@@ -211,8 +211,8 @@ updates:
       - /packages/stack-auth/fuzz
       - /packages/stack-kms/fuzz
       - /packages/stack-encrypt/fuzz
-      - /languages/golang/stackencrypt/guest
-      - /languages/golang/stackauth/guest
+      - /languages/golang/encrypt/guest
+      - /languages/golang/auth/guest
     # Monthly, matching the other two cargo entries.
     schedule:
       interval: monthly
 
@@ -120,8 +120,8 @@ jobs:
         with:
           workspaces: |
             .
-            languages/golang/stackencrypt/guest
-            languages/golang/stackauth/guest
+            languages/golang/encrypt/guest
+            languages/golang/auth/guest
 
       # The HTTP-free core compiles for wasm32-wasip1 with no JS-host backend
       # and no native HTTP/TLS stack in its graph: the invariant the wazero
@@ -155,7 +155,7 @@ jobs:
       # same bytes rather than a stale or rebuilt guest.
       - name: Record the guests' checksums
         run: |
-          for guest in stackencrypt/wasm/stack_encrypt_guest.wasm stackauth/wasm/stack_auth_guest.wasm; do
+          for guest in encrypt/wasm/stack_encrypt_guest.wasm auth/wasm/stack_auth_guest.wasm; do
             (cd languages/golang && openssl dgst -sha256 "$guest" | awk '{print $NF}' > "$guest.sha256" && echo "$guest sha256 $(cat "$guest.sha256")")
           done
 
@@ -164,20 +164,20 @@ jobs:
         with:
           name: wasm-guests
           path: |
-            languages/golang/stackencrypt/wasm/stack_encrypt_guest.wasm
-            languages/golang/stackencrypt/wasm/stack_encrypt_guest.wasm.sha256
-            languages/golang/stackauth/wasm/stack_auth_guest.wasm
-            languages/golang/stackauth/wasm/stack_auth_guest.wasm.sha256
+            languages/golang/encrypt/wasm/stack_encrypt_guest.wasm
+            languages/golang/encrypt/wasm/stack_encrypt_guest.wasm.sha256
+            languages/golang/auth/wasm/stack_auth_guest.wasm
+            languages/golang/auth/wasm/stack_auth_guest.wasm.sha256
           if-no-files-found: error
           retention-days: 1
 
       # Format, vet and hermetic tests on amd64 and 386. The guest's memory
       # lock is best effort, so its test skips where RLIMIT_MEMLOCK refuses
-      # it; CI raises the limit and sets STACKENCRYPT_TESTS_REQUIRE_LOCK so
+      # it; CI raises the limit and sets STACK_ENCRYPT_TESTS_REQUIRE_LOCK so
       # the skip is an error here.
       - name: Go binding
         env:
-          STACKENCRYPT_TESTS_REQUIRE_LOCK: "1"
+          STACK_ENCRYPT_TESTS_REQUIRE_LOCK: "1"
         run: |
           ulimit -l "$(ulimit -H -l)"
           echo "RLIMIT_MEMLOCK: $(ulimit -l) KiB"
@@ -256,7 +256,7 @@ jobs:
       - name: The guests are the ones Linux built and checked
         run: |
           cd languages/golang
-          for guest in stackencrypt/wasm/stack_encrypt_guest.wasm stackauth/wasm/stack_auth_guest.wasm; do
+          for guest in encrypt/wasm/stack_encrypt_guest.wasm auth/wasm/stack_auth_guest.wasm; do
             want=$(cat "$guest.sha256")
             got=$(openssl dgst -sha256 "$guest" | awk '{print $NF}')
             if [ "$want" != "$got" ]; then
@@ -320,7 +320,7 @@ jobs:
       - name: The guests are the ones the wasi-check job built and checked
         run: |
           cd languages/golang
-          for guest in stackencrypt/wasm/stack_encrypt_guest.wasm stackauth/wasm/stack_auth_guest.wasm; do
+          for guest in encrypt/wasm/stack_encrypt_guest.wasm auth/wasm/stack_auth_guest.wasm; do
             want=$(cat "$guest.sha256")
             got=$(openssl dgst -sha256 "$guest" | awk '{print $NF}')
             if [ "$want" != "$got" ]; then
@@ -334,7 +334,7 @@ jobs:
       # call `liveClient`, and not all of them are named `TestLive*`.
       - name: Go live tests
         working-directory: languages/golang
-        run: CGO_ENABLED=0 go test -v ./stackencrypt/...
+        run: CGO_ENABLED=0 go test -v ./encrypt/...
 
       - name: stack-encrypt examples
         run: |
 
@@ -108,7 +108,7 @@ mutants.out/
 
 # The Go module's embedded WASI guests: build outputs of `mise run
 # wasm:guest:build` and `mise run wasm:auth-guest:build`.
-languages/golang/stackencrypt/wasm/*.wasm
-languages/golang/stackauth/wasm/*.wasm
-languages/golang/stackencrypt/wasm/*.sha256
-languages/golang/stackauth/wasm/*.sha256
+languages/golang/encrypt/wasm/*.wasm
+languages/golang/auth/wasm/*.wasm
+languages/golang/encrypt/wasm/*.sha256
+languages/golang/auth/wasm/*.sha256
@@ -92,7 +92,7 @@ Every npm package except EQL lives under `languages/typescript/`: packages in `l
   links are provenance only.
 - `packages/stack-auth`, `packages/stack-profile`, `packages/stack-kms`, `packages/stack-encrypt`, `packages/stack-encrypt-derive`, `packages/stack-guest-abi`: The Rust crates imported from `cipherstash/cipherstash-suite` with their history — `stack-auth` and `stack-profile` (published to crates.io, one version group), `stack-kms` (published to crates.io from 0.1.0, its own version group, re-exported by `stack-encrypt` as `stack_encrypt::kms`), `stack-encrypt` and `stack-encrypt-derive` (published to crates.io from 0.1.0, one version group; `eql-bindings`' `stack-encrypt` feature depends on them from the registry), and `stack-guest-abi` (`publish = false`). They are the members of the **root Cargo workspace**, with the three node binding crates below. See "Working on the Rust crates".
 - `languages/typescript/packages/auth`, `languages/typescript/packages/profile`, `languages/typescript/packages/stack-auth-wasm`: The node bindings of those crates. `@cipherstash/auth` (napi-rs v2) and its six `platforms/*` packages are published to npm from this repository by `release.yml` (`auth-artifacts`, `publish-auth`); a change to what it ships, the `stack-auth` crate included, needs an `@cipherstash/auth` changeset (`require-auth-npm-changeset.yml`). `@cipherstash/profile` and its platforms are private and never published; `@cipherstash/stack-auth-wasm` is private and builds the wasm that `@cipherstash/auth` ships. Their `build` and `test` scripts never invoke cargo; `build:native`, `build:debug` and `test:cargo` do.
-- `languages/golang`: The Go module (`stackencrypt`, `stackauth`, `internal`), a wazero host with no cgo. Its two WASI guests (`*/guest`) are detached Cargo workspaces built by `mise run wasm:guest:build` and `mise run wasm:auth-guest:build`; the `.wasm` files they embed are gitignored. There is no Go release process yet.
+- `languages/golang`: The Go module (`encrypt`, `auth`, `internal`), a wazero host with no cgo. Its two WASI guests (`*/guest`) are detached Cargo workspaces built by `mise run wasm:guest:build` and `mise run wasm:auth-guest:build`; the `.wasm` files they embed are gitignored. There is no Go release process yet.
 - `e2e/*`: Cross-package end-to-end tests (package managers, supply chain, Prisma example README)
 - `languages/typescript/examples/*`: Working apps (basic, prisma, supabase-worker)
 - `docs/plans/*`: Internal design plans. User-facing documentation lives at https://cipherstash.com/docs (not in this repo).
 
@@ -27,8 +27,8 @@ exclude = [
   "packages/stack-encrypt/fuzz",
   # WASI guests for the Go module, built through `wasm:guest:build` and
   # `wasm:auth-guest:build`.
-  "languages/golang/stackencrypt/guest",
-  "languages/golang/stackauth/guest",
+  "languages/golang/encrypt/guest",
+  "languages/golang/auth/guest",
 ]
 
 [workspace.package]
 
@@ -33,7 +33,7 @@ It also carries the source of five Rust crates published to crates.io,
 `packages/stack-profile`) and **`stack-kms`**, **`stack-encrypt`** and
 **`stack-encrypt-derive`** (`packages/stack-kms`, `packages/stack-encrypt`,
 `packages/stack-encrypt-derive`), and of the **Go module** at
-`languages/golang` (`stackencrypt` and `stackauth`, over WASI guests built
+`languages/golang` (`encrypt` and `auth`, over WASI guests built
 from the stack-* crates), which has no release yet. All of these are in scope
 for security reports on the same terms as the npm packages above.
 
 
@@ -1,9 +1,9 @@
-# stackauth
+# auth
 
 The Go binding of the developer profile — the directory `stash auth login`
 writes — read through the `stack-profile` Rust crate running inside a WASI
 guest under [wazero], with `CGO_ENABLED=0`. It is the credential half of
-the Go SDK: it hands a [`stackencrypt`](../stackencrypt) client its client
+the Go SDK: it hands a [`encrypt`](../encrypt) client its client
 key and its bearer token without either package re-deriving the profile's
 layout, and without either importing the other.
 
@@ -16,30 +16,30 @@ cross-process refresh lock for device sessions.
 
 ## Use
 
-Most applications never call this package directly: a `stackencrypt`
+Most applications never call this package directly: a `encrypt`
 client built with `NewClient(ctx)` and no options resolves its credentials with
-`stackencrypt.AutoCredentials`, which reads the environment first and then
+`encrypt.AutoCredentials`, which reads the environment first and then
 the profile, through this package. Use it directly to take the profile
 apart yourself:
 
 ```go
 import (
     "context"
 
-    "github.com/cipherstash/stack/languages/golang/stackauth"
-    "github.com/cipherstash/stack/languages/golang/stackencrypt"
+    "github.com/cipherstash/stack/languages/golang/auth"
+    "github.com/cipherstash/stack/languages/golang/encrypt"
 )
 
 func run(ctx context.Context) error {
-    profile, err := stackauth.Resolve(ctx) // CS_CONFIG_PATH, else ~/.cipherstash
+    profile, err := auth.Resolve(ctx) // CS_CONFIG_PATH, else ~/.cipherstash
     if err != nil {
         return err
     }
     defer profile.Close()
 
     workspace, err := profile.CurrentWorkspaceStore(ctx)
     if err != nil {
-        return err // stackauth.ErrNoCurrentWorkspace: run `stash auth login`
+        return err // auth.ErrNoCurrentWorkspace: run `stash auth login`
     }
     clientID, clientKey, err := workspace.SecretKey(ctx)
     if err != nil {
@@ -50,9 +50,9 @@ func run(ctx context.Context) error {
         return err
     }
     defer source.Close()
-    client, err := stackencrypt.NewClient(ctx,
+    client, err := encrypt.NewClient(ctx,
         // The key is consumed and wiped by NewClient.
-        stackencrypt.WithCredentials(stackencrypt.NewCredentials(clientID, clientKey, source)),
+        encrypt.WithCredentials(encrypt.NewCredentials(clientID, clientKey, source)),
     )
     if err != nil {
         return err
@@ -63,31 +63,31 @@ func run(ctx context.Context) error {
 }
 ```
 
-`stackauth.ClientKey` and `stackencrypt.ClientKey` are one type, so the
+`auth.ClientKey` and `encrypt.ClientKey` are one type, so the
 key goes straight from the profile into the credentials. The profile and
 the strategy are the caller's: the client asks the strategy for a token on
 every request but never closes it, so both stay open until the client is
 closed (the deferred calls above run in that order).
 
-A stackencrypt client takes its token only from a strategy, never a raw
+A encrypt client takes its token only from a strategy, never a raw
 string: a raw token cannot be refreshed when it expires, and would bypass
 the cross-process lock a device-session refresh holds with the `stash` CLI
 (the IdP revokes a whole refresh-token chain when one is used twice).
 `workspace.Token(ctx)` still reads the stored token, for inspection.
 
 With no profile directory at all (CI, a container, a server authenticating
-by federation), `stackauth.OpenWithoutProfile(ctx)` runs the guest with
+by federation), `auth.OpenWithoutProfile(ctx)` runs the guest with
 nothing mounted: the access-key and OIDC strategies work, and every profile
 read is `ErrNoProfile`.
 
 `profile.AccessKey(ctx, crn, key)`, `profile.OIDC(ctx, crn, provider)`, and
-`profile.Auto(ctx)` also return strategies that `stackencrypt.NewCredentials`
+`profile.Auto(ctx)` also return strategies that `encrypt.NewCredentials`
 takes. `Auto` checks `CS_CLIENT_ACCESS_KEY` and
 `CS_WORKSPACE_CRN` first, then the current workspace's stored device session.
 The OIDC provider is a one-method `Token(context.Context) (string, error)`
 interface, called on every token fetch for the JWT of the user the call is
 for; each distinct JWT is exchanged once while its CTS token lasts. Use
-`stackauth.OAuth2TokenSource(source)` to adapt a
+`auth.OAuth2TokenSource(source)` to adapt a
 `golang.org/x/oauth2.TokenSource`. `WithAuthBaseURL(url)` overrides service
 discovery for local tests or a custom CTS host; `WithCacheCapacity(n)` sets
 how many users' CTS tokens an OIDC strategy keeps (1024 unless set), sized to
@@ -107,7 +107,7 @@ session refresh call, on the path `ProfileStore.LockPath` names. A fresh
 token is read without the lock; on refresh the guest re-reads
 auth.json after acquisition and saves refreshed tokens before release.
 
-The crypto guest behind `stackencrypt` is not widened by this package
+The crypto guest behind `encrypt` is not widened by this package
 existing: it still has no filesystem and no environment.
 
 ## Build
 
@@ -1,12 +1,12 @@
-package stackauth
+package auth
 
 import "github.com/cipherstash/stack/languages/golang/internal/guest"
 
 // ClientKey is the ZeroKMS client key as [ProfileStore.SecretKey] reads it
 // out of secretkey.json: opaque (it prints a redaction under every verb and
 // hands its bytes to no caller) and wiped once consumed. It is the same
-// type as stackencrypt.ClientKey, by identity, so a key read here goes
-// straight into stackencrypt.NewCredentials. This package does not import
-// stackencrypt: a binary that only wants the profile does not carry the
-// crypto guest. (stackencrypt imports this one, for AutoCredentials.)
+// type as encrypt.ClientKey, by identity, so a key read here goes
+// straight into encrypt.NewCredentials. This package does not import
+// encrypt: a binary that only wants the profile does not carry the
+// crypto guest. (encrypt imports this one, for AutoCredentials.)
 type ClientKey = guest.ClientKey
@@ -1,4 +1,4 @@
-// Package stackauth is the Go binding of the developer profile: the
+// Package auth is the Go binding of the developer profile: the
 // directory `stash auth login` writes (~/.cipherstash, or CS_CONFIG_PATH),
 // read through the stack-profile crate running unmodified inside a WASI
 // guest under wazero (CGO_ENABLED=0), so the on-disk layout is never
@@ -21,27 +21,27 @@
 // one workspace ([ProfileStore.WorkspaceStore],
 // [ProfileStore.CurrentWorkspaceStore]), and the typed reads of the files a
 // workspace holds: [ProfileStore.SecretKey] hands out the ZeroKMS client key
-// as the opaque [ClientKey] that stackencrypt.NewCredentials takes,
+// as the opaque [ClientKey] that encrypt.NewCredentials takes,
 // [ProfileStore.Token] the stored access token, [ProfileStore.DeviceIdentity]
 // the identity the CLI created. [ProfileStore.Close] releases the guest;
 // stores scoped from it are closed with it.
 //
 // For authentication and refresh, use [ProfileStore.AccessKey],
 // [ProfileStore.OIDC], [ProfileStore.DeviceSession], or [ProfileStore.Auto].
-// Each returns a [Strategy], which is what stackencrypt.NewCredentials takes
-// for the bearer token: the only way a token reaches a stackencrypt client.
+// Each returns a [Strategy], which is what encrypt.NewCredentials takes
+// for the bearer token: the only way a token reaches a encrypt client.
 // A raw token — [ProfileStore.Token]'s included — cannot be refreshed when
 // it expires, and would bypass the cross-process lock a device-session
-// refresh holds with the CLI, so stackencrypt does not accept one. A
+// refresh holds with the CLI, so encrypt does not accept one. A
 // strategy lives in its store's guest, and closing the store closes it. A
-// stackencrypt client given one never closes the strategy or the store:
+// encrypt client given one never closes the strategy or the store:
 // both are the caller's, and stay open until the client is closed.
 // [OAuth2TokenSource] adapts an existing golang.org/x/oauth2.TokenSource
 // into the OIDC provider interface.
 //
 // # Why a second guest
 //
-// The crypto guest behind stackencrypt has no filesystem and no
+// The crypto guest behind encrypt has no filesystem and no
 // environment: a bug or compromise inside it cannot read credentials off
 // disk. Mounting the profile into it would trade that away, and it is the
 // module that handles plaintext and data keys. So the profile lives in its
@@ -63,9 +63,9 @@
 // # Memory
 //
 // The guest's memory holds the client key and the token while a read is
-// in flight. It is supplied the way stackencrypt's is — reserved once so it
+// in flight. It is supplied the way encrypt's is — reserved once so it
 // never moves, locked in RAM and excluded from core dumps where the
 // platform allows, wiped before release, none of it depending on Close
 // running — and [ProfileStore.MemoryLocked] reports whether the lock was
 // granted. [RequireLockedMemory] makes a refused lock an error from Open.
-package stackauth
+package auth
@@ -1,4 +1,4 @@
-package stackauth
+package auth
 
 import (
 	"errors"
@@ -9,7 +9,7 @@ import (
 // Failure kinds the profile reports. The guest reports a status code from
 // the one table every guest shares, so these are the sentinels of the
 // shared decoder exposed under this package's names; an error from
-// stackencrypt of the same kind is the same value.
+// encrypt of the same kind is the same value.
 var (
 	// ErrNotFound is a profile file that does not exist in the store asked:
 	// no secretkey.json, auth.json or device.json there. For the workspace's
@@ -60,5 +60,5 @@ var (
 
 	// ErrNoProfile is a profile directory that does not exist: nothing has
 	// logged in on this machine, or CS_CONFIG_PATH names the wrong place.
-	ErrNoProfile = errors.New("stackauth: no profile directory; run `stash auth login`")
+	ErrNoProfile = errors.New("auth: no profile directory; run `stash auth login`")
 )