run402 4.95.0 → 4.97.0

package/lib/rooms-context.mjs

@@ -39,16 +39,16 @@ export const PRESENCE_ENV = "RUN402_PRESENCE_ID";
 /**
  * `r402.room` from `cwd`'s LOCAL git config (kygit-handoff design D10) —
  * best-effort, `null` on any absence or failure. Checks a real vault
- * checkout's pin first (`readPinnedGitvaultRepo`, gated on `r402.repoId`
+ * checkout's pin first (`readPinnedVaultRepo`, gated on `r402.repoId`
  * being present), then falls back to the bare room/org pin `rooms join
  * <key>` writes in a directory with NO vault at all (add-room-invite design
- * D10) — `readPinnedGitvaultRepo` would otherwise see that pin as absent,
+ * D10) — `readPinnedVaultRepo` would otherwise see that pin as absent,
  * since it never sets `r402.repoId`.
  */
-async function readGitvaultPinnedRoom(cwd) {
+async function readVaultPinnedRoom(cwd) {
   try {
-    const { readPinnedGitvaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
-    const pinned = await readPinnedGitvaultRepo(cwd);
+    const { readPinnedVaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
+    const pinned = await readPinnedVaultRepo(cwd);
     const room = typeof pinned?.room === "string" ? pinned.room.trim() : "";
     if (room.length > 0) return room;
     const bare = await readPinnedRoomBinding(cwd);
@@ -102,11 +102,11 @@ export async function resolveRoom({ org, room, project } = {}) {
   //    (`--room` alone works whenever the org resolves, and fails with
   //    ORG_REQUIRED — naming every way to supply one — when it does not.)
   //    kygit-handoff design D10: `r402.room` in this checkout's LOCAL git
-  //    config — written by `resume` and every other gitvault pin site — is
+  //    config — written by `resume` and every other vault pin site — is
   //    the LAST room-key source before falling to the project default,
   //    below the binding file's own `room` key.
   const bindingRoom = findBindingKey(process.cwd(), "room");
-  const roomKey = room ?? bindingRoom?.value ?? (await readGitvaultPinnedRoom(process.cwd()));
+  const roomKey = room ?? bindingRoom?.value ?? (await readVaultPinnedRoom(process.cwd()));
   if (roomKey) {
     const resolved = await resolveOrg({ org, project }, { cmd: "rooms" });
     return {

package/lib/sites.mjs

@@ -1,7 +1,7 @@
 import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join, resolve } from "path";
-import { fileSetFromDir, delegateTokenFromEnv } from "#sdk/node";
+import { fileSetFromDir, grantKeyFromEnv } from "#sdk/node";
 import { walletAuthHeaders, resolveProjectId, updateProject } from "./config.mjs";
 import { resolveFilePathsInManifest } from "./manifest.mjs";
 import { getSdk } from "./sdk.mjs";
@@ -220,9 +220,9 @@ async function deploy(args) {
   if (opts.manifest) resolveFilePathsInManifest(manifest, dirname(resolve(opts.manifest)));
 
   // Preserve the aggressive early exit when no local wallet is configured.
-  // A delegate holds `deploy` and /apply/v1/plans accepts it; refusing locally
+  // A grant key holds `deploy` and /apply/v1/plans accepts it; refusing locally
   // would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/plans");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/plans");
 
   const stage = stageFilesToTempDir(manifest.files || []);
   try {
@@ -289,9 +289,9 @@ async function deployDir(args) {
   if (opts.target !== undefined) failUnsupportedTarget();
 
   // Preserve the aggressive early exit when no local wallet is configured.
-  // A delegate holds `deploy` and /apply/v1/plans accepts it; refusing locally
+  // A grant key holds `deploy` and /apply/v1/plans accepts it; refusing locally
   // would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/plans");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/plans");
 
   let fileSet;
   try {

package/lib/up.mjs

@@ -84,12 +84,12 @@ Options:
 Repo composition (D4): against a local directory (not a git URL source), up
 composes git init (only when the app root is not already a repository) +
 provision + a run402 remote scaffold (origin is never claimed) + a first
-gitvault push — one command, the fly-launch shape. The app root is the
+vault push — one command, the fly-launch shape. The app root is the
 manifest's directory; an app root that lies INSIDE another repository is
 left untouched (result.repo.status "skipped", reason
 "inside_other_repository", toplevel named) and result.repo.next_actions
 carries create_nested_repo — re-run with --nested to give the app its own
-encrypted remote (result.repo.gitvault.nested true, enclosing_toplevel,
+encrypted remote (result.repo.vault.nested true, enclosing_toplevel,
 excluded_in_enclosing). The scaffold and first push are best-effort: a git
 or vault hiccup never turns an otherwise-successful deploy into a failure,
 and is reported under result.repo (default apply) or result (--repo-only)
@@ -395,7 +395,7 @@ export async function run(args = []) {
             createdRepository = await gitInitIfNeeded(workDir);
             result.result.repo = await composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested });
           } catch (err) {
-            result.result.repo = { status: "failed", first_push: null, first_push_error: { code: err?.code ?? "GITVAULT_SETUP_FAILED", message: err?.message ?? String(err) }, ...repoNextActionsOf(err) };
+            result.result.repo = { status: "failed", first_push: null, first_push_error: { code: err?.code ?? "VAULT_SETUP_FAILED", message: err?.message ?? String(err) }, ...repoNextActionsOf(err) };
           }
         }
       }
@@ -658,13 +658,13 @@ function looksLikeGitRemoteUrl(source) {
  *
  * `-b main`, not whatever `init.defaultBranch` (or the pre-2.28 hardcoded
  * `master`) happens to be — the docs teach `git push origin main`, and the
- * gitvault remote helper's own dangling-HEAD hazard note (a first push of
+ * vault remote helper's own dangling-HEAD hazard note (a first push of
  * any OTHER branch leaves HEAD naming a ref that does not exist yet) is
  * exactly what a mismatched default branch here would walk `up` straight
  * into. `-b` needs git 2.28+ (2020); an older git falls back to the same
  * result by a different route — `symbolic-ref` on a still-empty repository
  * has no existing ref to disturb, so it is exactly as safe as `-b main`
- * would have been. Mirrors `Gitvault.scaffoldRemote`'s identical fallback.
+ * would have been. Mirrors `Repos.scaffoldRemote`'s identical fallback.
  */
 async function gitInitIfNeeded(dir) {
   const { hardenedGit } = await import("#sdk/node");
@@ -685,20 +685,20 @@ async function gitInitIfNeeded(dir) {
 /**
  * Remote scaffold + first push, against an already-known project. Best-effort
  * in every branch — the same non-fatal discipline `projects provision`'s own
- * fold-in follows (`gitvault-scaffold.mjs`): a git or vault hiccup here must
+ * fold-in follows (`vault-scaffold.mjs`): a git or vault hiccup here must
  * never turn an otherwise-successful `up` into a failure.
  */
 async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested = false }) {
   const { resolveOwningOrgId } = await import("./org-context.mjs");
-  const { scaffoldGitvaultRemote } = await import("./gitvault-scaffold.mjs");
+  const { scaffoldVaultRemote } = await import("./vault-scaffold.mjs");
   const orgId = await resolveOwningOrgId(projectId);
   // `--nested`: an app root INSIDE another repository (a monorepo workspace)
   // becomes its own repository with the encrypted remote — the enclosing
   // checkout only gains one local `.git/info/exclude` line. Without it the
   // scaffold is skipped there and the result's `next_actions` name
   // `run402 up --nested` (the caller's own spelling of the way out).
-  const scaffold = await scaffoldGitvaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false, nested, nestedCommand: "run402 up --nested" });
-  if (createdRepository && scaffold.gitvault) scaffold.gitvault.created_repository = true;
+  const scaffold = await scaffoldVaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false, nested, nestedCommand: "run402 up --nested" });
+  if (createdRepository && scaffold.vault) scaffold.vault.created_repository = true;
   const out = { ...scaffold, first_push: null, first_push_error: null };
   if (scaffold.status !== "scaffolded") {
     // Nothing was scaffolded (the app root is inside another repository, or
@@ -707,7 +707,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     return out;
   }
   if (!orgId) {
-    out.first_push_error = { code: "GITVAULT_ORG_UNRESOLVED", message: `could not resolve the owning org for ${projectId} — the first push was skipped` };
+    out.first_push_error = { code: "VAULT_ORG_UNRESOLVED", message: `could not resolve the owning org for ${projectId} — the first push was skipped` };
     return out;
   }
   // Read BEFORE the push decision: an unborn HEAD is what decides the lane.
@@ -717,7 +717,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
   // a repository the agent `git init`ed itself and never committed to (an
   // UNBORN HEAD): there is no clean tree to keep, only untracked files, and
   // the strict lane would refuse SNAPSHOT_DIRTY_TREE on every first push.
-  const freshRepository = createdRepository || scaffold.gitvault?.created_repository === true || out.local_git.unborn === true;
+  const freshRepository = createdRepository || scaffold.vault?.created_repository === true || out.local_git.unborn === true;
   try {
     let vaultCreated = null;
     // A fresh repository has, by definition, nothing committed yet — every
@@ -726,7 +726,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     // first commit the dirty-tree lane produces (disclosed under
     // first_push.snapshot); a repository WITH commits keeps the clean-tree
     // rule and its refusal is reported, never overridden.
-    const pushed = await sdk.gitvault.push({
+    const pushed = await sdk.repos.capture({
       project_id: projectId,
       org_id: orgId,
       repo_dir: workDir,
@@ -736,14 +736,14 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository,
     out.first_push = {
       generation: pushed.generation,
       form: pushed.form,
-      gitvault_commit: pushed.gitvault_commit,
+      vault_commit: pushed.vault_commit,
       vault_created: vaultCreated,
       snapshot: pushed.snapshot ? { id: pushed.snapshot.oid, kind: pushed.snapshot.kind, backup_status: "succeeded" } : null,
       note: "Vault backup does not create a local branch commit or stage files. Local HEAD and dirty state are independent.",
       ...(freshRepository ? { captured_dirty: true, modified_captured: pushed.snapshot?.modified_captured ?? null, untracked_captured: pushed.snapshot?.untracked_captured ?? null } : {}),
     };
   } catch (err) {
-    out.first_push_error = { code: err?.body?.code ?? err?.code ?? "GITVAULT_PUSH_FAILED", message: err?.message ?? String(err) };
+    out.first_push_error = { code: err?.body?.code ?? err?.code ?? "VAULT_PUSH_FAILED", message: err?.message ?? String(err) };
     Object.assign(out, repoNextActionsOf(err));
   }
   return out;

package/lib/{gitvault-capabilities.mjs → vault-capabilities.mjs}

@@ -1,11 +1,11 @@
 /**
- * gitvault-capabilities.mjs — the capability ledger for the GitVault
- * marketing surface (openspec/changes/gitvault-page-truth-gate, design D1).
+ * vault-capabilities.mjs — the capability ledger for the KyGit
+ * marketing surface (openspec/changes/kygit-page-truth-gate, design D1).
  *
  * THIS FILE IS MARKETING-CLAIM GROUND TRUTH. run402-private's page-truth
- * gate (`scripts/check-gitvault-page-truth.mjs`) resolves the PUBLISHED
+ * gate (`scripts/check-kygit-page-truth.mjs`) resolves the PUBLISHED
  * `run402` package, reads these flags out of the generated
- * `cli/gitvault-surface.json`, and fails the GitVault product page's build
+ * `cli/vault-surface.json`, and fails the KyGit product page's build
  * when a claim marker contradicts what is asserted here. It lives NEXT TO
  * `command-manifest.mjs` so the change that flips a capability (ships a
  * feature, retires a spelling) is the SAME change that flips the fact this
@@ -13,12 +13,12 @@
  * behavior and this file in the same change, never one without the other.
  */
 
-export const GITVAULT_CAPABILITIES = {
+export const VAULT_CAPABILITIES = {
   // `repos access repair` / `repos access revoke-key` /
   // `repos access declare-exposure` (rev 42, D193-D203) drive a real epoch
   // rotation against the gateway — revocation is a live, shipped feature.
   revocation_live: true,
-  // `Gitvault#reconcileEnvelopeRecipients` (gitvault-human-envelopes task
+  // `Repos#reconcileEnvelopeRecipients` (vault-human-envelopes task
   // 4.1's ADD-path workaround) runs automatically after every successful
   // `push()`/`deploy()` and wraps the vault's current epoch key to every org
   // member who has published an encryption key but has no `key_envelope` on
@@ -34,7 +34,7 @@ export const GITVAULT_CAPABILITIES = {
   // fail-closed before allocation; chain-copy dual-write; attested finalize
   // with `storage_verification: "client_attested"`; degraded reads from the
   // destination; fsck absence check) — shipped end to end in the same
-  // change that flips this flag (gitvault-byo-primary-bucket, Phase 3).
+  // change that flips this flag (vault-byo-primary-bucket, Phase 3).
   byo_live: true,
   // `repos recover` materializes a git repository from a mirror source,
   // offline, with no server call.
@@ -42,15 +42,15 @@ export const GITVAULT_CAPABILITIES = {
   // `repos create` allocates the vault IMMEDIATELY — the moment the repo
   // starts existing — not lazily deferred to first push.
   allocation: "create_immediate",
-  // `repos snapshot` refuses to capture a dirty working tree
+  // `repos capture` refuses to capture a dirty working tree
   // (`SNAPSHOT_DIRTY_TREE`) by default; `--allow-dirty` opts in explicitly.
-  snapshot_dirty_default: "refuse",
+  capture_dirty_default: "refuse",
   // kygit-handoff (design D10): `repos handoff` / `repos resume` mint and
   // claim a real single-use bearer key against a live gateway route —
   // shipped, not aspirational.
   handoff_live: true,
   // `repos handoff` captures dirty work by DEFAULT (the opposite default
-  // from `snapshot_dirty_default` above) — two verbs, two defaults, one
+  // from `capture_dirty_default` above) — two verbs, two defaults, one
   // capture path (design D1).
   handoff_dirty_default: "capture",
   // kygit-invite (design D10): `repos invite` / `repos join` mint and claim
@@ -59,8 +59,4 @@ export const GITVAULT_CAPABILITIES = {
   // while the inviter keeps working.
   invite_live: true,
   join_live: true,
-  // Both remote door spellings resolve identically (design D8):
-  // `run402::` (canonical, plumbing) and `kygit::` (rendered by
-  // `@kychee/kygit` once it sets `RUN402_REMOTE_SCHEME=kygit`).
-  remote_schemes: ["run402", "kygit"],
 };

package/lib/{gitvault-daemon-run.mjs → vault-daemon-run.mjs}

@@ -1,5 +1,5 @@
 /**
- * Daemon process entry (gitvault-persistent-helper) — spawned detached by
+ * Daemon process entry (vault-persistent-helper) — spawned detached by
  * the thin client's fallback path; never invoked by users directly. Enables
  * the compile cache (the daemon compiles the heavy graph exactly once, so
  * this mostly benefits the NEXT daemon after an upgrade), then runs the
@@ -14,7 +14,7 @@ try {
   /* silent by contract */
 }
 
-const { runDaemon } = await import("./gitvault-daemon.mjs");
+const { runDaemon } = await import("./vault-daemon.mjs");
 try {
   await runDaemon();
 } catch {

package/lib/{gitvault-daemon.mjs → vault-daemon.mjs}

@@ -1,5 +1,5 @@
 /**
- * The resident helper engine (gitvault-persistent-helper D2–D6).
+ * The resident helper engine (vault-persistent-helper D2–D6).
  *
  * Holds the WARM things — the loaded session module (whose top-level await
  * pulls the whole SDK graph), the owned dispatcher's live h2 connection,
@@ -53,16 +53,16 @@ export async function runDaemon() {
   // Load the heavy module ONCE — this is the entire point of residency.
   // Its top-level await pulls the SDK graph; the prewarm dials the API
   // origin so the first forwarded session rides a warm h2 connection.
-  const { prewarmGitvaultConnection, kickGitvaultConnection, predialGitvaultObjectStore } = await import("../sdk/dist/node/gitvault-prewarm.js");
-  prewarmGitvaultConnection();
+  const { prewarmVaultConnection, kickVaultConnection, predialVaultObjectStore } = await import("../sdk/dist/node/vault-prewarm.js");
+  prewarmVaultConnection();
   const { runHelperSession } = await import("./remote-helper-session.mjs");
-  // gitvault-object-host-predial task 2.2 — narrow, session-scoped imports
+  // vault-object-host-predial task 2.2 — narrow, session-scoped imports
   // (not the whole `#sdk/node` barrel) for the OFFLINE repo resolution the
   // session-accept predial needs: a local git subprocess (`rev-parse
   // --absolute-git-dir`) plus a local git-config read, never a network
   // call (design D6).
-  const { resolveGitInvocationRepo } = await import("../sdk/dist/node/gitvault-snapshot.js");
-  const { readPinnedGitvaultRepo } = await import("../sdk/dist/node/gitvault-address.js");
+  const { resolveGitInvocationRepo } = await import("../sdk/dist/node/vault-snapshot.js");
+  const { readPinnedVaultRepo } = await import("../sdk/dist/node/vault-address.js");
 
   const socketPath = daemonSocketPath();
   if (process.platform !== "win32") {
@@ -107,7 +107,7 @@ export async function runDaemon() {
     };
 
     /**
-     * gitvault-checkpoint-cadence design D2: `session.backgroundWork` — set
+     * vault-checkpoint-cadence design D2: `session.backgroundWork` — set
      * by `onBackgroundWork` below when a push's auto-gc cycle was handed
      * off — is a promise this daemon keeps itself alive for BEFORE
      * restoring env/cwd/`busy`, even though the CLIENT already got its
@@ -176,22 +176,22 @@ export async function runDaemon() {
             socket.end();
             return;
           }
-          // gitvault-first-op-premium (design point: pre-connect on session
+          // vault-first-op-premium (design point: pre-connect on session
           // accept). Git's own helper handshake (capabilities/list stdin
           // exchange) buys ~100-200ms of free overlap before the SESSION's
           // first real transport op — kick the owned dispatcher's connection
           // right now, before env/cwd swap even, so a dead/never-dialed
           // socket redials NOW instead of on the verb's critical path. The
-          // NARROW half only (`kickGitvaultConnection`), never the full
-          // `prewarmGitvaultConnection` — that also (re)warms the signer +
+          // NARROW half only (`kickVaultConnection`), never the full
+          // `prewarmVaultConnection` — that also (re)warms the signer +
           // paid-fetch buyer stack, which this daemon already warmed ONCE at
           // boot; re-running it per session was measured to cost an EXTRA
-          // ~150-300ms/session (two live Base RPC probes a gitvault session
+          // ~150-300ms/session (two live Base RPC probes a vault session
           // never needs) for zero benefit. Fire-and-forget by contract
           // (never throws, never awaited, never delays a session).
           const acceptedAt = Date.now();
-          kickGitvaultConnection();
-          // gitvault-object-host-predial task 2.2 — the addressed repo's
+          kickVaultConnection();
+          // vault-object-host-predial task 2.2 — the addressed repo's
           // persisted object-store origin(s), predialed on the SAME
           // pre-connect timing as the API-origin kick above: resolved from
           // THIS session's OWN `msg.cwd`/`msg.env` (not `process.cwd()`/
@@ -199,7 +199,7 @@ export async function runDaemon() {
           // until the swap below runs) via the same offline, no-network
           // mechanism the session module itself uses once it takes over —
           // `resolveGitInvocationRepo` (a local `git rev-parse
-          // --absolute-git-dir`) then `readPinnedGitvaultRepo` (a local
+          // --absolute-git-dir`) then `readPinnedVaultRepo` (a local
           // `git config --local` read). Any resolution failure (no
           // `GIT_DIR`, not a repository, no pin yet) predials nothing —
           // never a network read to learn where to predial (design D6),
@@ -207,8 +207,8 @@ export async function runDaemon() {
           void (async () => {
             try {
               const { repo_dir } = await resolveGitInvocationRepo(msg.env ?? {}, msg.cwd);
-              const pinned = await readPinnedGitvaultRepo(repo_dir);
-              if (pinned) predialGitvaultObjectStore(pinned.repo_id);
+              const pinned = await readPinnedVaultRepo(repo_dir);
+              if (pinned) predialVaultObjectStore(pinned.repo_id);
             } catch {
               /* best-effort: must never surface from session accept */
             }
@@ -258,18 +258,18 @@ export async function runDaemon() {
           };
           session = { stdin, restoreEnv, restoreCwd, restoreWrites, backgroundWork: null };
           send({ t: "ready" });
-          // gitvault-first-op-premium task 1.1: phase stamps for attribution
+          // vault-first-op-premium task 1.1: phase stamps for attribution
           // (session accept -> env ready -> first transport call, the last
-          // covered by the existing RUN402_GITVAULT_TRACE per-op lines).
+          // covered by the existing RUN402_VAULT_TRACE per-op lines).
           // Emitted AFTER write-redirection so they ride the socket to the
           // client and land in the SAME trace stream the bench harness
           // already captures — gated on the session's own env, exactly like
-          // every other gitvault-trace line.
-          if (process.env.RUN402_GITVAULT_TRACE === "1") {
-            process.stderr.write(`gitvault-trace: daemon session-accept ${sessionsServed} at ${acceptedAt}\n`);
-            process.stderr.write(`gitvault-trace: daemon env-ready ${sessionsServed} +${envReadyAt - acceptedAt}ms\n`);
+          // every other vault-trace line.
+          if (process.env.RUN402_VAULT_TRACE === "1") {
+            process.stderr.write(`vault-trace: daemon session-accept ${sessionsServed} at ${acceptedAt}\n`);
+            process.stderr.write(`vault-trace: daemon env-ready ${sessionsServed} +${envReadyAt - acceptedAt}ms\n`);
           }
-          // gitvault-checkpoint-cadence design D2: a push's auto-gc cycle
+          // vault-checkpoint-cadence design D2: a push's auto-gc cycle
           // (if triggered) hands its ALREADY-STARTED promise here instead
           // of being awaited inline — `runHelperSession` itself still
           // resolves at push speed, so `exit`/`socket.end()` below reach

package/lib/{gitvault-scaffold.mjs → vault-scaffold.mjs}

@@ -4,7 +4,7 @@
  * `run402 init`'s 5b block pioneered this pattern; this module is the same
  * additive-only, non-fatal-in-every-branch scaffold factored out so
  * `run402 up` and `run402 repos create` report through the IDENTICAL
- * `gitvault` / `gitvault_skipped` / `gitvault_error` summary keys `init`
+ * `vault` / `vault_skipped` / `vault_error` summary keys `init`
  * already uses (plus `status` / `reason` / `toplevel`), instead of
  * near-copies drifting apart. `projects provision` never scaffolds: it is
  * the provisioning primitive and has no local side effects. `init.mjs` itself is left untouched — its own scaffold block is
@@ -32,12 +32,12 @@ import { resolveOwningOrgId } from "./org-context.mjs";
  * @param {string} options.projectId The project the remote should point at.
  * @param {string} [options.orgId] Explicit owning org. Resolved via `resolveOwningOrgId` when omitted.
  * @param {boolean} [options.createRepoIfMissing] Opt into `git init`-ing `repoDir` when it is not a repository yet.
- * @param {boolean} [options.nested] Scaffold `repoDir` as its OWN repository even when it lies inside another one (`Gitvault.scaffoldRemote`'s `nested`).
+ * @param {boolean} [options.nested] Scaffold `repoDir` as its OWN repository even when it lies inside another one (`Repos.scaffoldRemote`'s `nested`).
  * @param {string} [options.nestedCommand] The caller's own `--nested` spelling for the `create_nested_repo` next_action (default: the SDK's `run402 repos create --nested --project <project_id>`).
- * @returns {Promise<{status: "scaffolded"|"skipped"|"error", reason?: string, toplevel?: string|null, next_actions?: object[], gitvault: object|null, gitvault_skipped?: string, gitvault_error?: {code: string, message: string}}>}
+ * @returns {Promise<{status: "scaffolded"|"skipped"|"error", reason?: string, toplevel?: string|null, next_actions?: object[], vault: object|null, vault_skipped?: string, vault_error?: {code: string, message: string}}>}
  */
-export async function scaffoldGitvaultRemote({ repoDir = process.cwd(), projectId, orgId, createRepoIfMissing = false, nested = false, nestedCommand } = {}) {
-  const out = { gitvault: null, status: "skipped" };
+export async function scaffoldVaultRemote({ repoDir = process.cwd(), projectId, orgId, createRepoIfMissing = false, nested = false, nestedCommand } = {}) {
+  const out = { vault: null, status: "skipped" };
   try {
     const { hardenedGit } = await import("#sdk/node");
     let insideRepo = true;
@@ -48,16 +48,16 @@ export async function scaffoldGitvaultRemote({ repoDir = process.cwd(), projectI
     }
     if (!insideRepo && !createRepoIfMissing) {
       out.reason = "not_a_repository";
-      out.gitvault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
+      out.vault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
       return out;
     }
     const resolvedOrgId = orgId ?? (await resolveOwningOrgId(projectId));
     if (!resolvedOrgId) {
       out.reason = "org_unresolved";
-      out.gitvault_skipped = `could not resolve the owning org for ${projectId} — the run402 remote was not added`;
+      out.vault_skipped = `could not resolve the owning org for ${projectId} — the run402 remote was not added`;
       return out;
     }
-    const remote = await getSdk().gitvault.scaffoldRemote({ repo_dir: repoDir, org_id: resolvedOrgId, project_id: projectId, ...(nested ? { nested: true } : {}) });
+    const remote = await getSdk().repos.scaffoldRemote({ repo_dir: repoDir, org_id: resolvedOrgId, project_id: projectId, ...(nested ? { nested: true } : {}) });
     if (remote.status === "skipped") {
       // The app root lies INSIDE some other repository (first-deploy-agent-dx
       // D3): that repository is never touched. Say which one, why, and the
@@ -66,7 +66,7 @@ export async function scaffoldGitvaultRemote({ repoDir = process.cwd(), projectI
       // --nested`), so the command printed is the one the agent just ran.
       out.reason = "inside_other_repository";
       out.toplevel = remote.toplevel ?? null;
-      out.gitvault_skipped = remote.reason;
+      out.vault_skipped = remote.reason;
       out.next_actions = (remote.next_actions ?? []).map((action) =>
         action.type === "create_nested_repo" && nestedCommand ? { ...action, command: nestedCommand } : action,
       );
@@ -76,11 +76,11 @@ export async function scaffoldGitvaultRemote({ repoDir = process.cwd(), projectI
     // git only — no vault exists for the project yet (allocation happens
     // lazily on first push, or explicitly via `run402 repos create --project <project_id>`).
     out.status = "scaffolded";
-    out.gitvault = { ...remote, allocated: false };
+    out.vault = { ...remote, allocated: false };
   } catch (err) {
-    out.gitvault = null;
+    out.vault = null;
     out.status = "error";
-    out.gitvault_error = { code: err?.body?.code ?? err?.code ?? "GITVAULT_SCAFFOLD_FAILED", message: err?.message ?? String(err) };
+    out.vault_error = { code: err?.body?.code ?? err?.code ?? "VAULT_SCAFFOLD_FAILED", message: err?.message ?? String(err) };
   }
   return out;
 }

package/lib/{gitvault-target.mjs → vault-target.mjs}

@@ -1,6 +1,6 @@
 /**
- * Shared "which vault does this repo mean" resolution for `run402 gitvault`
- * and `run402 doctor`'s gitvault check. When a verb runs standing inside a
+ * Shared "which vault does this repo mean" resolution for `run402 repos`
+ * and `run402 doctor`'s vault check. When a verb runs standing inside a
  * repository that already names its own vault via a pinned repo id or a
  * run402/origin remote, targeting prefers that repo over the active-project
  * pointer — git muscle memory says a command run inside a repo acts on THAT
@@ -25,9 +25,9 @@
  * and 5 apply.
  *
  * ARCHITECTURAL NOTE: this is CLI-edge policy (which flag/env/file wins),
- * not gitvault protocol behavior — the same class of concern
+ * not vault protocol behavior — the same class of concern
  * `wallet-context.mjs` owns for wallet selection. The protocol reads it
- * composes (`readPinnedGitvaultRepo`, `resolveAddress`) already live once in
+ * composes (`readPinnedVaultRepo`, `resolveAddress`) already live once in
  * the SDK; this module adds no protocol logic of its own.
  */
 import { getActiveProjectId } from "./config.mjs";
@@ -35,12 +35,12 @@ import { getActiveProjectId } from "./config.mjs";
 /**
  * Tiers 4/5 (RUN402_PROJECT_ID env, then the active project) — deliberately
  * NON-throwing, unlike `config.mjs#resolveProjectId`. `run402 doctor`'s
- * gitvault check needs to report "skipped" gracefully when nothing resolves
+ * vault check needs to report "skipped" gracefully when nothing resolves
  * anywhere (its pre-existing, tested behavior); a `fail()`-triggered
  * `process.exit()` here would abort doctor's ENTIRE report, not just this
  * one check. Callers that DO want the historical PROJECT_REQUIRED failure
- * (gitvault.mjs's own verbs) get it by falling back to `resolveProjectId`
- * themselves when this returns `null` — see `vaultTarget` in gitvault.mjs.
+ * (vault.mjs's own verbs) get it by falling back to `resolveProjectId`
+ * themselves when this returns `null` — see `vaultTarget` in vault.mjs.
  */
 function envOrActiveProjectId() {
   return (process.env.RUN402_PROJECT_ID || "").trim() || getActiveProjectId() || null;
@@ -63,14 +63,14 @@ async function isInsideGitRepo(repoDir) {
  * repository at all, or (slug-form only) the remote fails to resolve over
  * the network — a miss here is always ordinary, never thrown.
  */
-export async function repoOwnGitvaultTarget(repoDir) {
+export async function repoOwnVaultTarget(repoDir) {
   if (!(await isInsideGitRepo(repoDir))) return null;
 
-  const { hardenedGit, readPinnedGitvaultRepo } = await import("#sdk/node");
-  const pinned = await readPinnedGitvaultRepo(repoDir);
+  const { hardenedGit, readPinnedVaultRepo } = await import("#sdk/node");
+  const pinned = await readPinnedVaultRepo(repoDir);
   if (pinned) return { repo_id: pinned.repo_id, project_id: null, source: "pin" };
 
-  const { parseGitvaultRemoteUrl, gitvaultRemoteAddressForm } = await import("#sdk");
+  const { parseVaultRemoteUrl, vaultRemoteAddressForm } = await import("#sdk");
   for (const name of ["run402", "origin"]) {
     let url;
     try {
@@ -79,16 +79,21 @@ export async function repoOwnGitvaultTarget(repoDir) {
       continue; // no such remote — try the other conventional name
     }
     if (!url) continue;
-    const address = parseGitvaultRemoteUrl(url);
+    let address;
+    try {
+      address = parseVaultRemoteUrl(url);
+    } catch {
+      continue; // another scheme's remote — not a vault address
+    }
     if (!address) continue; // exists, but isn't a run402 address — try the other name
-    if (gitvaultRemoteAddressForm(address) === "id") {
+    if (vaultRemoteAddressForm(address) === "id") {
       // id-form already carries both halves in the address string — no
       // network read needed at all.
       return { repo_id: null, project_id: address.project_id, source: "remote", remote_name: name };
     }
     try {
       const { getSdk } = await import("./sdk.mjs");
-      const resolved = await getSdk().gitvault.resolveAddress(address);
+      const resolved = await getSdk().repos.resolveAddress(address);
       return { repo_id: resolved.repo_id, project_id: resolved.project_id, source: "remote", remote_name: name };
     } catch {
       // Offline, SLUG_RELEASED, not-found, ... — nothing to target from this
@@ -100,7 +105,7 @@ export async function repoOwnGitvaultTarget(repoDir) {
 }
 
 /**
- * Resolve `{ repo_id?, project_id? }` for a gitvault verb that addresses a
+ * Resolve `{ repo_id?, project_id? }` for a vault verb that addresses a
  * vault the same way `--repo`/`--project` already do — pin beats remote
  * beats env beats active project, an explicit flag beats all of them.
  * `explicitProjectId`/`explicitRepoId` are the already-parsed flag values
@@ -114,14 +119,14 @@ export async function repoOwnGitvaultTarget(repoDir) {
  * only `--project` is checked against it — matching the task's own wording
  * ("a mismatch between an explicit flag and the repo's remote").
  */
-export async function resolveGitvaultTarget({
+export async function resolveVaultTarget({
   repoDir = process.cwd(),
   explicitProjectId,
   explicitRepoId,
   warn = (line) => console.error(line),
 } = {}) {
   const needsOwn = explicitRepoId == null || explicitProjectId == null;
-  const own = needsOwn ? await repoOwnGitvaultTarget(repoDir) : null;
+  const own = needsOwn ? await repoOwnVaultTarget(repoDir) : null;
 
   if (explicitRepoId != null && own?.source === "pin" && own.repo_id !== explicitRepoId) {
     warn(`warning: --repo ${explicitRepoId} does not match this repo's pinned vault ${own.repo_id} — using --repo ${explicitRepoId}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.95.0",
+  "version": "4.97.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {
@@ -21,7 +21,7 @@
     "fixtures/",
     "core-dist/",
     "sdk/",
-    "gitvault-surface.json"
+    "vault-surface.json"
   ],
   "dependencies": {
     "@hpke/chacha20poly1305": "^1.8.0",

package/sdk/core-dist/keystore.js

@@ -190,7 +190,7 @@ export function removeProject(projectId, path) {
  * bucket, not "unknown") and PERMANENTLY shadows every later wallet-scoped
  * activation for every caller that reads through this module: `resolveProjectId`
  * / `resolveProject` (cli/lib/config.mjs), `projects current`, and every
- * gitvault-verb target resolution. The failure it causes: `repos create`
+ * vault-verb target resolution. The failure it causes: `repos create`
  * calls `projects.provision`, whose `creds.setActiveProject` correctly
  * persists the new project under the real wallet's scoped bucket AND the
  * flat fallback, yet every CLI read of "the active project" resolves the

package/sdk/dist/errors.d.ts

@@ -120,7 +120,7 @@ export declare class ProjectNotFound extends Run402Error {
  * `NOT_AUTHORIZED`, `STEP_UP_REQUIRED`) — since 402 is reserved for
  * genuine payment challenges, this now also covers non-payment 403 denials
  * such as quota (`QUOTA_EXCEEDED`), lifecycle (`PROJECT_FROZEN` /
- * `PROJECT_DORMANT`), and delegate spend-cap denials. Check `body.code` (or
+ * `PROJECT_DORMANT`), and grant-key spend-cap denials. Check `body.code` (or
  * use `formatCanonicalErrorContext`-style parsing) to distinguish these
  * from a true auth failure.
  */
@@ -340,19 +340,19 @@ export declare class TransferFreezeError extends Run402Error {
  * name was not claimed). `push_repo`, `verify_refs`, `submit_gc`,
  * `use_moved_command`, and `access_repair_pending` are repo-surface-
  * consolidation's own additions — see `cli/lib/repos.mjs` for where each is
- * emitted. `configure_mirror` (gitvault-mirror-default) rides `repos create`'s
+ * emitted. `configure_mirror` (vault-mirror-default) rides `repos create`'s
  * result beside the recovery receipt — the customer-owned mirror taught at
- * vault birth. `sync_writers` / `request_writer_sync` (gitvault-multi-writer
+ * vault birth. `sync_writers` / `request_writer_sync` (vault-multi-writer
  * rev 47, D10) are the writer dimension's own pair — `sync_writers` rides
  * `POST /orgs/v1/:org_id/members`'s own gateway response (the caller's next
  * `orgs members add`/`repos access sync` admits a just-added member as a
  * writer on every vault it can reach); `request_writer_sync` is CLIENT-
- * constructed (`GitvaultVault#assertCallerIsWriter`, task 5.8) when a local
+ * constructed (`Vault#assertCallerIsWriter`, task 5.8) when a local
  * push pre-check refuses because this session's own key is not (or is no
  * longer) an admitted writer.
  * Tolerates unknown future gateway types via the `(string & {})` fallback.
  */
-export type NextActionType = "retry" | "poll" | "reconcile_payment" | "authenticate" | "submit_payment" | "renew_tier" | "check_usage" | "resume_deploy" | "edit_request" | "edit_migration" | "create_project" | "initialize_wallet" | "deploy" | "approve_write" | "hand_to_member" | "register_contact" | "contact_staff" | "contact_support" | "gitvault_policy_required" | "set_org_slug" | "set_repo_name" | "push_repo" | "create_nested_repo" | "verify_refs" | "submit_gc" | "use_moved_command" | "access_repair_pending" | "configure_mirror" | "resume_handoff" | "revoke_handoff" | "remove_member" | "sync_writers" | "request_writer_sync" | "join_invite" | "revoke_invite" | "wait_room" | "send_room_message" | "create_manifest" | "create_file" | "check_manifest" | "run_in_directory" | "commit_changes" | "add_subdomain";
+export type NextActionType = "retry" | "poll" | "reconcile_payment" | "authenticate" | "submit_payment" | "renew_tier" | "check_usage" | "resume_deploy" | "edit_request" | "edit_migration" | "create_project" | "initialize_wallet" | "deploy" | "approve_write" | "hand_to_member" | "register_contact" | "contact_staff" | "contact_support" | "vault_policy_required" | "set_org_slug" | "set_repo_name" | "push_repo" | "create_nested_repo" | "verify_refs" | "submit_gc" | "use_moved_command" | "access_repair_pending" | "configure_mirror" | "resume_handoff" | "revoke_handoff" | "remove_member" | "sync_writers" | "request_writer_sync" | "join_invite" | "revoke_invite" | "wait_room" | "send_room_message" | "create_manifest" | "create_file" | "check_manifest" | "run_in_directory" | "commit_changes" | "add_subdomain";
 /**
  * A single advisory "what to do next" entry. Mirrors the gateway's
  * `next_actions[]` shape (`{ type, method?, path?, auth?, why? }`) extended with