryptionKeys}).
  *
  * The gateway route (`GET /orgs/v1/:org_id/encryption-keys`, `routes/org.ts`
  * in run402-private) returns `public_key` on every row — the raw key
  * material is what makes the directory usable for wrapping at all.
  * The field stays OPTIONAL in this wire type the
- * same way `desired[]` does on {@link GitvaultEnvelopeRecipientsResponse}:
+ * same way `desired[]` does on {@link VaultEnvelopeRecipientsResponse}:
  * a response is network data, and an older/rolling-deploy gateway that
  * omits the field must degrade to a per-entry `skipped` report
- * (`missing_public_key`) from {@link GitvaultVault.reconcileEnvelopeRecipients},
+ * (`missing_public_key`) from {@link Vault.reconcileEnvelopeRecipients},
  * never a hardcoded assumption or a thrown error.
  */
-export interface GitvaultOrgEncryptionKeyEntry {
+export interface VaultOrgEncryptionKeyEntry {
     principal_id: string;
     display_name: string | null;
     ek_fingerprint: string;
@@ -844,7 +844,7 @@ export interface GitvaultOrgEncryptionKeyEntry {
     /** Raw base64url X25519 public key. Present on every current-gateway row; tolerated as absent (per-entry `missing_public_key` skip) for wire robustness only. */
     public_key?: string;
     /**
-     * gitvault-multi-writer (rev 47) D9 — the SAME row's vault-WRITER signing
+     * vault-multi-writer (rev 47) D9 — the SAME row's vault-WRITER signing
      * half (`routes/org.ts` in run402-private, deployed alongside `public_key`
      * D9). Raw base64url Ed25519 public key; `null` when this principal has
      * never published a signing half (a pre-rev47 or encryption-only
@@ -855,21 +855,21 @@ export interface GitvaultOrgEncryptionKeyEntry {
     signing_possession_verified_at?: string | null;
     [key: string]: unknown;
 }
-/** `GET /orgs/v1/:org_id/encryption-keys` — {@link GitvaultTransport.listOrgEncryptionKeys}'s result. */
-export interface GitvaultOrgEncryptionKeyDirectory {
+/** `GET /orgs/v1/:org_id/encryption-keys` — {@link VaultTransport.listOrgEncryptionKeys}'s result. */
+export interface VaultOrgEncryptionKeyDirectory {
     org_id: string;
-    keys: GitvaultOrgEncryptionKeyEntry[];
+    keys: VaultOrgEncryptionKeyEntry[];
 }
 /**
  * One row of the vault's org-level, membership-driven DESIRED-recipient
  * state. `status` is the server's own honest accounting of what membership
  * currently wants, NOT a claim about whether access was actually revoked:
- * `"pending_removal"` means membership removed this principal but gitvault
+ * `"pending_removal"` means membership removed this principal but vault
  * protocol v0 has no epoch-rotation mechanism yet to un-wrap their existing
  * `key_envelope`, so `covered: true` on a `pending_removal` row is a REAL
  * continuing-access fact, not stale data.
  */
-export interface GitvaultDesiredRecipientEntry {
+export interface VaultDesiredRecipientEntry {
     principal_id: string;
     display_name: string | null;
     status: "active" | "pending_removal";
@@ -880,39 +880,39 @@ export interface GitvaultDesiredRecipientEntry {
     /** `true` when `ek_fingerprint` currently has a `key_envelope` on this vault. */
     covered: boolean;
 }
-/** `GET /gitvault/v1/vaults/:vault_id/envelope-recipients` — {@link GitvaultTransport.listEnvelopeRecipients}'s result. */
-export interface GitvaultEnvelopeRecipientsResponse {
+/** `GET /vaults/v1/:vault_id/envelope-recipients` — {@link VaultTransport.listEnvelopeRecipients}'s result. */
+export interface VaultEnvelopeRecipientsResponse {
     vault_id: string;
     recipient_fingerprints: string[];
     /**
      * The org's desired-recipient state, cross-referenced against this
-     * vault's coverage — see {@link GitvaultDesiredRecipientEntry}. OPTIONAL:
+     * vault's coverage — see {@link VaultDesiredRecipientEntry}. OPTIONAL:
      * absent (not empty) on an older gateway that predates this field —
      * callers MUST distinguish "field absent" (older gateway, state genuinely
      * unknown) from "field present and empty" (org has no desired recipients)
      * rather than treating both as "no data."
      */
-    desired?: GitvaultDesiredRecipientEntry[];
+    desired?: VaultDesiredRecipientEntry[];
     /** The desired-recipient substrate's own monotonic version, for cheap client-side diffing. Present iff `desired` is present. */
     desired_state_version?: number;
     /**
      * D194's two org-level rotation counters, read (never locked) alongside
      * `desired` so a writer can drive the writer-capable
      * `reason:"member_removed"` rotation from the same read it partitions H
-     * from ({@link GitvaultVault.rotateEpochForMemberRemoval}). OPTIONAL:
+     * from ({@link Vault.rotateEpochForMemberRemoval}). OPTIONAL:
      * absent on a gateway that predates them.
      */
     recipient_state_version?: string;
     recipient_revocation_version?: string;
 }
-/** `GET /gitvault/v1/vaults/:vault_id` — the shape `reads.ts:getVaultRecord` returns. */
-export interface GitvaultVaultRecord {
+/** `GET /vaults/v1/:vault_id` — the shape `reads.ts:getVaultRecord` returns. */
+export interface VaultRecord {
     repo_id: string;
     project_id: string;
     org_id: string;
-    gitvault_policy: "required" | "grandfathered" | null;
-    gitvault_policy_version: string;
-    gitvault_policy_changed_at: string | null;
+    vault_policy: "required" | "grandfathered" | null;
+    vault_policy_version: string;
+    vault_policy_changed_at: string | null;
     allocation_generation: string;
     allocation_sha256: string | null;
     newest_generation: string | null;
@@ -923,7 +923,7 @@ export interface GitvaultVaultRecord {
     repair_version: string;
     repair_fence_state: string;
     /**
-     * gitvault-byo-primary-bucket task 3.1/3.5 (protocol-v0.md rev 46 §9.2,
+     * vault-byo-primary-bucket task 3.1/3.5 (protocol-v0.md rev 46 §9.2,
      * D220). Absent-or-`"managed"` is BYTE-IDENTICAL to every vault allocated
      * before this fold. `byo_destination` is the destination's ADDRESS ONLY
      * (never credential material) and is non-null iff `storage_profile ===
@@ -953,9 +953,9 @@ export interface GitvaultVaultRecord {
         pending_repair_attempt_id: string | null;
     };
     /**
-     * gitvault-multi-writer (rev 47) task 3.7 — the writer chain state's read
+     * vault-multi-writer (rev 47) task 3.7 — the writer chain state's read
      * surface, mirrored client-side from the gateway's `VaultRecord` (see
-     * `services/gitvault/reads.ts` in run402-private for the authoritative doc
+     * `services/vault/reads.ts` in run402-private for the authoritative doc
      * comment). `writer_set` is the on-chain-recognized set exactly as the
      * chain itself would verify (regardless of any gateway-only block — that's
      * `ineligible_members`). `pending_writers` is the reverse direction:
@@ -969,14 +969,14 @@ export interface GitvaultVaultRecord {
     writer_set?: {
         version: string;
         sha256: string | null;
-        writers: GitvaultVaultWriterSetEntry[];
+        writers: VaultWriterSetEntry[];
     };
-    pending_writers?: GitvaultVaultPendingWriter[];
-    ineligible_members?: GitvaultVaultIneligibleMember[];
-    /** `gitvault_vaults.read_only_terminal_at IS NOT NULL` — the D228 forced sole-writer-removal terminal state: no further writer-authenticated push is admissible. Absent (never `undefined`-checked as `true`) on an older gateway — treat as `false`. */
+    pending_writers?: VaultPendingWriter[];
+    ineligible_members?: VaultIneligibleMember[];
+    /** `vault_vaults.read_only_terminal_at IS NOT NULL` — the D228 forced sole-writer-removal terminal state: no further writer-authenticated push is admissible. Absent (never `undefined`-checked as `true`) on an older gateway — treat as `false`. */
     read_only_terminal?: boolean;
     /**
-     * gitvault-multi-writer (rev 47) D6/D227, task 5.9 — decimal-string
+     * vault-multi-writer (rev 47) D6/D227, task 5.9 — decimal-string
      * uint64 counter, bumped by the gateway every time a membership/role/key
      * change gateway-blocks one or more writer keys. A client building a
      * `writer_set_update` freezes THIS value into `rotation_attempt_
@@ -994,7 +994,7 @@ export interface GitvaultVaultRecord {
     /**
      * The control plane's SIGNED allocation record for the vault (present on
      * gateways that wrap it into the vault read; `null`/absent otherwise).
-     * gitvault-agent-envelopes D4: a cold open compares genesis's creator
+     * vault-agent-envelopes D4: a cold open compares genesis's creator
      * fingerprints against these — platform-attested consistency, never
      * independent authentication (the platform serves both sides).
      */
@@ -1006,36 +1006,36 @@ export interface GitvaultVaultRecord {
         [key: string]: unknown;
     } | null;
 }
-/** One chain-recognized active writer on {@link GitvaultVaultRecord.writer_set} — the on-chain shape only; `gateway_blocked_at` (gateway-only) rides {@link GitvaultVaultIneligibleMember} instead. */
-export interface GitvaultVaultWriterSetEntry {
+/** One chain-recognized active writer on {@link VaultRecord.writer_set} — the on-chain shape only; `gateway_blocked_at` (gateway-only) rides {@link VaultIneligibleMember} instead. */
+export interface VaultWriterSetEntry {
     writer_key_id: string;
     principal_id: string;
     authorization_kind: "writer" | "handoff";
     admitted_generation: string;
     admitted_head_sha256: string;
 }
-/** An org member eligible to become a writer (active membership at role developer+, a published possession-verified signing key) who is NOT yet in {@link GitvaultVaultRecord.writer_set}'s `writers` — a candidate for the "writer"-door `add_writer_key` ({@link GitvaultVault.reconcileWriterAdmissions}). */
-export interface GitvaultVaultPendingWriter {
+/** An org member eligible to become a writer (active membership at role developer+, a published possession-verified signing key) who is NOT yet in {@link VaultRecord.writer_set}'s `writers` — a candidate for the "writer"-door `add_writer_key` ({@link Vault.reconcileWriterAdmissions}). */
+export interface VaultPendingWriter {
     principal_id: string;
     writer_key_id: string;
 }
 /** A chain-recognized active writer the gateway has flagged for removal — still active on-chain, pending the next `rotate_epoch{writer_set_update}`. */
-export interface GitvaultVaultIneligibleMember {
+export interface VaultIneligibleMember {
     principal_id: string;
     writer_key_id: string;
     gateway_blocked_at: string | null;
     reason: "membership_revoked" | "role_below_developer" | "encryption_key_revoked" | "gateway_blocked_pending_removal";
 }
 /**
- * {@link GitvaultTransport.getState}'s result — the SAME bytes the per-object
+ * {@link VaultTransport.getState}'s result — the SAME bytes the per-object
  * routes serve, resolved to raw `Uint8Array` here (never verified here; see
  * that method's own doc comment). `head`/`carriers` are `null` together for
  * a freshly allocated vault (mirrors `newest_generation: null`); a `carriers`
  * field can independently be `null` when that carrier's stored bytes are
  * absent from the backing store.
  */
-export interface GitvaultVaultState {
-    vault: GitvaultVaultRecord;
+export interface VaultState {
+    vault: VaultRecord;
     newest_generation: string | null;
     head: {
         stored_bytes: Uint8Array;
@@ -1045,13 +1045,13 @@ export interface GitvaultVaultState {
         ref_state: Uint8Array | null;
         retention_roots: Uint8Array | null;
     } | null;
-    /** Present only when the gateway answered a `since` request with a qualifying span (gitvault-delta-fetch); absent otherwise, including on every older gateway. */
-    delta?: GitvaultVaultStateDelta | null;
-    /** Present only when the caller declared `restore: true` AND the gateway located a qualifying checkpoint boundary (gitvault-restore-recipe); absent otherwise, including on every older gateway. */
-    restore_plan?: GitvaultVaultRestorePlan | null;
+    /** Present only when the gateway answered a `since` request with a qualifying span (vault-delta-fetch); absent otherwise, including on every older gateway. */
+    delta?: VaultStateDelta | null;
+    /** Present only when the caller declared `restore: true` AND the gateway located a qualifying checkpoint boundary (vault-restore-recipe); absent otherwise, including on every older gateway. */
+    restore_plan?: VaultRestorePlan | null;
 }
 /**
- * The state read's restore recipe (gitvault-restore-recipe design D1-D5):
+ * The state read's restore recipe (vault-restore-recipe design D1-D5):
  * the heads from the newest checkpoint boundary through the caller's own
  * newest generation (ascending, boundary-first — ONE entry when the
  * boundary IS the newest head), that boundary's checkpoint claim set +
@@ -1065,12 +1065,12 @@ export interface GitvaultVaultState {
  * `url`/`edge_url` on a lying, absent, or over-cap `inline`), `null` when
  * neither arm produced bytes (an absent object, a failed GET). UNTRUSTED
  * THROUGHOUT: nothing here is verified by this decode — {@link
- * GitvaultVault} re-derives the full chain-link/signature/cross-equality/
+ * Vault} re-derives the full chain-link/signature/cross-equality/
  * receipt-hash/AEAD-open obligations before consuming anything, matching
  * one for one by `(object_kind, object_id)`, and falls back to the ordinary
  * backward walk byte-identically on any failure.
  */
-export interface GitvaultVaultRestorePlan {
+export interface VaultRestorePlan {
     boundary_generation: string;
     heads: Array<{
         generation: string;
@@ -1094,14 +1094,14 @@ export interface GitvaultVaultRestorePlan {
     }>;
 }
 /**
- * The state read's bounded delta (gitvault-delta-fetch): the span's heads in
+ * The state read's bounded delta (vault-delta-fetch): the span's heads in
  * chain order plus their WAL packs' INLINE bytes. Over-cap packs arrive as
  * presigned references on the wire and are DROPPED here (v1 consumes inline
  * only — an uncovered pack simply rides the ordinary batched fetch, so the
  * reference arm costs nothing to ignore). Untrusted throughout: every
  * consumer hash-checks before use.
  */
-export interface GitvaultVaultStateDelta {
+export interface VaultStateDelta {
     heads: Array<{
         generation: string;
         stored_bytes: Uint8Array;
@@ -1112,11 +1112,11 @@ export interface GitvaultVaultStateDelta {
         bytes: Uint8Array;
     }>;
 }
-export interface GitvaultHttpTransportOptions {
-    /** Wire shape: every vault-scoped route is `/gitvault/v1/vaults/:vault_id/...`; `vault_id` is the `repo_id` unless a mapping is supplied (D185). */
+export interface VaultHttpTransportOptions {
+    /** Wire shape: every vault-scoped route is `/vaults/v1/:vault_id/...`; `vault_id` is the `repo_id` unless a mapping is supplied (D185). */
     vaultIdFor?: (repoId: string) => string;
     /**
-     * gitvault-byo-primary-bucket: where THIS machine reads a BYO vault's
+     * vault-byo-primary-bucket: where THIS machine reads a BYO vault's
      * payload from. The gateway holds no payload copy of a `storage_profile:
      * "byo"` vault, so its `object-reads` entries and `GET …/state` carriers
      * for the payload kinds carry `byo_key` (the object's relative key under
@@ -1125,22 +1125,22 @@ export interface GitvaultHttpTransportOptions {
      * backend (`byo/<repo_id>.json` in the keystore — destination + credential
      * NAME, never material) and reads the key from it. `null` means this
      * machine has no such config, and the read fails
-     * `GITVAULT_BYO_NOT_CONFIGURED` by name — never a silent "absent". Absent
+     * `VAULT_BYO_NOT_CONFIGURED` by name — never a silent "absent". Absent
      * option: same as `null`. Managed vaults never consult it.
      */
-    byoBackend?: (repoId: string) => GitvaultMirrorBackend | null;
+    byoBackend?: (repoId: string) => VaultMirrorBackend | null;
     /**
-     * gitvault-object-host-predial (design D1, task 1.2): called with the
+     * vault-object-host-predial (design D1, task 1.2): called with the
      * ORIGIN(s) (`scheme://host`) of an object-store URL this transport just
      * completed a round trip against — the presigned `url`'s origin, and the
      * `edge_url`'s origin too when the target carried one, regardless of
      * which one actually served the bytes (both are worth a future predial;
-     * see `gitvault-prewarm.ts`). Fired ONLY after a completed fetch (any
+     * see `vault-prewarm.ts`). Fired ONLY after a completed fetch (any
      * status, including 404 — a real "absent" response still proves the
      * origin is reachable); NEVER fired for an `inline`-satisfied read
      * (nothing was dialed) or a fetch that threw. This is the ONE place the
      * transport observes origins — the caller (who holds the keystore) is
-     * expected to persist them via `GitvaultKeystore.recordObjectStoreOrigins`;
+     * expected to persist them via `VaultKeystore.recordObjectStoreOrigins`;
      * the transport itself has no keystore and does no persistence. Called
      * synchronously and never awaited — a throwing callback must never
      * surface into the read it rode along with, so callers wrap their own
@@ -1149,13 +1149,13 @@ export interface GitvaultHttpTransportOptions {
     onObjectStoreOriginObserved?: (repoId: string, origins: string[]) => void;
 }
 /**
- * Independent reads/PUTs within one gitvault step run at this concurrency
+ * Independent reads/PUTs within one vault step run at this concurrency
  * (design D2) — "browser-era origin etiquette", well within what S3/the
  * gateway tolerate, and it keeps in-flight memory bounded by ~6×frame size.
  * Chain-ordered steps (the head-chain walk, admission, readback) never call
  * this — they stay strictly sequential.
  */
-export declare const GITVAULT_TRANSPORT_CONCURRENCY = 6;
+export declare const VAULT_TRANSPORT_CONCURRENCY = 6;
 /**
  * Run `fn` over `items` with at most `limit` in flight at once, preserving
  * result order regardless of completion order. A plain worker-pool: `limit`
@@ -1167,8 +1167,8 @@ export declare function mapBounded<T, R>(items: readonly T[], limit: number, fn:
  * `If-None-Match: *` (create-only — the bucket policy demands it) and the
  * FULL_OBJECT SHA-256 checksum header.
  */
-export declare function createGitvaultHttpTransport(client: Client, options?: GitvaultHttpTransportOptions): GitvaultTransport;
-export declare const gitvaultPaths: {
+export declare function createVaultHttpTransport(client: Client, options?: VaultHttpTransportOptions): VaultTransport;
+export declare const vaultPaths: {
     readonly head: (generation: string) => string;
     readonly admission: (generation: string) => string;
     readonly wal: (id: string) => string;
@@ -1182,7 +1182,7 @@ export declare const gitvaultPaths: {
     readonly verifierReceipt: (id: string) => string;
     /**
      * `envelopes/<epoch>/<recipient_fingerprint>` — mirrors
-     * `gitvault-creation-journal.ts`'s private `envelopePath` (the genesis
+     * `vault-creation-journal.ts`'s private `envelopePath` (the genesis
      * creator's envelope); this is the same addressing for every OTHER
      * recipient's `key_envelope`. `rotationId` present (D195, rev 42) widens
      * this to `envelopes/<epoch>/<rotation_id>/<recipient_fingerprint>` — a
@@ -1193,25 +1193,25 @@ export declare const gitvaultPaths: {
     /** `recipient-pins/<pin_manifest_version>.json` (D197, rev 42) — version-addressed, plaintext-structured, writer-signed. */
     readonly pinManifest: (pinManifestVersion: string) => string;
 };
-export interface GitvaultRestoreMarker {
+export interface VaultRestoreMarker {
     generation: string;
     head_sha256: string;
 }
 /** Read this target directory's `restored_through` marker, or `null` when nothing was ever restored into it. */
-export declare function readGitvaultRestoreMarker(targetRepoDir: string): Promise<GitvaultRestoreMarker | null>;
+export declare function readVaultRestoreMarker(targetRepoDir: string): Promise<VaultRestoreMarker | null>;
 /** Default `auto_gc_generations` — see the change proposal's rationale (≈2-3s over the fresh-checkpoint floor at this backlog, a busy repo compacts roughly once per few dozen pushes). */
-export declare const GITVAULT_AUTO_GC_GENERATIONS_DEFAULT = 32;
+export declare const VAULT_AUTO_GC_GENERATIONS_DEFAULT = 32;
 /**
  * Read this checkout's auto-gc threshold, or the default when unset or
  * unparseable. Never throws — a corrupt local config value degrades to the
  * default rather than blocking a push's own auto-gc check.
  */
-export declare function readGitvaultAutoGcThreshold(targetRepoDir: string): Promise<number>;
+export declare function readVaultAutoGcThreshold(targetRepoDir: string): Promise<number>;
 /** Set this checkout's auto-gc threshold. `0` disables auto-gc entirely. */
-export declare function writeGitvaultAutoGcThreshold(targetRepoDir: string, generations: number): Promise<void>;
+export declare function writeVaultAutoGcThreshold(targetRepoDir: string, generations: number): Promise<void>;
 /**
- * {@link GitvaultVault.ensureRepoState}'s report when a cold keystore was
- * restored from its own envelope (gitvault-agent-envelopes D4). `trust` is
+ * {@link Vault.ensureRepoState}'s report when a cold keystore was
+ * restored from its own envelope (vault-agent-envelopes D4). `trust` is
  * `receipt` only when a creator-held recovery receipt pinned genesis;
  * `platform_attested` means the control plane's signed allocation matched —
  * consistency the platform itself vouches for, so `independently_verified`
@@ -1219,7 +1219,7 @@ export declare function writeGitvaultAutoGcThreshold(targetRepoDir: string, gene
  * authentication. `continuity` is `pinned` when this keystore had already
  * seen this genesis (a later open), `first_seen` on the first.
  */
-export interface GitvaultColdOpenResult {
+export interface VaultColdOpenResult {
     repo_id: string;
     org_id: string;
     provenance: "restored_from_envelope";
@@ -1229,9 +1229,9 @@ export interface GitvaultColdOpenResult {
     epoch: string;
     recipient_fingerprint: string;
 }
-export interface GitvaultVaultOptions {
-    keystore: GitvaultKeystore;
-    transport: GitvaultTransport;
+export interface VaultOptions {
+    keystore: VaultKeystore;
+    transport: VaultTransport;
     repo_id: string;
     /** The local git repository (objects for pack building / ancestry); optional for read-only use. */
     repo_dir?: string;
@@ -1252,7 +1252,7 @@ export interface GitvaultVaultOptions {
     allow_unauthenticated_salvage?: boolean;
 }
 /** How a checkpoint-bearing head binds a `retention_cutoff` ticket and expires roots (§4.5a / §4.5). */
-export interface GitvaultCutoffOptions {
+export interface VaultCutoffOptions {
     /**
      * `effective_admitted_at` for a root's drop generation, or `null` when this
      * client cannot resolve it — a `null` RETAINS the root (expiry is permissive).
@@ -1261,15 +1261,15 @@ export interface GitvaultCutoffOptions {
      */
     effectiveAdmittedAt?: (droppedAtGeneration: string) => string | null;
 }
-/** One admitted `rotate_epoch` transition {@link GitvaultVault.verifyToNewest} walked over, KEYLESS (structural only — no envelope opened yet). */
-export interface GitvaultEncounteredRotation {
+/** One admitted `rotate_epoch` transition {@link Vault.verifyToNewest} walked over, KEYLESS (structural only — no envelope opened yet). */
+export interface VaultEncounteredRotation {
     /** The rotate_epoch head's own generation. */
     generation: string;
     /** == `payload.new_epoch` == the head's own `epoch`. */
     epoch: string;
-    payload: GitvaultRotateEpochPayload;
+    payload: VaultRotateEpochPayload;
     /**
-     * gitvault-multi-writer rev 47 — the writer who actually signed THIS
+     * vault-multi-writer rev 47 — the writer who actually signed THIS
      * rotation head (already resolved + signature-verified by the forward
      * chain walk at the point this was collected — never the vault's fixed
      * genesis creator in a multi-writer vault). Optional: the BACKWARD
@@ -1282,8 +1282,8 @@ export interface GitvaultEncounteredRotation {
      */
     signing_pubkey?: string;
 }
-/** Named detail for a reader's own `GITVAULT_EPOCH_NOT_OPENABLE` / decrypt stop point (Part C: `repos fsck`'s honest `chain_verified_to` vs `decryptable_to` split). */
-export interface GitvaultEpochDecryptFailure {
+/** Named detail for a reader's own `VAULT_EPOCH_NOT_OPENABLE` / decrypt stop point (Part C: `repos fsck`'s honest `chain_verified_to` vs `decryptable_to` split). */
+export interface VaultEpochDecryptFailure {
     generation: string;
     epoch: string;
     rotation_id: string | null;
@@ -1300,79 +1300,79 @@ export interface GitvaultEpochDecryptFailure {
  * `strict: false` (tolerant) mode, in which case `failure` names exactly
  * where and why (never a bare, undifferentiated AEAD failure).
  */
-export interface GitvaultDecryptValidationResult {
+export interface VaultDecryptValidationResult {
     decryptable_to_generation: string;
     /** The newest successfully-decrypted `ref_state`/`retention_roots`, or `null` if none this call reached (generation zero, or the very first head failed). */
-    ref_state: GitvaultRefState | null;
-    retention_roots: GitvaultRetentionRoots | null;
+    ref_state: VaultRefState | null;
+    retention_roots: VaultRetentionRoots | null;
     /** Every locally-known epoch key at the end of this call, hex-encoded — seeded from the keystore's persisted `epoch_keys` plus every rotation this call itself opened. */
     epoch_keys_hex: Record<string, string>;
-    failure: GitvaultEpochDecryptFailure | null;
+    failure: VaultEpochDecryptFailure | null;
 }
-export interface GitvaultVerifiedState {
+export interface VaultVerifiedState {
     generation: string;
     head_sha256: string;
     /** `null` at generation zero. */
-    head: GitvaultHead | null;
-    genesis: GitvaultVaultGenesis;
+    head: VaultHead | null;
+    genesis: VaultGenesis;
     /** Every admitted `rotate_epoch` transition walked THIS call, oldest first — keyless (Part A's structural half; D202's join predicate needs only this). */
-    rotations: GitvaultEncounteredRotation[];
+    rotations: VaultEncounteredRotation[];
     /** Present iff `decryptValidate` was requested. */
-    decrypt: GitvaultDecryptValidationResult | null;
+    decrypt: VaultDecryptValidationResult | null;
 }
-export interface GitvaultMaterializedState extends GitvaultVerifiedState {
-    ref_state: GitvaultRefState | null;
-    retention_roots: GitvaultRetentionRoots | null;
-    refs: GitvaultRefMap;
-    roots: GitvaultRetentionRoot[];
-    head_target: GitvaultHeadTarget;
+export interface VaultMaterializedState extends VaultVerifiedState {
+    ref_state: VaultRefState | null;
+    retention_roots: VaultRetentionRoots | null;
+    refs: VaultRefMap;
+    roots: VaultRetentionRoot[];
+    head_target: VaultHeadTarget;
     /** Every locally-known epoch key after this call, hex-encoded, keyed by epoch — `restoreObjectsInto` needs every epoch spanned by the covered generations, not just the newest. */
     epoch_keys_hex: Record<string, string>;
 }
-/** One directory entry {@link GitvaultVault.reconcileEnvelopeRecipients} wrapped a fresh `key_envelope` for. */
-export interface GitvaultReconcileEnvelopeRecipientsWrapped {
+/** One directory entry {@link Vault.reconcileEnvelopeRecipients} wrapped a fresh `key_envelope` for. */
+export interface VaultReconcileEnvelopeRecipientsWrapped {
     principal_id: string;
     ek_fingerprint: string;
 }
-/** Why {@link GitvaultVault.reconcileEnvelopeRecipients} did NOT wrap a directory entry it otherwise would have. */
-export type GitvaultReconcileEnvelopeRecipientsSkipReason = "missing_public_key" | "invalid_public_key" | "pinned_key_mismatch";
-export interface GitvaultReconcileEnvelopeRecipientsSkipped {
+/** Why {@link Vault.reconcileEnvelopeRecipients} did NOT wrap a directory entry it otherwise would have. */
+export type VaultReconcileEnvelopeRecipientsSkipReason = "missing_public_key" | "invalid_public_key" | "pinned_key_mismatch";
+export interface VaultReconcileEnvelopeRecipientsSkipped {
     principal_id: string;
     ek_fingerprint: string;
-    reason: GitvaultReconcileEnvelopeRecipientsSkipReason;
+    reason: VaultReconcileEnvelopeRecipientsSkipReason;
     /** `pinned_key_mismatch`: `{pinned_fingerprint, directory_fingerprint}`. `invalid_public_key` (derivation mismatch): `{derived_fingerprint}`. Absent for `missing_public_key` and a bad-encoding `invalid_public_key`. */
     details?: Record<string, unknown>;
 }
-/** {@link GitvaultVault.reconcileEnvelopeRecipients}'s full per-recipient breakdown. */
-export interface GitvaultReconcileEnvelopeRecipientsResult {
+/** {@link Vault.reconcileEnvelopeRecipients}'s full per-recipient breakdown. */
+export interface VaultReconcileEnvelopeRecipientsResult {
     repo_id: string;
     org_id: string;
-    /** The epoch every wrap in this call used (V0: always {@link GITVAULT_GENESIS_EPOCH}). */
+    /** The epoch every wrap in this call used (V0: always {@link VAULT_GENESIS_EPOCH}). */
     epoch: string;
     /** Directory entries this call itself wrapped a NEW `key_envelope` for. */
-    wrapped: GitvaultReconcileEnvelopeRecipientsWrapped[];
+    wrapped: VaultReconcileEnvelopeRecipientsWrapped[];
     /** `ek_` fingerprints already covering the vault before (or, for a raced wrap, as of) this call — no action taken. */
     already_covered: string[];
     /** Directory entries this call could not (or, for `pinned_key_mismatch`, would not) wrap. */
-    skipped: GitvaultReconcileEnvelopeRecipientsSkipped[];
+    skipped: VaultReconcileEnvelopeRecipientsSkipped[];
 }
-/** One `pending_writers[]` entry {@link GitvaultVault.reconcileWriterAdmissions} admitted via a fresh `add_writer_key{"writer"}` head. */
-export interface GitvaultReconcileWriterAdmissionsAdmitted {
+/** One `pending_writers[]` entry {@link Vault.reconcileWriterAdmissions} admitted via a fresh `add_writer_key{"writer"}` head. */
+export interface VaultReconcileWriterAdmissionsAdmitted {
     principal_id: string;
     writer_key_id: string;
     generation: string;
 }
-/** Why {@link GitvaultVault.reconcileWriterAdmissions} did NOT admit a `pending_writers[]` entry it otherwise would have. */
-export type GitvaultReconcileWriterAdmissionsSkipReason = "missing_signing_pubkey" | "invalid_signing_pubkey";
-export interface GitvaultReconcileWriterAdmissionsSkipped {
+/** Why {@link Vault.reconcileWriterAdmissions} did NOT admit a `pending_writers[]` entry it otherwise would have. */
+export type VaultReconcileWriterAdmissionsSkipReason = "missing_signing_pubkey" | "invalid_signing_pubkey";
+export interface VaultReconcileWriterAdmissionsSkipped {
     principal_id: string;
     writer_key_id: string;
-    reason: GitvaultReconcileWriterAdmissionsSkipReason;
+    reason: VaultReconcileWriterAdmissionsSkipReason;
 }
 /**
- * {@link GitvaultVault.reconcileWriterAdmissions}'s full per-candidate
+ * {@link Vault.reconcileWriterAdmissions}'s full per-candidate
  * breakdown (task 5.7). Structurally parallel to
- * {@link GitvaultReconcileEnvelopeRecipientsResult} (same repo/wrapped-or-
+ * {@link VaultReconcileEnvelopeRecipientsResult} (same repo/wrapped-or-
  * admitted/already-covered/skipped shape), but this reconcile submits a REAL
  * chain head per admission (one `add_writer_key{"writer"}` transition per
  * candidate — the protocol allows only one added writer per head) rather
@@ -1380,7 +1380,7 @@ export interface GitvaultReconcileWriterAdmissionsSkipped {
  * admission materializes fresh against the PRIOR admission's own updated
  * writer set.
  */
-export interface GitvaultReconcileWriterAdmissionsResult {
+export interface VaultReconcileWriterAdmissionsResult {
     repo_id: string;
     org_id: string;
     /**
@@ -1395,26 +1395,26 @@ export interface GitvaultReconcileWriterAdmissionsResult {
      */
     eligible: boolean;
     /** `pending_writers[]` entries this call admitted this call, each via its own head. */
-    admitted: GitvaultReconcileWriterAdmissionsAdmitted[];
+    admitted: VaultReconcileWriterAdmissionsAdmitted[];
     /** `writer_key_id`s already active before (or, for a raced admission, as of) this call — no action taken. */
     already_covered: string[];
     /** `pending_writers[]` entries this call could not admit. */
-    skipped: GitvaultReconcileWriterAdmissionsSkipped[];
+    skipped: VaultReconcileWriterAdmissionsSkipped[];
 }
-export interface GitvaultPushOptions {
-    transaction: GitvaultRefTransaction;
+export interface VaultPushOptions {
+    transaction: VaultRefTransaction;
     /** New `HEAD` target for the published ref_state; carried forward when omitted. */
-    head_target?: GitvaultHeadTarget;
+    head_target?: VaultHeadTarget;
     protocol_refs?: "refuse" | "allow";
     /** Force the checkpoint-bearing form (purpose `ordinary_push`) regardless of delta size. */
     checkpoint?: boolean;
     /** Bind a fresh `retention_cutoff` ticket so expired roots may leave the map (checkpoint-bearing heads only). */
-    cutoff?: GitvaultCutoffOptions;
+    cutoff?: VaultCutoffOptions;
     /** Built lazily at head-sign time — the deploy lane may still be computing the plan digest. */
-    capture_binding?: GitvaultCaptureBinding | (() => Promise<GitvaultCaptureBinding | null> | GitvaultCaptureBinding | null);
+    capture_binding?: VaultCaptureBinding | (() => Promise<VaultCaptureBinding | null> | VaultCaptureBinding | null);
     /**
-     * A caller-supplied base (gitvault-client-round-trips design D1) — used
-     * VERBATIM for the first attempt instead of calling {@link GitvaultVault.materialize}
+     * A caller-supplied base (vault-client-round-trips design D1) — used
+     * VERBATIM for the first attempt instead of calling {@link Vault.materialize}
      * again. Only meaningful for a base the caller JUST materialized from this
      * same vault instance (e.g. one `list → push` protocol exchange sharing
      * one snapshot for both `expected_old` derivation and the push itself) —
@@ -1423,34 +1423,34 @@ export interface GitvaultPushOptions {
      * admission), just not the round-trip win. A conflict retry re-materializes
      * from storage exactly as when no base is supplied at all.
      */
-    base?: GitvaultMaterializedState;
+    base?: VaultMaterializedState;
 }
-export interface GitvaultPublishResult {
+export interface VaultPublishResult {
     generation: string;
     head_sha256: string;
-    head: GitvaultHead;
+    head: VaultHead;
     admission_record_sha256: string;
-    capture_receipt: GitvaultCaptureReceipt | null;
+    capture_receipt: VaultCaptureReceipt | null;
     /** `wal` = direct WAL receipts; `checkpoint` = the delta shipped as a checkpoint set. */
     form: "wal" | "checkpoint";
     conflicts_retried: number;
-    refs: GitvaultRefMap;
+    refs: VaultRefMap;
     /**
-     * gitvault-clone-scaling (P3): generations-since-checkpoint against the
+     * vault-clone-scaling (P3): generations-since-checkpoint against the
      * coverage this checkout has locally learned (`{0, false}` when unknown
      * — see the keystore field's doc). Advisory data only; consumers echo,
      * never gate.
      */
-    checkpoint_staleness: GitvaultCheckpointStaleness;
+    checkpoint_staleness: VaultCheckpointStaleness;
 }
-/** {@link GitvaultVault.rotateEpoch}'s result (D193-D203, rev 42). */
-export interface GitvaultRotationResult {
+/** {@link Vault.rotateEpoch}'s result (D193-D203, rev 42). */
+export interface VaultRotationResult {
     outcome: "admitted";
     generation: string;
     head_sha256: string;
     new_epoch: string;
     rotation_id: string;
-    reason: GitvaultRotationReason;
+    reason: VaultRotationReason;
     included: {
         principal_id: string;
         ek_fingerprint: string;
@@ -1458,10 +1458,10 @@ export interface GitvaultRotationResult {
     excluded_keyless_principal_ids: string[];
     excluded_unconfirmed_principal_ids: string[];
     admission_record_sha256: string;
-    capture_receipt: GitvaultCaptureReceipt | null;
+    capture_receipt: VaultCaptureReceipt | null;
     /**
      * `"passed"` — this principal is itself an included recipient and its own
-     * new-epoch envelope opened (via {@link import("../namespaces/gitvault.crypto.js").openEpochRotationForRecipient},
+     * new-epoch envelope opened (via {@link import("../namespaces/vault.crypto.js").openEpochRotationForRecipient},
      * the real reader entry point) to reproduce the sealed `K_e` +
      * `epoch_key_commitment` — the SAME round-trip that fed
      * `payload.self_open_attestation` (D209), run BEFORE this head was ever
@@ -1476,7 +1476,7 @@ export interface GitvaultRotationResult {
      * `keystore.recordEpochRotation` below advances the LOCAL pointer
      * unconditionally once admission succeeds, regardless of `self_check` —
      * an agent/CI writer that is deliberately never a directory envelope
-     * recipient (design D1 of `services/gitvault/desired-recipients.ts`:
+     * recipient (design D1 of `services/vault/desired-recipients.ts`:
      * "agents hold their own vault keys in their CLI keystore") keeps
      * read/write access to its own vault through every rotation it itself
      * drives, with or without an envelope.
@@ -1511,7 +1511,7 @@ export interface GitvaultRotationResult {
         principal_ids: string[];
     } | null;
     /**
-     * gitvault-multi-writer (task 5.9, D6/D227) — writer keys this SAME head
+     * vault-multi-writer (task 5.9, D6/D227) — writer keys this SAME head
      * removed via a folded `writer_set_update`, each with the reason it was
      * removed for. Empty (never omitted) when nothing needed removing — the
      * common case, matching `excluded_keyless_principal_ids`' own
@@ -1525,7 +1525,7 @@ export interface GitvaultRotationResult {
     }[];
 }
 /**
- * What {@link GitvaultVault.planPush} reports — a REAL
+ * What {@link Vault.planPush} reports — a REAL
  * local computation, not an estimate: every number here comes from actually
  * building the packs (or checkpoint set) and actually sealing/encrypting
  * them, exactly as a real `push` would. `would_admit_generation` is what this
@@ -1533,7 +1533,7 @@ export interface GitvaultRotationResult {
  * win the race before a real push runs (see the method doc for why that is
  * not a defect: `git push --dry-run` carries the identical caveat).
  */
-export interface GitvaultPushPlan {
+export interface VaultPushPlan {
     /** The base this plan was computed against — `materialize()`'s generation at call time. */
     base_generation: string;
     /** The generation a real push would claim, computed the same way a real push computes it (`nextGeneration(base_generation)`). */
@@ -1543,11 +1543,11 @@ export interface GitvaultPushPlan {
     /** `wal` = direct WAL receipts; `checkpoint` = the delta would ship as a checkpoint set — the SAME threshold real `push` uses. */
     form: "wal" | "checkpoint";
     /** The ref map this push would publish (after evaluating the transaction against the base). */
-    refs: GitvaultRefMap;
-    head_target: GitvaultHeadTarget;
+    refs: VaultRefMap;
+    head_target: VaultHeadTarget;
     /** Every object that would be uploaded — `ref_state`, `retention_roots`, and the WAL/checkpoint pack(s) — with their REAL sealed (encrypted) sizes. */
     objects: Array<{
-        object_kind: GitvaultUploadObject["object_kind"];
+        object_kind: VaultUploadObject["object_kind"];
         size_bytes: string;
     }>;
     object_count: number;
@@ -1557,11 +1557,11 @@ export interface GitvaultPushPlan {
     raw_bytes: string;
 }
 /**
- * What {@link GitvaultVault.verifyStoredCheckpoint} observed. Every boolean is
+ * What {@link Vault.verifyStoredCheckpoint} observed. Every boolean is
  * a FINDING, not a promise: a `false` here is what makes a truthful negative
  * `verifier_receipt` possible.
  */
-export interface GitvaultStoredCheckpointAttestation {
+export interface VaultStoredCheckpointAttestation {
     checkpoint_head_sha256: string;
     checkpoint_generation: string;
     claim_set_sha256: string;
@@ -1578,26 +1578,26 @@ export interface GitvaultStoredCheckpointAttestation {
     /** The `rootset` commitment over this generation's roots carrier — the intent core's `retention_state_hmac`. */
     retention_state_hmac: string;
 }
-export interface GitvaultBuiltCheckpoint {
-    manifest: GitvaultCheckpointManifest;
-    claim_set: GitvaultCheckpointClaimSet;
-    claim_set_receipt: GitvaultCheckpointBlock["claim_set"];
-    objects: GitvaultUploadObject[];
+export interface VaultBuiltCheckpoint {
+    manifest: VaultCheckpointManifest;
+    claim_set: VaultCheckpointClaimSet;
+    claim_set_receipt: VaultCheckpointBlock["claim_set"];
+    objects: VaultUploadObject[];
     /** Plaintext packs in order (for the acceptance self-check). */
     packs: Uint8Array[];
     covered_tips: string[];
 }
 /** A transport-agnostic view of git ops the publication needs (the local repository). */
-export declare class GitvaultVault {
+export declare class Vault {
     #private;
-    readonly keystore: GitvaultKeystore;
-    readonly transport: GitvaultTransport;
+    readonly keystore: VaultKeystore;
+    readonly transport: VaultTransport;
     readonly repoId: string;
     readonly repoDir: string | null;
     private readonly now;
     private readonly budget;
     /**
-     * gitvault-clone-scaling (bench P2): the CURRENT walk window's prefetched
+     * vault-clone-scaling (bench P2): the CURRENT walk window's prefetched
      * bytes — head bytes (bounded-concurrent direct reads) and carrier frames
      * (one batched getObjects), keyed by storage path — filled by
      * `verifyToNewest`'s per-page prefetch and `restoreObjectsInto`'s
@@ -1614,7 +1614,7 @@ export declare class GitvaultVault {
      */
     private walkPrefetch;
     /**
-     * WAL pack bytes carried by the state read's delta (gitvault-delta-fetch),
+     * WAL pack bytes carried by the state read's delta (vault-delta-fetch),
      * keyed by object_id — the walkPrefetch discipline exactly: UNTRUSTED
      * until a consumer's own hash check passes, a mismatch is a plain miss,
      * and the buffer is transient (stashed by {@link tryStateFastPath},
@@ -1622,7 +1622,7 @@ export declare class GitvaultVault {
      */
     private stateDeltaPacks;
     /**
-     * The state read's restore plan (gitvault-restore-recipe design D1-D5),
+     * The state read's restore plan (vault-restore-recipe design D1-D5),
      * stashed RAW — never verified at stash time, unlike `stateDeltaPacks`
      * (whose heads self-check before entering the shared keystore cache): a
      * plan's heads/checkpoint/packs are only ever verified by {@link
@@ -1638,7 +1638,7 @@ export declare class GitvaultVault {
     private readonly allowUnauthenticatedSalvage;
     private genesisCache;
     /**
-     * gitvault-byo-primary-bucket task 3.2 — this vault's resolved BYO write
+     * vault-byo-primary-bucket task 3.2 — this vault's resolved BYO write
      * target, cached after the first resolution (storage_profile/
      * byo_destination are immutable-at-allocation in v1, so a single
      * read-once-per-instance is safe). `undefined` = not yet resolved;
@@ -1647,14 +1647,14 @@ export declare class GitvaultVault {
      * been configured to write — see {@link resolveByoWriteTarget}).
      */
     private byoResolution;
-    constructor(options: GitvaultVaultOptions);
-    static open(options: GitvaultVaultOptions): GitvaultVault;
-    repoFile(): GitvaultRepoFile;
+    constructor(options: VaultOptions);
+    static open(options: VaultOptions): Vault;
+    repoFile(): VaultRepoFile;
     /**
-     * gitvault-agent-envelopes D4 — the COLD OPEN. A keystore that holds an
+     * vault-agent-envelopes D4 — the COLD OPEN. A keystore that holds an
      * identity but no repo file for this vault (a member joining from a fresh
      * machine, or a creator whose repo file was lost) restores `K_repo` from
-     * its OWN `key_envelope` instead of dying `GITVAULT_REPO_STATE_MISSING`:
+     * its OWN `key_envelope` instead of dying `VAULT_REPO_STATE_MISSING`:
      *
      *   1. genesis (the writer-key source) is fetched and signature-verified;
      *   2. its creator fingerprints are compared against the control plane's
@@ -1663,10 +1663,10 @@ export declare class GitvaultVault {
      *      genesis needs a substituted allocation, which the org's owners can
      *      see — TOFU + audit, human-envelopes D4's tier);
      *   3. the envelope-recipients read says whether THIS fingerprint is
-     *      covered — if not, `GITVAULT_ENVELOPE_PENDING` names the key-holders
+     *      covered — if not, `VAULT_ENVELOPE_PENDING` names the key-holders
      *      who can fulfil and the exact next actions (never a terminal error:
      *      the desired state already records this member; any key-holder's
-     *      next gitvault operation wraps);
+     *      next vault operation wraps);
      *   4. the base envelope is fetched, opened, and the repo file written
      *      `restored_from_envelope` with the genesis hash PINNED (a later open
      *      seeing a different genesis for this repo_id refuses
@@ -1679,7 +1679,7 @@ export declare class GitvaultVault {
      * Returns `null` when the repo file already existed (nothing restored).
      */
     /**
-     * gitvault-multi-writer (rev 47) — the vault's CURRENT admitted writer set
+     * vault-multi-writer (rev 47) — the vault's CURRENT admitted writer set
      * for a cold open, computed from the chain itself: every admitted head is
      * hash-checked against the listing, signature-verified under the writer
      * the chain admits at that point, and its `add_writer_key` /
@@ -1689,16 +1689,16 @@ export declare class GitvaultVault {
      * trusted when the chain vouches for it.
      */
     private resolveAdmittedWritersForColdOpen;
-    ensureRepoState(): Promise<GitvaultColdOpenResult | null>;
+    ensureRepoState(): Promise<VaultColdOpenResult | null>;
     /** {@link open}, but a missing repo file triggers {@link ensureRepoState} first. */
-    static openOrRestore(options: GitvaultVaultOptions): Promise<{
-        vault: GitvaultVault;
-        restored: GitvaultColdOpenResult | null;
+    static openOrRestore(options: VaultOptions): Promise<{
+        vault: Vault;
+        restored: VaultColdOpenResult | null;
     }>;
     private kRepo;
     private epoch;
     /**
-     * gitvault-clone-scaling (P3): staleness of the newest checkpoint coverage
+     * vault-clone-scaling (P3): staleness of the newest checkpoint coverage
      * this checkout has locally learned, measured at `newestGeneration`. Reads
      * the keystore AFTER the caller's own persist (a checkpoint-form push has
      * already recorded its fresh coverage by the time its result is built), so
@@ -1710,7 +1710,7 @@ export declare class GitvaultVault {
      * Fetch many generation-addressed heads' bytes ahead of the ordered walk,
      * keyed by head path.
      *
-     * BATCH-FIRST (gitvault-batched-head-reads task 4.2): one
+     * BATCH-FIRST (vault-batched-head-reads task 4.2): one
      * `POST …/head-reads` carries a whole page's bytes. Heads deliberately do
      * NOT ride `getObjects` — the `object-reads` presign batch is CARRIER-ONLY
      * by wire design (see `getObjectsBytes`'s fail-closed doc comment; the live
@@ -1718,10 +1718,10 @@ export declare class GitvaultVault {
      * by 25 serial singles), which is exactly why the batch route had to be its
      * own thing.
      *
-     * FALLBACK (the shipped gitvault-clone-scaling P2 shape): on ANY
+     * FALLBACK (the shipped vault-clone-scaling P2 shape): on ANY
      * unsupported answer — an older gateway, a refusal, a fault — head bytes
      * parallelize as the SAME direct GETs the ordered walk itself would issue,
-     * just early and overlapped at {@link GITVAULT_TRANSPORT_CONCURRENCY}. The
+     * just early and overlapped at {@link VAULT_TRANSPORT_CONCURRENCY}. The
      * transport remembers a route-absent verdict, so the probe is paid once per
      * client, not once per window.
      *
@@ -1734,11 +1734,11 @@ export declare class GitvaultVault {
     private git;
     /** Fetch + pin-check the genesis (the writer key source). */
     genesis(): Promise<{
-        genesis: GitvaultVaultGenesis;
+        genesis: VaultGenesis;
         sha256: string;
     }>;
     /**
-     * gitvault-composite-state-read design D1 — the pin-current fast path
+     * vault-composite-state-read design D1 — the pin-current fast path
      * `verifyToNewest` tries FIRST: one `GET …/state` in place of BOTH the
      * live "server still holds the pin" read {@link readHead} would otherwise
      * perform AND, when eligible, the `listHeads` walk that would follow it.
@@ -1776,13 +1776,13 @@ export declare class GitvaultVault {
      * {@link openCarrier} already key their own writes) but NEVER trusted
      * here — every reader downstream re-verifies a cache hit against the hash
      * it would check network bytes against before using it (this file's own
-     * established cache discipline; see `GitvaultKeystore`'s class doc
+     * established cache discipline; see `VaultKeystore`'s class doc
      * comment). A wrong or absent byte this method wrote is therefore just a
      * cache MISS on the next read, never a verification bypass.
      */
     private tryStateFastPath;
     /**
-     * Absorb a state read's delta (gitvault-delta-fetch): heads blind-warm the
+     * Absorb a state read's delta (vault-delta-fetch): heads blind-warm the
      * SAME keystore head cache every walk already re-verifies on read (the
      * established cache discipline — a wrong byte is a miss, never a bypass),
      * gated only on each entry's self-consistency; packs stash into the
@@ -1830,7 +1830,7 @@ export declare class GitvaultVault {
      * producer/consumer would, and counting each decrypt attempt as an EXTRA
      * unit against the same `this.budget` (decryption is the expensive step).
      * `options.strict` (default `true`) throws immediately, fail-closed, on the
-     * first `GITVAULT_EPOCH_NOT_OPENABLE` / AEAD failure it hits — the ordinary
+     * first `VAULT_EPOCH_NOT_OPENABLE` / AEAD failure it hits — the ordinary
      * `materialize()` read path's behavior. `strict: false` (fsck's tolerant
      * mode) instead records `decrypt.failure` and stops attempting further
      * decrypts while the pure chain walk keeps going — this is exactly what
@@ -1843,7 +1843,7 @@ export declare class GitvaultVault {
         strict?: boolean;
         deltaSince?: string;
         restore?: boolean;
-    }): Promise<GitvaultVerifiedState>;
+    }): Promise<VaultVerifiedState>;
     /**
      * Read one NEWLY-LISTED head's raw bytes, trying the local cache first
      * (design D3), re-verified against `expectedSha256` — the SAME check
@@ -1920,7 +1920,7 @@ export declare class GitvaultVault {
      * transition now opens the rotation's own envelope and decrypts under the
      * NEW epoch, chaining through multiple sequential rotations; a keystore
      * with no envelope for a new epoch fails CLOSED with
-     * `GITVAULT_EPOCH_NOT_OPENABLE`, never a bare `GITVAULT_AEAD_AUTH_FAILURE`)
+     * `VAULT_EPOCH_NOT_OPENABLE`, never a bare `VAULT_AEAD_AUTH_FAILURE`)
      * — `strict: true` means this call throws exactly where the OLD
      * (pre-fix) `materialize()` silently produced a wrong `k_obj` instead.
      */
@@ -1928,7 +1928,7 @@ export declare class GitvaultVault {
         persist?: boolean;
         deltaSince?: string;
         restore?: boolean;
-    }): Promise<GitvaultMaterializedState>;
+    }): Promise<VaultMaterializedState>;
     /**
      * Wrap the vault's CURRENT epoch key to every org member the directory
      * lists but the vault does not yet have a `key_envelope` for.
@@ -1937,7 +1937,7 @@ export declare class GitvaultVault {
      * describes a recipient-set change as an epoch rotation — "history epochs
      * stay wrapped as they were; a new member reads from their first covered
      * epoch forward" — which needs a protocol revision: V0 pins `epoch` to
-     * the single constant `GITVAULT_GENESIS_EPOCH` on every head, so there
+     * the single constant `VAULT_GENESIS_EPOCH` on every head, so there
      * is no "forward" to speak of. What this method actually does, legally, without any
      * protocol change: `key_envelope` objects are never head-referenced (not
      * even genesis's own envelope is), so uploading an ADDITIONAL one at
@@ -1962,7 +1962,7 @@ export declare class GitvaultVault {
      *
      * **The gateway directory route carries `public_key` on every row**
      * (`GET /orgs/v1/:org_id/encryption-keys` — see the
-     * doc comment on {@link GitvaultOrgEncryptionKeyEntry}), so against a
+     * doc comment on {@link VaultOrgEncryptionKeyEntry}), so against a
      * current gateway entries actually wrap. A directory entry that arrives
      * WITHOUT the field (an older/rolling-deploy gateway) is still tolerated
      * per-entry — reported under `skipped` with reason `missing_public_key`,
@@ -1970,11 +1970,11 @@ export declare class GitvaultVault {
      *
      * Best-effort by design at the call site, not here: this method itself
      * either completes (returning a full per-recipient breakdown) or throws
-     * (e.g. `GITVAULT_READ_ONLY` when this principal holds no signing key).
+     * (e.g. `VAULT_READ_ONLY` when this principal holds no signing key).
      * Callers that want "never block on this" (the deploy hook) wrap the call
-     * themselves — see `Gitvault.push`'s `#tryReconcileEnvelopeRecipients`.
+     * themselves — see `Repos.capture`'s `#tryReconcileEnvelopeRecipients`.
      */
-    reconcileEnvelopeRecipients(): Promise<GitvaultReconcileEnvelopeRecipientsResult>;
+    reconcileEnvelopeRecipients(): Promise<VaultReconcileEnvelopeRecipientsResult>;
     /**
      * `keyOverride` (D194, rev 42): a `rotate_epoch` head's OWN `ref_state`/
      * `retention_roots` must be sealed under the NEWLY-sampled `K_e` at the
@@ -1984,7 +1984,7 @@ export declare class GitvaultVault {
      */
     private seal;
     /**
-     * The owner signing seed, or `GITVAULT_READ_ONLY`.
+     * The owner signing seed, or `VAULT_READ_ONLY`.
      *
      * Public so the prune lane signs its intent core, wrapper, and verifier
      * receipt through the SAME refusal path every other signed object uses — a
@@ -1995,7 +1995,7 @@ export declare class GitvaultVault {
     signer(): Uint8Array;
     private writerKeyId;
     /**
-     * gitvault-multi-writer (task 5.8) — the push pre-check: before signing an
+     * vault-multi-writer (task 5.8) — the push pre-check: before signing an
      * ORDINARY head (any operation that expects this session to already be an
      * active writer), refuse EARLY and LOCALLY when this session's own key is
      * not (or is no longer) an active writer, rather than let real
@@ -2009,13 +2009,13 @@ export declare class GitvaultVault {
      * `removedMidRace` (design D8/D10) distinguishes the two shapes this
      * refusal takes: `false` (the default) is the ORDINARY pre-check — this
      * session was never (or is not currently) an admitted writer, thrown as
-     * `GITVAULT_WRITER_NOT_ADMITTED`. `true` is the CAS-LOSER path
+     * `VAULT_WRITER_NOT_ADMITTED`. `true` is the CAS-LOSER path
      * specifically: a retry, after re-materializing from the winner, that
      * discovers THIS session's own key was removed by whatever won the race —
      * "stop if removed" in D8's loser-rule sequence (fetch winner → verify →
      * apply writer transition → stop if removed → rebase → rebuild → bounded
      * backoff) — thrown as the more specific, client-local
-     * `GITVAULT_WRITER_REMOVED` (D10) instead: a real prior attempt just lost
+     * `VAULT_WRITER_REMOVED` (D10) instead: a real prior attempt just lost
      * to a removal, not a caller who was never eligible.
      *
      * Deliberately NOT called for a "handoff"-door `add_writer_key` head
@@ -2023,7 +2023,7 @@ export declare class GitvaultVault {
      * yet a writer — becoming one is what that exact head does.
      */
     private assertCallerIsWriter;
-    /** The owner's full signing keypair, or `GITVAULT_READ_ONLY` — same refusal path as {@link signer}, which returns only the seed; {@link sealKeyEnvelope} needs both halves. */
+    /** The owner's full signing keypair, or `VAULT_READ_ONLY` — same refusal path as {@link signer}, which returns only the seed; {@link sealKeyEnvelope} needs both halves. */
     private signingKeypair;
     private buildRefState;
     private buildRetentionRoots;
@@ -2048,7 +2048,7 @@ export declare class GitvaultVault {
      * generation's. Same `openCarrier` path, same `CHAIN_UNUSABLE` semantics — a
      * carrier that cannot be opened is never silently treated as empty.
      */
-    openRetentionRootsAt(receipt: GitvaultRetentionRootsReceipt): Promise<GitvaultRetentionRoots>;
+    openRetentionRootsAt(receipt: VaultRetentionRootsReceipt): Promise<VaultRetentionRoots>;
     private digest;
     /**
      * The §1 keyed commitment under one of the five `K_digest` labels.
@@ -2060,14 +2060,14 @@ export declare class GitvaultVault {
      * agreeing. Keyed by design (§7.3): a server-comparable plaintext digest
      * would be a confirmation oracle.
      */
-    keyedDigest(label: GitvaultDigestLabel, content: unknown): string;
+    keyedDigest(label: VaultDigestLabel, content: unknown): string;
     /** Strip the single top-level signature — the commitment preimage shape carriers use. */
     digestPreimage<T extends {
         signature: string;
     }>(o: T): Omit<T, "signature">;
     private withoutSignature;
     /** Coverage tips (§4.7): canonical refs ∪ unexpired roots ∪ the HEAD target (detached commit; an unborn symref contributes nothing). */
-    static coverageTips(refs: GitvaultRefMap, roots: GitvaultRetentionRoot[], headTarget: GitvaultHeadTarget): string[];
+    static coverageTips(refs: VaultRefMap, roots: VaultRetentionRoot[], headTarget: VaultHeadTarget): string[];
     /**
      * Build a checkpoint set (§4.7): manifest + packs + the owner-signed claim
      * set, with the acceptance self-check (restore into an empty scratch, every
@@ -2076,11 +2076,11 @@ export declare class GitvaultVault {
      */
     buildCheckpoint(input: {
         generation: string;
-        ref_state: GitvaultRefState;
-        retention_roots: GitvaultRetentionRoots;
-    }): Promise<GitvaultBuiltCheckpoint>;
+        ref_state: VaultRefState;
+        retention_roots: VaultRetentionRoots;
+    }): Promise<VaultBuiltCheckpoint>;
     /** §4.7 acceptance: restore from the set ALONE into an empty scratch; every covered ref resolves; fsck connectivity; recompute the three commitments. */
-    acceptCheckpoint(built: GitvaultBuiltCheckpoint, refState: GitvaultRefState, roots: GitvaultRetentionRoots): Promise<void>;
+    acceptCheckpoint(built: VaultBuiltCheckpoint, refState: VaultRefState, roots: VaultRetentionRoots): Promise<void>;
     /**
      * The §4.7 acceptance run against a checkpoint ALREADY IN STORAGE — the
      * restore-and-verify pass a `verifier_receipt` attests (§7.3).
@@ -2092,7 +2092,7 @@ export declare class GitvaultVault {
      * must be able to carry as `false` — turning it into an exception would make
      * an honest negative attestation impossible to produce.
      */
-    verifyStoredCheckpoint(head: GitvaultHead, headSha256: string): Promise<GitvaultStoredCheckpointAttestation>;
+    verifyStoredCheckpoint(head: VaultHead, headSha256: string): Promise<VaultStoredCheckpointAttestation>;
     /**
      * The whole verified chain, newest-first walk returned oldest-first, each
      * head paired with its checkpoint claim set (`null` when it bears none).
@@ -2104,18 +2104,18 @@ export declare class GitvaultVault {
      * trusted from a listing.
      */
     chainEntries(): Promise<Array<{
-        head: GitvaultHead;
+        head: VaultHead;
         head_sha256: string;
-        claim_set: GitvaultCheckpointClaimSet | null;
+        claim_set: VaultCheckpointClaimSet | null;
     }>>;
     /**
-     * gitvault-byo-primary-bucket task 3.2 — resolve (once, cached) this
+     * vault-byo-primary-bucket task 3.2 — resolve (once, cached) this
      * machine's local BYO write config for THIS vault. `null` when none is
      * configured locally — either because this is an ordinary managed vault
      * (the common case; deliberately never confirmed with a network call, so
      * a managed vault's push pays zero extra round trips), or because this
      * machine has not been configured to write a BYO vault it nonetheless
-     * belongs to (surfaced downstream as `GITVAULT_BYO_BUCKET_WRITE_REFUSED`
+     * belongs to (surfaced downstream as `VAULT_BYO_BUCKET_WRITE_REFUSED`
      * when the session actually names a `put: null` object with no target).
      */
     private resolveByoWriteTarget;
@@ -2135,7 +2135,7 @@ export declare class GitvaultVault {
      * retry always re-materializes from storage, exactly as when no base is
      * supplied.
      */
-    push(options: GitvaultPushOptions): Promise<GitvaultPublishResult>;
+    push(options: VaultPushOptions): Promise<VaultPublishResult>;
     /**
      * A REAL preview of what {@link push} would publish
      * — runs the SAME local pipeline `push` runs (materialize → evaluate →
@@ -2151,11 +2151,11 @@ export declare class GitvaultVault {
      *
      * Never retries and never allocates: an unallocated vault has no `repo_id`
      * (hence no encryption key) to preview a push against at all — callers
-     * resolve the vault READ-ONLY first (see `Gitvault.planPush` in
-     * `../namespaces/gitvault.js`, which reports `allocation_needed: true` in
+     * resolve the vault READ-ONLY first (see `Repos.planCapture` in
+     * `../namespaces/repos.js`, which reports `allocation_needed: true` in
      * that case instead of calling this method).
      */
-    planPush(options: GitvaultPushOptions): Promise<GitvaultPushPlan>;
+    planPush(options: VaultPushOptions): Promise<VaultPushPlan>;
     /**
      * Publish an `ordinary_push` checkpoint-bearing head that changes NO ref (the
      * canonical map and HEAD target are carried forward). With a cutoff the head
@@ -2170,14 +2170,14 @@ export declare class GitvaultVault {
      * `prepared_at` alone would shorten the lane, which the protocol's own
      * delayed-PUT vector calls out as the naive implementation.
      *
-     * This is NOT `run402 gitvault compact`: the §7.2 maintenance CYCLE (purpose
+     * This is NOT `run402 repos gc`: the §7.2 maintenance CYCLE (purpose
      * `maintenance_cycle`, C1/C2 roles, stage claim sets, prune intents, `R2_cap`
      * accounting) is a separate protocol under compact authority, and gets its own
      * method when it ships.
      */
     publishCheckpoint(options?: {
-        cutoff?: GitvaultCutoffOptions | false;
-    }): Promise<GitvaultPublishResult>;
+        cutoff?: VaultCutoffOptions | false;
+    }): Promise<VaultPublishResult>;
     /** Request a `retention_cutoff` ticket and check it binds THIS base head (and the service key, when one is pinned). */
     private issueRetentionCutoff;
     /**
@@ -2216,7 +2216,7 @@ export declare class GitvaultVault {
      */
     private loadEffectivePinManifest;
     /**
-     * Local-cache short-circuit (see {@link GitvaultRepoFile.known_pin_manifest}'s
+     * Local-cache short-circuit (see {@link VaultRepoFile.known_pin_manifest}'s
      * own doc comment for why this is safe): a manifest THIS keystore itself
      * just built, signed, and admitted is resolved from the on-disk cache
      * instead of a network `object-reads` round trip — same return shape,
@@ -2265,7 +2265,7 @@ export declare class GitvaultVault {
      * **This is an ORDINARY admission (`transition: null`) and is therefore
      * itself refused `EPOCH_ROTATION_REQUIRED` while a migration/revocation/
      * exposure condition is outstanding on this vault (D193) — the exact
-     * deadlock the incident behind {@link GitvaultVault.rotateEpoch}'s
+     * deadlock the incident behind {@link Vault.rotateEpoch}'s
      * `pending_confirmations` parameter closes.** When this vault is in that
      * state, fold the receipt into `rotateEpoch({..., pending_confirmations:
      * [{principal_id, ek_fingerprint, receipt}]})` instead of calling this
@@ -2276,8 +2276,8 @@ export declare class GitvaultVault {
         principal_id: string;
         ek_fingerprint: string;
         confirmed_by: "operator_confirmation";
-        receipt: GitvaultRecipientConfirmationReceipt;
-    }): Promise<GitvaultPublishResult>;
+        receipt: VaultRecipientConfirmationReceipt;
+    }): Promise<VaultPublishResult>;
     /**
      * Drive one epoch rotation to a committed head (D193-D203). This is the
      * producer's obligations in full: sample a FRESH `K_e` independent of
@@ -2296,17 +2296,17 @@ export declare class GitvaultVault {
      *
      * **`recipient_state_version`/`recipient_revocation_version` are REQUIRED
      * inputs, not discovered here.** The gateway exposes NO general read route
-     * for `internal.gitvault_recipient_state_counters` (D194) — the ONLY
+     * for `internal.vault_recipient_state_counters` (D194) — the ONLY
      * client-visible read of these two org-scoped counters today is the
      * response of `POST …/recipients/:principal_id/key-revocation`
-     * ({@link GitvaultTransport.declareRecipientKeyRevoked}), which is why
+     * ({@link VaultTransport.declareRecipientKeyRevoked}), which is why
      * {@link rotateEpochForKeyRevocation} (below) is the one fully
      * self-contained entry point. For `member_removed` / `elective_rekey` /
      * `epoch_secret_exposed`, a caller that does not already know the current
      * counter pair cannot discover it from any shipped gateway route — this
      * is a confirmed gap in the live gateway (verified against
-     * `packages/gateway/src/services/gitvault/reads.ts:getVaultRecord` and
-     * every `routes/gitvault*.ts` handler, not inferred), not a client
+     * `packages/gateway/src/services/vault/reads.ts:getVaultRecord` and
+     * every `routes/vault*.ts` handler, not inferred), not a client
      * limitation this SDK can work around. Passing a stale/guessed pair fails
      * safely: the admission fence's D194 frozen-counter comparison refuses
      * `RECIPIENT_SET_MISMATCH` rather than silently canonizing against wrong
@@ -2329,7 +2329,7 @@ export declare class GitvaultVault {
      * PREDECESSOR manifest, unchanged. They land in
      * `excluded_unconfirmed_principal_ids` here (same as without folding) and
      * become eligible starting at the NEXT rotation, once this manifest is
-     * the admitted predecessor. See {@link GitvaultRotationResult.pin_manifest_published}.
+     * the admitted predecessor. See {@link VaultRotationResult.pin_manifest_published}.
      *
      * **Honest residual — this does not rescue a vault with ZERO ever-
      * confirmed principals.** If `included` would be empty even with the
@@ -2344,7 +2344,7 @@ export declare class GitvaultVault {
      * over) and needs an operator-side decision, not a client workaround.
      */
     rotateEpoch(options: {
-        reason: GitvaultRotationReason;
+        reason: VaultRotationReason;
         recipient_state_version: string;
         recipient_revocation_version: string;
         client_idempotency_key?: string;
@@ -2352,10 +2352,10 @@ export declare class GitvaultVault {
         pending_confirmations?: {
             principal_id: string;
             ek_fingerprint: string;
-            receipt: GitvaultRecipientConfirmationReceipt;
+            receipt: VaultRecipientConfirmationReceipt;
         }[];
         /**
-         * gitvault-multi-writer (task 5.9, D7/D228) — an outstanding
+         * vault-multi-writer (task 5.9, D7/D228) — an outstanding
          * gateway-blocked writer set (`ineligible_members`, checked fresh on
          * every call — see the `writer_set_update` fold-in below) is ALWAYS
          * folded into this rotation automatically; this flag is the EXPLICIT
@@ -2367,22 +2367,22 @@ export declare class GitvaultVault {
          * it widens nothing beyond that one specific, named exception.
          */
         force_empty_writer_set?: boolean;
-    }): Promise<GitvaultRotationResult>;
+    }): Promise<VaultRotationResult>;
     /**
      * The writer-capable rotation that completes an org membership removal
-     * (gitvault-multi-writer D6: "`member_removed` keeps its automatic
+     * (vault-multi-writer D6: "`member_removed` keeps its automatic
      * writer-capable path"). The removal itself already advanced the org's
      * D194 counters and flipped the member to `pending_removal`, so there is
      * nothing to declare: read the counters off the envelope-recipients read
      * (the same read the H-partition uses) and rotate under
      * `reason:"member_removed"`, which needs `gitvault.writer` only — any
      * surviving writer can run it, no owner step-up. Refuses
-     * `GITVAULT_ROTATION_COUNTERS_UNAVAILABLE` on a gateway that does not yet
+     * `VAULT_ROTATION_COUNTERS_UNAVAILABLE` on a gateway that does not yet
      * carry the counters on that read.
      */
     rotateEpochForMemberRemoval(options?: {
         client_idempotency_key?: string;
-    }): Promise<GitvaultRotationResult>;
+    }): Promise<VaultRotationResult>;
     /**
      * The ONE fully self-contained rotation entry point: declares
      * `reason:"recipient_key_revoked"` (owner + step-up) for `principal_id`,
@@ -2391,7 +2391,7 @@ export declare class GitvaultVault {
      */
     rotateEpochForKeyRevocation(principalId: string, options?: {
         client_idempotency_key?: string;
-    }): Promise<GitvaultRotationResult>;
+    }): Promise<VaultRotationResult>;
     /**
      * Submit a REF-NEUTRAL `add_writer_key{authorization.kind:"handoff"}`
      * activation head — no ref/checkpoint/repair changes ride it (protocol
@@ -2428,13 +2428,13 @@ export declare class GitvaultVault {
         acceptance: Record<string, unknown>;
     }): Promise<{
         outcome: "activated";
-        result: GitvaultPublishResult;
+        result: VaultPublishResult;
     } | {
         outcome: "already_admitted";
         generation: string;
     }>;
     /**
-     * gitvault-multi-writer (task 5.7) — the "writer"-door twin of {@link
+     * vault-multi-writer (task 5.7) — the "writer"-door twin of {@link
      * submitWriterActivationHead}: an ALREADY-ACTIVE writer (this vault
      * session's own key) admits `input`, an eligible org member with a
      * published signing key but no writer standing yet, via a fresh
@@ -2444,8 +2444,8 @@ export declare class GitvaultVault {
      * branch), re-verified admission-side by `checkTransitionAdmissible`.
      * Task 5.8 adds the SAME local pre-check every other head-signing path
      * gets: if THIS session's own key is not (or is no longer) an active
-     * writer, refuse EARLY and LOCALLY (`GITVAULT_WRITER_NOT_ADMITTED` /
-     * `GITVAULT_WRITER_REMOVED`) rather than let the head reach the gateway
+     * writer, refuse EARLY and LOCALLY (`VAULT_WRITER_NOT_ADMITTED` /
+     * `VAULT_WRITER_REMOVED`) rather than let the head reach the gateway
      * only to be refused there — redundant with `reconcileWriterAdmissions`'s
      * own upfront gate for that caller, but this method is public and a
      * direct caller should get the same fast, specific refusal.
@@ -2456,13 +2456,13 @@ export declare class GitvaultVault {
         addedPrincipalId: string;
     }): Promise<{
         outcome: "activated";
-        result: GitvaultPublishResult;
+        result: VaultPublishResult;
     } | {
         outcome: "already_admitted";
         generation: string;
     }>;
     /**
-     * gitvault-multi-writer (task 5.7) — the vault's OWN writer-admission
+     * vault-multi-writer (task 5.7) — the vault's OWN writer-admission
      * reconcile: reads `pending_writers[]` off the vault record (eligible org
      * members with no writer standing yet), resolves each candidate's
      * published signing key off the org's encryption-key directory (the SAME
@@ -2480,7 +2480,7 @@ export declare class GitvaultVault {
      * a session that reached this call already pushed successfully as an
      * active writer in every wired call site (push/snapshot/deploy) OR is a
      * member that simply is not one yet (session-start/read) — the SAME
-     * "not yet admitted" case {@link Gitvault.push}'s own pre-push check
+     * "not yet admitted" case {@link Repos.capture}'s own pre-push check
      * (task 5.8) names, not a new refusal shape. Returns `{eligible: false}`
      * with every other field empty (never throws) for that case: every OTHER
      * `pending_writers[]` entry would fail identically, so there is nothing
@@ -2489,7 +2489,7 @@ export declare class GitvaultVault {
      * (`eligible: true`, still all empty), which matters to a caller trying
      * to explain an all-empty result to a human.
      */
-    reconcileWriterAdmissions(): Promise<GitvaultReconcileWriterAdmissionsResult>;
+    reconcileWriterAdmissions(): Promise<VaultReconcileWriterAdmissionsResult>;
     /**
      * Publish a repair head over `base_generation` (§4.3): superseded tips that
      * the repaired state no longer reaches enter the retention-root map with
@@ -2499,8 +2499,8 @@ export declare class GitvaultVault {
      */
     repair(input: {
         base_generation: string;
-        reason: GitvaultRepairDescriptor["reason"];
-    }): Promise<GitvaultPublishResult>;
+        reason: VaultRepairDescriptor["reason"];
+    }): Promise<VaultPublishResult>;
     /** Heads `base..newest` (already chain-verified by `verifyToNewest`) re-read + hash-checked from storage. */
     /**
      * Re-read heads `baseGeneration..newest` and hash-check each against the
@@ -2518,10 +2518,10 @@ export declare class GitvaultVault {
      * `targetRepoDir` (an initialized repository), then verify every canonical
      * ref + the HEAD target resolves. Returns the materialized refs.
      *
-     * Design D5 (gitvault-client-round-trips): incremental above the local
+     * Design D5 (vault-client-round-trips): incremental above the local
      * `restored_through` marker (this target directory's own local git
-     * config, read/written by {@link readGitvaultRestoreMarker}/{@link
-     * writeGitvaultRestoreMarker}) — replaying only the WAL packs of
+     * config, read/written by {@link readVaultRestoreMarker}/{@link
+     * writeVaultRestoreMarker}) — replaying only the WAL packs of
      * generations above it — WHEN the walk from newest back to the marker is
      * plain WAL the entire way. The moment that walk crosses a
      * checkpoint-bearing, repair, or transition head (checked BEFORE
@@ -2533,16 +2533,16 @@ export declare class GitvaultVault {
      * paths; the marker only advances after they both succeed.
      */
     restoreObjectsInto(targetRepoDir: string, reuse?: {
-        marker: GitvaultRestoreMarker | null;
-        state: GitvaultMaterializedState;
+        marker: VaultRestoreMarker | null;
+        state: VaultMaterializedState;
     }): Promise<{
-        refs: GitvaultRefMap;
-        head_target: GitvaultHeadTarget;
+        refs: VaultRefMap;
+        head_target: VaultHeadTarget;
         generation: string;
-        retained_refs: GitvaultRetainedRefsReconcileResult;
+        retained_refs: VaultRetainedRefsReconcileResult;
     }>;
     /**
-     * The shared restore tail (gitvault-restore-recipe): apply `heads`'
+     * The shared restore tail (vault-restore-recipe): apply `heads`'
      * checkpoint (if any) + WAL packs into `targetRepoDir`, verify §4.7
      * coverage, reconcile retained refs, and advance the marker — IDENTICALLY
      * whether `heads` came from {@link restoreObjectsInto}'s own backward walk
@@ -2562,10 +2562,10 @@ export declare class GitvaultVault {
      * packs (`stateDeltaPacks` never carries checkpoint packs — a delta span
      * never crosses a checkpoint boundary). Both are `null` on the ordinary
      * walk path, in which case every line below is byte-identical to the
-     * pre-gitvault-restore-recipe shape.
+     * pre-vault-restore-recipe shape.
      */
     /**
-     * gitvault-multi-writer (rev 47): the key a head's own checkpoint claim set
+     * vault-multi-writer (rev 47): the key a head's own checkpoint claim set
      * and carriers were signed under — the head's writer, resolved against the
      * keystore's persisted `writer_set_pin` (maintained by the chain walk that
      * always precedes a restore), falling back to `fallback` (the genesis
@@ -2580,7 +2580,7 @@ export declare class GitvaultVault {
      * `newest.epoch_keys_hex[epoch]`, decoded — the D194 per-carrying-head key
      * lookup shared by {@link applyRestoreHeads} and {@link verifyRestorePlan}.
      * `newest.epoch_keys_hex` is the FULL map `materialize()` resolved
-     * (throwing `GITVAULT_EPOCH_NOT_OPENABLE` fail-closed if any needed epoch
+     * (throwing `VAULT_EPOCH_NOT_OPENABLE` fail-closed if any needed epoch
      * could not be opened), so every lookup through this helper is guaranteed
      * present.
      */
@@ -2607,7 +2607,7 @@ export declare class GitvaultVault {
      */
     private verifyRestorePlan;
     /**
-     * Consume a stashed restore plan (gitvault-restore-recipe design D1-D6):
+     * Consume a stashed restore plan (vault-restore-recipe design D1-D6):
      * verify it ({@link verifyRestorePlan}) and, on success, apply it via the
      * SAME shared tail the backward walk uses ({@link applyRestoreHeads}) —
      * `null` on absence or ANY verification failure, the caller's cue to run
@@ -2617,16 +2617,16 @@ export declare class GitvaultVault {
      * `verifyRestorePlan` itself).
      */
     private tryConsumeRestorePlan;
-    /** Thin passthrough to the transport — see {@link GitvaultTransport.openCompactionGrant}. */
-    openCompactionGrant(): Promise<GitvaultCompactionGrant>;
-    /** Thin passthrough to the transport — see {@link GitvaultTransport.closeCompactionGrant}. Always safe best-effort; never throws by construction of the route (idempotent). */
+    /** Thin passthrough to the transport — see {@link VaultTransport.openCompactionGrant}. */
+    openCompactionGrant(): Promise<VaultCompactionGrant>;
+    /** Thin passthrough to the transport — see {@link VaultTransport.closeCompactionGrant}. Always safe best-effort; never throws by construction of the route (idempotent). */
     closeCompactionGrant(): Promise<{
         closed: boolean;
     }>;
 }
 /** §4.7 cross-field equality: covers_through agree; the claim set's ordered pack ids/hashes/sizes/total equal the manifest's (shared stored fields only). */
-export declare function checkClaimSetEquality(claimSet: GitvaultCheckpointClaimSet, manifest: GitvaultCheckpointManifest, headCoversThrough: string): void;
+export declare function checkClaimSetEquality(claimSet: VaultCheckpointClaimSet, manifest: VaultCheckpointManifest, headCoversThrough: string): void;
 /** Convenience for the deploy lane: the §6.5 capture binding. */
-export declare function captureBinding(captureId: string, applyPlanSha256: string | null, snapshotOidHmac: string): GitvaultCaptureBinding;
-export type { GitvaultRefUpdate };
-//# sourceMappingURL=gitvault-publication.d.ts.map
+export declare function captureBinding(captureId: string, applyPlanSha256: string | null, snapshotOidHmac: string): VaultCaptureBinding;
+export type { VaultRefUpdate };
+//# sourceMappingURL=vault-publication.d.ts.map