@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/with-lookup/{aggregate/aggregation.d.ts → reduce/reduction.d.ts}

@@ -1,13 +1,13 @@
 /**
  * Aggregate execution — the runtime behind `Query.aggregate()`.
  *
- * takes an `AggregateSpec` (a record of named reducers
+ * takes an `ReduceSpec` (a record of named reducers
  * built from `reducers.ts`) and runs every reducer over the records
  * produced by the underlying query. Two terminal surfaces:
  *
  *   - `.run(): R` — synchronous one-shot reduction. Matches the
  *     existing `Query.toArray()` / `.first()` / `.count()` style.
- *   - `.live(): LiveAggregation<R>` — reactive primitive that
+ *   - `.live(): LiveReduction<R>` — reactive primitive that
  *     re-runs the reduction whenever the query's source notifies of
  *     a change. uses naive full re-run; incremental delta
  *     maintenance is admitted by the reducer protocol (`remove()`)
@@ -15,7 +15,7 @@
  *     can switch from full re-run to delta-based without breaking
  *     the public API. Consumers get correct, reactive values today.
  *
- * The `Aggregation<R>` wrapper is deliberately tiny — it exists so
+ * The `Reduction<R>` wrapper is deliberately tiny — it exists so
  * `.aggregate(spec)` can be chained with either `.run()` or `.live()`
  * without the builder needing two separate terminal methods. It
  * holds the closure over the query execution (produces the current
@@ -39,9 +39,9 @@ import type { Reducer } from './reducers.js';
  * }
  * ```
  */
-export type AggregateSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
+export type ReduceSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
 /**
- * Map an `AggregateSpec` to its reduced result shape — each key
+ * Map an `ReduceSpec` to its reduced result shape — each key
  * carries the finalized result type from its reducer. A spec built
  * from `{ total: sum('amount'), n: count() }` yields a result of
  * `{ total: number, n: number }`.
@@ -50,26 +50,26 @@ export type AggregateSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
  * each `Reducer<R, _>`. The `infer` captures the user-visible result
  * type, discarding the internal state type `S`.
  */
-export type AggregateResult<Spec extends AggregateSpec> = {
+export type ReduceResult<Spec extends ReduceSpec> = {
     [K in keyof Spec]: Spec[K] extends Reducer<infer R, unknown> ? R : never;
 };
 /**
  * Pure reduction over a record array. Runs every reducer's
  * `init → step* → finalize` pipeline exactly once over the records.
  *
- * Called by `Aggregation.run()` and by the live-mode refresh path.
+ * Called by `Reduction.run()` and by the live-mode refresh path.
  * Exported for tests and for future `scan().aggregate()` reuse
  * — the streaming path will call the same reducer protocol with a
  * per-page loop instead of a single array.
  */
-export declare function reduceRecords<Spec extends AggregateSpec>(records: readonly unknown[], spec: Spec): AggregateResult<Spec>;
+export declare function reduceRecords<Spec extends ReduceSpec>(records: readonly unknown[], spec: Spec): ReduceResult<Spec>;
 /**
- * A minimal reactive primitive for aggregation results.
+ * A minimal reactive primitive for reduction results.
  *
  * Same spirit as the `LiveQuery` in : frame-agnostic, a plain
  * object with `value` / `error` fields and a `subscribe(cb)`
  * notification channel that Vue / React / Solid adapters wrap in
- * their own primitive. Intentionally NOT a Promise — aggregations
+ * their own primitive. Intentionally NOT a Promise — reductions
  * have a well-defined "current value" at every instant, and the
  * reactive consumer wants to read that value synchronously.
  *
@@ -86,7 +86,7 @@ export declare function reduceRecords<Spec extends AggregateSpec>(records: reado
  * Always call `stop()` when done; Vue's `onUnmounted` is the
  * canonical place. Raw consumers must do it themselves.
  */
-export interface LiveAggregation<R> {
+export interface LiveReduction<R> {
     /** Current reduced value. Undefined only if the first compute threw. */
     readonly value: R | undefined;
     /** Last execution error, if any. Cleared on the next successful run. */
@@ -97,14 +97,14 @@ export interface LiveAggregation<R> {
     stop(): void;
 }
 /**
- * Upstream change-notification hook for live aggregation.
+ * Upstream change-notification hook for live reduction.
  *
  * Matches the shape that `QuerySource.subscribe` already uses — a
  * single method that accepts a callback and returns an unsubscribe
- * function. The `Aggregation` wrapper collects upstreams from the
+ * function. The `Reduction` wrapper collects upstreams from the
  * query's source and wires them into a single re-run trigger.
  */
-export interface AggregationUpstream {
+export interface ReductionUpstream {
     subscribe(cb: () => void): () => void;
 }
 /**
@@ -120,14 +120,14 @@ export interface AggregationUpstream {
  * `.aggregate(spec).live()`. Wrapping lets the spec be named once
  * and reused for either terminal, and keeps the `Query` class
  * from growing a pair of near-duplicate method overloads
- * (`aggregateRun` / `aggregateLive`) that would be harder to
+ * (`reduceRun` / `reduceLive`) that would be harder to
  * discover.
  */
-export declare class Aggregation<R> {
+export declare class Reduction<R> {
     private readonly executeRecords;
     private readonly spec;
     private readonly upstreams;
-    constructor(executeRecords: () => readonly unknown[], spec: AggregateSpec, upstreams: readonly AggregationUpstream[]);
+    constructor(executeRecords: () => readonly unknown[], spec: ReduceSpec, upstreams: readonly ReductionUpstream[]);
     /**
      * Execute the query and reduce the results synchronously.
      * Returns the reduced shape matching the spec — e.g. a spec of
@@ -136,7 +136,7 @@ export declare class Aggregation<R> {
      */
     run(): R;
     /**
-     * Build a reactive `LiveAggregation<R>` that re-runs the reduction
+     * Build a reactive `LiveReduction<R>` that re-runs the reduction
      * whenever any upstream source notifies of a change. The initial
      * value is computed eagerly in the constructor, so consumers can
      * read `live.value` immediately after calling `.live()`.
@@ -153,14 +153,14 @@ export declare class Aggregation<R> {
      * correct, reactive values today; future PRs can switch to
      * delta-based maintenance without changing this API.
      */
-    live(): LiveAggregation<R>;
+    live(): LiveReduction<R>;
 }
 /**
- * Build a `LiveAggregation<V>` from a recompute closure and a list
+ * Build a `LiveReduction<V>` from a recompute closure and a list
  * of upstreams. Exposed so sibling files in the query DSL
  * (currently `groupby.ts`) can reuse the reactive primitive
  * without reaching into `LiveAggregationImpl` directly. This keeps
  * the implementation class private while still allowing planned
  * composition with `.groupBy().aggregate().live()`.
  */
-export declare function buildLiveAggregation<V>(recompute: () => V, upstreams: readonly AggregationUpstream[]): LiveAggregation<V>;
+export declare function buildLiveReduction<V>(recompute: () => V, upstreams: readonly ReductionUpstream[]): LiveReduction<V>;

package/dist/with-lookup/{aggregate → reduce}/strategy.d.ts

@@ -1,18 +1,18 @@
 /**
  * Strategy seam between the core Query / ScanBuilder chain and the
  * optional aggregate / groupBy service. Core imports
- * `AggregateStrategy` as a TYPE-ONLY symbol and `NO_AGGREGATE` as a
+ * `ReduceStrategy` as a TYPE-ONLY symbol and `NO_REDUCE` as a
  * tiny runtime stub.
  *
- * The heavy machinery — `Aggregation`, `GroupedQuery`, the
- * reducer-step logic — is only reachable from `withAggregate()` in
+ * The heavy machinery — `Reduction`, `GroupedQuery`, the
+ * reducer-step logic — is only reachable from `withReduce()` in
  * `./active.ts`, which is only exported through the
- * `@noy-db/hub/aggregate` subpath. Consumers that don't import the
+ * `@noy-db/hub/reduce` subpath. Consumers that don't import the
  * subpath ship none of the ~886 LOC.
  *
  * @internal
  */
-import type { Aggregation, AggregateSpec, AggregateResult, AggregationUpstream } from './aggregation.js';
+import type { Reduction, ReduceSpec, ReduceResult, ReductionUpstream } from './reduction.js';
 import type { GroupedQuery, GroupedQueryN } from './groupby.js';
 import type { ViaPipeline } from '../../kernel/via/pipeline.js';
 /**
@@ -21,39 +21,39 @@ import type { ViaPipeline } from '../../kernel/via/pipeline.js';
  *
  * @internal
  */
-export interface AggregateStrategy {
+export interface ReduceStrategy {
     /**
-     * Build an `Aggregation<R>` for `Query.aggregate(spec)`. `executeRecords`
+     * Build an `Reduction<R>` for `Query.aggregate(spec)`. `executeRecords`
      * is a closure that produces the matching record set when the
-     * aggregation runs. NO_AGGREGATE throws; the active strategy
-     * constructs a real `Aggregation`.
+     * reduction runs. NO_REDUCE throws; the active strategy
+     * constructs a real `Reduction`.
      */
-    aggregate<Spec extends AggregateSpec>(executeRecords: () => readonly unknown[], spec: Spec, upstreams: readonly AggregationUpstream[]): Aggregation<AggregateResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(executeRecords: () => readonly unknown[], spec: Spec, upstreams: readonly ReductionUpstream[]): Reduction<ReduceResult<Spec>>;
     /**
      * Build a `GroupedQuery<T, F, S>` for `Query.groupBy(field)`. Same
      * closure / upstream inputs as `aggregate` plus the group key field.
      */
-    groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], field: F, upstreams: readonly AggregationUpstream[], dictLabelResolver?: (key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>, via?: ViaPipeline): GroupedQuery<T, F, S, M>;
+    groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], field: F, upstreams: readonly ReductionUpstream[], dictLabelResolver?: (key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>, via?: ViaPipeline): GroupedQuery<T, F, S, M>;
     /**
      * Variadic-keyed sibling — builds a `GroupedQueryN<T, F, S>` for
      * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`
      * projection only applies to single-field groupings, which dispatch
      * through `groupBy` above.
      */
-    groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], fields: F, upstreams: readonly AggregationUpstream[], via?: ViaPipeline): GroupedQueryN<T, F, S, M>;
+    groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(executeRecords: () => readonly unknown[], fields: F, upstreams: readonly ReductionUpstream[], via?: ViaPipeline): GroupedQueryN<T, F, S, M>;
     /**
      * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.
      * Takes an async iterable of decrypted records + the spec and
      * returns the reduced result.
      */
-    scanAggregate<Spec extends AggregateSpec>(iter: AsyncIterable<unknown>, spec: Spec): Promise<AggregateResult<Spec>>;
+    scanAggregate<Spec extends ReduceSpec>(iter: AsyncIterable<unknown>, spec: Spec): Promise<ReduceResult<Spec>>;
 }
 /**
  * No-aggregate stub. Every `.aggregate()` / `.groupBy()` / streaming
  * `scan().aggregate()` call throws with a pointer at the subpath. The
- * real `Aggregation` / `GroupedQuery` classes are never referenced at
+ * real `Reduction` / `GroupedQuery` classes are never referenced at
  * runtime, so the bundler drops the ~886 LOC.
  *
  * @internal
  */
-export declare const NO_AGGREGATE: AggregateStrategy;
+export declare const NO_REDUCE: ReduceStrategy;

package/dist/with-lookup/search/build-docs.d.ts

@@ -1,7 +1,13 @@
 import type { I18nTextDescriptor } from '../../via/i18n/core.js';
 import type { DictKeyDescriptor, StaticDictDescriptor } from '../../via/i18n/dictionary.js';
 import type { IndexDoc } from './inverted-index.js';
-type FieldEntry = IndexDoc['fields'][number];
+/**
+ * One entry in an {@link IndexDoc}'s `fields` array — the return shape of the
+ * `build*FieldEntries` helpers. Exported so `@noy-db/hub/search` can name the
+ * return type of its own public functions (#843 C1: the subpath's first
+ * type-reachability gap).
+ */
+export type FieldEntry = IndexDoc['fields'][number];
 export declare function buildStringFieldEntries(record: Record<string, unknown>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 export declare function buildI18nFieldEntries(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, textIndexes: readonly string[], only?: readonly string[]): FieldEntry[];
 /** label map: field -> (key -> { locale -> label }). Precomputed in the collection (async for dynamic dicts). */
@@ -12,4 +18,3 @@ export declare function buildDictKeyFieldEntries(record: Record<string, unknown>
  * caller). Bytes are never tokenized; only the slot `filename` is indexed.
  */
 export declare function buildBlobFieldEntries(filenamesByField: Map<string, string[]>): FieldEntry[];
-export {};

package/dist/with-lookup/search/index.d.ts

@@ -11,7 +11,7 @@ export { segmentTokens, segmentTokenizer, type Token } from './segment.js';
 export { InvertedIndex, type IndexDoc, type IndexHit, type QueryOptions } from './inverted-index.js';
 export { extractSnippet } from './snippet.js';
 export { MemoryIndexStore, type IndexStore } from './index-store.js';
-export { buildStringFieldEntries } from './build-docs.js';
+export { buildStringFieldEntries, type FieldEntry } from './build-docs.js';
 export type { RetrieveOptions, RetrieveHit } from './retrieve-types.js';
 export { fuseRetrieval, type FuseOptions } from './fuse.js';
 export { withSearch } from './active.js';

package/dist/with-party/broker/index.d.ts

@@ -26,3 +26,4 @@ export declare function issueChallenge(opts?: {
 }): IssuedChallenge;
 export { verifyBrokerProof };
 export type { VerifyBrokerProofArgs };
+export type { IssuedChallenge } from '../../kernel/enclave/index.js';

package/dist/with-party/broker/seed.d.ts

@@ -1,6 +1,6 @@
 /**
  * `_broker` reserved-collection seed lifecycle (#479, credential-broker
- * spec §2/§3). Modeled on `with-party/team/sync-credentials.ts`: a
+ * spec §2/§3). Modeled on `with-sync/credentials.ts`: a
  * `_`-prefixed reserved collection, record id = `brokerId`, encrypted under
  * the collection's own DEK, `requireAdminAccess` role gate (owner/admin
  * only — custodian intentionally excluded, same rationale as

package/dist/with-party/custody/liberate.d.ts

@@ -24,7 +24,7 @@
  * unseal the original sealed owner. The old sealed-owner credential is left
  * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still
  * sealed under the non-firm provider), never impersonated. The new owner is a
- * DISTINCT principal under a fresh KEK derived from `newOwnerPassphrase`. This
+ * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This
  * preserves the inalienability floor: the act of claiming ownership is itself
  * auditable and produces a different principal, rather than silently assuming
  * the latent owner's identity.
@@ -47,8 +47,8 @@ import type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-ac
 export interface LiberateOptions {
     /** The id of the new owner principal the custodian mints by claiming ownership. */
     readonly newOwnerId: string;
-    /** The passphrase that derives the new owner's KEK (the DEKs are re-wrapped under it). */
-    readonly newOwnerPassphrase: string;
+    /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */
+    readonly newOwnerSecret: string;
     /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */
     readonly legalBasis: string;
     readonly factors?: FactorProofBundle;

package/dist/with-party/directory/cover/index.d.ts

@@ -8,12 +8,8 @@
  */
 export type { Cover, CoverText, CoverSchema, CoverField, JsonValue, ResolvedCoverSchema, } from './types.js';
 export { COVER_FIELDS, DEFAULT_COVER_SCHEMA, resolveSchema, } from './types.js';
+export { resolveSchema as resolveCoverSchema } from './types.js';
 export type { SetCoverInput } from './schema.js';
 export { validateCoverInput, isCover } from './schema.js';
 export { mergeCustom, validateCoverSize } from './custom.js';
 export { loadCover, saveCover, readCover, resolveLocale, pickLocale, COVER_RECORD_ID, } from './storage.js';
-export type { PublicEnvelope, PublicEnvelopeText, PublicEnvelopeSchema, PublicEnvelopeField, ResolvedPublicEnvelopeSchema, } from './types.js';
-export { PUBLIC_ENVELOPE_FIELDS, DEFAULT_PUBLIC_ENVELOPE_SCHEMA, } from './types.js';
-export type { SetPublicEnvelopeInput } from './schema.js';
-export { validatePublicEnvelopeInput, isPublicEnvelope } from './schema.js';
-export { loadPublicEnvelope, savePublicEnvelope, readPublicEnvelope, PUBLIC_ENVELOPE_RECORD_ID, } from './storage.js';

package/dist/with-party/directory/cover/schema.d.ts

@@ -31,9 +31,3 @@ export declare function validateCoverInput(input: SetCoverInput, schema: Resolve
  * discriminator keeps its frozen name: `_noydb_public: 1`.)
  */
 export declare function isCover(x: unknown): x is Cover;
-/** @deprecated Use {@link SetCoverInput}. */
-export type SetPublicEnvelopeInput = SetCoverInput;
-/** @deprecated Use {@link validateCoverInput}. */
-export declare const validatePublicEnvelopeInput: typeof validateCoverInput;
-/** @deprecated Use {@link isCover}. */
-export declare const isPublicEnvelope: typeof isCover;

package/dist/with-party/directory/cover/storage.d.ts

@@ -61,11 +61,3 @@ export declare function resolveLocale(cover: Cover, locale: string): Cover;
  * This deviation is documented in `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md`.
  */
 export declare function pickLocale(value: string | Record<string, string>, locale: string, defaultLocale: string | undefined): string;
-/** @deprecated Use {@link COVER_RECORD_ID}. */
-export declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
-/** @deprecated Use {@link loadCover}. */
-export declare const loadPublicEnvelope: typeof loadCover;
-/** @deprecated Use {@link saveCover}. */
-export declare const savePublicEnvelope: typeof saveCover;
-/** @deprecated Use {@link readCover}. */
-export declare const readPublicEnvelope: typeof readCover;

package/dist/with-party/directory/cover/types.d.ts

@@ -126,24 +126,3 @@ export interface ResolvedCoverSchema {
  * overrides the keys it provides.
  */
 export declare function resolveSchema(schema: true | CoverSchema | undefined): ResolvedCoverSchema | undefined;
-/** @deprecated Use {@link Cover}. */
-export type PublicEnvelope = Cover;
-/** @deprecated Use {@link CoverText}. */
-export type PublicEnvelopeText = CoverText;
-/** @deprecated Use {@link CoverField}. */
-export type PublicEnvelopeField = CoverField;
-/** @deprecated Use {@link CoverSchema}. */
-export type PublicEnvelopeSchema = CoverSchema;
-/** @deprecated Use {@link ResolvedCoverSchema}. */
-export type ResolvedPublicEnvelopeSchema = ResolvedCoverSchema;
-/** @deprecated Use {@link COVER_FIELDS}. */
-export declare const PUBLIC_ENVELOPE_FIELDS: readonly ["name", "description", "icon", "createdAt", "updatedAt", "defaultLocale", "custom"];
-/** @deprecated Use {@link DEFAULT_COVER_SCHEMA}. */
-export declare const DEFAULT_PUBLIC_ENVELOPE_SCHEMA: {
-    readonly fields: readonly ["name", "description", "icon", "createdAt", "updatedAt", "defaultLocale"];
-    readonly maxIconBytes: number;
-    readonly iconMimeTypes: readonly ["image/png", "image/svg+xml"];
-    readonly maxStringChars: 200;
-    readonly maxCustomBytes: number;
-    readonly maxCoverBytes: number;
-};

package/dist/with-party/directory/index.d.ts

@@ -7,5 +7,7 @@
  * @module
  */
 export type { DirectoryConfig, UserVisibility } from './types.js';
+export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './user-envelope/storage.js';
+export { UserApi } from './user-envelope/api.js';
 export { readDirectoryConfig, persistDirectoryConfig, META_COLLECTION, DIRECTORY_RECORD_ID, } from './storage.js';
 export { readUserVisibility, persistUserVisibility, deleteUserVisibility, visibilityRecordId, VISIBILITY_RECORD_PREFIX, } from './visibility.js';

package/dist/with-party/session/dev-unlock.d.ts

@@ -2,11 +2,11 @@
  * Dev-mode persistent unlock —
  *
  * Solves the developer inner-loop friction: hot-reload destroys the session
- * (page navigation semantics), forcing a passphrase re-entry every refresh.
+ * (page navigation semantics), forcing a secret re-entry every refresh.
  *
  * This module provides an opt-in, deliberately-named escape hatch that lets
  * developers store the keyring payload in sessionStorage or localStorage so
- * the vault auto-unlocks on every page load — without a passphrase,
+ * the vault auto-unlocks on every page load — without a secret,
  * without a biometric prompt, without any OIDC flow.
  *
  * ⚠️ WARNING — this is a loaded footgun ⚠️

package/dist/with-party/session/index.d.ts

@@ -21,3 +21,5 @@ export type { DevUnlockOptions } from './dev-unlock.js';
 export { withSession } from './active.js';
 export type { SessionStrategy } from './strategy.js';
 export { SessionExpiredError, SessionNotFoundError, SessionPolicyError, } from '../../kernel/errors.js';
+/** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
+export { NO_SESSION } from './strategy.js';

package/dist/with-party/session/session.d.ts

@@ -1,7 +1,7 @@
 /**
  * Session tokens —
  *
- * After a vault is unlocked (via passphrase, WebAuthn, OIDC, or magic-
+ * After a vault is unlocked (via secret, WebAuthn, OIDC, or magic-
  * link), the caller can call `createSession()` to get a session token that
  * allows re-establishing the KEK for the session lifetime without re-running
  * PBKDF2 or any interactive auth challenge.
@@ -75,7 +75,7 @@ export interface CreateSessionOptions {
 /**
  * Create a session for an already-unlocked keyring.
  *
- * Call this after any successful unlock (passphrase, WebAuthn, OIDC,
+ * Call this after any successful unlock (secret, WebAuthn, OIDC,
  * magic-link). The returned `sessionId` is the handle for later
  * `resolveSession()` and `revokeSession()` calls.
  *

package/dist/with-party/team/deed.d.ts

@@ -2,7 +2,7 @@
  * FR-6 — Deed: sealed / hidden-owner provisioning.
  *
  * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
+ * authenticates. The owner credential (the random secret that
  * derives `KEK_owner`) is minted machine-side and sealed under a
  * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
  * the cryptographic *inalienability anchor*: whoever holds the
@@ -13,10 +13,10 @@
  *
  * Provisioning reuses the managed-mode seam:
  *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     secret at `_meta/sealed-secret` (and unseals it on every
  *     subsequent open through the same provider).
  *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *     secret and writes the `_keyring/<ownerUserId>` file.
  *
  * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
  * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
@@ -30,7 +30,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { SealingKeyProvider } from './managed-passphrase.js';
+import type { SealingKeyProvider } from './managed-secret.js';
 /** Reserved id for the Deed marker under `_meta`. */
 export declare const DEED_RECORD_ID: "deed";
 /**
@@ -60,7 +60,7 @@ export interface DeedMarker {
 }
 /**
  * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * `sealing` (a NON-firm provider). Mints + seals the owner secret
  * via {@link resolveManagedSecret}, derives the owner keyring via
  * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
  * marker. Returns the unlocked owner keyring.
@@ -68,8 +68,8 @@ export interface DeedMarker {
  * The returned keyring is the only in-memory window onto `KEK_owner`
  * for this call; the persistent re-entry point is the sealing provider
  * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
+ * re-resolve the secret, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive secret is ever required).
  *
  * There is deliberately no firm-controlled fallback: the marker's
  * `sealedUnder` is the single cryptographic anchor of ownership.
@@ -85,7 +85,7 @@ export declare function loadDeedMarker(store: NoydbStore, vault: string): Promis
 export declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
 /**
  * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors
- * `saveSealedPassphrase`'s envelope shape: a standard
+ * `saveSealedSecret`'s envelope shape: a standard
  * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the
  * payload stored as plaintext JSON in `_data`. The marker is metadata,
  * not a secret — sealing it would defeat its purpose (auditors /

package/dist/with-party/team/index.d.ts

@@ -18,10 +18,11 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
-export { rotatePassphrase, recoverPassphrase, } from './rotate-recover.js';
-export type { RotatePassphraseInput, RecoverPassphraseInput, RecoverPassphraseResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
+export { rotateSecret, recoverSecret, } from './rotate-recover.js';
+export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
 export { recoverUser } from './peer-recover.js';
 export type { RecoverUserOptions } from './peer-recover.js';
 export { mintPaperRecoveryEntry, unwrapDeksFromPaperEntry, loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEntry, } from './recovery.js';
@@ -31,8 +32,4 @@ export type { WrappedDeksBlob } from './wrapped-deks.js';
 export { writeMagicLinkGrant, readMagicLinkGrantRecord, listMagicLinkGrants, unwrapMagicLinkGrant, revokeMagicLinkGrant, deriveMagicLinkContentKey, magicLinkGrantRecordId, isMagicLinkGrantExpired, } from './magic-link-grant.js';
 export { hasExportCapability, evaluateExportCapability, } from './keyring.js';
 export { hasImportCapability, evaluateImportCapability, } from './keyring.js';
-export { SyncEngine } from './sync.js';
-export { SyncTransaction } from './sync-transaction.js';
-export { PresenceHandle } from './presence.js';
-export { putCredential, getCredential, deleteCredential, listCredentials, credentialStatus, SYNC_CREDENTIALS_COLLECTION, } from './sync-credentials.js';
-export type { SyncCredential } from './sync-credentials.js';
+export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';