feat: 0.2.0 — rename Gitway* types to Anvil* with #[deprecated] aliases

Implements PRD §7.4 versioning ramp step 0.2.0 and resolves Q6: the
three flat re-exports at the crate root drop their inherited Gitway*
prefix.

Renamed:
* GitwaySession   -> AnvilSession
* GitwayConfig    -> AnvilConfig
* GitwayError     -> AnvilError

(GitwayConfigBuilder also renamed to AnvilConfigBuilder; reachable via
anvil_ssh::config::AnvilConfigBuilder, no flat re-export at the crate
root in 0.1 or 0.2.)

The rename touches every source file that referenced the old names —
struct definitions, doc-comments, tests, the throughput benchmark, the
README + CLAUDE + AGENTS scaffolding, and the CHANGELOG entry for 0.2.0.
All internal references now use the new Anvil* names; rustfmt
re-flowed two functions in src/hostkey.rs and src/keygen.rs because
the shorter type names changed line widths.

Backwards compat:
* lib.rs adds three #[deprecated] re-exports so consumers that wrote
  `use anvil_ssh::GitwaySession;` against 0.1.x continue to compile
  with a deprecation warning.  Aliases stay for one major version per
  PRD §7.4; removed in 1.0.0.
* The downstream Gitway workspace bumps its `anvil-ssh` pin and
  renames its in-source `GitwaySession` references to drop the
  warnings (separate PR; not in this commit).

Verification (Windows + Rust 1.88, after `cargo clean`):
* cargo build --release --locked: PASS
* cargo test --lib --tests --locked: 58 passed, 0 failed, 1 ignored
  (52 lib unit + 2 test_clone + 4 test_connection)
* cargo clippy --locked --all-targets -- -D warnings: PASS
* cargo fmt --all --check: PASS
* cargo publish --dry-run --locked: PASS (anvil-ssh v0.2.0 packages
  cleanly, 322.6 KiB / 90.5 KiB compressed, 34 files)

Doctest harness note: 4 of 10 doctests fail locally on Windows with
E0462 (`staticlib delegate instead of rlib`) and "aws_lc_rs not
available in rlib format".  Pre-existing Windows + complex-deps
doctest harness quirk; the same source compiled fine in 0.1.0 with
warm cache.  CI runs the full `cargo test` (including doctests) on
Linux + macOS where this issue does not manifest.

Lockfile note: bumping the package version requires regenerating the
lockfile entry (`anvil-ssh v0.1.0` -> `v0.2.0`).  Done as part of the
Cargo.toml bump; no other lockfile changes.

Author: UnbreakableMJ

AGENTS.md

@@ -28,7 +28,7 @@ Pure-Rust SSH stack for Git tooling: transport, keys, signing, agent.  Foundatio
 1. Find the provider's official SSH host key fingerprint documentation page.
 2. Add `const DEFAULT_<PROVIDER>_HOST: &str` and `const <PROVIDER>_FINGERPRINTS` to `src/hostkey.rs`.
 3. Add a `fingerprints_for_host` match arm covering the new host constant.
-4. Add a `GitwayConfig::<provider>()` convenience constructor in `src/config.rs`.
+4. Add a `AnvilConfig::<provider>()` convenience constructor in `src/config.rs`.
 5. Add tests for the new provider in `hostkey.rs`.
 6. Update `CLAUDE.md` with the new fingerprint rotation URL.
 7. Open a PR; downstream consumers (Gitway and friends) bump their pinned `anvil-ssh` version on next release.
@@ -50,9 +50,9 @@ Pure-Rust SSH stack for Git tooling: transport, keys, signing, agent.  Foundatio
 
 ## Type rename roadmap
 
-- `v0.1.x` — types stay `GitwaySession` / `GitwayConfig` / `GitwayError` (zero-rename extraction; downstream churn limited to crate-name change).
-- `v0.2.0` — rename to `AnvilSession` / `AnvilConfig` / `AnvilError` with `#[deprecated]` aliases.  Aliases stay for one major version.
-- `v1.0.0` — stabilization; cut concurrently with Gitway 1.0.0.
+- `v0.1.x` — types carried over from the source crate as `GitwaySession` / `GitwayConfig` / `GitwayError` to keep the lift-and-shift extraction zero-rename. Downstream churn limited to crate-name change.
+- `v0.2.0` (current) — types renamed to `AnvilSession` / `AnvilConfig` / `AnvilError`. Legacy `Gitway*` names retained as `#[deprecated]` re-exports for one major version.
+- `v1.0.0` — stabilization; cut concurrently with Gitway 1.0.0. Deprecated `Gitway*` aliases removed.
 
 ## Versioning
 

CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to Anvil are documented here.  Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/).
 
+## [0.2.0] — 2026-05-03
+
+### Changed
+
+- **Breaking (with deprecated aliases):** the three flat re-exports at the crate root were renamed to drop the inherited `Gitway*` prefix:
+  - `GitwaySession` → `AnvilSession`
+  - `GitwayConfig` → `AnvilConfig`
+  - `GitwayError` → `AnvilError`
+
+  The legacy names remain available as `#[deprecated]` re-exports for one major version (per [Gitway PRD §7.4](https://github.com/steelbore/gitway/blob/main/Gitway-PRD-v1.0.md)), so consumers that depended on `anvil-ssh = "0.1"` continue to compile with a deprecation warning until they migrate.  Migration is mechanical:
+
+  ```rust
+  // before
+  use anvil_ssh::{GitwayConfig, GitwaySession, GitwayError};
+  // after
+  use anvil_ssh::{AnvilConfig, AnvilSession, AnvilError};
+  ```
+
+  The deprecated aliases will be removed in `1.0.0`.
+
+- The `GitwayConfigBuilder` type returned by `AnvilConfig::builder()` is also renamed to `AnvilConfigBuilder`.  It is reachable via `anvil_ssh::config::AnvilConfigBuilder`; no flat re-export at the crate root in either 0.1 or 0.2 (consumers typically obtain it through `AnvilConfig::builder()`).
+
+### Notes
+
+- All internal references in `src/` (struct definitions, doc-comments, tests) have been updated to the new names.  `cargo build`, `cargo test`, `cargo clippy --all-targets -- -D warnings`, and `cargo fmt --check` all pass on the renamed source.
+- Downstream tracking issue: the [Steelbore/Gitway](https://github.com/Steelbore/Gitway) workspace bumps its `anvil-ssh` pin to `0.2.0` in a follow-up PR and renames its in-source `GitwaySession`/`Config`/`Error` references to drop the deprecation warnings.
+
 ## [0.1.0] — 2026-05-03
 
 ### Added
@@ -18,5 +45,5 @@ All notable changes to Anvil are documented here.  Format follows [Keep a Change
 
 ### Notes
 
-- Type names (`GitwaySession`, `GitwayConfig`, `GitwayError`) carry forward from the source crate unchanged.  They will be renamed to `AnvilSession` / `AnvilConfig` / `AnvilError` in `0.2.0` with `#[deprecated]` aliases.  See [Gitway PRD §7.4](https://github.com/steelbore/gitway/blob/main/Gitway-PRD-v1.0.md) for the extraction plan.
+- Type names carried forward from the source crate as `GitwaySession` / `GitwayConfig` / `GitwayError` to keep the lift-and-shift extraction zero-rename.  These were superseded in 0.2.0 (see above); the legacy names remain available as `#[deprecated]` re-exports for one major version per [Gitway PRD §7.4](https://github.com/steelbore/gitway/blob/main/Gitway-PRD-v1.0.md).
 - This is a *cold-start* extraction: the new repo's git history starts here.  Per-commit history of the original library remains in [steelbore/gitway](https://github.com/steelbore/gitway) — `git blame` and historical context for any line of code can be found there.

CLAUDE.md

@@ -83,9 +83,9 @@ The `ssh-key` RustCrypto stack (`ed25519-dalek` 2.x, `rsa` 0.9, `p256`/`p384`/`p
 
 ## Type rename roadmap
 
-- `v0.1.x` — types stay `GitwaySession` / `GitwayConfig` / `GitwayError`.  Doc-comments and `use` paths reference `anvil_ssh::` (Rust module path), but the type names retain their `Gitway*` prefix.
-- `v0.2.0` — rename types to `Anvil*` with `#[deprecated]` aliases for one major version.
-- `v1.0.0` — stabilization (concurrent with Gitway 1.0.0).
+- `v0.1.x` — types carried over from the source crate as `GitwaySession` / `GitwayConfig` / `GitwayError` (lift-and-shift extraction; only the crate name changed).
+- `v0.2.0` (current) — types renamed to `AnvilSession` / `AnvilConfig` / `AnvilError`. Legacy `Gitway*` names retained as `#[deprecated]` re-exports at the crate root.
+- `v1.0.0` — stabilization (concurrent with Gitway 1.0.0). Deprecated `Gitway*` aliases removed.
 
 ## Related
 

Cargo.lock

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 [package]
 name          = "anvil-ssh"
-version       = "0.1.0"
+version       = "0.2.0"
 edition       = "2021"
 license       = "GPL-3.0-or-later"
 authors       = ["Mohamed Hammad <MJ@S3cure.me>"]

Cargo.toml

@@ -16,20 +16,20 @@ anvil-ssh = "0.1"
 ```
 
 ```rust,no_run
-use anvil_ssh::{GitwayConfig, GitwaySession};
+use anvil_ssh::{AnvilConfig, AnvilSession};
 
 #[tokio::main]
-async fn main() -> Result<(), anvil_ssh::GitwayError> {
-    let config = GitwayConfig::github();
-    let mut session = GitwaySession::connect(&config).await?;
+async fn main() -> Result<(), anvil_ssh::AnvilError> {
+    let config = AnvilConfig::github();
+    let mut session = AnvilSession::connect(&config).await?;
     session.authenticate_best(&config).await?;
     let exit_code = session.exec("git-upload-pack 'steelbore/gitway.git'").await?;
     session.close().await?;
     Ok(())
 }
 ```
 
-The type names (`GitwaySession`, `GitwayConfig`, `GitwayError`) are inherited from the source crate. They will be renamed to `AnvilSession` / `AnvilConfig` / `AnvilError` in `0.2.0` with `#[deprecated]` aliases for one major version.
+The flat re-exports `AnvilSession` / `AnvilConfig` / `AnvilError` were renamed in `0.2.0` from the legacy `GitwaySession` / `GitwayConfig` / `GitwayError` (which were carried over from the source crate to keep the 0.1.0 extraction zero-rename). The legacy names remain available as `#[deprecated]` re-exports for one major version per [Gitway PRD §7.4](https://github.com/steelbore/gitway/blob/main/Gitway-PRD-v1.0.md); they will be removed in `1.0.0`. Migration is mechanical — `s/Gitway/Anvil/g` in your `use anvil_ssh::*;` imports.
 
 ## Modules
 

README.md

@@ -25,7 +25,7 @@
 use std::process::Command;
 use std::time::Instant;
 
-use anvil_ssh::{GitwayConfig, GitwaySession};
+use anvil_ssh::{AnvilConfig, AnvilSession};
 use criterion::{criterion_group, criterion_main, Criterion};
 
 /// Returns `true` when the integration environment variable is set.
@@ -47,8 +47,8 @@ fn bench_gitway_exec(c: &mut Criterion) {
     c.bench_function("gitway_exec", |b| {
         b.iter(|| {
             rt.block_on(async {
-                let config = GitwayConfig::github();
-                let mut session = GitwaySession::connect(&config)
+                let config = AnvilConfig::github();
+                let mut session = AnvilSession::connect(&config)
                     .await
                     .expect("gitway connect");
                 session

benches/throughput.rs

@@ -35,7 +35,7 @@ use std::time::Duration;
 use tokio::process::Command;
 use tokio::time::timeout;
 
-use crate::GitwayError;
+use crate::AnvilError;
 
 /// Hard cap for how long the daemon will wait on an askpass reply.
 ///
@@ -89,10 +89,10 @@ pub async fn confirm(prompt: &str) -> bool {
 ///
 /// # Errors
 ///
-/// Returns [`GitwayError`] when the path fails security validation
+/// Returns [`AnvilError`] when the path fails security validation
 /// (not absolute, world-writable), the spawn itself fails, or the
 /// child does not exit within [`ASKPASS_TIMEOUT`].
-pub async fn confirm_with(askpass: &OsString, prompt: &str) -> Result<bool, GitwayError> {
+pub async fn confirm_with(askpass: &OsString, prompt: &str) -> Result<bool, AnvilError> {
     let path = PathBuf::from(askpass);
     validate_security(&path)?;
 
@@ -110,13 +110,13 @@ pub async fn confirm_with(askpass: &OsString, prompt: &str) -> Result<bool, Gitw
     let status = match timeout(ASKPASS_TIMEOUT, cmd.status()).await {
         Ok(Ok(s)) => s,
         Ok(Err(e)) => {
-            return Err(GitwayError::signing(format!(
+            return Err(AnvilError::signing(format!(
                 "askpass spawn failed for {}: {e}",
                 path.display()
             )));
         }
         Err(_elapsed) => {
-            return Err(GitwayError::signing(format!(
+            return Err(AnvilError::signing(format!(
                 "askpass {} did not respond within {:?}",
                 path.display(),
                 ASKPASS_TIMEOUT
@@ -138,15 +138,15 @@ pub async fn confirm_with(askpass: &OsString, prompt: &str) -> Result<bool, Gitw
 /// subset of the Unix contract we can still enforce. Windows users
 /// wanting stricter checks should place their askpass binary in a
 /// directory their account has exclusive write access to.
-fn validate_security(askpass: &Path) -> Result<(), GitwayError> {
+fn validate_security(askpass: &Path) -> Result<(), AnvilError> {
     if !askpass.is_absolute() {
-        return Err(GitwayError::invalid_config(format!(
+        return Err(AnvilError::invalid_config(format!(
             "SSH_ASKPASS {} must be an absolute path",
             askpass.display()
         )));
     }
     let meta = std::fs::metadata(askpass).map_err(|e| {
-        GitwayError::invalid_config(format!(
+        AnvilError::invalid_config(format!(
             "SSH_ASKPASS {} cannot be stat()ed: {e}",
             askpass.display()
         ))
@@ -158,7 +158,7 @@ fn validate_security(askpass: &Path) -> Result<(), GitwayError> {
         // to the user but writable by anyone on the system is an
         // exploit waiting to happen.
         if meta.permissions().mode() & 0o002 != 0 {
-            return Err(GitwayError::invalid_config(format!(
+            return Err(AnvilError::invalid_config(format!(
                 "SSH_ASKPASS {} is world-writable and cannot be trusted",
                 askpass.display()
             )));

src/agent/askpass.rs

@@ -28,14 +28,14 @@
 //!
 //! let mut agent = Agent::from_env()?;
 //! agent.list()?.iter().for_each(|id| println!("{}", id.fingerprint));
-//! # Ok::<(), anvil_ssh::GitwayError>(())
+//! # Ok::<(), anvil_ssh::AnvilError>(())
 //! ```
 //!
 //! # Errors
 //!
-//! Every operation returns [`GitwayError`]. Agent-protocol failures and
+//! Every operation returns [`AnvilError`]. Agent-protocol failures and
 //! I/O failures are both folded into the `Io` variant with a descriptive
-//! message; callers that care can match via [`GitwayError::is_io`].
+//! message; callers that care can match via [`AnvilError::is_io`].
 //!
 //! # Zeroization
 //!
@@ -56,7 +56,7 @@ use ssh_agent_lib::proto::{
 use ssh_key::{Algorithm, HashAlg, PrivateKey, PublicKey, Signature};
 use zeroize::Zeroizing;
 
-use crate::GitwayError;
+use crate::AnvilError;
 
 // ── Transport abstraction ─────────────────────────────────────────────────────
 //
@@ -105,7 +105,7 @@ pub struct Identity {
 /// Handle to a running SSH agent.
 ///
 /// Thin wrapper over [`ssh_agent_lib::blocking::Client`] that translates
-/// its error type into [`GitwayError`] and the protocol structs into
+/// its error type into [`AnvilError`] and the protocol structs into
 /// more convenient Gitway types.
 #[derive(Debug)]
 pub struct Agent {
@@ -117,12 +117,12 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError::invalid_config`] when `$SSH_AUTH_SOCK` is
-    /// unset or empty, and [`GitwayError::from`] an I/O error when the
+    /// Returns [`AnvilError::invalid_config`] when `$SSH_AUTH_SOCK` is
+    /// unset or empty, and [`AnvilError::from`] an I/O error when the
     /// socket cannot be opened.
-    pub fn from_env() -> Result<Self, GitwayError> {
+    pub fn from_env() -> Result<Self, AnvilError> {
         let sock = env::var("SSH_AUTH_SOCK").map_err(|_e| {
-            GitwayError::invalid_config("SSH_AUTH_SOCK is not set").with_hint(
+            AnvilError::invalid_config("SSH_AUTH_SOCK is not set").with_hint(
                 "No SSH agent is advertised in this shell. Start one with \
                  `gitway agent start -s` and eval the output, or enable the \
                  bundled systemd user unit (`systemctl --user enable --now \
@@ -134,7 +134,7 @@ impl Agent {
         })?;
         if sock.is_empty() {
             return Err(
-                GitwayError::invalid_config("SSH_AUTH_SOCK is empty").with_hint(
+                AnvilError::invalid_config("SSH_AUTH_SOCK is empty").with_hint(
                     "Something cleared `SSH_AUTH_SOCK` to the empty string. \
                  Unset it (`unset SSH_AUTH_SOCK`) and re-export it to a \
                  real socket path, or just restart the shell.",
@@ -148,9 +148,9 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError::from`] the underlying I/O error when the
+    /// Returns [`AnvilError::from`] the underlying I/O error when the
     /// socket cannot be opened.
-    pub fn connect(path: &std::path::Path) -> Result<Self, GitwayError> {
+    pub fn connect(path: &std::path::Path) -> Result<Self, AnvilError> {
         let stream = open_transport(path)?;
         Ok(Self {
             inner: Client::new(stream),
@@ -161,8 +161,8 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] on agent protocol or I/O failure.
-    pub fn list(&mut self) -> Result<Vec<Identity>, GitwayError> {
+    /// Returns [`AnvilError`] on agent protocol or I/O failure.
+    pub fn list(&mut self) -> Result<Vec<Identity>, AnvilError> {
         let raw = self
             .inner
             .request_identities()
@@ -189,13 +189,13 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] on agent protocol or I/O failure.
+    /// Returns [`AnvilError`] on agent protocol or I/O failure.
     pub fn add(
         &mut self,
         key: &PrivateKey,
         lifetime: Option<Duration>,
         confirm: bool,
-    ) -> Result<(), GitwayError> {
+    ) -> Result<(), AnvilError> {
         let identity = AddIdentity {
             credential: Credential::Key {
                 privkey: key.key_data().clone(),
@@ -211,7 +211,7 @@ impl Agent {
         let mut constraints: Vec<KeyConstraint> = Vec::with_capacity(2);
         if let Some(d) = lifetime {
             let secs = u32::try_from(d.as_secs())
-                .map_err(|_e| GitwayError::invalid_config("lifetime exceeds u32 seconds"))?;
+                .map_err(|_e| AnvilError::invalid_config("lifetime exceeds u32 seconds"))?;
             constraints.push(KeyConstraint::Lifetime(secs));
         }
         if confirm {
@@ -230,9 +230,9 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] when the agent rejects the request (e.g.
+    /// Returns [`AnvilError`] when the agent rejects the request (e.g.
     /// identity not loaded) or on I/O failure.
-    pub fn remove(&mut self, public_key: &PublicKey) -> Result<(), GitwayError> {
+    pub fn remove(&mut self, public_key: &PublicKey) -> Result<(), AnvilError> {
         self.inner
             .remove_identity(RemoveIdentity {
                 pubkey: public_key.key_data().clone(),
@@ -244,8 +244,8 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] on agent protocol or I/O failure.
-    pub fn remove_all(&mut self) -> Result<(), GitwayError> {
+    /// Returns [`AnvilError`] on agent protocol or I/O failure.
+    pub fn remove_all(&mut self) -> Result<(), AnvilError> {
         self.inner
             .remove_all_identities()
             .map_err(|e| io_err(format!("agent remove-all failed: {e}")))
@@ -258,11 +258,11 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] when the agent rejects the passphrase or
+    /// Returns [`AnvilError`] when the agent rejects the passphrase or
     /// on I/O failure. The passphrase string passed through to
     /// `ssh-agent-lib` is a fresh `String` derived from `passphrase`; the
     /// caller's [`Zeroizing`] buffer is not moved.
-    pub fn lock(&mut self, passphrase: &Zeroizing<String>) -> Result<(), GitwayError> {
+    pub fn lock(&mut self, passphrase: &Zeroizing<String>) -> Result<(), AnvilError> {
         self.inner
             .lock(passphrase.as_str().to_owned())
             .map_err(|e| io_err(format!("agent lock failed: {e}")))
@@ -272,9 +272,9 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] when the agent rejects the passphrase or
+    /// Returns [`AnvilError`] when the agent rejects the passphrase or
     /// on I/O failure.
-    pub fn unlock(&mut self, passphrase: &Zeroizing<String>) -> Result<(), GitwayError> {
+    pub fn unlock(&mut self, passphrase: &Zeroizing<String>) -> Result<(), AnvilError> {
         self.inner
             .unlock(passphrase.as_str().to_owned())
             .map_err(|e| io_err(format!("agent unlock failed: {e}")))
@@ -296,10 +296,10 @@ impl Agent {
     ///
     /// # Errors
     ///
-    /// Returns [`GitwayError`] when the agent rejects the request
+    /// Returns [`AnvilError`] when the agent rejects the request
     /// (commonly because the key is not loaded, the agent is locked,
     /// or a `--confirm` prompt was denied) or on I/O failure.
-    pub fn sign(&mut self, public_key: &PublicKey, data: &[u8]) -> Result<Signature, GitwayError> {
+    pub fn sign(&mut self, public_key: &PublicKey, data: &[u8]) -> Result<Signature, AnvilError> {
         let flags: u32 = match public_key.algorithm() {
             Algorithm::Rsa { .. } => 4, // SSH_AGENT_RSA_SHA2_512
             _ => 0,
@@ -316,8 +316,8 @@ impl Agent {
 
 // ── Internal helpers ──────────────────────────────────────────────────────────
 
-/// Convert any display-able error into a `GitwayError` with an
+/// Convert any display-able error into a `AnvilError` with an
 /// `std::io::Error` source carrying `message`.
-fn io_err(message: String) -> GitwayError {
-    GitwayError::from(std::io::Error::other(message))
+fn io_err(message: String) -> AnvilError {
+    AnvilError::from(std::io::Error::other(message))
 }