diff --git a/.claude/commands/code-review.md b/.claude/commands/code-review.md
new file mode 100644
index 00000000..498fcfac
--- /dev/null
+++ b/.claude/commands/code-review.md
@@ -0,0 +1,107 @@
+---
+name: code-review
+description: Full code review — SDK patterns, naming, test coverage, then runs /code-smell and /code-security.
+paths:
+  - src/main/java/**/*.java
+  - src/test/java/**/*.java
+---
+
+You are a senior engineer performing a thorough code review on the Skyflow Java SDK.
+
+## Scope
+
+Use `$ARGUMENTS` to determine scope:
+- `full review` — scan all files under `src/main/java/com/skyflow/` recursively (exclude `generated/`)
+- A file or directory path — review only that path
+- Empty / default — review files changed on current branch vs `main`:
+  ```bash
+  git diff main...HEAD --name-only | grep '\.java$' | grep -v 'generated'
+  ```
+
+**Skip entirely:** `src/main/java/com/skyflow/generated/` — Fern-generated REST client, read-only.
+
+---
+
+## Step 1 — SDK Pattern Review
+
+Check the files in scope against the rules below.
+
+### 1. Request / Response / Options patterns
+
+- Request builders are plain data holders — validation happens in `Validations.validateXxxRequest()` inside the controller, not in `build()`. Flag if validation logic is duplicated outside `Validations`.
+- Response getters returning `ArrayList<HashMap<String, Object>>` is the established SDK pattern — do not flag these as violations.
+- All response classes must have `getErrors()` returning `null` (not absent) when no errors.
+- No separate `*Options` classes exist — options are fields on the request builder itself.
+- SDK must not add field-level null/empty validation on top of what the backend enforces. Only structural checks (`table == null`, `values == null`) are permitted.
+
+### 2. Error handling
+
+- All public methods must declare `throws SkyflowException`
+- `SkyflowException` must be thrown (not swallowed) on invalid input
+- No `System.out.println` or bare `e.printStackTrace()` — use `LogUtil`
+- Catch blocks must not silently drop exceptions
+- `catch (Exception e)` without re-throw or explicit handling is a critical issue
+
+### 3. Naming conventions and response field normalisation
+
+Follow the conventions in CLAUDE.md under "Naming Conventions". Key enforcement points:
+- Acronyms as words: `skyflowId`, `tokenUri`, `clientId` — never uppercase abbreviations
+- Builder setters: `setFooId()` not `setFooID()`; constants: `UPPER_SNAKE_CASE`; classes: `PascalCase`
+- Response maps: `skyflowId` (camelCase) only — never `skyflow_id`; `getErrors()` must be present on every response class
+- Deprecated methods: `@Deprecated(since = "x.x", forRemoval = true)` + `@deprecated` Javadoc with `{@link}` to replacement
+
+### 5. Test coverage
+
+- Every public method must have at least one positive and one negative test
+- Tests must use `Assert.assertEquals` / `Assert.assertNull` — not just `Assert.fail` guards
+- No mocking of the production class under test
+- Reflection-based tests on private methods are acceptable only when no public API exercises the method
+
+### 6. Code quality
+
+- No magic strings for API field names — use `Constants` or `ErrorMessage` enums
+- No duplicate validation logic across request classes — belongs in `Validations`
+- No `@SuppressWarnings` without a comment explaining why
+- `LogUtil.printWarningLog` must be used for deprecation warnings, not `System.err`
+
+### Output for Step 1
+
+Group findings by file:
+
+```
+### path/to/File.java
+
+| Severity   | Line | Finding                                                    |
+|------------|------|------------------------------------------------------------|
+| Critical   | 42   | SkyflowException swallowed in catch block                  |
+| Bug        | 87   | skyflow_id not normalised to skyflowId                     |
+| Quality    | 103  | Magic string "records" — use Constants                     |
+```
+
+**Severities:**
+| Level | Meaning |
+|---|---|
+| **Critical** | Data loss, silent failure, security risk — must fix before merge |
+| **Bug** | Wrong behaviour, incorrect output — must fix before merge |
+| **Edge Case** | Unhandled input that will cause runtime failure — fix before merge |
+| **Quality** | Maintainability issue, naming violation, missing pattern — fix before merge |
+
+---
+
+## Step 2 — Code Smell Analysis
+
+Read the file `.claude/commands/code-smell.md` and follow all of its instructions for the same files in scope. Produce its full output (per-file smell table + smell summary + recommendation).
+
+---
+
+## Step 3 — Security Audit
+
+Read the file `.claude/commands/code-security.md` and follow all of its instructions for the same files in scope. Produce its full output (per-finding blocks + summary table + overall risk rating).
+
+---
+
+## Final Verdict
+
+After all three steps, close with:
+1. A tech-debt summary table grouped by category (SDK Patterns / Error Handling / Naming / Tests / Smells / Security)
+2. A verdict: `APPROVE` / `APPROVE WITH FIXES` / `REQUEST CHANGES`
diff --git a/.claude/commands/code-security.md b/.claude/commands/code-security.md
new file mode 100644
index 00000000..0fa69923
--- /dev/null
+++ b/.claude/commands/code-security.md
@@ -0,0 +1,69 @@
+---
+name: code-security
+description: Security audit — credential exposure, input validation, path traversal, HTTP security, token lifecycle, dependency CVEs.
+paths:
+  - src/main/java/com/skyflow/serviceaccount/**/*.java
+  - src/main/java/com/skyflow/config/**/*.java
+  - src/main/java/com/skyflow/utils/**/*.java
+  - src/main/java/com/skyflow/vault/controller/**/*.java
+  - pom.xml
+---
+
+You are a security engineer auditing the Skyflow Java SDK for vulnerabilities.
+
+## Audit Scope
+
+Use `$ARGUMENTS` to determine target files. If none provided, run:
+```bash
+git diff main...HEAD --name-only | grep '\.java$' | grep -v 'generated'
+```
+
+**Skip:** `src/main/java/com/skyflow/generated/` — observations only, no edits.
+
+## Security Checks
+
+### 1. Credential and token exposure (Critical)
+- Bearer tokens, API keys, and private keys must never appear in logs, error messages, exception messages, or `toString()` output
+- `Credentials` fields (`path`, `token`, `apiKey`, `credentialsString`) must not be serialised to logs
+- JWT claims must not be logged
+
+### 2. Input validation (High)
+- All string inputs from callers must be null/empty checked before use
+- File paths passed to `new File(path)` must not allow path traversal (`../`)
+- JSON strings parsed with `JsonParser` must be wrapped in try/catch for `JsonSyntaxException`
+
+### 3. Credentials file handling (High)
+- Credentials files must only be read from paths provided by the caller — no environment variable path injection without sanitisation
+- `FileReader` must be in a try-with-resources or explicitly closed
+
+### 4. HTTP security (Medium)
+- All API calls must go over HTTPS — verify `Utils.getBaseURL` enforces this
+- Authorization headers must not be logged at any log level
+- HTTP timeouts must be configured
+
+### 5. Error information leakage (Medium)
+- `SkyflowException` messages must not include raw server response bodies that could contain PII
+- Stack traces must not be surfaced to callers — wrap in `SkyflowException`
+
+### 6. Dependency vulnerabilities (Low)
+- Note any dependencies that are known to have CVEs (check pom.xml versions)
+
+### 7. Authentication lifecycle (Medium)
+- Bearer token caching must check expiry before reuse
+- Token refresh must be thread-safe (`synchronized` or equivalent)
+
+## Output Format
+
+For each finding:
+
+```
+### path/to/File.java : line N
+
+**Severity:** Critical / High / Medium / Low / Info
+**Risk:** What an attacker could do
+**Trigger:** Input or code path that triggers the vulnerability
+**Fix:** Concrete remediation with code example
+**CWE:** CWE-NNN
+```
+
+End with a summary table and overall risk rating.
diff --git a/.claude/commands/code-smell.md b/.claude/commands/code-smell.md
new file mode 100644
index 00000000..f456a8d8
--- /dev/null
+++ b/.claude/commands/code-smell.md
@@ -0,0 +1,145 @@
+---
+name: code-smell
+description: Structural smell analysis + spell check — long methods, dead code, misplaced validation, deep nesting, magic numbers. Does not check patterns or security.
+paths:
+  - src/main/java/**/*.java
+---
+
+You are a senior engineer performing a code smell analysis on the Skyflow Java SDK.
+
+## Scope
+
+Use `$ARGUMENTS` to determine scope:
+- A file or directory path — analyse only that path
+- Empty / default — analyse files changed on current branch vs `main`:
+  ```bash
+  git diff main...HEAD --name-only | grep '\.java$' | grep -v 'generated'
+  ```
+
+**Skip entirely:** `src/main/java/com/skyflow/generated/` — Fern-generated REST client, read-only.
+
+---
+
+## Spell check
+
+Before analysing smells, run cspell on the files in scope:
+
+```bash
+npx cspell --no-progress "src/**/*.java" ".claude/**/*.md" "CLAUDE.md" "docs/**/*.md" 2>&1 | grep "Unknown word"
+```
+
+Report any spelling violations at **Smell** severity in the per-file table. The word list is in `.cspell.json` — add legitimate project-specific terms there rather than fixing them as typos.
+
+---
+
+## What Are Code Smells
+
+Code smells are structural signals — they do not necessarily mean the code is broken, but they indicate areas of technical debt, reduced readability, or future maintenance risk. All findings are reported at **Smell** severity and do not block merge unless they indicate a design violation.
+
+---
+
+## Smell Catalogue
+
+### Method & Class Size
+
+**Long method** — any method over 40 lines.
+Signal: the method is doing too much. Candidate for decomposition into named private helpers.
+
+**Long class** — any class over 300 lines.
+Signal: the class may be taking on too many responsibilities. Check if it can be split by concern.
+
+**Large parameter list** — more than 4 parameters on a method.
+Signal: consider a config/options object or a builder to group related parameters.
+
+---
+
+### Responsibility Violations
+
+**Business logic in Request/Response classes**
+Request and Response classes are data holders — they carry data, nothing more. Flag any conditional logic, field transformation, or computation beyond null-safe getters.
+Example of a violation: a Response class that renames map keys in `toString()` instead of letting the controller do it.
+
+**toString() with business logic**
+`toString()` should only serialise state for debugging. Logic like field renaming, manual JSON construction, conditional field injection, or iteration belongs in the controller or formatter methods.
+
+**Validation outside `Validations.java`**
+Any `if (x == null) throw new SkyflowException(...)` outside `src/main/java/com/skyflow/utils/validations/` is misplaced validation. All request validation must live in `Validations.validateXxxRequest()`.
+
+---
+
+### Control Flow
+
+**Deep nesting** — more than 3 levels of `if` / `for` / `try` nesting.
+Signal: extract inner blocks to named private methods. Deep nesting hides the happy path.
+
+**Long if-else chains** — more than 4 branches on the same condition.
+Signal: consider a `Map`, `switch`, or polymorphism.
+
+**Null checks scattered**
+Multiple consecutive null guards that could be replaced with `Optional` or an early return guard clause.
+
+---
+
+### Data
+
+**Magic numbers**
+Literal integers or sizes (e.g. `25`, `3600`, `100`) without a named constant. Use `Constants`.
+
+**Raw HashMap chains**
+`HashMap<String, Object>` passed through more than 2 method boundaries without a typed wrapper or explanatory comment. Flag for awareness — do not require an immediate fix.
+
+**Temporary field**
+A class field that is only set in certain code paths and is `null` the rest of the time. Should be a local variable or method parameter instead.
+
+---
+
+### Dead Code
+
+**Unused private methods** — private methods with no callers.
+
+**Unused imports** — any `import` not referenced in the file.
+
+**Unreachable code** — code after `return` / `throw` in the same branch.
+
+**Commented-out code** — blocks of commented code without explanation. Remove entirely or add a `// TODO: [ticket]` with context.
+
+---
+
+### Comments
+
+**Explains what, not why**
+A comment that restates what the code does (`// get the vault ID`) adds no value. Only flag comments that explain the *what* without explaining *why*.
+
+**Stale comment**
+A comment that contradicts the current code — e.g. references a removed parameter, an old method name, or a behaviour that has changed.
+
+---
+
+## Output Format
+
+Group findings by file:
+
+```
+### path/to/File.java
+
+| Smell                     | Line | Detail                                                    |
+|---------------------------|------|-----------------------------------------------------------|
+| Long method               | 42   | processInsertResponse() is 67 lines — decompose          |
+| Business logic in Response| 88   | toString() renames skyflow_id — move to formatter         |
+| Magic number              | 103  | Literal 25 — extract to Constants.MAX_QUERY_RECORDS       |
+| Stale comment             | 210  | References removed tokenizedData field                    |
+| Dead code                 | 315  | Private method buildHeaders() has no callers              |
+```
+
+End with a **Smell Summary** table:
+
+```
+| Category              | Count | Files affected         |
+|-----------------------|-------|------------------------|
+| Long methods          | 2     | VaultController.java   |
+| Business logic in DTO | 1     | QueryResponse.java     |
+| Magic numbers         | 3     | Validations.java       |
+| Dead code             | 2     | Utils.java             |
+```
+
+Close with a recommendation: **CLEAN** / **MINOR DEBT** / **SIGNIFICANT DEBT** and a one-sentence summary.
diff --git a/.claude/commands/commit.md b/.claude/commands/commit.md
new file mode 100644
index 00000000..6aae4614
--- /dev/null
+++ b/.claude/commands/commit.md
@@ -0,0 +1,55 @@
+---
+name: commit
+description: Stage check + Jira-aware commit — extracts ticket ID from branch name and validates against pr.yml commit-message check.
+---
+
+Create a git commit for staged changes on the current branch.
+
+Use `$ARGUMENTS` as the commit message description. If empty, ask the user for a description before proceeding.
+
+## Step 1 — Extract ticket ID from branch name
+
+```bash
+git rev-parse --abbrev-ref HEAD
+```
+
+Extract the Jira ticket ID using the pattern `[A-Z]{1,10}-[0-9]+`:
+- `devesh/SK-1234-fix-foo` → `SK-1234`
+- `karthik/GV-770-ext-auth-json-error` → `GV-770`
+- `username/SDK-2814-some-fix` → `SDK-2814`
+
+If no ticket ID is found, **stop** and ask the user to provide one before continuing.
+
+## Step 2 — Check what is staged
+
+```bash
+git status --short
+git diff --cached --stat
+```
+
+If nothing is staged, list the unstaged files and ask the user which files to stage. Do not run `git add .` — ask for explicit paths (`.env`, `credentials.json`, and `generated/` must never be staged).
+
+## Step 3 — Assemble and validate the commit message
+
+Build the message as:
+```
+<ticket-id> <description>
+```
+
+If the user provided a Conventional Commits prefix (`feat`, `fix`, `chore`, `docs`, `refactor`, `test`), prepend it:
+```
+feat: SK-1234 add bulk insert support
+fix: GV-770 handle null bearer token on refresh
+```
+
+Validate against the `pr.yml` enforced pattern: `(\[?[A-Z]{1,10}-[1-9][0-9]*)|(\[AUTOMATED\])|(Merge)|(Release)`
+- Must contain a Jira ID — a bare description without a ticket ID will fail CI.
+- If validation fails, report the exact requirement and stop.
+
+## Step 4 — Commit
+
+```bash
+git commit -m "<assembled message>"
+```
+
+Report the resulting commit SHA and the commit message first line.
diff --git a/.claude/commands/sdk-sample.md b/.claude/commands/sdk-sample.md
new file mode 100644
index 00000000..a7b84a65
--- /dev/null
+++ b/.claude/commands/sdk-sample.md
@@ -0,0 +1,70 @@
+---
+name: sdk-sample
+description: Generate a Skyflow Java SDK sample file for a vault feature or service account operation. Compile-verified after creation.
+paths:
+  - samples/**/*.java
+  - samples/pom.xml
+---
+
+Create a Skyflow Java SDK sample file demonstrating: $ARGUMENTS
+
+## File placement
+
+| Feature type | Package | Directory |
+|---|---|---|
+| Vault ops (insert/get/update/delete/query/tokenize) | `com.example.vault` | `samples/src/main/java/com/example/vault/` |
+| Service account auth | `com.example.serviceaccount` | `samples/src/main/java/com/example/serviceaccount/` |
+| Connection | `com.example.connection` | `samples/src/main/java/com/example/connection/` |
+| Detect | `com.example.detect` | `samples/src/main/java/com/example/detect/` |
+| Audit event operations | `com.example.audit` | `samples/src/main/java/com/example/audit/` |
+| BIN lookup | `com.example.bin` | `samples/src/main/java/com/example/bin/` |
+
+File name: `<FeatureName>Example.java`
+
+## Structure (follow this order)
+
+1. Package declaration
+2. Imports — only from `com.skyflow.*`, `java.*`; never from `com.skyflow.generated.*`
+3. Public class with `main(String[] args) throws SkyflowException`
+4. Credentials setup — choose based on feature:
+   - **Vault ops:** `credentials.setApiKey("<YOUR_API_KEY>")` or `credentials.setCredentialsString("<YOUR_CREDENTIALS_STRING>")`
+   - **Service account:** `credentials.setPath("credentials.json")` (path to the service account JSON file)
+5. `VaultConfig` with `setVaultId`, `setClusterId`, `setEnv(Env.PROD)`, `setCredentials(credentials)`
+6. Build the Skyflow client:
+   ```java
+   Skyflow skyflowClient = Skyflow.builder()
+       .setLogLevel(LogLevel.DEBUG)
+       .addVaultConfig(vaultConfig)
+       .build();
+   ```
+7. Request object via `*Request.builder()` — options go directly on the builder (no separate Options class):
+   ```java
+   // Example: InsertRequest with tokenMode
+   InsertRequest request = InsertRequest.builder()
+       .table("...")
+       .values(records)
+       .tokenMode(TokenMode.ENABLE)
+       .build();
+   ```
+8. Call the vault method inside a try/catch for `SkyflowException`:
+   ```java
+   InsertResponse response = skyflowClient.vault().insert(request);
+   System.out.println(response);
+   ```
+
+## Rules
+
+- Vault IDs / cluster IDs use placeholders: `"<YOUR_VAULT_ID>"`, `"<YOUR_CLUSTER_ID>"`
+- Credential values use placeholders: `"<YOUR_API_KEY>"`, `"<YOUR_CREDENTIALS_STRING>"`
+- Credentials file path: `"credentials.json"` (relative — no absolute paths)
+- Always catch `SkyflowException` and print `e.getMessage()`
+- No separate `*Options` classes — they don't exist in this SDK; use request builder methods
+- Keep under 80 lines
+
+## After creating the file
+
+```bash
+cd samples && mvn compile -q 2>&1 | tail -20
+```
+
+Report the file path and any compile errors.
diff --git a/.claude/commands/test.md b/.claude/commands/test.md
new file mode 100644
index 00000000..e690a355
--- /dev/null
+++ b/.claude/commands/test.md
@@ -0,0 +1,73 @@
+---
+name: test
+description: Quality pipeline — compile, checkstyle, build, tests, coverage analysis. Pass a class name to target a single test class.
+paths:
+  - src/**/*.java
+  - pom.xml
+---
+
+Run the Skyflow Java SDK quality pipeline.
+
+Use `$ARGUMENTS` to target a specific test class (e.g. `BearerTokenTests`). If empty, run the full suite.
+
+> Baseline failures are listed in CLAUDE.md under "Known Pre-existing Test Failures".
+> Do not investigate them unless specifically asked. Only report failures **beyond** that baseline.
+
+## Pipeline
+
+### Step 1 — Compile
+```bash
+mvn compile -q 2>&1 | tail -20
+```
+Expected: no output (clean compile). Report any errors.
+
+### Step 2 — Checkstyle
+```bash
+mvn checkstyle:check -q 2>&1 | tail -20
+```
+Note: `failsOnError=false` in pom.xml means the build will not fail even if violations exist — check the output for `[WARN]` checkstyle lines. Violations are excluded from `generated/` by pom config.
+
+### Step 3 — Build
+```bash
+mvn package -DskipTests -q 2>&1 | tail -20
+```
+Expected: BUILD SUCCESS.
+
+### Step 4 — Tests
+If `$ARGUMENTS` is set:
+```bash
+mvn test -Dtest=$ARGUMENTS -q 2>&1 | tail -40
+```
+Otherwise:
+```bash
+mvn test -q 2>&1 | tail -40
+```
+Report: tests run, failures, errors. Flag any pre-existing failures separately from new ones.
+
+### Step 5 — Coverage analysis
+Flag any public interface class (`src/main/java/com/skyflow/vault/`, `src/main/java/com/skyflow/config/`, `src/main/java/com/skyflow/serviceaccount/`) that has no corresponding test file under `src/test/`.
+
+For classes that do have tests, check whether each public method has at least one positive and one negative test case. List any gaps.
+
+### Step 6 — Edge case identification
+For any test class below complete coverage, identify missing scenarios:
+- Null / empty inputs
+- Invalid types / wrong enum values
+- Concurrent / reuse scenarios
+- Error paths (API rejection, network failure)
+
+Write concrete JUnit 4 test method stubs (not full implementations) for each gap.
+
+### Step 7 — Report
+
+```
+| Step | Status | Notes |
+|---|---|---|
+| Compile | ✅ / ❌ | ... |
+| Checkstyle | ✅ / ❌ | ... |
+| Build | ✅ / ❌ | ... |
+| Tests | ✅ / ❌ | N passed, M failed |
+| Coverage gaps | ... | list classes |
+```
+
+Conclude with **READY TO MERGE** or **NEEDS FIXES** and a prioritised fix list.
diff --git a/.claude/hooks/checkstyle-on-edit.py b/.claude/hooks/checkstyle-on-edit.py
new file mode 100644
index 00000000..4fd0787d
--- /dev/null
+++ b/.claude/hooks/checkstyle-on-edit.py
@@ -0,0 +1,19 @@
+import sys, json, subprocess, os
+
+d = json.load(sys.stdin)
+f = d.get('tool_input', {}).get('file_path', d.get('file_path', ''))
+if not f or not f.endswith('.java'):
+    sys.exit(0)
+
+root = '/home/devb/SDK/skyflow-java'
+marker = 'src/main/java/'
+if marker in f:
+    rel = f.split(marker, 1)[1]
+    args = ['mvn', 'checkstyle:check', '-q', '-Dcheckstyle.includes=' + rel]
+else:
+    args = ['mvn', 'checkstyle:check', '-q']
+
+r = subprocess.run(args, capture_output=True, text=True, cwd=root)
+out = (r.stdout + r.stderr).strip()
+if out:
+    print('\n'.join(out.splitlines()[-20:]))
diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 00000000..1d00baed
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,30 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 .claude/hooks/checkstyle-on-edit.py"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [
+      "Bash(mvn *)",
+      "Bash(java *)",
+      "Bash(python3 *)",
+      "Bash(git *)",
+      "Bash(find *)",
+      "Bash(grep *)",
+      "Bash(npx cspell *)"
+    ],
+    "deny": [
+      "Edit(src/main/java/com/skyflow/generated/**)",
+      "Write(src/main/java/com/skyflow/generated/**)"
+    ]
+  }
+}
diff --git a/.claude/skills/requesting-code-review/SKILL.md b/.claude/skills/requesting-code-review/SKILL.md
new file mode 100644
index 00000000..9f662842
--- /dev/null
+++ b/.claude/skills/requesting-code-review/SKILL.md
@@ -0,0 +1,76 @@
+---
+name: requesting-code-review
+description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
+paths:
+  - src/main/java/**/*.java
+  - src/test/java/**/*.java
+---
+
+# Requesting Code Review
+
+**Core principle:** Review early, review often. Review after each task — catch issues before they compound.
+
+## When to Request Review
+
+**Mandatory:**
+- After each task in subagent-driven development
+- After completing a major feature
+- Before merge to main
+
+**Optional but valuable:**
+- When stuck (fresh perspective)
+- Before refactoring (baseline check)
+- After fixing a complex bug
+
+## How to Request
+
+**1. Pick the right command:**
+
+| Change type | Command |
+|---|---|
+| SDK logic, patterns, naming, tests | `/code-review` — SDK checks + smell + security |
+| Structural debt only | `/code-smell` — standalone smell analysis |
+| Auth, credentials, tokens, HTTP | `/code-security` — standalone security audit |
+
+For security-sensitive changes, run both:
+```bash
+/code-review src/main/java/com/skyflow/serviceaccount/
+/code-security src/main/java/com/skyflow/serviceaccount/
+```
+
+**2. Fork context — dispatch a subagent reviewer:**
+
+The commands above run in the current session and share your context. For an independent second opinion (no confirmation bias, preserved main context window), dispatch a fresh subagent:
+
+```
+Agent tool (general-purpose):
+  description: "SDK code review"
+  prompt: |
+    You are a senior engineer reviewing the Skyflow Java SDK.
+
+    Read CLAUDE.md for project conventions, then read and follow
+    .claude/commands/code-review.md for the full review process.
+
+    Git range to review:
+      Base: {BASE_SHA}
+      Head: {HEAD_SHA}
+
+    Run:
+      git diff --stat {BASE_SHA}..{HEAD_SHA}
+      git diff {BASE_SHA}..{HEAD_SHA}
+
+    Description of what was implemented:
+      {DESCRIPTION}
+```
+
+Get the SHAs:
+```bash
+BASE_SHA=$(git merge-base main HEAD)   # branch vs main
+HEAD_SHA=$(git rev-parse HEAD)
+```
+
+**3. Act on feedback:**
+- Fix Critical issues immediately
+- Fix Important issues before proceeding
+- Note Minor/Smell issues for later
+- Push back with reasoning if you disagree
diff --git a/.cspell.json b/.cspell.json
index 757f0c48..a982f837 100644
--- a/.cspell.json
+++ b/.cspell.json
@@ -91,6 +91,7 @@
     "Behaviour",
     "behaviours",
     "sanitisation",
+    "prioritise",
     "recognised",
     "unrecognised",
     "nocreds",
diff --git a/.github/workflows/claude-changelog.yml b/.github/workflows/claude-changelog.yml
new file mode 100644
index 00000000..aae70fa2
--- /dev/null
+++ b/.github/workflows/claude-changelog.yml
@@ -0,0 +1,86 @@
+name: Claude Changelog
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - '*.*.*-beta.*'
+
+permissions:
+  contents: write
+
+jobs:
+  generate-changelog:
+    name: Generate Release Notes
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get previous tag
+        id: previoustag
+        uses: WyriHaximus/github-action-get-previous-tag@v1
+        with:
+          fallback: '0.0.0'
+
+      - name: Get commits since previous tag
+        id: commits
+        run: |
+          PREV="${{ steps.previoustag.outputs.tag }}"
+          CURR="${{ github.ref_name }}"
+          COMMITS=$(git log "${PREV}..${CURR}" --oneline \
+            | grep -v '^\S* \[AUTOMATED\]' \
+            | grep -v '^\S* Merge ' \
+            | grep -v '^\S* \[AUTOMATED\]')
+          echo "log<<EOF" >> $GITHUB_OUTPUT
+          echo "$COMMITS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Install Claude CLI
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Generate release notes
+        id: notes
+        continue-on-error: true
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          PREV="${{ steps.previoustag.outputs.tag }}"
+          CURR="${{ github.ref_name }}"
+          COMMITS="${{ steps.commits.outputs.log }}"
+          NOTES=$(claude --print --model claude-sonnet-4-5 -p "
+          Generate GitHub Release notes for the Skyflow Java SDK.
+
+          Release: $CURR (previous: $PREV)
+
+          Commits:
+          $COMMITS
+
+          Rules:
+          - Group into sections: ## Features, ## Bug Fixes, ## Security, ## Breaking Changes
+          - Omit any section with no entries
+          - Each entry: bullet point with a concise one-line description; include the Jira ticket ID if present (e.g. SK-1234)
+          - Strip PR merge numbers like (#323) — keep the substance
+          - Skip [AUTOMATED] commits, version bump commits, and bare merge commits
+          - Breaking Changes section must come first if present
+          - End with: _Full changelog: https://github.com/skyflowapi/skyflow-java/compare/${PREV}...${CURR}_
+
+          Output only the markdown. No preamble or explanation.
+          ")
+          echo "notes<<EOF" >> $GITHUB_OUTPUT
+          echo "$NOTES" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Create or update GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.ref_name }}"
+          NOTES="${{ steps.notes.outputs.notes }}"
+          if gh release view "$TAG" > /dev/null 2>&1; then
+            gh release edit "$TAG" --notes "$NOTES"
+          else
+            gh release create "$TAG" --notes "$NOTES" --title "Release $TAG"
+          fi
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
new file mode 100644
index 00000000..821b2d50
--- /dev/null
+++ b/.github/workflows/claude-pr-review.yml
@@ -0,0 +1,157 @@
+name: Claude PR Review
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**/*.java'
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  sdk-patterns-review:
+    name: SDK Patterns & Naming Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Claude CLI
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Get changed Java files
+        id: changed-files
+        run: |
+          FILES=$(git diff --name-only origin/${{ github.base_ref }}...${{ github.sha }} \
+            | grep '\.java$' \
+            | grep -v 'generated' \
+            | tr '\n' ' ')
+          echo "files=$FILES" >> $GITHUB_OUTPUT
+
+      - name: Run SDK patterns review
+        if: steps.changed-files.outputs.files != ''
+        id: review
+        continue-on-error: true
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          FILES="${{ steps.changed-files.outputs.files }}"
+          REVIEW=$(claude --print --model claude-sonnet-4-5 -p "
+          You are a senior engineer reviewing the Skyflow Java SDK.
+
+          Review the following changed Java files for SDK pattern violations:
+          1. Request/Response/Options patterns — builders are data holders, validation in Validations.java only
+          2. Error handling — all public methods throw SkyflowException, no swallowed exceptions, no bare println/printStackTrace
+          3. Naming — acronyms as words (skyflowId not skyflowID, tokenUri not tokenURI); UPPER_SNAKE constants; PascalCase classes
+          4. Response normalisation — skyflowId not skyflow_id in response maps; getErrors() present on every response class
+          5. Code quality — no magic strings (use Constants), no @SuppressWarnings without comment, deprecation via LogUtil.printWarningLog
+
+          Skip src/main/java/com/skyflow/generated/ entirely.
+
+          Files to review: $FILES
+
+          For each file with findings, produce a markdown table:
+          | Severity | Line | Finding |
+          Severities: Critical (data loss/security), Bug (wrong behaviour), Quality (naming/patterns).
+          Skip Info-level observations. If no findings for a file, omit it.
+          If no findings at all, write: 'No issues found.'
+
+          End with one of: APPROVE / APPROVE WITH FIXES / REQUEST CHANGES
+          ")
+          echo "result<<EOF" >> $GITHUB_OUTPUT
+          echo "$REVIEW" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Post review comment
+        if: steps.changed-files.outputs.files != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const review = `${{ steps.review.outputs.result }}`;
+            const files = `${{ steps.changed-files.outputs.files }}`;
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.payload.pull_request.number,
+              body: `## Claude SDK Patterns Review\n\n${review}\n\n---\n_Files reviewed: \`${files}\`_`
+            });
+
+  security-review:
+    name: Security Review (serviceaccount changes)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check for serviceaccount changes
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            serviceaccount:
+              - 'src/**/serviceaccount/**/*.java'
+
+      - name: Install Claude CLI
+        if: steps.filter.outputs.serviceaccount == 'true'
+        run: npm install -g @anthropic-ai/claude-code
+
+      - name: Get changed serviceaccount files
+        if: steps.filter.outputs.serviceaccount == 'true'
+        id: sa-files
+        run: |
+          FILES=$(git diff --name-only origin/${{ github.base_ref }}...${{ github.sha }} \
+            | grep 'serviceaccount' \
+            | grep '\.java$' \
+            | tr '\n' ' ')
+          echo "files=$FILES" >> $GITHUB_OUTPUT
+
+      - name: Run security audit
+        if: steps.filter.outputs.serviceaccount == 'true' && steps.sa-files.outputs.files != ''
+        id: security
+        continue-on-error: true
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          FILES="${{ steps.sa-files.outputs.files }}"
+          AUDIT=$(claude --print --model claude-sonnet-4-5 -p "
+          You are a security engineer auditing the Skyflow Java SDK serviceaccount module.
+
+          Audit the following files for:
+          1. Credential and token exposure — bearer tokens, API keys, private keys must never appear in logs, error messages, or toString() output
+          2. Path traversal — file paths passed to new File(path) must not allow ../
+          3. JSON parsing — JsonParser calls must be wrapped in try/catch for JsonSyntaxException
+          4. HTTP security — all API calls must be HTTPS; Authorization headers must not be logged at any level
+          5. Token lifecycle — bearer token caching must check expiry before reuse; token refresh must be thread-safe
+
+          Files: $FILES
+
+          For each finding:
+          **Severity:** Critical / High / Medium / Low
+          **File:Line:** path:N
+          **Risk:** one sentence
+          **Fix:** one concrete sentence
+
+          If no findings, write: 'No security issues found.'
+          End with overall risk rating: LOW / MEDIUM / HIGH / CRITICAL
+          ")
+          echo "result<<EOF" >> $GITHUB_OUTPUT
+          echo "$AUDIT" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Post security comment
+        if: steps.filter.outputs.serviceaccount == 'true' && steps.sa-files.outputs.files != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const audit = `${{ steps.security.outputs.result }}`;
+            const files = `${{ steps.sa-files.outputs.files }}`;
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.payload.pull_request.number,
+              body: `## Claude Security Audit (serviceaccount)\n\n${audit}\n\n---\n_Files audited: \`${files}\`_`
+            });
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..00904528
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,148 @@
+---
+name: skyflow-java-sdk
+description: Skyflow Java SDK project context — naming conventions, build commands, known failures, and slash commands. Loaded for all Java source, test, and sample files.
+paths:
+  - src/**/*.java
+  - samples/**/*.java
+  - pom.xml
+  - checkstyle.xml
+---
+
+# Skyflow Java SDK — Claude Code Instructions
+
+## Project Overview
+
+This is the Skyflow Java SDK (`skyflow-java`). It provides a Java interface to the Skyflow Data Privacy Vault API — vault operations (insert, get, update, delete, query, tokenize, detokenize), service account authentication (bearer tokens, signed data tokens), connections, detect, and audit.
+
+**v1 (maintenance mode, `v1` branch):** Security and bug fixes only — no new features. EOL announced: **October 31, 2026**. 
+
+**Current stable version: v2.1** — supports PDB vaults. This is what customers use.
+
+**v3 (pre-release, Flow DB only):** v3 is *not* a full replacement for v2. It adds Flow DB-specific operations used by the [Spark wrapper](https://github.com/skyflowapi/vault-workflows):
+- `bulkInsert`
+- `batchProcessing` (`batchSize` + `concurrencyLimit`)
+
+v3 does not yet have full parity with v2. Do not treat v3 as the general SDK — scope v3 work strictly to Flow DB features unless explicitly told otherwise.
+
+## Critical Boundary — Generated Code
+
+**Never edit files under `src/main/java/com/skyflow/generated/`.**
+
+These are auto-generated by [Fern](https://buildwithfern.com) from the Skyflow API definition. Manual edits are overwritten on the next generation run. If you find a bug in generated code, report it — do not patch it directly.
+
+The `pom.xml` checkstyle and test configs already exclude `generated/` from all checks.
+
+## Project Structure
+
+```
+src/
+  main/java/com/skyflow/
+    config/          # VaultConfig, Credentials, ConnectionConfig
+    vault/           # controller/, data/, tokens/, connection/, audit/, bin/, detect/
+    serviceaccount/  # BearerToken, SignedDataTokens (JWT + credential parsing)
+    enums/           # LogLevel, RedactionType, TokenMode, Env
+    errors/          # SkyflowException, ErrorCode, ErrorMessage
+    utils/           # Utils, Constants, HttpUtility, LogUtil, Validations
+    generated/       # ← FERN-GENERATED, DO NOT EDIT
+  test/java/com/skyflow/
+    ...              # JUnit 4 tests mirroring main structure
+samples/             # Standalone Maven project — vault / serviceaccount / detect / connection
+docs/
+  superpowers/specs/ # Design specs
+  superpowers/plans/ # Implementation plans
+```
+
+## Naming Conventions
+
+- **Acronyms as words:** `skyflowId` (not `skyflowID`), `clientId` (not `clientID`), `tokenUri` (not `tokenURI`), `keyId` (not `keyID`)
+- **Builder setters:** `setVaultId()`, `setClusterId()`, `setSkyflowId()` — never `setVaultID()`
+- **Response maps:** always use `skyflowId` (camelCase) — the raw API returns `skyflow_id` (snake_case) which VaultController normalises before returning to callers
+- **Constants class:** use `com.skyflow.utils.Constants` for string literals; `ErrorMessage` enum for error message strings
+
+## Build and Test
+
+```bash
+mvn compile -q              # compile
+mvn checkstyle:check -q     # lint (config: checkstyle.xml)
+mvn test -q                 # full test suite (JUnit 4)
+mvn test -Dtest=ClassName   # single test class
+mvn package -DskipTests -q  # build jar
+```
+
+Samples (separate Maven project):
+```bash
+cd samples && mvn compile -q
+```
+
+## Credentials JSON Format
+
+The SDK reads a `credentials.json` file for service account authentication. The canonical field names (v3+) are:
+
+```json
+{
+  "clientId": "...",
+  "keyId": "...",
+  "tokenUri": "...",
+  "privateKey": "..."
+}
+```
+
+The legacy all-caps forms (`clientID`, `keyID`, `tokenURI`) are accepted as fallbacks for migration.
+
+## Known Pre-existing Test Failures
+
+These failures exist on `main` and are **not regressions** — do not investigate them unless specifically asked:
+
+| Test class | Failure | Cause |
+|---|---|---|
+| `HttpUtilityTests` | `InaccessibleObject` (all tests) | JDK 21 + PowerMock incompatibility — PowerMock cannot reflect into `java.net` |
+| `TokenTests#testExpiredTokenForIsExpiredToken` | Environment error | Requires live credentials |
+| `VaultClientTests#testSetBearerTokenWithEnvCredentials` | Environment error | Requires `SKYFLOW_CREDENTIALS` env var |
+| `ConnectionClientTests#testSetBearerTokenWithEnvCredentials` | Environment error | Requires `SKYFLOW_CREDENTIALS` env var |
+
+Run `mvn test -q 2>&1 | grep -E "Tests run|FAIL|ERROR"` to see the current baseline.
+
+## Active Work
+
+See `docs/superpowers/specs/` for in-progress design specs and `docs/superpowers/plans/` for implementation plans.
+
+## Slash Commands
+
+- `/code-review` — full review: SDK patterns + code smells + security (Steps 2 and 3 read `.claude/commands/code-smell.md` and `.claude/commands/code-security.md` at runtime)
+- `/code-smell` — standalone structural smell analysis only (long methods, dead code, misplaced logic)
+- `/code-security` — standalone security audit only (credentials, input validation, HTTP security)
+- `/sdk-sample <feature>` — generate a sample file for a feature
+- `/test [ClassName]` — run quality pipeline (compile → checkstyle → build → test → coverage)
+- `/commit <description>` — stage check + Jira-aware commit (extracts ticket ID from branch name)
+
+## Commit & PR Guidelines
+
+### Commit messages
+Every commit on a PR branch **must** include a Jira ticket ID — enforced by the `check-commit-message` step in `.github/workflows/pr.yml`.
+
+Accepted formats:
+```
+SK-1234 short description
+SK-1234: short description
+feat: SK-1234 short description
+fix(SK-1234): short description
+```
+
+Exempt patterns (no ticket needed):
+- `[AUTOMATED]` — release version bumps only
+- `Merge ...` — merge commits
+- `Release ...` — release commits
+
+Conventional Commits prefixes (`feat:`, `fix:`, `chore:`, `docs:`) are encouraged but only valid alongside a Jira ID.
+
+### Branch naming
+Branch name must include your GitHub username:
+
+```
+<github-username>/<ticket-id>-<short-description>
+```
+
+Example: `karthik/GV-770-ext-auth-json-error`
+
+### PR template
+The `.github/pull_request_template.md` requires: **Why**, **Goal**, **Testing** sections. Tech debt section is optional.
diff --git a/docs/migrate_to_v2.md b/docs/migrate_to_v2.md
deleted file mode 100644
index 671210fd..00000000
--- a/docs/migrate_to_v2.md
+++ /dev/null
@@ -1,284 +0,0 @@
-# Skyflow Java SDK — V1 to V2 Migration Guide
-
-This guide covers the steps to migrate the Skyflow Java SDK from v1 to v2.
-
----
-
-## Authentication options
-
-In V2, multiple authentication options are available. You can now provide credentials in the following ways:
-
-- Environment variable (`SKYFLOW_CREDENTIALS`) _(Recommended)_
-- API Key
-- Path to credentials JSON file
-- Stringified JSON of credentials
-- Bearer token
-
-**V1 (Old)**
-
-```java
-static class DemoTokenProvider implements TokenProvider {
-    @Override
-    public String getBearerToken() throws Exception {
-        ResponseToken res = null;
-        try {
-            String filePath = "<YOUR_CREDENTIALS_FILE_HERE>";
-            res = Token.generateBearerToken(filePath);
-        } catch (SkyflowException e) {
-            e.printStackTrace();
-        }
-        return res.getAccessToken();
-    }
-}
-```
-
-**V2 (New): Choose one of the following:**
-
-```java
-// Option 1: API Key (Recommended)
-Credentials skyflowCredentials = new Credentials();
-skyflowCredentials.setApiKey("<YOUR_API_KEY>");
-
-// Option 2: Environment Variable (Recommended)
-// Set SKYFLOW_CREDENTIALS in your environment
-
-// Option 3: Credentials File
-skyflowCredentials.setPath("<YOUR_CREDENTIALS_FILE_PATH>");
-
-// Option 4: Stringified JSON
-skyflowCredentials.setCredentialsString("<YOUR_CREDENTIALS_STRING>");
-
-// Option 5: Bearer Token
-skyflowCredentials.setToken("<BEARER_TOKEN>");
-```
-
-> **Notes:**
-> - Use only ONE authentication method per credentials object.
-> - API Key or environment variable are recommended for production.
-> - For priority order see [Quickstart — Initialize the client](../README.md#initialize-the-client).
-
----
-
-## Initializing the client
-
-V2 introduces a builder pattern for client initialization with multi-vault support.
-
-**Key changes:**
-- `vaultUrl` replaced with `clusterId` (derived from vault URL)
-- Added `env` specification (e.g. `Env.PROD`, `Env.SANDBOX`)
-- Log level is now per-client-instance
-
-**V1 (Old)**
-
-```java
-DemoTokenProvider demoTokenProvider = new DemoTokenProvider();
-SkyflowConfiguration skyflowConfig = new SkyflowConfiguration(
-    "<VAULT_ID>", "<VAULT_URL>", demoTokenProvider
-);
-Skyflow skyflowClient = Skyflow.init(skyflowConfig);
-```
-
-**V2 (New)**
-
-```java
-Credentials credentials = new Credentials();
-credentials.setPath("<YOUR_CREDENTIALS_FILE_PATH>");
-
-VaultConfig config = new VaultConfig();
-config.setVaultId("<YOUR_VAULT_ID>");
-config.setClusterId("<YOUR_CLUSTER_ID>");
-config.setEnv(Env.PROD);
-config.setCredentials(credentials);
-
-Skyflow skyflowClient = Skyflow.builder()
-    .setLogLevel(LogLevel.DEBUG)
-    .addVaultConfig(config)
-    .build();
-```
-
----
-
-## Request and response structure
-
-V2 removes third-party JSON objects in favour of native `ArrayList` and `HashMap` with a builder pattern for requests.
-
-**V1 (Old) — Request**
-
-```java
-JSONObject recordsJson = new JSONObject();
-JSONArray recordsArrayJson = new JSONArray();
-JSONObject recordJson = new JSONObject();
-recordJson.put("table", "cards");
-JSONObject fieldsJson = new JSONObject();
-fieldsJson.put("cardNumber", "41111111111");
-fieldsJson.put("cvv", "123");
-recordJson.put("fields", fieldsJson);
-recordsArrayJson.add(recordJson);
-recordsJson.put("records", recordsArrayJson);
-try {
-    JSONObject insertResponse = skyflowClient.insert(records);
-} catch (SkyflowException e) {
-    System.out.println(e);
-}
-```
-
-**V2 (New) — Request**
-
-```java
-HashMap<String, Object> value = new HashMap<>();
-value.put("<COLUMN_NAME_1>", "<COLUMN_VALUE_1>");
-value.put("<COLUMN_NAME_2>", "<COLUMN_VALUE_2>");
-ArrayList<HashMap<String, Object>> values = new ArrayList<>();
-values.add(value);
-
-InsertRequest insertRequest = InsertRequest.builder()
-    .table("<TABLE_NAME>")
-    .values(values)
-    .returnTokens(true)
-    .build();
-
-InsertResponse response = skyflowClient.vault().insert(insertRequest);
-```
-
-**V1 (Old) — Response**
-
-```json
-{
-  "records": [
-    {
-      "table": "cards",
-      "fields": {
-        "skyflow_id": "16419435-aa63-4823-aae7-19c6a2d6a19f",
-        "cardNumber": "f3907186-e7e2-466f-91e5-48e12c2bcbc1",
-        "cvv": "1989cb56-63da-4482-a2df-1f74cd0dd1a5"
-      }
-    }
-  ]
-}
-```
-
-**V2 (New) — Response**
-
-```json
-{
-  "insertedFields": [
-    {
-      "skyflowId": "9fac9201-7b8a-4446-93f8-5244e1213bd1",
-      "card_number": "5484-7829-1702-9110",
-      "cardholder_name": "b2308e2a-c1f5-469b-97b7-1f193159399b"
-    }
-  ],
-  "errors": null
-}
-```
-
----
-
-## Request options
-
-V2 builder pattern replaces V1 options objects.
-
-**V1 (Old)**
-
-```java
-InsertOptions insertOptions = new InsertOptions(true);
-```
-
-**V2 (New)**
-
-```java
-InsertRequest request = InsertRequest.builder()
-    .table("<TABLE_NAME>")
-    .values(values)
-    .continueOnError(false)
-    .tokenMode(TokenMode.DISABLE)
-    .returnTokens(false)
-    .upsert("<UPSERT_COLUMN>")
-    .build();
-```
-
----
-
-## Error structure
-
-V2 provides richer error details for easier debugging.
-
-**V1 (Old)**
-
-```json
-{
-  "code": "<http_code>",
-  "description": "<description>"
-}
-```
-
-**V2 (New)**
-
-```json
-{
-  "httpStatus": "<http_status>",
-  "grpcCode": "<grpc_code>",
-  "httpCode": "<http_code>",
-  "message": "<message>",
-  "requestId": "<request_id>",
-  "details": ["<details>"]
-}
-```
-
----
-
-## Credential field names (v2.1+)
-
-The credentials JSON file field names are updated to follow Java camelCase conventions. Both old and new forms are permanently accepted.
-
-| Old form (still accepted) | New form (preferred) |
-|---|---|
-| `clientID` | `clientId` |
-| `keyID` | `keyId` |
-| `tokenURI` | `tokenUri` |
-
----
-
-## Response field names (v2.1+)
-
-Response maps now return `skyflowId` (camelCase). The legacy `skyflow_id` key is still present for backward compatibility but is deprecated.
-
-| Deprecated (still returned) | Preferred |
-|---|---|
-| `skyflow_id` | `skyflowId` |
-
----
-
-## Update request data key (v2.1+)
-
-When calling `update()`, use `skyflowId` (camelCase) as the key in the data map to identify the record. Using `skyflow_id` still works but emits a deprecation warning. If both keys are present, `skyflowId` takes precedence.
-
-```java
-HashMap<String, Object> data = new HashMap<>();
-data.put("skyflowId", "<SKYFLOW_ID>");   // preferred
-data.put("card_number", "<NEW_VALUE>");
-
-UpdateRequest request = UpdateRequest.builder()
-    .table("<TABLE_NAME>")
-    .data(data)
-    .returnTokens(true)
-    .build();
-
-skyflowClient.vault().update(request);
-```
-
----
-
-## Method renames (v2.1+)
-
-The following instance methods have been renamed for consistency. The old names still work but emit deprecation warnings.
-
-| Deprecated | Preferred |
-|---|---|
-| `skyflowClient.updateLogLevel(logLevel)` | `skyflowClient.setLogLevel(logLevel)` |
-| `TokenMode.getBYOT()` | `TokenMode.getByot()` |
-| `DetokenizeRequest.builder().downloadURL(b)` | `DetokenizeRequest.builder().downloadUrl(b)` |
-
----
-
-For the full list of changes see [CHANGELOG.md](../CHANGELOG.md).