@run402/sdk 4.95.0 → 4.96.0

package/dist/node/{gitvault-apply.js → vault-apply.js}

@@ -1,8 +1,8 @@
 /**
- * The gitvault deploy lane, supplied at last (change `gitvault-deploy-lane`).
+ * The vault deploy lane, supplied at last (change `vault-deploy-lane`).
  *
- * `add-gitvault` 5.6 built `runGitvaultDeploy` with the lane INJECTED and never
- * supplied one, so a project whose `gitvault_policy` is `required` could not be
+ * `add-vault` 5.6 built `runVaultDeploy` with the lane INJECTED and never
+ * supplied one, so a project whose `vault_policy` is `required` could not be
  * deployed by any published client. This module is that supplier, plus the
  * entry point the CLI calls in place of a bare `apply()`:
  *
@@ -12,11 +12,11 @@
  *     than reassembling it. Warning gating, CAS dedup, event emission, asset
  *     re-plan, and terminal polling are the same code every other deploy runs;
  *     the only difference is two extra wire fields.
- *   - {@link applyWithGitvault} decides whether any of that happens at all. A
+ *   - {@link applyWithVault} decides whether any of that happens at all. A
  *     project that is not `required` takes the untouched path: no capture, no
  *     token, no extra refusal, one policy read.
  *
- * THE COROUTINE, because it is the non-obvious part. `runGitvaultDeploy` wants
+ * THE COROUTINE, because it is the non-obvious part. `runVaultDeploy` wants
  * two separable steps (plan, then commit) with the vault push running between
  * them; `Deploy.apply()` is one call. The lane bridges them with a pair of
  * deferreds: `apply()`'s `authorize` hook fires once the plan exists and its
@@ -46,7 +46,7 @@ export function createApplyDeployLane(options) {
         async plan(input) {
             applyPromise = options.engine.apply(options.spec, {
                 ...(options.apply ?? {}),
-                gitvault: {
+                vault: {
                     declaration: { capture_id: input.capture_id, snapshot_oid_hmac: input.snapshot_oid_hmac },
                     authorize: async (p) => {
                         if (!p.apply_plan_sha256) {
@@ -55,7 +55,7 @@ export function createApplyDeployLane(options) {
                             // inventing a placeholder: the capture still publishes (with a
                             // null digest, so nothing is mintable from it) and the outcome
                             // is an honest `DEPLOY_FAILED_VAULTED`.
-                            const missing = new LocalError("the gateway accepted a capture-bearing plan but returned no apply_plan_sha256; no activation token can be minted for it", "planning a gitvault deploy", { code: "GITVAULT_PLAN_DIGEST_MISSING", details: { plan_id: p.plan_id, operation_id: p.operation_id } });
+                            const missing = new LocalError("the gateway accepted a capture-bearing plan but returned no apply_plan_sha256; no activation token can be minted for it", "planning a vault deploy", { code: "VAULT_PLAN_DIGEST_MISSING", details: { plan_id: p.plan_id, operation_id: p.operation_id } });
                             planned.reject(missing);
                             throw missing;
                         }
@@ -73,7 +73,7 @@ export function createApplyDeployLane(options) {
         async commit(input) {
             authorized.resolve(commitDeclaration(input));
             if (!applyPromise)
-                throw new LocalError("commit was called before plan", "committing gitvault deploy", { code: "GITVAULT_LANE_OUT_OF_ORDER" });
+                throw new LocalError("commit was called before plan", "committing vault deploy", { code: "VAULT_LANE_OUT_OF_ORDER" });
             result = await applyPromise;
             return result;
         },
@@ -82,7 +82,7 @@ export function createApplyDeployLane(options) {
                 return;
             authorized.reject(reason instanceof Error
                 ? reason
-                : new LocalError("the gitvault deploy was abandoned before commit", "committing gitvault deploy", { code: "GITVAULT_DEPLOY_ABANDONED", details: { reason } }));
+                : new LocalError("the vault deploy was abandoned before commit", "committing vault deploy", { code: "VAULT_DEPLOY_ABANDONED", details: { reason } }));
         },
         result: () => result,
     };
@@ -93,25 +93,25 @@ function commitDeclaration(input) {
         return { allow_unvaulted: true, override_reason: input.allow_unvaulted.reason };
     const tokenId = input.activation_token?.object_id;
     if (!tokenId) {
-        throw new LocalError("a vaulted commit needs an activation token and none was minted", "committing gitvault deploy", { code: "GITVAULT_ACTIVATION_TOKEN_MISSING" });
+        throw new LocalError("a vaulted commit needs an activation token and none was minted", "committing vault deploy", { code: "VAULT_ACTIVATION_TOKEN_MISSING" });
     }
     return { activation_token_id: tokenId };
 }
 /** `run402 repos policy required` — the offer D3 attaches to every ungated deploy. */
-export function gitvaultPolicyRequiredNextAction(repoId) {
+export function vaultPolicyRequiredNextAction(repoId) {
     return {
-        type: "gitvault_policy_required",
+        type: "vault_policy_required",
         command: "run402 repos policy required",
-        why: `vault ${repoId} exists but gitvault_policy was never set, so this deploy ran without requiring a vaulted capture. Set it to require one, or run \`run402 repos policy grandfathered --reason <why>\` to explicitly accept the current state.`,
+        why: `vault ${repoId} exists but vault_policy was never set, so this deploy ran without requiring a vaulted capture. Set it to require one, or run \`run402 repos policy grandfathered --reason <why>\` to explicitly accept the current state.`,
     };
 }
 /** The standing `warnings[]` entry D3 attaches to every ungated deploy, until the policy is set either way. */
-export function gitvaultUngatedWarning(repoId) {
+export function vaultUngatedWarning(repoId) {
     return {
-        code: "GITVAULT_POLICY_UNSET",
+        code: "VAULT_POLICY_UNSET",
         severity: "low",
         requires_confirmation: false,
-        message: `vault ${repoId} is not gated: gitvault_policy was never set, so a deploy can activate without a vaulted capture. Run \`run402 repos policy required\` (or \`grandfathered --reason <why>\` to explicitly accept this) to clear the drift.`,
+        message: `vault ${repoId} is not gated: vault_policy was never set, so a deploy can activate without a vaulted capture. Run \`run402 repos policy required\` (or \`grandfathered --reason <why>\` to explicitly accept this) to clear the drift.`,
         affected: [repoId],
     };
 }
@@ -119,12 +119,12 @@ export function gitvaultUngatedWarning(repoId) {
 function decorateUngatedResult(result, repoId) {
     return {
         ...result,
-        warnings: [...(result.warnings ?? []), gitvaultUngatedWarning(repoId)],
-        next_actions: [...(result.next_actions ?? []), gitvaultPolicyRequiredNextAction(repoId)],
+        warnings: [...(result.warnings ?? []), vaultUngatedWarning(repoId)],
+        next_actions: [...(result.next_actions ?? []), vaultPolicyRequiredNextAction(repoId)],
     };
 }
 /**
- * Deploy, taking the project's `gitvault_policy` into account.
+ * Deploy, taking the project's `vault_policy` into account.
  *
  * NOT `required` — no vault, an unreadable policy, a Core target, or an
  * explicit `grandfathered` — runs `apply()` with the caller's own options and
@@ -132,7 +132,7 @@ function decorateUngatedResult(result, repoId) {
  * user's deploy, and the only cost this function may add to it is the single
  * policy read that determines the project is not `required`.
  */
-export async function applyWithGitvault(options) {
+export async function applyWithVault(options) {
     const applyOpts = {
         ...(options.apply ?? {}),
         ...(options.target ? { target: options.target } : {}),
@@ -140,32 +140,32 @@ export async function applyWithGitvault(options) {
     const plain = async (mode) => ({
         mode,
         deploy: await options.sdk._applyEngine.apply(options.spec, applyOpts),
-        gitvault: null,
+        vault: null,
     });
     // A self-hosted Core gateway has no vault gate; never spend a round trip.
     if (options.target === "core")
         return plain({ kind: "none", reason: "no_vault" });
-    const record = await readVaultRecord(options.sdk.gitvault, options.spec.project_id);
+    const record = await readVaultRecord(options.sdk.repos, options.spec.project_id);
     if (!record)
         return plain({ kind: "none", reason: "policy_unreadable" });
-    if (record.gitvault_policy === "grandfathered") {
+    if (record.vault_policy === "grandfathered") {
         return plain({ kind: "grandfathered", repo_id: record.repo_id });
     }
-    if (record.gitvault_policy !== "required") {
-        // D3: allocation no longer sets `gitvault_policy`, so a vault whose
+    if (record.vault_policy !== "required") {
+        // D3: allocation no longer sets `vault_policy`, so a vault whose
         // policy is `null` is the ORDINARY shape, not a weakened one — the
         // deploy is never blocked or interactively prompted on this. It still
-        // runs the untouched plain path (same options object, no gitvault hooks);
+        // runs the untouched plain path (same options object, no vault hooks);
         // the only difference from `grandfathered` is that the result carries an
         // offer to gate, plus a standing warning naming the drift until the
         // policy is set either way (spec scenario "Ungated drift stays visible").
         const deploy = await options.sdk._applyEngine.apply(options.spec, applyOpts);
-        return { mode: { kind: "ungated", repo_id: record.repo_id }, deploy: decorateUngatedResult(deploy, record.repo_id), gitvault: null };
+        return { mode: { kind: "ungated", repo_id: record.repo_id }, deploy: decorateUngatedResult(deploy, record.repo_id), vault: null };
     }
     const lane = createApplyDeployLane({ engine: options.sdk._applyEngine, spec: options.spec, apply: applyOpts });
-    let gitvault;
+    let vault;
     try {
-        gitvault = await options.sdk.gitvault.deploy({
+        vault = await options.sdk.repos.deploy({
             lane,
             repo_id: record.repo_id,
             repo_dir: options.repo_dir ?? process.cwd(),
@@ -185,9 +185,9 @@ export async function applyWithGitvault(options) {
         throw enrichCaptureRefusal(err, record.repo_id);
     }
     finally {
-        lane.abandon(new LocalError("the deploy ended without committing this plan", "committing gitvault deploy", { code: "GITVAULT_DEPLOY_ABANDONED" }));
+        lane.abandon(new LocalError("the deploy ended without committing this plan", "committing vault deploy", { code: "VAULT_DEPLOY_ABANDONED" }));
     }
-    return { mode: { kind: "vaulted", repo_id: record.repo_id }, deploy: lane.result(), gitvault };
+    return { mode: { kind: "vaulted", repo_id: record.repo_id }, deploy: lane.result(), vault };
 }
 /**
  * Read the vault record, or `null` when it cannot be read.
@@ -197,9 +197,9 @@ export async function applyWithGitvault(options) {
  * genuinely required. Turning a transient control-plane blip into a failed
  * deploy for a project that has no vault at all would be the worse trade.
  */
-async function readVaultRecord(gitvault, projectId) {
+async function readVaultRecord(repos, projectId) {
     try {
-        return await gitvault.forProject(projectId);
+        return await repos.forProject(projectId);
     }
     catch {
         return null;
@@ -208,23 +208,23 @@ async function readVaultRecord(gitvault, projectId) {
 /**
  * A `required` project whose keystore this machine does not hold cannot
  * capture. The protocol's own code is PRESERVED (`KEYSTORE_MISSING` /
- * `GITVAULT_REPO_STATE_MISSING` — surfacing the typed outcome rather than
+ * `VAULT_REPO_STATE_MISSING` — surfacing the typed outcome rather than
  * substituting one), with actions prepended that actually resolve it.
  */
 function enrichCaptureRefusal(err, repoId) {
     if (!isRun402Error(err))
         return err;
     const e = err;
-    if (e.code !== "KEYSTORE_MISSING" && e.code !== "GITVAULT_REPO_STATE_MISSING")
+    if (e.code !== "KEYSTORE_MISSING" && e.code !== "VAULT_REPO_STATE_MISSING")
         return err;
-    return new LocalError(`${e.message} — this project's gitvault_policy is \`required\`, so a deploy from this machine needs the vault keystore`, "capturing for a gitvault-required deploy", {
+    return new LocalError(`${e.message} — this project's vault_policy is \`required\`, so a deploy from this machine needs the vault keystore`, "capturing for a vault-required deploy", {
         code: e.code,
         details: { repo_id: repoId, ...(e.details && typeof e.details === "object" ? e.details : {}) },
         next_actions: [
-            { action: "restore the gitvault keystore onto this machine (run402 repos view prints keystore.root; back it up from the machine that holds it)" },
+            { action: "restore the vault keystore onto this machine (run402 repos view prints keystore.root; back it up from the machine that holds it)" },
             { action: 'run402 repos policy grandfathered --reason "<why>" — un-gate the project so deploys activate without a capture (owner + step-up, audited, doctor-persistent advisory)' },
             ...(Array.isArray(e.next_actions) ? e.next_actions : []),
         ],
     });
 }
-//# sourceMappingURL=gitvault-apply.js.map
+//# sourceMappingURL=vault-apply.js.map

package/dist/node/vault-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-apply.js","sourceRoot":"","sources":["../../src/node/vault-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AA2B1E,SAAS,QAAQ;IACf,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAkC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,2CAA2C;IAC3C,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAqBD,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,OAAO,GAAG,QAAQ,EAAuB,CAAC;IAChD,MAAM,UAAU,GAAG,QAAQ,EAA0B,CAAC;IACtD,IAAI,YAAY,GAAiC,IAAI,CAAC;IACtD,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAoB;QAC5B,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;gBAChD,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBACzF,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;wBACrB,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;4BACzB,kEAAkE;4BAClE,6DAA6D;4BAC7D,+DAA+D;4BAC/D,+DAA+D;4BAC/D,wCAAwC;4BACxC,MAAM,OAAO,GAAG,IAAI,UAAU,CAC5B,yHAAyH,EACzH,yBAAyB,EACzB,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CACrG,CAAC;4BACF,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BACxB,MAAM,OAAO,CAAC;wBAChB,CAAC;wBACD,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;wBAC9G,OAAO,UAAU,CAAC,OAAO,CAAC;oBAC5B,CAAC;iBACF;aACF,CAAC,CAAC;YACH,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,YAAY,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EACtC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9C,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAiC;YAC5C,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,UAAU,CAAC,+BAA+B,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACzI,MAAM,GAAG,MAAM,YAAY,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,MAAM;YACZ,IAAI,OAAO;gBAAE,OAAO;YACpB,UAAU,CAAC,MAAM,CACf,MAAM,YAAY,KAAK;gBACrB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,UAAU,CAAC,8CAA8C,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CACvJ,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;KACrB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,gEAAgE,EAChE,yBAAyB,EACzB,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAsBD,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,8BAA8B;QACvC,GAAG,EAAE,SAAS,MAAM,4NAA4N;KACjP,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,KAAK;QACf,qBAAqB,EAAE,KAAK;QAC5B,OAAO,EAAE,SAAS,MAAM,yNAAyN;QACjP,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,qBAAqB,CAAC,MAAoB,EAAE,MAAc;IACjE,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnE,YAAY,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,6BAA6B,CAAC,MAAM,CAAC,CAAC;KACtF,CAAC;AACJ,CAAC;AAkCD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,SAAS,GAAgC;QAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAoB,EAAiC,EAAE,CAAC,CAAC;QAC5E,IAAI;QACJ,MAAM,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QACrE,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,0EAA0E;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,YAAY,KAAK,eAAe,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,iEAAiE;QACjE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpI,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/G,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACrC,IAAI;YACJ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE;YAC3C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,+CAA+C,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,KAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,MAAc;IACxD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,CAAC,GAAG,GAAsF,CAAC;IACjG,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B;QAAE,OAAO,GAAG,CAAC;IACvF,OAAO,IAAI,UAAU,CACnB,GAAG,CAAC,CAAC,OAAO,wGAAwG,EACpH,uCAAuC,EACvC;QACE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC9F,YAAY,EAAE;YACZ,EAAE,MAAM,EAAE,kIAAkI,EAAE;YAC9I,EAAE,MAAM,EAAE,uKAAuK,EAAE;YACnL,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;KACF,CACF,CAAC;AACJ,CAAC"}

package/dist/node/vault-byo-config.d.ts

@@ -0,0 +1,29 @@
+import { VaultKeystore } from "./vault-keystore.js";
+import type { VaultMirrorCredential, VaultMirrorDestination } from "./vault-mirror-config.js";
+/** `byo/<repo_id>.json` — where THIS machine writes a BYO vault's payload objects, and which credential NAME resolves it at use time. */
+export interface VaultByoConfig {
+    version: 1;
+    repo_id: string;
+    destination: VaultMirrorDestination;
+    /** Present only for an `s3` destination — a directory destination needs no credential. */
+    credential?: VaultMirrorCredential;
+    created_at: string;
+    updated_at: string;
+}
+export declare function byoConfigDir(keystore: VaultKeystore): string;
+export declare function byoConfigPath(keystore: VaultKeystore, repoId: string): string;
+/** Read the local BYO write-credential config for one vault, or `null` when none is configured on this machine. */
+export declare function readByoConfig(keystore: VaultKeystore, repoId: string): VaultByoConfig | null;
+/** Every repo id with a local BYO write config on this machine. */
+export declare function listByoConfiguredRepoIds(keystore: VaultKeystore): string[];
+/** Set (create or replace) the local BYO write-credential config for one vault. */
+export declare function saveByoConfig(keystore: VaultKeystore, input: {
+    repo_id: string;
+    destination: VaultMirrorDestination;
+    credential?: VaultMirrorCredential;
+}, now?: () => Date): VaultByoConfig;
+/** Remove the local BYO write-credential config for one vault. Never touches the customer bucket's own bytes — this only stops THIS machine from writing/reading it as the vault's primary destination. */
+export declare function removeByoConfig(keystore: VaultKeystore, repoId: string): {
+    removed: boolean;
+};
+//# sourceMappingURL=vault-byo-config.d.ts.map

package/dist/node/vault-byo-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-byo-config.d.ts","sourceRoot":"","sources":["../../src/node/vault-byo-config.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,aAAa,EAAyC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAM9F,yIAAyI;AACzI,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,sBAAsB,CAAC;IACpC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,mHAAmH;AACnH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAa5F;AAED,mEAAmE;AACnE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,EAAE,CAQ1E;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAC;IAAC,UAAU,CAAC,EAAE,qBAAqB,CAAA;CAAE,EACnG,GAAG,GAAE,MAAM,IAAuB,GACjC,cAAc,CAehB;AAED,2MAA2M;AAC3M,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAS7F"}

package/dist/node/{gitvault-byo-config.js → vault-byo-config.js}

@@ -1,33 +1,33 @@
 /**
- * gitvault-byo-primary-bucket — local per-vault BYO credential config
- * (design D2, task 3.1/3.2). Parallels `gitvault-mirror-config.ts` exactly,
+ * vault-byo-primary-bucket — local per-vault BYO credential config
+ * (design D2, task 3.1/3.2). Parallels `vault-mirror-config.ts` exactly,
  * on purpose: same file shape, same "beside the keystore, never in
  * `run402.config.json`, never a raw secret value" reasoning.
  *
  * A BYO vault's `storage_profile`/`byo_destination` are recorded on the
  * GATEWAY's vault record (the destination ADDRESS only — see
- * `gitvault-creation-journal.ts`'s allocation request). This file carries
+ * `vault-creation-journal.ts`'s allocation request). This file carries
  * the ONE thing that must stay purely local, per D2: the credential NAME
  * (an AWS profile, or the ambient environment chain) that resolves to the
  * customer bucket's actual secret at USE time — resolved by
- * `gitvault-mirror-backend.ts`, never read or cached here, never
+ * `vault-mirror-backend.ts`, never read or cached here, never
  * transmitted to run402 in any request. The destination's `region`/
  * `endpoint` are ALSO local-only (the server-side address string carries
- * neither), so this config persists the full `GitvaultMirrorDestination`,
+ * neither), so this config persists the full `VaultMirrorDestination`,
  * not just the credential.
  *
  * Written once by `repos create --byo` (or, for a fresh machine re-linking
- * to an already-BYO vault, `Gitvault.byoConfigSet`), keyed by `repo_id` —
+ * to an already-BYO vault, `Repos.byoConfigSet`), keyed by `repo_id` —
  * `repo_id` only exists AFTER allocation, so this file's existence for a
  * given repo is itself the local "this machine can write this vault's
- * payload objects directly" fact `gitvault-mirror.ts`'s dual-push hook and
- * `gitvault-degraded-read.ts`'s fallback resolution both gate on.
+ * payload objects directly" fact `vault-mirror.ts`'s dual-push hook and
+ * `vault-degraded-read.ts`'s fallback resolution both gate on.
  */
 import { existsSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { LocalError } from "../errors.js";
-import { GITVAULT_SRC_RE } from "../namespaces/gitvault.crypto.js";
-import { readFileNoFollow, writeFileAtomic0600 } from "./gitvault-keystore.js";
+import { VAULT_SRC_RE } from "../namespaces/vault.crypto.js";
+import { readFileNoFollow, writeFileAtomic0600 } from "./vault-keystore.js";
 function fail(code, message, context, details, nextActions) {
     throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
 }
@@ -35,8 +35,8 @@ export function byoConfigDir(keystore) {
     return join(keystore.rootDir, "byo");
 }
 export function byoConfigPath(keystore, repoId) {
-    if (!GITVAULT_SRC_RE.test(repoId))
-        fail("GITVAULT_BAD_REPO_ID", `not a src_ id: ${repoId}`, "resolving gitvault byo config path");
+    if (!VAULT_SRC_RE.test(repoId))
+        fail("VAULT_BAD_REPO_ID", `not a src_ id: ${repoId}`, "resolving vault byo config path");
     return join(byoConfigDir(keystore), `${repoId}.json`);
 }
 /** Read the local BYO write-credential config for one vault, or `null` when none is configured on this machine. */
@@ -49,10 +49,10 @@ export function readByoConfig(keystore, repoId) {
         parsed = JSON.parse(text);
     }
     catch (e) {
-        fail("GITVAULT_BYO_CONFIG_CORRUPT", `byo config for ${repoId} is not valid JSON: ${e.message}`, "reading gitvault byo config", { repo_id: repoId });
+        fail("VAULT_BYO_CONFIG_CORRUPT", `byo config for ${repoId} is not valid JSON: ${e.message}`, "reading vault byo config", { repo_id: repoId });
     }
     if (parsed.version !== 1 || parsed.repo_id !== repoId || !parsed.destination) {
-        fail("GITVAULT_BYO_CONFIG_CORRUPT", `byo config for ${repoId} is not a version-1 gitvault byo config`, "reading gitvault byo config", { repo_id: repoId });
+        fail("VAULT_BYO_CONFIG_CORRUPT", `byo config for ${repoId} is not a version-1 vault byo config`, "reading vault byo config", { repo_id: repoId });
     }
     return parsed;
 }
@@ -64,13 +64,13 @@ export function listByoConfiguredRepoIds(keystore) {
     return readdirSync(dir)
         .filter((n) => n.endsWith(".json"))
         .map((n) => n.slice(0, -5))
-        .filter((id) => GITVAULT_SRC_RE.test(id))
+        .filter((id) => VAULT_SRC_RE.test(id))
         .sort();
 }
 /** Set (create or replace) the local BYO write-credential config for one vault. */
 export function saveByoConfig(keystore, input, now = () => new Date()) {
     if (input.destination.kind === "s3" && !input.credential) {
-        fail("GITVAULT_MIRROR_CREDENTIAL_REQUIRED", "an s3 byo destination needs a credential — pass --profile <name> or --ambient", "configuring gitvault byo credential");
+        fail("VAULT_MIRROR_CREDENTIAL_REQUIRED", "an s3 byo destination needs a credential — pass --profile <name> or --ambient", "configuring vault byo credential");
     }
     const existing = readByoConfig(keystore, input.repo_id);
     const full = {
@@ -93,8 +93,8 @@ export function removeByoConfig(keystore, repoId) {
         unlinkSync(path);
     }
     catch (e) {
-        fail("GITVAULT_BYO_CONFIG_REMOVE_FAILED", `could not remove byo config for ${repoId}: ${e.message}`, "removing gitvault byo config", { repo_id: repoId });
+        fail("VAULT_BYO_CONFIG_REMOVE_FAILED", `could not remove byo config for ${repoId}: ${e.message}`, "removing vault byo config", { repo_id: repoId });
     }
     return { removed: true };
 }
-//# sourceMappingURL=gitvault-byo-config.js.map
+//# sourceMappingURL=vault-byo-config.js.map

package/dist/node/vault-byo-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-byo-config.js","sourceRoot":"","sources":["../../src/node/vault-byo-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAiB,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG3F,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,QAAuB;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAuB,EAAE,MAAc;IACnE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,aAAa,CAAC,QAAuB,EAAE,MAAc;IACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,0BAA0B,EAAE,kBAAkB,MAAM,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3J,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7E,IAAI,CAAC,0BAA0B,EAAE,kBAAkB,MAAM,sCAAsC,EAAE,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,wBAAwB,CAAC,QAAuB;IAC9D,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACrC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAC3B,QAAuB,EACvB,KAAmG,EACnG,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACzD,IAAI,CAAC,kCAAkC,EAAE,+EAA+E,EAAE,kCAAkC,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAmB;QAC3B,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;QACvD,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;KAChC,CAAC;IACF,mBAAmB,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2MAA2M;AAC3M,MAAM,UAAU,eAAe,CAAC,QAAuB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,EAAE,mCAAmC,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/node/vault-byo-probe.d.ts

@@ -0,0 +1,20 @@
+import type { VaultBucketProbeResult } from "./vault-mirror-backend.js";
+import type { VaultMirrorCredential, VaultMirrorDestination } from "./vault-mirror-config.js";
+/**
+ * The failing properties, named — never a bundled "the probe failed". Every
+ * entry maps 1:1 to one of {@link VaultBucketProbeResult}'s three
+ * booleans, so a caller (or a test) can assert on exactly what broke.
+ */
+export declare function vaultByoProbeFailingProperties(result: VaultBucketProbeResult): string[];
+/**
+ * `repos create --byo`'s pre-allocation gate: open a root-scoped backend at
+ * `destination` (no `repo_id` — the probe never collides with any vault's
+ * own `source/<repo_id>/` prefix, since it writes under `_byo-probe/`
+ * instead) and run {@link VaultMirrorBackend.probeWritePolicy}. A failed
+ * property (or a thrown transport error) refuses with
+ * `VAULT_BYO_BUCKET_PROBE_FAILED`, naming exactly which propert(y/ies)
+ * failed and the underlying fact — the caller MUST NOT proceed to
+ * allocation on a failed probe.
+ */
+export declare function probeVaultByoDestination(destination: VaultMirrorDestination, credential?: VaultMirrorCredential): Promise<VaultBucketProbeResult>;
+//# sourceMappingURL=vault-byo-probe.d.ts.map

package/dist/node/vault-byo-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-byo-probe.d.ts","sourceRoot":"","sources":["../../src/node/vault-byo-probe.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAO9F;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMvF;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA0BvJ"}

package/dist/node/vault-byo-probe.js

@@ -0,0 +1,57 @@
+/**
+ * vault-byo-primary-bucket — the allocation-time bucket-policy probe
+ * (design D6, task 3.1). Runs BEFORE the allocation request ever reaches
+ * the gateway, against the DESTINATION's own root (no `repo_id` exists yet
+ * — allocation is what mints one) — so a failed probe means "no vault
+ * half-exists", never a partially-created one.
+ *
+ * Reuses the shipped mirror backend's SigV4 client — no second S3 client.
+ */
+import { LocalError } from "../errors.js";
+import { openVaultDestinationBackend } from "./vault-mirror-backend.js";
+import { formatMirrorDestination } from "./vault-mirror-config.js";
+function fail(code, message, context, details, nextActions) {
+    throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
+}
+/**
+ * The failing properties, named — never a bundled "the probe failed". Every
+ * entry maps 1:1 to one of {@link VaultBucketProbeResult}'s three
+ * booleans, so a caller (or a test) can assert on exactly what broke.
+ */
+export function vaultByoProbeFailingProperties(result) {
+    const failing = [];
+    if (!result.write_permitted)
+        failing.push("write_permitted");
+    if (!result.create_only_honored)
+        failing.push("create_only_honored");
+    if (!result.versioning_off)
+        failing.push("versioning_off");
+    return failing;
+}
+/**
+ * `repos create --byo`'s pre-allocation gate: open a root-scoped backend at
+ * `destination` (no `repo_id` — the probe never collides with any vault's
+ * own `source/<repo_id>/` prefix, since it writes under `_byo-probe/`
+ * instead) and run {@link VaultMirrorBackend.probeWritePolicy}. A failed
+ * property (or a thrown transport error) refuses with
+ * `VAULT_BYO_BUCKET_PROBE_FAILED`, naming exactly which propert(y/ies)
+ * failed and the underlying fact — the caller MUST NOT proceed to
+ * allocation on a failed probe.
+ */
+export async function probeVaultByoDestination(destination, credential) {
+    const backend = openVaultDestinationBackend(destination, credential);
+    let result;
+    try {
+        result = await backend.probeWritePolicy();
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        fail("VAULT_BYO_BUCKET_PROBE_FAILED", `the bucket-policy probe against ${formatMirrorDestination(destination)} failed before any property could be confirmed: ${message}`, "probing the BYO destination before allocation", { destination: formatMirrorDestination(destination), failing_properties: ["write_permitted", "create_only_honored", "versioning_off"] }, [{ action: "confirm the destination and credential are correct, and that the bucket policy grants PutObject + GetBucketVersioning to this credential, then retry" }]);
+    }
+    const failing = vaultByoProbeFailingProperties(result);
+    if (failing.length > 0) {
+        fail("VAULT_BYO_BUCKET_PROBE_FAILED", `${formatMirrorDestination(destination)} does not satisfy the BYO bucket-policy profile (versioning disabled, create-only if-none-match writes honored, write permitted) — failing: ${failing.join(", ")}${result.detail ? ` (${result.detail})` : ""}`, "probing the BYO destination before allocation", { destination: formatMirrorDestination(destination), failing_properties: failing, probe: result }, [{ action: "disable bucket versioning, confirm the bucket policy enforces s3:if-none-match create-only writes, and confirm PutObject is permitted for this credential, then retry" }]);
+    }
+    return result;
+}
+//# sourceMappingURL=vault-byo-probe.js.map

package/dist/node/vault-byo-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-byo-probe.js","sourceRoot":"","sources":["../../src/node/vault-byo-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAA8B;IAC3E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmC,EAAE,UAAkC;IACpH,MAAM,OAAO,GAAG,2BAA2B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CACF,+BAA+B,EAC/B,mCAAmC,uBAAuB,CAAC,WAAW,CAAC,mDAAmD,OAAO,EAAE,EACnI,+CAA+C,EAC/C,EAAE,WAAW,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,EAAE,EACvI,CAAC,EAAE,MAAM,EAAE,sJAAsJ,EAAE,CAAC,CACrK,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CACF,+BAA+B,EAC/B,GAAG,uBAAuB,CAAC,WAAW,CAAC,+IAA+I,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EACvP,+CAA+C,EAC/C,EAAE,WAAW,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EACjG,CAAC,EAAE,MAAM,EAAE,uKAAuK,EAAE,CAAC,CACtL,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}