@run402/sdk 4.95.0 → 4.97.0

package/dist/namespaces/{gitvault.crypto.js → vault.crypto.js}

@@ -1,9 +1,9 @@
 /**
- * gitvault — `r402s/v0` crypto core (protocol rev 40, §1 + §2; task 5.1).
+ * vault — `r402s/v0` crypto core (protocol rev 40, §1 + §2; task 5.1).
  *
  * Pure, isomorphic (WebCrypto + noble + `@hpke/core`), no I/O. Everything
  * byte-level the protocol pins lives here ONCE and is replayed against the
- * frozen vector set (`gitvault.crypto.test.ts`):
+ * frozen vector set (`vault.crypto.test.ts`):
  *
  *   - JCS (RFC 8785) for the no-JSON-numbers profile + the strict-parse profile
  *   - the two hash rules: stored bytes (JCS INCLUDING `signature`) and the
@@ -39,65 +39,65 @@ import { Chacha20Poly1305 } from "@hpke/chacha20poly1305";
 import { LocalError } from "../errors.js";
 // ─── Constants ───────────────────────────────────────────────────────────────
 /** Wire format tag (retained by decision D181 across the product rename). */
-export const GITVAULT_FORMAT = "r402s/v0";
+export const VAULT_FORMAT = "r402s/v0";
 /** The one V0 cryptographic suite. */
-export const GITVAULT_SUITE = "r402s-1";
+export const VAULT_SUITE = "r402s-1";
 /** Frame magic, bytes 0–5 of every encrypted object. */
-export const GITVAULT_FRAME_MAGIC = "R402S0";
+export const VAULT_FRAME_MAGIC = "R402S0";
 /** Frame suite byte (byte 6) and its two-char AAD spelling. */
-export const GITVAULT_FRAME_SUITE_BYTE = 0x01;
-export const GITVAULT_FRAME_SUITE_ID = "01";
+export const VAULT_FRAME_SUITE_BYTE = 0x01;
+export const VAULT_FRAME_SUITE_ID = "01";
 /** Protocol §2: max plaintext per encrypted object (256 MiB). */
-export const GITVAULT_MAX_PLAINTEXT_BYTES = 256 * 1024 * 1024;
+export const VAULT_MAX_PLAINTEXT_BYTES = 256 * 1024 * 1024;
 /** The genesis generation / epoch constants (schema consts). */
-export const GITVAULT_GENESIS_GENERATION = "0000000000000000";
-export const GITVAULT_GENESIS_EPOCH = "0000000000000001";
+export const VAULT_GENESIS_GENERATION = "0000000000000000";
+export const VAULT_GENESIS_EPOCH = "0000000000000001";
 /** HPKE `info` label for `key_envelope` (D188). */
-export const GITVAULT_ENVELOPE_INFO_LABEL = "r402s/v0/envelope";
+export const VAULT_ENVELOPE_INFO_LABEL = "r402s/v0/envelope";
 /**
  * The V0-A terminal-loss sentence — protocol §0 / client-surface spec. Doctor
  * and status surfaces MUST state it verbatim while V0-A is current. Do not
  * paraphrase; the wording is a reviewed product commitment.
  */
-export const GITVAULT_TERMINAL_LOSS_STATEMENT = "whole-machine or whole-keystore loss is terminal for vault history until human envelopes ship";
+export const VAULT_TERMINAL_LOSS_STATEMENT = "whole-machine or whole-keystore loss is terminal for vault history until human envelopes ship";
 /**
  * The protocol's durability sentence — the keystore-qualified half of the
  * terminal-loss statement, reusable on its own. It is TRUE regardless of how
- * many principals cover a vault (unlike {@link GITVAULT_TERMINAL_LOSS_STATEMENT},
+ * many principals cover a vault (unlike {@link VAULT_TERMINAL_LOSS_STATEMENT},
  * which is specifically the single-principal V0-A claim), so a caller that has
  * locally proven a vault carries >= 2 covering recipients prints this sentence
- * instead of the terminal-loss one — see `Gitvault.status()`'s `covering_recipients`
+ * instead of the terminal-loss one — see `Repos.status()`'s `covering_recipients`
  * field. Never paraphrase; the wording is a reviewed product commitment.
  */
-export const GITVAULT_DURABILITY_STATEMENT = "The vault protects source history from host-side loss while a principal keystore survives.";
+export const VAULT_DURABILITY_STATEMENT = "The vault protects source history from host-side loss while a principal keystore survives.";
 /** Protocol §0 sentence in full, as `doctor`/`status` print it. */
-export const GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT = "In V0-A, whole-machine or whole-keystore loss is terminal for vault history (VAULT_UNRECOVERABLE) until human envelopes ship. " +
-    `${GITVAULT_DURABILITY_STATEMENT} ` +
+export const VAULT_TERMINAL_LOSS_DOCTOR_TEXT = "In V0-A, whole-machine or whole-keystore loss is terminal for vault history (VAULT_UNRECOVERABLE) until human envelopes ship. " +
+    `${VAULT_DURABILITY_STATEMENT} ` +
     "The remaining paths are the platform's custodial restore of deployed artifacts (the deploy lane's CAS) and org/infra recovery; " +
     "a recovery receipt authenticates a genesis — it cannot decrypt anything.";
 /**
- * gitvault-mirror-and-recover (design D8) — the two honesty statements. Both
+ * vault-mirror-and-recover (design D8) — the two honesty statements. Both
  * appear VERBATIM wherever mirror status or recovery success is shown (mirror
  * `status`/`sync`, `recover`, keyless `mirror verify`), same voice and
- * mechanism as {@link GITVAULT_TERMINAL_LOSS_STATEMENT} above. Never
+ * mechanism as {@link VAULT_TERMINAL_LOSS_STATEMENT} above. Never
  * paraphrased — the §6.4 honesty posture is a reviewed product commitment.
  */
-export const GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT = "this recovery proves validity, never freshness — a mirror (or the vault itself) can only tell you the newest generation it happens to hold, never that a newer one does not exist elsewhere";
+export const VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT = "this recovery proves validity, never freshness — a mirror (or the vault itself) can only tell you the newest generation it happens to hold, never that a newer one does not exist elsewhere";
 /** The mirror does not change the V0 terminal-loss sentence: it is durability, not a second key. */
-export const GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT = "a mirror without the principal keystore (or an equivalent key) recovers nothing — mirroring ciphertext does not create a second key, and the V0 terminal-loss sentence is unchanged";
+export const VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT = "a mirror without the principal keystore (or an equivalent key) recovers nothing — mirroring ciphertext does not create a second key, and the V0 terminal-loss sentence is unchanged";
 /**
- * gitvault-mirror-default — the recommended-default framing, stated the same
+ * vault-mirror-default — the recommended-default framing, stated the same
  * way everywhere (the copy gate pins the doc surfaces to it). "Replicated"
  * describes the platform's storage substrate (S3 multi-AZ redundancy), never
  * a second run402 service; the customer-owned mirror is the only copy outside
  * run402's custody, and — per the two honesty statements above — it proves
  * validity, never freshness, and recovers nothing without the keystore.
  */
-export const GITVAULT_MIRROR_THREE_COPIES_STATEMENT = "the recommended shape is three copies: your working clone, the platform's replicated vault, and a mirror in storage you own";
+export const VAULT_MIRROR_THREE_COPIES_STATEMENT = "the recommended shape is three copies: your working clone, the platform's replicated vault, and a mirror in storage you own";
 /**
- * gitvault-byo-primary-bucket (design D4) — the degraded-read mechanism
+ * vault-byo-primary-bucket (design D4) — the degraded-read mechanism
  * sentence: the invariant part of the ONE stderr line a degraded chain/
- * payload read prints (`formatGitvaultDegradedReadNote`, `gitvault-node-
+ * payload read prints (`formatVaultDegradedReadNote`, `vault-node-
  * degraded-read.ts`). Mechanism-only, per the copy rules — never a
  * confidentiality claim: it names WHY (run402 is unreachable), restates
  * validity-not-freshness in brief, and states that a write still needs the
@@ -107,84 +107,84 @@ export const GITVAULT_MIRROR_THREE_COPIES_STATEMENT = "the recommended shape is
  * the constant. Never paraphrase — same reviewed-product-commitment voice
  * as the other statements in this file.
  */
-export const GITVAULT_DEGRADED_READ_STATEMENT = "run402 is unreachable — this read is served from your mirror; it proves validity, not freshness; a later push still requires the gateway";
+export const VAULT_DEGRADED_READ_STATEMENT = "run402 is unreachable — this read is served from your mirror; it proves validity, not freshness; a later push still requires the gateway";
 /**
- * gitvault-mirror-default — the `vault_unmirrored` standing finding, worded to
+ * vault-mirror-default — the `vault_unmirrored` standing finding, worded to
  * stay true in BOTH pre-clear states (no mirror configured at all, and a
  * configured mirror with no successful write/sync yet — the finding clears on
  * the first successful mirror write or sync, never on configuration alone).
  * Informational, never blocking; computed client-side only, so the gateway
  * never learns whether a mirror exists.
  */
-export const GITVAULT_UNMIRRORED_FINDING_STATEMENT = `this vault has no customer-held mirror copy yet — ${GITVAULT_MIRROR_THREE_COPIES_STATEMENT}; until a first mirror write or sync succeeds, the third copy does not exist`;
+export const VAULT_UNMIRRORED_FINDING_STATEMENT = `this vault has no customer-held mirror copy yet — ${VAULT_MIRROR_THREE_COPIES_STATEMENT}; until a first mirror write or sync succeeds, the third copy does not exist`;
 /**
- * gitvault-mirror-default — the one-liner `repos create` prints beside the
+ * vault-mirror-default — the one-liner `repos create` prints beside the
  * recovery receipt: the two things worth doing in the first minute, stated in
  * the first minute. Deliberately custody-scoped ("stays in your custody"),
  * never a recoverability claim — the terminal-loss statement printed beside it
  * carries the key half.
  */
-export const GITVAULT_MIRROR_SETUP_HINT = "recommended: 'run402 repos mirror <destination>' (an s3:// bucket or a local directory) starts the customer-owned mirror — every later snapshot dual-pushes to it automatically, and it is the copy that stays in your custody";
+export const VAULT_MIRROR_SETUP_HINT = "recommended: 'run402 repos mirror <destination>' (an s3:// bucket or a local directory) starts the customer-owned mirror — every later capture is mirrored to it automatically, and it is the copy that stays in your custody";
 /**
- * gitvault-byo-primary-bucket (proposal, the ratified D + chain-copy rung-3
+ * vault-byo-primary-bucket (proposal, the ratified D + chain-copy rung-3
  * headline; design D10 — verified from network topology once the client's
  * BYO write path ships, not by this sentence alone). Structurally scoped to
  * `storage_profile:"byo"` ONLY — the sentence is FALSE for a managed vault
  * (payload ciphertext IS client-written to run402's own bucket there), so
  * every caller MUST gate it behind a BYO-profile check before printing it
- * and MUST NEVER use it as a blanket claim describing gitvault in general.
+ * and MUST NEVER use it as a blanket claim describing vault in general.
  * INERT as of this fold (Phase 1, protocol coordination only) — nothing
  * emits it yet; Phase 2/3 wire the allocation/doctor/`repos view` surfaces
  * that print it once `storage_profile:"byo"` is a real, allocatable vault
  * state. Never paraphrase — the wording is a reviewed product commitment.
  */
-export const GITVAULT_BYO_HEADLINE_STATEMENT = "your source ciphertext never touches our infrastructure — not even encrypted";
+export const VAULT_BYO_HEADLINE_STATEMENT = "your source ciphertext never touches our infrastructure — not even encrypted";
 /**
- * gitvault-byo-primary-bucket (design D7) — the allocation-time no-payload-copy
+ * vault-byo-primary-bucket (design D7) — the allocation-time no-payload-copy
  * disclosure a BYO `repos create` prints, unconditionally and independent of
  * mirror status: unlike a managed vault (where the platform's own bucket is
  * an extra copy beside the customer's clone), a BYO vault's primary bucket is
  * the ONLY payload copy from the moment it is allocated — run402 holds the
  * small signed chain only, never the payload. Distinct from
- * {@link GITVAULT_BYO_UNMIRRORED_REMEDY_STATEMENT} below, which is about a
+ * {@link VAULT_BYO_UNMIRRORED_REMEDY_STATEMENT} below, which is about a
  * missing SECOND customer-held copy on top of this primary one. INERT as of
  * this fold — Phase 2/3 wire the surfaces that print it. Never paraphrase.
  */
-export const GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT = "run402 holds no payload copy of a BYO vault — only the small signed chain; your primary bucket is the sole copy of your source until you add a second customer-held location";
+export const VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT = "run402 holds no payload copy of a BYO vault — only the small signed chain; your primary bucket is the sole copy of your source until you add a second customer-held location";
 /**
- * gitvault-byo-primary-bucket (design D7) — the BYO variant of the
- * `vault_unmirrored` finding's remedy (gitvault-mirror-default): for a
+ * vault-byo-primary-bucket (design D7) — the BYO variant of the
+ * `vault_unmirrored` finding's remedy (vault-mirror-default): for a
  * managed vault the remedy is an ADDITIONAL mirror beside the platform's own
- * replicated copy ({@link GITVAULT_MIRROR_SETUP_HINT}); for a BYO vault the
+ * replicated copy ({@link VAULT_MIRROR_SETUP_HINT}); for a BYO vault the
  * platform holds no payload copy to fall back on
- * ({@link GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}), so the remedy names a
+ * ({@link VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}), so the remedy names a
  * SECOND customer-held location as the only additional copy available — the
  * ordinary `repos mirror` machinery works unchanged against a different
  * destination (design D7). The `vault_unmirrored` finding itself still
  * applies to BYO vaults; only this remedy half is BYO-specific. INERT as of
  * this fold — Phase 2/3 wire the surfaces that print it. Never paraphrase.
  */
-export const GITVAULT_BYO_UNMIRRORED_REMEDY_STATEMENT = "add a second customer-held location: 'run402 repos mirror <destination>' works unchanged against a different destination — for a BYO vault this is your only additional copy, since run402 holds no payload copy of its own";
+export const VAULT_BYO_UNMIRRORED_REMEDY_STATEMENT = "add a second customer-held location: 'run402 repos mirror <destination>' works unchanged against a different destination — for a BYO vault this is your only additional copy, since run402 holds no payload copy of its own";
 const FRAME_NONCE_BYTES = 24;
 const FRAME_HEADER_BYTES = 6 + 1 + FRAME_NONCE_BYTES;
 const AEAD_TAG_BYTES = 16;
 // ─── Scalar grammars (common.json) ───────────────────────────────────────────
-export const GITVAULT_HEX16_RE = /^[0-9a-f]{16}$/;
-export const GITVAULT_HEX32_RE = /^[0-9a-f]{32}$/;
-export const GITVAULT_SHA256_RE = /^[0-9a-f]{64}$/;
-export const GITVAULT_OID40_RE = /^[0-9a-f]{40}$/;
-export const GITVAULT_VK_RE = /^vk_[0-9a-f]{32}$/;
-export const GITVAULT_EK_RE = /^ek_[0-9a-f]{32}$/;
-export const GITVAULT_SRC_RE = /^src_[0-9a-f]{32}$/;
-export const GITVAULT_SERVICE_KEY_ID_RE = /^sk_[0-9a-z-]{4,64}$/;
-export const GITVAULT_SIZE_BYTES_RE = /^(0|[1-9][0-9]{0,14})$/;
+export const VAULT_HEX16_RE = /^[0-9a-f]{16}$/;
+export const VAULT_HEX32_RE = /^[0-9a-f]{32}$/;
+export const VAULT_SHA256_RE = /^[0-9a-f]{64}$/;
+export const VAULT_OID40_RE = /^[0-9a-f]{40}$/;
+export const VAULT_VK_RE = /^vk_[0-9a-f]{32}$/;
+export const VAULT_EK_RE = /^ek_[0-9a-f]{32}$/;
+export const VAULT_SRC_RE = /^src_[0-9a-f]{32}$/;
+export const VAULT_SERVICE_KEY_ID_RE = /^sk_[0-9a-z-]{4,64}$/;
+export const VAULT_SIZE_BYTES_RE = /^(0|[1-9][0-9]{0,14})$/;
 /** 32 bytes base64url: 43 chars, final char in the 16-value padding class. */
-export const GITVAULT_B64U_32_RE = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+export const VAULT_B64U_32_RE = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
 /** 64 bytes base64url: 86 chars, final char ∈ {A,Q,g,w}. */
-export const GITVAULT_B64U_64_RE = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+export const VAULT_B64U_64_RE = /^[A-Za-z0-9_-]{85}[AQgw]$/;
 /** The HPKE-sealed K_repo: 48 bytes = exactly 64 base64url chars. */
-export const GITVAULT_HPKE_CT_RE = /^[A-Za-z0-9_-]{64}$/;
-export const GITVAULT_TIMESTAMP_RE = /^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$/;
+export const VAULT_HPKE_CT_RE = /^[A-Za-z0-9_-]{64}$/;
+export const VAULT_TIMESTAMP_RE = /^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$/;
 function fail(code, message, context, details) {
     throw new LocalError(message, context, { code, details });
 }
@@ -199,10 +199,10 @@ export function isCanonicalBase64url(value) {
         return false;
     }
 }
-/** Decode canonical base64url or throw (`GITVAULT_NONCANONICAL_BASE64URL`). */
+/** Decode canonical base64url or throw (`VAULT_NONCANONICAL_BASE64URL`). */
 export function fromBase64url(value, field = "value") {
     if (!isCanonicalBase64url(value)) {
-        fail("GITVAULT_NONCANONICAL_BASE64URL", `${field} is not canonical base64url`, "decoding r402s/v0 scalar", { field });
+        fail("VAULT_NONCANONICAL_BASE64URL", `${field} is not canonical base64url`, "decoding r402s/v0 scalar", { field });
     }
     return base64urlnopad.decode(value);
 }
@@ -210,8 +210,8 @@ export function toBase64url(bytes) {
     return base64urlnopad.encode(bytes);
 }
 /** RFC 3339 UTC ms `Z` with semantic calendar validation (D187: `2026-02-31` and a non-leap Feb 29 are rejects). */
-export function isValidGitvaultTimestamp(value) {
-    if (!GITVAULT_TIMESTAMP_RE.test(value))
+export function isValidVaultTimestamp(value) {
+    if (!VAULT_TIMESTAMP_RE.test(value))
         return false;
     const year = Number(value.slice(0, 4));
     const month = Number(value.slice(5, 7));
@@ -221,7 +221,7 @@ export function isValidGitvaultTimestamp(value) {
     return day <= daysInMonth;
 }
 /** Format a Date as the protocol timestamp grammar (RFC 3339 UTC, milliseconds, `Z`). */
-export function formatGitvaultTimestamp(date = new Date()) {
+export function formatVaultTimestamp(date = new Date()) {
     return date.toISOString();
 }
 // ─── Encoding helpers ────────────────────────────────────────────────────────
@@ -242,11 +242,11 @@ let hashBackend = null;
  * SDK-INTERNAL (underscore-exported so the byte-equality suite can swap
  * backends). Installing `null` restores the `@noble` default.
  */
-export function _setGitvaultHashBackend(backend) {
+export function _setVaultHashBackend(backend) {
     hashBackend = backend;
 }
 /** SDK-INTERNAL: which hash backend is live. The isomorphic-entry test asserts `null`. */
-export function _gitvaultHashBackend() {
+export function _vaultHashBackend() {
     return hashBackend;
 }
 export function sha256Hex(bytes) {
@@ -261,7 +261,7 @@ export function randomBytes(length) {
     return out;
 }
 /** A fresh `<prefix>_<32 lowercase hex>` id (protocol §1: ids are CSPRNG). */
-export function newGitvaultId(prefix) {
+export function newVaultId(prefix) {
     return `${prefix}_${bytesToHex(randomBytes(16))}`;
 }
 /** A fresh 32-lowercase-hex scalar (client_creation_id, capture_id, …). */
@@ -273,7 +273,7 @@ function assertProfileValue(value, path) {
     if (value === null || typeof value === "string" || typeof value === "boolean")
         return;
     if (typeof value === "number" || typeof value === "bigint") {
-        fail("GITVAULT_JSON_NUMBER", `r402s/v0 profile forbids JSON numbers (at ${path})`, "canonicalizing r402s/v0 object", { path });
+        fail("VAULT_JSON_NUMBER", `r402s/v0 profile forbids JSON numbers (at ${path})`, "canonicalizing r402s/v0 object", { path });
     }
     if (Array.isArray(value)) {
         value.forEach((entry, i) => assertProfileValue(entry, `${path}[${i}]`));
@@ -282,13 +282,13 @@ function assertProfileValue(value, path) {
     if (typeof value === "object") {
         for (const [key, entry] of Object.entries(value)) {
             if (entry === undefined) {
-                fail("GITVAULT_JSON_UNDEFINED", `undefined member at ${path}.${key}`, "canonicalizing r402s/v0 object", { path: `${path}.${key}` });
+                fail("VAULT_JSON_UNDEFINED", `undefined member at ${path}.${key}`, "canonicalizing r402s/v0 object", { path: `${path}.${key}` });
             }
             assertProfileValue(entry, `${path}.${key}`);
         }
         return;
     }
-    fail("GITVAULT_JSON_UNSUPPORTED", `unsupported value at ${path}`, "canonicalizing r402s/v0 object", { path });
+    fail("VAULT_JSON_UNSUPPORTED", `unsupported value at ${path}`, "canonicalizing r402s/v0 object", { path });
 }
 /** RFC 8785 canonical JSON (no-numbers profile) as UTF-8 bytes. */
 export function jcs(value) {
@@ -305,14 +305,14 @@ function inspectStrict(node, path) {
         case "Document":
             return inspectStrict(node.body, path);
         case "Number":
-            fail("GITVAULT_STRICT_PARSE", `JSON number at ${path}`, "strict-parsing r402s/v0 object", { reason: "json-number", path });
+            fail("VAULT_STRICT_PARSE", `JSON number at ${path}`, "strict-parsing r402s/v0 object", { reason: "json-number", path });
         // eslint-disable-next-line no-fallthrough
         case "Object": {
             const seen = new Set();
             for (const member of node.members) {
                 const name = member.name.type === "String" ? member.name.value : member.name.name;
                 if (seen.has(name)) {
-                    fail("GITVAULT_STRICT_PARSE", `duplicate member ${name} at ${path}`, "strict-parsing r402s/v0 object", { reason: "duplicate-member", path: `${path}.${name}` });
+                    fail("VAULT_STRICT_PARSE", `duplicate member ${name} at ${path}`, "strict-parsing r402s/v0 object", { reason: "duplicate-member", path: `${path}.${name}` });
                 }
                 seen.add(name);
                 inspectStrict(member.value, `${path}.${name}`);
@@ -332,24 +332,24 @@ function inspectStrict(node, path) {
  * (member order, whitespace, escapes). Schema-awareness (unknown members,
  * hex case, scalar lengths) is the caller's job.
  */
-export function parseGitvaultStrict(text) {
+export function parseVaultStrict(text) {
     let ast;
     try {
         ast = parse(text, { mode: "json", allowTrailingCommas: false });
     }
     catch {
-        fail("GITVAULT_STRICT_PARSE", "invalid JSON", "strict-parsing r402s/v0 object", { reason: "invalid-json" });
+        fail("VAULT_STRICT_PARSE", "invalid JSON", "strict-parsing r402s/v0 object", { reason: "invalid-json" });
     }
     inspectStrict(ast, "$");
     const value = evaluate(ast);
     if (jcsString(value) !== text) {
-        fail("GITVAULT_STRICT_PARSE", "text is not canonical JCS", "strict-parsing r402s/v0 object", { reason: "noncanonical-encoding" });
+        fail("VAULT_STRICT_PARSE", "text is not canonical JCS", "strict-parsing r402s/v0 object", { reason: "noncanonical-encoding" });
     }
     return value;
 }
 /** Classify a strict-parse failure (for vector replay + diagnostics). */
-export function gitvaultStrictParseReason(error) {
-    if (error instanceof LocalError && error.code === "GITVAULT_STRICT_PARSE") {
+export function vaultStrictParseReason(error) {
+    if (error instanceof LocalError && error.code === "VAULT_STRICT_PARSE") {
         const details = error.details;
         return details?.reason ?? null;
     }
@@ -375,26 +375,26 @@ function withoutSignature(object) {
  * (`sha256(JCS(descriptor minus signature))`) without reaching into this
  * module's private helper twice under two different names.
  */
-export function gitvaultWithoutSignature(object) {
+export function vaultWithoutSignature(object) {
     return withoutSignature(object);
 }
 /**
  * Signature preimage = `"r402s/v0/" + domain + "\n" + JCS(object without its
- * single top-level signature)`. `domain` is USUALLY a `GitvaultObjectKind`
+ * single top-level signature)`. `domain` is USUALLY a `VaultObjectKind`
  * (an actual `object_kind`-carrying signed object), but the type accepts any
- * string: gitvault-multi-writer rev 47's `writer_acceptance.statement` reuses
+ * string: vault-multi-writer rev 47's `writer_acceptance.statement` reuses
  * this exact byte-construction under the ad-hoc domain
  * `"handoff-writer-accept/v1"` for a sub-object that is NOT itself a
- * `GitvaultSignedObject` (no `object_kind`/`signature` fields of its own —
+ * `VaultSignedObject` (no `object_kind`/`signature` fields of its own —
  * both signatures over it live on the PARENT `writer_acceptance`). Matches
  * the gateway's own `signaturePreimage(objectKind: string, ...)`, which was
  * never narrower than `string` to begin with.
  */
 export function signaturePreimage(domain, objectWithoutSignature) {
     if ("signature" in objectWithoutSignature) {
-        fail("GITVAULT_PREIMAGE_HAS_SIGNATURE", "preimage input must not carry a signature member", "building r402s/v0 signature preimage");
+        fail("VAULT_PREIMAGE_HAS_SIGNATURE", "preimage input must not carry a signature member", "building r402s/v0 signature preimage");
     }
-    return concatBytes(utf8ToBytes(`${GITVAULT_FORMAT}/${domain}\n`), jcs(objectWithoutSignature));
+    return concatBytes(utf8ToBytes(`${VAULT_FORMAT}/${domain}\n`), jcs(objectWithoutSignature));
 }
 // ─── Ed25519 strict (RFC 8032, zip215:false) ─────────────────────────────────
 export function ed25519PublicKey(seed) {
@@ -419,7 +419,7 @@ export function ed25519VerifyStrict(signature, message, publicKey) {
     }
 }
 /** Sign an object under its `object_kind` domain; returns the complete signed object. */
-export function signGitvaultObject(objectWithoutSignature, seed) {
+export function signVaultObject(objectWithoutSignature, seed) {
     const preimage = signaturePreimage(objectWithoutSignature.object_kind, objectWithoutSignature);
     return { ...objectWithoutSignature, signature: toBase64url(ed25519Sign(preimage, seed)) };
 }
@@ -428,12 +428,12 @@ export function signGitvaultObject(objectWithoutSignature, seed) {
  * checked FIRST (an 85-char signature or a 42-char key is a schema reject,
  * never a decode-time surprise), then strict Ed25519 under the object's domain.
  */
-export function verifyGitvaultObject(object, publicKey) {
-    if (typeof object.signature !== "string" || !GITVAULT_B64U_64_RE.test(object.signature) || !isCanonicalBase64url(object.signature))
+export function verifyVaultObject(object, publicKey) {
+    if (typeof object.signature !== "string" || !VAULT_B64U_64_RE.test(object.signature) || !isCanonicalBase64url(object.signature))
         return false;
     let pub;
     if (typeof publicKey === "string") {
-        if (!GITVAULT_B64U_32_RE.test(publicKey) || !isCanonicalBase64url(publicKey))
+        if (!VAULT_B64U_32_RE.test(publicKey) || !isCanonicalBase64url(publicKey))
             return false;
         pub = fromBase64url(publicKey);
     }
@@ -443,10 +443,10 @@ export function verifyGitvaultObject(object, publicKey) {
     const preimage = signaturePreimage(object.object_kind, withoutSignature(object));
     return ed25519VerifyStrict(fromBase64url(object.signature), preimage, pub);
 }
-/** Verify or throw `GITVAULT_SIGNATURE_INVALID`. */
-export function assertGitvaultSignature(object, publicKey, context = "verifying r402s/v0 signature") {
-    if (!verifyGitvaultObject(object, publicKey)) {
-        fail("GITVAULT_SIGNATURE_INVALID", `${object.object_kind} signature does not verify (strict RFC 8032)`, context, { object_kind: object.object_kind });
+/** Verify or throw `VAULT_SIGNATURE_INVALID`. */
+export function assertVaultSignature(object, publicKey, context = "verifying r402s/v0 signature") {
+    if (!verifyVaultObject(object, publicKey)) {
+        fail("VAULT_SIGNATURE_INVALID", `${object.object_kind} signature does not verify (strict RFC 8032)`, context, { object_kind: object.object_kind });
     }
 }
 // ─── Key fingerprints + keypairs ─────────────────────────────────────────────
@@ -464,18 +464,18 @@ export function ekFingerprint(rawPublicKey) {
 }
 export function generateSigningKeypair(seed = randomBytes(32)) {
     if (seed.length !== 32)
-        fail("GITVAULT_BAD_SEED", "Ed25519 seed must be 32 bytes", "generating signing keypair");
+        fail("VAULT_BAD_SEED", "Ed25519 seed must be 32 bytes", "generating signing keypair");
     return { seed, public_key: ed25519PublicKey(seed) };
 }
 export function generateEncryptionKeypair(privateKey = randomBytes(32)) {
     if (privateKey.length !== 32)
-        fail("GITVAULT_BAD_SEED", "X25519 private key must be 32 bytes", "generating encryption keypair");
+        fail("VAULT_BAD_SEED", "X25519 private key must be 32 bytes", "generating encryption keypair");
     return { private_key: privateKey, public_key: x25519.getPublicKey(privateKey) };
 }
 // ─── HKDF: k_obj / K_digest, keyed commitments ──────────────────────────────
 /** `k_obj` info = lp("r402s/v0") ‖ lp(suite) ‖ lp(repo_id) ‖ lp(epoch) ‖ lp(object_kind) ‖ lp(object_id) ‖ lp("L=32"). */
 export function objectKeyInfo(repoId, epoch, objectKind, objectId) {
-    return concatBytes(lp(GITVAULT_FORMAT), lp(GITVAULT_SUITE), lp(repoId), lp(epoch), lp(objectKind), lp(objectId), lp("L=32"));
+    return concatBytes(lp(VAULT_FORMAT), lp(VAULT_SUITE), lp(repoId), lp(epoch), lp(objectKind), lp(objectId), lp("L=32"));
 }
 /** `k_obj = HKDF-SHA-256(ikm=K_repo, salt=∅, info, L=32)`. */
 export function deriveObjectKey(kRepo, repoId, epoch, objectKind, objectId) {
@@ -483,7 +483,7 @@ export function deriveObjectKey(kRepo, repoId, epoch, objectKind, objectId) {
 }
 /** `K_digest` info = lp("r402s/v0") ‖ lp("r402s-1") ‖ lp(repo_id) ‖ lp(epoch) ‖ lp("digest") ‖ lp(label) ‖ lp("L=32"). */
 export function digestKeyInfo(repoId, epoch, label) {
-    return concatBytes(lp(GITVAULT_FORMAT), lp(GITVAULT_SUITE), lp(repoId), lp(epoch), lp("digest"), lp(label), lp("L=32"));
+    return concatBytes(lp(VAULT_FORMAT), lp(VAULT_SUITE), lp(repoId), lp(epoch), lp("digest"), lp(label), lp("L=32"));
 }
 export function deriveDigestKey(kRepo, repoId, epoch, label) {
     return deriveDigestKeyFrom(kRepo, repoId, epoch, label);
@@ -506,8 +506,8 @@ export function keyedCommitment(kDigest, content) {
 export function objectsetContent(oids) {
     const unique = [...new Set(oids)];
     for (const oid of unique) {
-        if (!GITVAULT_OID40_RE.test(oid))
-            fail("GITVAULT_BAD_OID", `not a lowercase 40-hex oid: ${oid}`, "building objectset content");
+        if (!VAULT_OID40_RE.test(oid))
+            fail("VAULT_BAD_OID", `not a lowercase 40-hex oid: ${oid}`, "building objectset content");
     }
     return { oids: unique.sort() };
 }
@@ -518,8 +518,8 @@ export function isCanonicalObjectset(content) {
 }
 /** The `"snapshot_oid"` content shape. */
 export function snapshotOidContent(oid) {
-    if (!GITVAULT_OID40_RE.test(oid))
-        fail("GITVAULT_BAD_OID", `not a lowercase 40-hex oid: ${oid}`, "building snapshot_oid content");
+    if (!VAULT_OID40_RE.test(oid))
+        fail("VAULT_BAD_OID", `not a lowercase 40-hex oid: ${oid}`, "building snapshot_oid content");
     return { oid, format: "sha1" };
 }
 // ─── Golden preimages (open-id / open-binding) ──────────────────────────────
@@ -534,7 +534,7 @@ export function openBindingPreimage(clientOpenId, baseHeadSha256, priorCheckpoin
 // ─── AEAD frame (XChaCha20-Poly1305) ────────────────────────────────────────
 /** The seven-member frame AAD, as the object JCS serializes. */
 export function frameAad(repoId, objectKind, objectId, epoch) {
-    return { repo_id: repoId, object_kind: objectKind, object_id: objectId, epoch, suite: GITVAULT_SUITE, magic: GITVAULT_FRAME_MAGIC, suite_id: GITVAULT_FRAME_SUITE_ID };
+    return { repo_id: repoId, object_kind: objectKind, object_id: objectId, epoch, suite: VAULT_SUITE, magic: VAULT_FRAME_MAGIC, suite_id: VAULT_FRAME_SUITE_ID };
 }
 let aeadBackend = null;
 /**
@@ -542,11 +542,11 @@ let aeadBackend = null;
  * backends). Installing `null` restores the `@noble` default — which is what
  * every runtime without a registration already has.
  */
-export function _setGitvaultAeadBackend(backend) {
+export function _setVaultAeadBackend(backend) {
     aeadBackend = backend;
 }
 /** SDK-INTERNAL: which backend is live. The verifier-lineage test asserts `null`. */
-export function _gitvaultAeadBackend() {
+export function _vaultAeadBackend() {
     return aeadBackend;
 }
 function aeadSeal(key32, nonce24, aad, plaintext) {
@@ -556,7 +556,7 @@ function aeadSeal(key32, nonce24, aad, plaintext) {
 }
 /**
  * Returns the plaintext, or `null` for ANY failure the caller must render as
- * `GITVAULT_AEAD_AUTH_FAILURE` (D4). A backend that throws is treated as an
+ * `VAULT_AEAD_AUTH_FAILURE` (D4). A backend that throws is treated as an
  * auth failure rather than surfacing a second error shape from the same input
  * space — the native path is an optimization, never a new failure mode.
  */
@@ -577,16 +577,16 @@ function aeadOpen(key32, nonce24, aad, ctAndTag) {
  */
 export function sealFrame(input) {
     if (input.k_obj.length !== 32)
-        fail("GITVAULT_BAD_KEY", "k_obj must be 32 bytes", "sealing r402s/v0 frame");
-    if (input.plaintext.length > GITVAULT_MAX_PLAINTEXT_BYTES) {
+        fail("VAULT_BAD_KEY", "k_obj must be 32 bytes", "sealing r402s/v0 frame");
+    if (input.plaintext.length > VAULT_MAX_PLAINTEXT_BYTES) {
         fail("GIT_OBJECT_TOO_LARGE", "plaintext exceeds the 256 MiB per-object cap", "sealing r402s/v0 frame", { size_bytes: String(input.plaintext.length) });
     }
     const nonce = input.nonce ?? randomBytes(FRAME_NONCE_BYTES);
     if (nonce.length !== FRAME_NONCE_BYTES)
-        fail("GITVAULT_BAD_NONCE", "frame nonce must be 24 bytes", "sealing r402s/v0 frame");
+        fail("VAULT_BAD_NONCE", "frame nonce must be 24 bytes", "sealing r402s/v0 frame");
     const aad = jcs(frameAad(input.repo_id, input.object_kind, input.object_id, input.epoch));
     const ct = aeadSeal(input.k_obj, nonce, aad, input.plaintext);
-    const frame = concatBytes(utf8ToBytes(GITVAULT_FRAME_MAGIC), new Uint8Array([GITVAULT_FRAME_SUITE_BYTE]), nonce, ct);
+    const frame = concatBytes(utf8ToBytes(VAULT_FRAME_MAGIC), new Uint8Array([VAULT_FRAME_SUITE_BYTE]), nonce, ct);
     return { frame, ciphertext_sha256: sha256Hex(frame), size_bytes: String(frame.length), nonce_hex: bytesToHex(nonce) };
 }
 /**
@@ -597,14 +597,14 @@ export function sealFrame(input) {
 export function openFrame(input) {
     const { frame } = input;
     if (input.expected_ciphertext_sha256 !== undefined && sha256Hex(frame) !== input.expected_ciphertext_sha256) {
-        fail("GITVAULT_RECEIPT_MISMATCH", "frame bytes do not hash to the receipt's ciphertext_sha256", "opening r402s/v0 frame", { object_id: input.object_id });
+        fail("VAULT_RECEIPT_MISMATCH", "frame bytes do not hash to the receipt's ciphertext_sha256", "opening r402s/v0 frame", { object_id: input.object_id });
     }
     if (frame.length < FRAME_HEADER_BYTES + AEAD_TAG_BYTES) {
-        fail("GITVAULT_FRAME_INVALID", "frame shorter than header + tag", "opening r402s/v0 frame", { object_id: input.object_id });
+        fail("VAULT_FRAME_INVALID", "frame shorter than header + tag", "opening r402s/v0 frame", { object_id: input.object_id });
     }
     const magic = new TextDecoder().decode(frame.subarray(0, 6));
-    if (magic !== GITVAULT_FRAME_MAGIC || frame[6] !== GITVAULT_FRAME_SUITE_BYTE) {
-        fail("GITVAULT_FRAME_INVALID", "frame header magic/suite mismatch", "opening r402s/v0 frame", { object_id: input.object_id });
+    if (magic !== VAULT_FRAME_MAGIC || frame[6] !== VAULT_FRAME_SUITE_BYTE) {
+        fail("VAULT_FRAME_INVALID", "frame header magic/suite mismatch", "opening r402s/v0 frame", { object_id: input.object_id });
     }
     return openFrameWithAad(input.k_obj, frame, jcs(frameAad(input.repo_id, input.object_kind, input.object_id, input.epoch)), input.object_id);
 }
@@ -616,20 +616,20 @@ export function openFrame(input) {
  */
 export function openFrameWithAad(kObj, frame, aad, objectId = "?") {
     if (frame.length < FRAME_HEADER_BYTES + AEAD_TAG_BYTES) {
-        fail("GITVAULT_FRAME_INVALID", "frame shorter than header + tag", "opening r402s/v0 frame", { object_id: objectId });
+        fail("VAULT_FRAME_INVALID", "frame shorter than header + tag", "opening r402s/v0 frame", { object_id: objectId });
     }
     const nonce = frame.subarray(7, FRAME_HEADER_BYTES);
     const ct = frame.subarray(FRAME_HEADER_BYTES);
     const opened = aeadOpen(kObj, nonce, aad, ct);
     if (opened === null) {
-        fail("GITVAULT_AEAD_AUTH_FAILURE", "frame failed AEAD authentication", "opening r402s/v0 frame", { object_id: objectId });
+        fail("VAULT_AEAD_AUTH_FAILURE", "frame failed AEAD authentication", "opening r402s/v0 frame", { object_id: objectId });
     }
     return opened;
 }
 // ─── HPKE (named implementation: @hpke/core + @hpke/chacha20poly1305) ───────
 let hpkeSuite;
 /** The one `r402s-1` HPKE suite: Base mode, DHKEM(X25519,HKDF-SHA256) 0x0020 / HKDF-SHA256 0x0001 / ChaCha20-Poly1305 0x0003. */
-export function gitvaultHpkeSuite() {
+export function vaultHpkeSuite() {
     hpkeSuite ??= new CipherSuite({ kem: new DhkemX25519HkdfSha256(), kdf: new HkdfSha256(), aead: new Chacha20Poly1305() });
     return hpkeSuite;
 }
@@ -640,7 +640,7 @@ function toArrayBuffer(bytes) {
 }
 /** HPKE `info` (D188): lp("r402s/v0/envelope") ‖ lp("r402s-1") ‖ lp(lowerhex(SHA-256(recipient raw X25519 pubkey))) ‖ lp(created_by). */
 export function envelopeInfo(recipientPublicKeyRaw, createdBy) {
-    return concatBytes(lp(GITVAULT_ENVELOPE_INFO_LABEL), lp(GITVAULT_SUITE), lp(sha256Hex(recipientPublicKeyRaw)), lp(createdBy));
+    return concatBytes(lp(VAULT_ENVELOPE_INFO_LABEL), lp(VAULT_SUITE), lp(sha256Hex(recipientPublicKeyRaw)), lp(createdBy));
 }
 /**
  * HPKE AAD (D188, discriminated by `rotation_id` presence — D203, rev 42):
@@ -660,31 +660,31 @@ export function envelopeAad(repoId, epoch, recipientFingerprint, rotationId) {
 }
 /** Single-shot HPKE seal (Base mode) returning `{enc, ct}`. */
 export async function hpkeSeal(input) {
-    const suite = gitvaultHpkeSuite();
+    const suite = vaultHpkeSuite();
     const recipientPublicKey = await suite.kem.deserializePublicKey(toArrayBuffer(input.recipient_public_key));
     const ekm = input.ikm_e ? await suite.kem.deriveKeyPair(toArrayBuffer(input.ikm_e)) : undefined;
     const sender = await suite.createSenderContext({ recipientPublicKey, info: toArrayBuffer(input.info), ...(ekm ? { ekm } : {}) });
     const ct = new Uint8Array(await sender.seal(toArrayBuffer(input.plaintext), toArrayBuffer(input.aad)));
     return { enc: new Uint8Array(sender.enc), ct };
 }
-/** Single-shot HPKE open; any failure is `GITVAULT_HPKE_OPEN_FAILED` (never garbage plaintext). */
+/** Single-shot HPKE open; any failure is `VAULT_HPKE_OPEN_FAILED` (never garbage plaintext). */
 export async function hpkeOpen(input) {
-    const suite = gitvaultHpkeSuite();
+    const suite = vaultHpkeSuite();
     try {
         const recipientKey = await suite.kem.deserializePrivateKey(toArrayBuffer(input.recipient_private_key));
         const recipient = await suite.createRecipientContext({ recipientKey, enc: toArrayBuffer(input.enc), info: toArrayBuffer(input.info) });
         return new Uint8Array(await recipient.open(toArrayBuffer(input.ct), toArrayBuffer(input.aad)));
     }
     catch {
-        fail("GITVAULT_HPKE_OPEN_FAILED", "HPKE open failed — the recipient recovers no key", "opening r402s/v0 key envelope");
+        fail("VAULT_HPKE_OPEN_FAILED", "HPKE open failed — the recipient recovers no key", "opening r402s/v0 key envelope");
     }
 }
 /** Seal + sign a `key_envelope` for one principal; returns the object with its stored-bytes identity + genesis receipt. */
 export async function sealKeyEnvelope(input) {
     if (input.k_repo.length !== 32)
-        fail("GITVAULT_BAD_KEY", "K_repo must be 32 bytes", "sealing r402s/v0 key envelope");
-    if (!isValidGitvaultTimestamp(input.created_at))
-        fail("GITVAULT_BAD_TIMESTAMP", "created_at is not an RFC 3339 UTC ms timestamp", "sealing r402s/v0 key envelope");
+        fail("VAULT_BAD_KEY", "K_repo must be 32 bytes", "sealing r402s/v0 key envelope");
+    if (!isValidVaultTimestamp(input.created_at))
+        fail("VAULT_BAD_TIMESTAMP", "created_at is not an RFC 3339 UTC ms timestamp", "sealing r402s/v0 key envelope");
     const createdBy = vkFingerprint(input.signer.public_key);
     const recipientFingerprint = ekFingerprint(input.recipient_public_key);
     const rotationId = input.rotation_id ?? null;
@@ -696,9 +696,9 @@ export async function sealKeyEnvelope(input) {
         ikm_e: input.ikm_e,
     });
     const unsigned = {
-        format: GITVAULT_FORMAT,
+        format: VAULT_FORMAT,
         object_kind: "key_envelope",
-        suite: GITVAULT_SUITE,
+        suite: VAULT_SUITE,
         repo_id: input.repo_id,
         epoch: input.epoch,
         recipient_kind: "principal",
@@ -709,7 +709,7 @@ export async function sealKeyEnvelope(input) {
         created_at: input.created_at,
         ...(rotationId ? { rotation_id: rotationId } : {}),
     };
-    const envelope = signGitvaultObject(unsigned, input.signer.seed);
+    const envelope = signVaultObject(unsigned, input.signer.seed);
     const bytes = storedBytes(envelope);
     const hash = sha256Hex(bytes);
     return {
@@ -736,13 +736,13 @@ export async function sealKeyEnvelope(input) {
  */
 export async function openKeyEnvelope(input) {
     const env = input.envelope;
-    if (!GITVAULT_HPKE_CT_RE.test(env.ct) || !GITVAULT_B64U_32_RE.test(env.enc) || !isCanonicalBase64url(env.ct) || !isCanonicalBase64url(env.enc)) {
-        fail("GITVAULT_SCHEMA_REJECT", "key_envelope enc/ct are not the exact scalar lengths", "opening r402s/v0 key envelope");
+    if (!VAULT_HPKE_CT_RE.test(env.ct) || !VAULT_B64U_32_RE.test(env.enc) || !isCanonicalBase64url(env.ct) || !isCanonicalBase64url(env.enc)) {
+        fail("VAULT_SCHEMA_REJECT", "key_envelope enc/ct are not the exact scalar lengths", "opening r402s/v0 key envelope");
     }
-    assertGitvaultSignature(env, input.signer_public_key, "opening r402s/v0 key envelope");
+    assertVaultSignature(env, input.signer_public_key, "opening r402s/v0 key envelope");
     const ours = ekFingerprint(input.recipient.public_key);
     if (env.recipient_fingerprint !== ours || env.recipient_kind !== "principal") {
-        fail("GITVAULT_ENVELOPE_NOT_FOR_RECIPIENT", "key_envelope is addressed to another recipient", "opening r402s/v0 key envelope", { recipient_fingerprint: env.recipient_fingerprint });
+        fail("VAULT_ENVELOPE_NOT_FOR_RECIPIENT", "key_envelope is addressed to another recipient", "opening r402s/v0 key envelope", { recipient_fingerprint: env.recipient_fingerprint });
     }
     const kRepo = await hpkeOpen({
         recipient_private_key: input.recipient.private_key,
@@ -752,7 +752,7 @@ export async function openKeyEnvelope(input) {
         ct: fromBase64url(env.ct, "ct"),
     });
     if (kRepo.length !== 32)
-        fail("GITVAULT_HPKE_OPEN_FAILED", "opened plaintext is not a 32-byte K_repo", "opening r402s/v0 key envelope");
+        fail("VAULT_HPKE_OPEN_FAILED", "opened plaintext is not a 32-byte K_repo", "opening r402s/v0 key envelope");
     return kRepo;
 }
 // ─── Epoch rotation — reader side (D193-D203, rev 42) ───────────────────────
@@ -769,7 +769,7 @@ export async function openKeyEnvelope(input) {
 export function parseRotateEpochPayload(head) {
     const t = head.transition;
     if (!t || t.kind !== "rotate_epoch")
-        fail("GITVAULT_NOT_A_ROTATION", `head ${head.generation} does not carry a rotate_epoch transition`, "parsing rotate_epoch_payload");
+        fail("VAULT_NOT_A_ROTATION", `head ${head.generation} does not carry a rotate_epoch transition`, "parsing rotate_epoch_payload");
     if (t.payload_format !== "base64url-jcs")
         fail("CHAIN_BROKEN", `head ${head.generation}: unsupported transition payload_format "${t.payload_format}"`, "parsing rotate_epoch_payload");
     let raw;
@@ -783,7 +783,7 @@ export function parseRotateEpochPayload(head) {
         fail("CHAIN_BROKEN", `head ${head.generation}: transition.payload_sha256 does not match the payload bytes`, "parsing rotate_epoch_payload");
     let payload;
     try {
-        payload = parseGitvaultStrict(new TextDecoder().decode(raw));
+        payload = parseVaultStrict(new TextDecoder().decode(raw));
     }
     catch {
         fail("CHAIN_BROKEN", `head ${head.generation}: transition.payload is not strict-parseable r402s/v0 JSON`, "parsing rotate_epoch_payload");
@@ -791,7 +791,7 @@ export function parseRotateEpochPayload(head) {
     if (payload.new_epoch !== head.epoch) {
         fail("CHAIN_BROKEN", `head ${head.generation}: rotate_epoch_payload.new_epoch (${payload.new_epoch}) does not equal the carrying head's own epoch (${head.epoch})`, "parsing rotate_epoch_payload");
     }
-    if (!GITVAULT_SHA256_RE.test(payload.rotation_id))
+    if (!VAULT_SHA256_RE.test(payload.rotation_id))
         fail("CHAIN_BROKEN", `head ${head.generation}: rotate_epoch_payload.rotation_id is not a 64-hex digest`, "parsing rotate_epoch_payload");
     if (!Array.isArray(payload.envelopes))
         fail("CHAIN_BROKEN", `head ${head.generation}: rotate_epoch_payload.envelopes is not an array`, "parsing rotate_epoch_payload");
@@ -799,21 +799,21 @@ export function parseRotateEpochPayload(head) {
 }
 /**
  * Decode + validate one head's `transition.payload` as an
- * `add_writer_key_payload` (gitvault-multi-writer rev 47, protocol §4.16):
+ * `add_writer_key_payload` (vault-multi-writer rev 47, protocol §4.16):
  * base64url-jcs decode, `payload_sha256` self-check, strict JSON parse, and
  * the payload's OWN `repo_id` agreeing with the carrying head's — mirrors
  * {@link parseRotateEpochPayload} exactly, `repo_id` in place of `epoch`
  * (this transition never changes the epoch). Pure and keyless: the FULL
  * cryptographic + structural validation (signatures, base/next writer-set
  * commitments, handoff-grant binding) is `validateAddWriterKeyPayload`'s job
- * (`../node/gitvault-writer-state.js`) — this function only gets the bytes
+ * (`../node/vault-writer-state.js`) — this function only gets the bytes
  * off the wire safely, so every reader can call it before any key material
  * is needed.
  */
 export function parseAddWriterKeyPayload(head) {
     const t = head.transition;
     if (!t || t.kind !== "add_writer_key")
-        fail("GITVAULT_NOT_A_WRITER_ADD", `head ${head.generation} does not carry an add_writer_key transition`, "parsing add_writer_key_payload");
+        fail("VAULT_NOT_A_WRITER_ADD", `head ${head.generation} does not carry an add_writer_key transition`, "parsing add_writer_key_payload");
     if (t.payload_format !== "base64url-jcs")
         fail("CHAIN_BROKEN", `head ${head.generation}: unsupported transition payload_format "${t.payload_format}"`, "parsing add_writer_key_payload");
     let raw;
@@ -827,7 +827,7 @@ export function parseAddWriterKeyPayload(head) {
         fail("CHAIN_BROKEN", `head ${head.generation}: transition.payload_sha256 does not match the payload bytes`, "parsing add_writer_key_payload");
     let payload;
     try {
-        payload = parseGitvaultStrict(new TextDecoder().decode(raw));
+        payload = parseVaultStrict(new TextDecoder().decode(raw));
     }
     catch {
         fail("CHAIN_BROKEN", `head ${head.generation}: transition.payload is not strict-parseable r402s/v0 JSON`, "parsing add_writer_key_payload");
@@ -844,29 +844,29 @@ export function parseAddWriterKeyPayload(head) {
  * `own_fingerprint` and return the derived `K_e`, after verifying it
  * reproduces the payload's `epoch_key_commitment` (D200's per-recipient
  * self-check — never a global set-coherence proof, §14ao/§2). Fails CLOSED
- * with `GITVAULT_EPOCH_NOT_OPENABLE` — never a bare `GITVAULT_AEAD_AUTH_FAILURE`
+ * with `VAULT_EPOCH_NOT_OPENABLE` — never a bare `VAULT_AEAD_AUTH_FAILURE`
  * — either when this recipient is not among the rotation's `envelopes[]` at
  * all, or when the addressed envelope's stored bytes are absent or altered.
  *
  * Transport-agnostic by design (`get_envelope_bytes` + `envelope_path`
  * callbacks): this is the ONE place a reader opens a rotation envelope, and
- * both the live publication read path (`GitvaultVault.verifyToNewest`, over
+ * both the live publication read path (`Vault.verifyToNewest`, over
  * the gateway transport) and the offline mirror recovery path
- * (`recoverGitvaultMirror`, over a `GitvaultMirrorBackend`) call it —
+ * (`recoverVaultMirror`, over a `VaultMirrorBackend`) call it —
  * differing only in HOW they fetch bytes, never in the open/verify logic.
  */
 export async function openEpochRotationForRecipient(input) {
     const { repo_id, payload, own_fingerprint, own_encryption_keypair, writer_signing_public_key, get_envelope_bytes, envelope_path } = input;
     const pair = payload.envelopes.find((p) => p.envelope.recipient_fingerprint === own_fingerprint);
     if (!pair) {
-        fail("GITVAULT_EPOCH_NOT_OPENABLE", `this keystore (fingerprint ${own_fingerprint}) is not among epoch ${payload.new_epoch}'s included recipients (rotation ${payload.rotation_id}) — the vault rotated past an epoch this identity was never given a key for`, "opening an epoch-rotation key envelope", { epoch: payload.new_epoch, rotation_id: payload.rotation_id, recipient_fingerprint: own_fingerprint, reason: "not_included" });
+        fail("VAULT_EPOCH_NOT_OPENABLE", `this keystore (fingerprint ${own_fingerprint}) is not among epoch ${payload.new_epoch}'s included recipients (rotation ${payload.rotation_id}) — the vault rotated past an epoch this identity was never given a key for`, "opening an epoch-rotation key envelope", { epoch: payload.new_epoch, rotation_id: payload.rotation_id, recipient_fingerprint: own_fingerprint, reason: "not_included" });
     }
     const path = envelope_path(payload.new_epoch, own_fingerprint, payload.rotation_id);
     const bytes = await get_envelope_bytes(path);
     if (!bytes || sha256Hex(bytes) !== pair.envelope.stored_bytes_sha256) {
-        fail("GITVAULT_EPOCH_NOT_OPENABLE", `the rotation-attempt key_envelope for epoch ${payload.new_epoch} (rotation ${payload.rotation_id}) is absent or altered — this keystore (fingerprint ${own_fingerprint}) cannot open this epoch`, "opening an epoch-rotation key envelope", { epoch: payload.new_epoch, rotation_id: payload.rotation_id, recipient_fingerprint: own_fingerprint, reason: "envelope_absent_or_altered" });
+        fail("VAULT_EPOCH_NOT_OPENABLE", `the rotation-attempt key_envelope for epoch ${payload.new_epoch} (rotation ${payload.rotation_id}) is absent or altered — this keystore (fingerprint ${own_fingerprint}) cannot open this epoch`, "opening an epoch-rotation key envelope", { epoch: payload.new_epoch, rotation_id: payload.rotation_id, recipient_fingerprint: own_fingerprint, reason: "envelope_absent_or_altered" });
     }
-    const envelope = parseGitvaultStrict(new TextDecoder().decode(bytes));
+    const envelope = parseVaultStrict(new TextDecoder().decode(bytes));
     const kE = await openKeyEnvelope({ envelope, recipient: own_encryption_keypair, signer_public_key: writer_signing_public_key });
     const includedFingerprints = payload.envelopes.map((p) => p.envelope.recipient_fingerprint);
     const recomputed = epochRotationKeyCommitment(kE, repo_id, payload.new_epoch, payload.rotation_id, includedFingerprints);
@@ -878,15 +878,15 @@ export async function openEpochRotationForRecipient(input) {
 /** Build + sign a `vault_genesis` (generation 0, epoch 1, the creator's single envelope). */
 export function buildVaultGenesis(input) {
     const unsigned = {
-        format: GITVAULT_FORMAT,
+        format: VAULT_FORMAT,
         object_kind: "vault_genesis",
-        suite: GITVAULT_SUITE,
+        suite: VAULT_SUITE,
         repo_id: input.repo_id,
         org_id: input.org_id,
         project_id: input.project_id,
         allocation_nonce: input.allocation_nonce,
-        generation: GITVAULT_GENESIS_GENERATION,
-        epoch: GITVAULT_GENESIS_EPOCH,
+        generation: VAULT_GENESIS_GENERATION,
+        epoch: VAULT_GENESIS_EPOCH,
         git_object_format: "sha1",
         creator_signing_pubkey: toBase64url(input.creator_signing.public_key),
         creator_encryption_pubkey: toBase64url(input.creator_encryption_public_key),
@@ -894,7 +894,7 @@ export function buildVaultGenesis(input) {
         writer_key_id: vkFingerprint(input.creator_signing.public_key),
         created_at: input.created_at,
     };
-    return signGitvaultObject(unsigned, input.creator_signing.seed);
+    return signVaultObject(unsigned, input.creator_signing.seed);
 }
 /**
  * The genesis key bindings (round-10 A6): exactly one envelope at epoch 1 whose
@@ -908,7 +908,7 @@ export function checkGenesisKeyBindings(genesis, storedEnvelope) {
     if (genesis.envelopes.length !== 1)
         problems.push("envelope_count");
     const receipt = genesis.envelopes[0];
-    if (receipt && receipt.epoch !== GITVAULT_GENESIS_EPOCH)
+    if (receipt && receipt.epoch !== VAULT_GENESIS_EPOCH)
         problems.push("envelope_epoch");
     const expectedEk = ekFingerprint(fromBase64url(genesis.creator_encryption_pubkey, "creator_encryption_pubkey"));
     if (receipt && receipt.recipient_fingerprint !== expectedEk)
@@ -936,9 +936,9 @@ export function checkGenesisKeyBindings(genesis, storedEnvelope) {
 /** Build + sign the creator's `recovery_receipt` (emitted at ACTIVE; integrity data, not a secret). */
 export function buildRecoveryReceipt(input) {
     const unsigned = {
-        format: GITVAULT_FORMAT,
+        format: VAULT_FORMAT,
         object_kind: "recovery_receipt",
-        suite: GITVAULT_SUITE,
+        suite: VAULT_SUITE,
         repo_id: input.repo_id,
         org_id: input.org_id,
         project_id: input.project_id,
@@ -946,7 +946,7 @@ export function buildRecoveryReceipt(input) {
         creator_signing_fingerprint: vkFingerprint(input.creator_signing.public_key),
         creator_encryption_fingerprint: ekFingerprint(input.creator_encryption_public_key),
     };
-    return signGitvaultObject(unsigned, input.creator_signing.seed);
+    return signVaultObject(unsigned, input.creator_signing.seed);
 }
 /**
  * Check a recovery receipt against a genesis it claims to pin: the receipt's
@@ -956,7 +956,7 @@ export function buildRecoveryReceipt(input) {
  */
 export function checkRecoveryReceipt(receipt, genesis) {
     const problems = [];
-    if (!verifyGitvaultObject(receipt, genesis.creator_signing_pubkey))
+    if (!verifyVaultObject(receipt, genesis.creator_signing_pubkey))
         problems.push("signature");
     if (receipt.genesis_sha256 !== storedBytesSha256(genesis))
         problems.push("genesis_sha256");
@@ -989,15 +989,15 @@ export function checkRecoveryReceipt(receipt, genesis) {
  */
 export function checkAllocation(allocation, expected, servicePublicKey) {
     const problems = [];
-    if (allocation.format !== GITVAULT_FORMAT || allocation.object_kind !== "allocation" || allocation.suite !== GITVAULT_SUITE)
+    if (allocation.format !== VAULT_FORMAT || allocation.object_kind !== "allocation" || allocation.suite !== VAULT_SUITE)
         problems.push("envelope");
-    if (!GITVAULT_SRC_RE.test(allocation.repo_id))
+    if (!VAULT_SRC_RE.test(allocation.repo_id))
         problems.push("repo_id");
-    if (!GITVAULT_HEX32_RE.test(allocation.allocation_nonce))
+    if (!VAULT_HEX32_RE.test(allocation.allocation_nonce))
         problems.push("allocation_nonce");
-    if (!GITVAULT_HEX16_RE.test(allocation.allocation_generation))
+    if (!VAULT_HEX16_RE.test(allocation.allocation_generation))
         problems.push("allocation_generation");
-    if (!GITVAULT_SERVICE_KEY_ID_RE.test(allocation.service_key_id))
+    if (!VAULT_SERVICE_KEY_ID_RE.test(allocation.service_key_id))
         problems.push("service_key_id");
     if (allocation.client_creation_id !== expected.client_creation_id)
         problems.push("client_creation_id");
@@ -1009,19 +1009,19 @@ export function checkAllocation(allocation, expected, servicePublicKey) {
         problems.push("org_id");
     if (expected.project_id !== undefined && allocation.project_id !== expected.project_id)
         problems.push("project_id");
-    if (!isValidGitvaultTimestamp(allocation.issued_at) || !isValidGitvaultTimestamp(allocation.created_at))
+    if (!isValidVaultTimestamp(allocation.issued_at) || !isValidVaultTimestamp(allocation.created_at))
         problems.push("timestamp");
-    if (servicePublicKey !== undefined && !verifyGitvaultObject(allocation, servicePublicKey))
+    if (servicePublicKey !== undefined && !verifyVaultObject(allocation, servicePublicKey))
         problems.push("signature");
     return problems;
 }
-// ─── Epoch rotation (D193-D203, rev 42, change gitvault-human-envelopes) ───
+// ─── Epoch rotation (D193-D203, rev 42, change vault-human-envelopes) ───
 //
-// Pure, isomorphic math shared by the producer (Node-only, gitvault-
+// Pure, isomorphic math shared by the producer (Node-only, vault-
 // publication.ts's `rotateEpoch`, which has the live desired-recipient
 // state + local keystore this module cannot see) and by vector generation.
 // Every formula here MIRRORS the gateway's own pure functions in
-// `packages/gateway/src/services/gitvault/epoch-rotation.ts` byte-for-byte
+// `packages/gateway/src/services/vault/epoch-rotation.ts` byte-for-byte
 // (same field order is irrelevant — JCS sorts — but the SAME field SET and
 // the SAME preimage construction is load-bearing: a drift here would build
 // a descriptor/payload the gateway's own re-derivation refuses).
@@ -1066,7 +1066,7 @@ export function computeTargetPartitionDigest(input) {
  * stripped either way, matching the gateway's `computeRotationId`).
  */
 export function computeRotationId(descriptor) {
-    return sha256Hex(jcs(gitvaultWithoutSignature(descriptor)));
+    return sha256Hex(jcs(vaultWithoutSignature(descriptor)));
 }
 /**
  * D195's `attempt_key_commitment` preimage: the descriptor's OWN fields
@@ -1121,8 +1121,8 @@ export function epochRotationKeyCommitment(kE, repoId, newEpoch, rotationId, fin
  * genesis support.
  */
 export function genesisEpochKeyCommitment(k1, repoId, fingerprints) {
-    const kDigest = deriveDigestKeyFrom(k1, repoId, GITVAULT_GENESIS_EPOCH, "vault_genesis_epoch_key");
-    return keyedCommitment(kDigest, { repo_id: repoId, generation: GITVAULT_GENESIS_GENERATION, epoch: GITVAULT_GENESIS_EPOCH, fingerprints: sortedDistinct(fingerprints) });
+    const kDigest = deriveDigestKeyFrom(k1, repoId, VAULT_GENESIS_EPOCH, "vault_genesis_epoch_key");
+    return keyedCommitment(kDigest, { repo_id: repoId, generation: VAULT_GENESIS_GENERATION, epoch: VAULT_GENESIS_EPOCH, fingerprints: sortedDistinct(fingerprints) });
 }
 /**
  * D195's producer obligation the round-3 review's own decisive witness
@@ -1139,11 +1139,11 @@ export function genesisEpochKeyCommitment(k1, repoId, fingerprints) {
  */
 export function checkFreshEpochKeyAgainstPriorKeys(kE, priorKeys) {
     if (kE.length !== 32)
-        fail("GITVAULT_BAD_KEY", "a freshly sampled K_e must be 32 bytes", "sampling a fresh epoch key");
+        fail("VAULT_BAD_KEY", "a freshly sampled K_e must be 32 bytes", "sampling a fresh epoch key");
     const fresh = bytesToHex(kE);
     for (const prior of priorKeys) {
         if (bytesToHex(prior) === fresh) {
-            fail("GITVAULT_EPOCH_KEY_NOT_FRESH", "the freshly sampled K_e equals a prior epoch key already held locally — refusing to seal under it", "sampling a fresh epoch key");
+            fail("VAULT_EPOCH_KEY_NOT_FRESH", "the freshly sampled K_e equals a prior epoch key already held locally — refusing to seal under it", "sampling a fresh epoch key");
         }
     }
 }
@@ -1243,7 +1243,7 @@ export function pinManifestLedgerId(pinManifestVersion) {
 }
 // ─── Source-access wrapper custody — WrapperV1 / `swrap2` (DECRYPT SIDE) ─────
 //
-// gitvault-recovery-custody: a human member's X25519 private scalar is RANDOM
+// vault-recovery-custody: a human member's X25519 private scalar is RANDOM
 // and persisted only as sealed wrappers — each an XChaCha20-Poly1305 AEAD
 // encryption of the 32-byte scalar under a KEK derived from a credential
 // secret, bound to a canonical JCS context. This SDK implements only the
@@ -1253,7 +1253,7 @@ export function pinManifestLedgerId(pinManifestVersion) {
 //
 // Every constant below is pinned byte-for-byte against the canonical module
 // (private repo `apps/git/public/lib/r402s-crypto.js`, "Source-access wrapper
-// custody" section, and gitvault-recovery-custody/design.md D1 addendum). If
+// custody" section, and vault-recovery-custody/design.md D1 addendum). If
 // they ever disagree, both are wrong and need reconciling together. The prior
 // `swrap1_` format never protected a real member key and is NOT decodable —
 // it fails by name.
@@ -1295,7 +1295,7 @@ export function buildSourceWrapperContext(fields) {
         member_public_key_sha256: bytesToHex(sha256(fields.member_public_key)),
         principal_id: String(fields.principal_id),
         rp_id: String(fields.rp_id),
-        suite: GITVAULT_SUITE,
+        suite: VAULT_SUITE,
         wrapper_id: String(fields.wrapper_id),
     })));
 }
@@ -1377,7 +1377,7 @@ export function normalizeSourceRecoveryCode(input) {
     return core;
 }
 export { bytesToHex, hexToBytes };
-// ── gitvault-agent-envelopes: keystore-key possession proof ──────────────────
+// ── vault-agent-envelopes: keystore-key possession proof ──────────────────
 /**
  * The client half of the gateway's ECDH key-confirmation challenge for a
  * `keystore_v1` enrollment (`POST /agent/v1/whoami/encryption-key` →
@@ -1390,16 +1390,16 @@ export { bytesToHex, hexToBytes };
  * the prefix + JCS message are pinned here so the two lineages cannot drift.
  * Client convention, not r402s/v0 wire protocol.
  */
-export const GITVAULT_KEYSTORE_POSSESSION_PREFIX = "r402s/v0/keystore-key-possession/v1\n";
+export const VAULT_KEYSTORE_POSSESSION_PREFIX = "r402s/v0/keystore-key-possession/v1\n";
 export function computeKeystorePossessionProof(input) {
     const shared = x25519.getSharedSecret(input.private_key, fromBase64url(input.epk_b64u, "activation.epk"));
     // Sorted-key JSON.stringify IS RFC 8785 here: three plain string fields.
     const jcs = JSON.stringify({ challenge_id: input.challenge_id, encryption_key_id: input.encryption_key_id, public_key: input.public_key_b64u });
-    const message = concatBytes(utf8ToBytes(GITVAULT_KEYSTORE_POSSESSION_PREFIX), utf8ToBytes(jcs));
+    const message = concatBytes(utf8ToBytes(VAULT_KEYSTORE_POSSESSION_PREFIX), utf8ToBytes(jcs));
     return toBase64url(hmac(sha256, shared, message));
 }
 /**
- * gitvault-multi-writer rev 47 (design D9) — the writer-signing-key
+ * vault-multi-writer rev 47 (design D9) — the writer-signing-key
  * possession message. Byte-identical to the gateway's own
  * `signingKeyPossessionMessage` (services/principal-encryption-keys.ts) —
  * `JSON.stringify({domain, principal_id, signing_pubkey, encryption_pubkey})`
@@ -1414,13 +1414,13 @@ export function computeKeystorePossessionProof(input) {
  * principal_id, signing_pubkey`) and silently produce a signature that
  * never verifies.
  */
-export const GITVAULT_SIGNING_KEY_POSSESSION_DOMAIN = "r402s/v0/signing-key-possession/v1";
+export const VAULT_SIGNING_KEY_POSSESSION_DOMAIN = "r402s/v0/signing-key-possession/v1";
 export function signingKeyPossessionMessage(fields) {
-    const json = JSON.stringify({ domain: GITVAULT_SIGNING_KEY_POSSESSION_DOMAIN, principal_id: fields.principal_id, signing_pubkey: fields.signing_pubkey, encryption_pubkey: fields.encryption_pubkey });
+    const json = JSON.stringify({ domain: VAULT_SIGNING_KEY_POSSESSION_DOMAIN, principal_id: fields.principal_id, signing_pubkey: fields.signing_pubkey, encryption_pubkey: fields.encryption_pubkey });
     return utf8ToBytes(json);
 }
 /** Ed25519 signature over {@link signingKeyPossessionMessage} — proves possession of the signing half's private key over this specific (principal, signing key, encryption key) binding. */
 export function computeSigningKeyPossessionSignature(input) {
     return toBase64url(ed25519Sign(signingKeyPossessionMessage(input), input.signing_seed));
 }
-//# sourceMappingURL=gitvault.crypto.js.map
+//# sourceMappingURL=vault.crypto.js.map