@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/with-party/team/keyring.d.ts

@@ -1,6 +1,6 @@
-import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope as UserEnvelopeReader } from '../../kernel/types.js';
+import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type PassphrasePolicy } from '../../kernel/validation.js';
+import { type SecretPolicy } from '../../kernel/validation.js';
 /** In-memory representation of an unlocked keyring. */
 export interface UnlockedKeyring {
     readonly userId: string;
@@ -9,7 +9,7 @@ export interface UnlockedKeyring {
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
     /**
-     * The KEK, when this keyring was unlocked via tier 1 (passphrase) or
+     * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the
      * keyring was opened via:
      *
@@ -71,8 +71,15 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
+/** Options for {@link loadKeyring} (#846b). */
+export interface LoadKeyringOptions {
+    /** The user whose keyring to unlock. */
+    readonly userId: string;
+    /** That user's secret. */
+    readonly secret: string;
+}
 /** Load and unlock a user's keyring for a vault. */
-export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string): Promise<UnlockedKeyring>;
+export declare function loadKeyring(store: NoydbStore, vault: string, opts: LoadKeyringOptions): Promise<UnlockedKeyring>;
 /**
  * Open-policy pre-gate: decide create-vs-fail-closed **before** any
  * vault write. `openVault` must not self-provision an owner keyring into a
@@ -81,26 +88,38 @@ export declare function loadKeyring(adapter: NoydbStore, vault: string, userId:
  * `store.list`. Returns when the open may proceed (the caller is a member, or
  * the vault is genuinely-new and `create` is allowed, in which case the caller
  * falls through to the normal `createOwnerKeyring` path); throws `NoAccessError`
- * otherwise. Placed before managed-passphrase secret resolution (which persists
+ * otherwise. Placed before managed-secret secret resolution (which persists
  * on first open), so a fail-closed open writes nothing.
  */
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
+/**
+ * Options for {@link createOwnerKeyring} (#846b). The `SecretPolicy` knobs are
+ * flattened into the same bag rather than nested, so `assertStrongSecret` can
+ * take `opts` directly.
+ */
+export interface CreateOwnerKeyringOptions extends SecretPolicy {
+    /** The owner to create. */
+    readonly userId: string;
+    /** The owner's secret. */
+    readonly secret: string;
+    /** Gate creation on the phrase-format strength rules. Default false. */
+    readonly validate?: boolean;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Create the initial owner keyring for a new vault.
  *
- * Pass `{ validate: true }` (or a `PassphrasePolicy`) to gate creation
+ * Pass `{ validate: true }` (or any `SecretPolicy` knob) to gate creation
  * on the phrase-format strength rules — `Noydb` threads this from
- * `NoydbOptions.validatePassphrase`. Direct callers (CLI, scripts,
+ * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
-export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string, passphraseOpts?: PassphrasePolicy & {
-    validate?: boolean;
-    allowWeakPassphrase?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
-export declare function grant(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
 /**
  * Mutate `role`, `displayName`, and/or `permissions` on an existing
  * keyring. Pure plaintext-header rewrite — no DEK rewrap, no KEK
@@ -125,33 +144,62 @@ export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
  * 2. Re-encrypt all records in affected collections
  * 3. Re-wrap new DEKs for all remaining users
  */
-export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]): Promise<void>;
 /**
- * Change the user's passphrase. Re-wraps every DEK under the new KEK.
+ * What a DEK rotation leaves behind (#854).
+ *
+ * A member's DEKs are wrapped under that member's KEK, and a KEK derives only
+ * from that member's secret — so the caller cannot re-wrap a fresh DEK for
+ * anyone else. That is the zero-knowledge property working as designed, but it
+ * means rotation necessarily DROPS the rotated collections from every other
+ * member's keyring rather than re-keying them.
+ *
+ * `needsRegrant` names exactly who lost what, so the caller can re-run
+ * `grant()` instead of discovering the access loss later.
+ */
+export interface RotateResult {
+    /** (member, collection) pairs whose access was dropped by the rotation. */
+    readonly needsRegrant: ReadonlyArray<{
+        readonly userId: string;
+        readonly collection: string;
+    }>;
+}
+/** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
+export interface RotateKeysOptions {
+    /** Collections whose DEKs are re-minted. */
+    readonly collections: readonly string[];
+}
+export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
+/** Options for {@link changeSecret} (#846b). */
+export interface ChangeSecretOptions extends SecretPolicy {
+    /** The replacement secret. */
+    readonly newSecret: string;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
+/**
+ * Change the user's secret. Re-wraps every DEK under the new KEK.
  *
- * Validates the new passphrase against the strength rules unless
- * `allowWeakPassphrase: true` is passed. Mirrors `rotatePassphrase`'s
+ * Validates the new secret against the strength rules unless
+ * `allowWeakSecret: true` is passed. Mirrors `rotateSecret`'s
  * default-on validation contract.
  *
- * `db.rotatePassphrase()` adds a `checkGate('rotate-passphrase')` step
- * on top of this primitive and additionally requires the OLD passphrase
+ * `db.team.rotateSecret()` adds a `checkGate('rotate-secret')` step
+ * on top of this primitive and additionally requires the OLD secret
  * for re-derivation; `changeSecret` reuses the cached unlocked KEK so
- * the OLD passphrase is not retyped.
+ * the OLD secret is not retyped.
  */
-export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newPassphrase: string, passphraseOpts?: PassphrasePolicy & {
-    allowWeakPassphrase?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function changeSecret(store: NoydbStore, vault: string, keyring: UnlockedKeyring, opts: ChangeSecretOptions): Promise<UnlockedKeyring>;
 /**
  * Recipient slot in a re-keyed `.noydb` bundle. Each slot becomes its
- * own keyring file inside the bundle, sealed with its own passphrase.
- * Same role/permission semantics as `db.grant()` but no adapter side
+ * own keyring file inside the bundle, sealed with its own secret.
+ * Same role/permission semantics as `db.grant()` but no store side
  * effect — the slot only exists inside the bundle bytes.
  *
  * @public
@@ -161,8 +209,8 @@ export interface BundleRecipient {
     readonly id: string;
     /** Optional display name. Defaults to `id`. */
     readonly displayName?: string;
-    /** Passphrase the recipient will type to unlock. */
-    readonly passphrase: string;
+    /** Secret the recipient will type to unlock. */
+    readonly secret: string;
     /** Role on the destination vault. Defaults to `'viewer'`. */
     readonly role?: Role;
     /**
@@ -193,7 +241,7 @@ export interface BundleRecipient {
 }
 /**
  * Build a `KeyringFile` for one bundle recipient, given the source
- * vault's unwrapped DEKs. Mirrors `grant()` minus the adapter write —
+ * vault's unwrapped DEKs. Mirrors `grant()` minus the store write —
  * the produced file is meant to be embedded in the bundle's
  * `keyrings` map, never persisted to the source vault.
  *
@@ -204,7 +252,7 @@ export interface BundleRecipient {
  */
 export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
-export declare function listUsers(adapter: NoydbStore, vault: string): Promise<UserInfo[]>;
+export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**
  * Optional filter knobs for {@link listUsersWithEnvelopes}.
  *
@@ -254,18 +302,18 @@ export interface ListUsersOptions {
  * Order matches `listUsers()` (store-defined; sort if you need a
  * stable display order).
  */
-export declare function listUsersWithEnvelopes<T = unknown>(adapter: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
+export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
     user: UserInfo;
-    envelope: UserEnvelopeReader<T> | null;
+    envelope: UserEnvelope<T> | null;
 }>>;
 /** Ensure a DEK exists for a collection. Generates one if new. */
-export declare function ensureCollectionDEK(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
-/** Persist a keyring file to the adapter. */
-export declare function persistKeyring(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
+/** Persist a keyring file to the store. */
+export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
  * export tier.

package/dist/with-party/team/{managed-passphrase.d.ts → managed-secret.d.ts}

@@ -1,7 +1,7 @@
 /**
- * Managed-passphrase mode — rubber-hose-resistant vaults.
+ * Managed-secret mode — rubber-hose-resistant vaults.
  *
- * A vault mode where the passphrase is machine-generated and never
+ * A vault mode where the secret is machine-generated and never
  * exposed to the user, sealed under a developer-provided
  * {@link SealingKeyProvider} (macOS Keychain, Windows Credential
  * Manager, libsecret, AWS KMS, …). The user has no secret to give
@@ -27,31 +27,31 @@
  *     implementation of both `RecipientSealer` and
  *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;
  *     safe for tests and same-process sender/recipient scenarios.
- *   - {@link loadSealedPassphrase} / {@link saveSealedPassphrase} —
- *     plaintext envelope storage at `_meta/sealed-passphrase`.
+ *   - {@link loadSealedSecret} / {@link saveSealedSecret} —
+ *     plaintext envelope storage at `_meta/sealed-secret`.
  *     Mirrors the `_meta/handle` and `_meta/public-envelope` AES-
  *     GCM-bypassed patterns. The sealing layer (provider's job)
  *     is the security boundary; hub doesn't have a key to encrypt
  *     with at this layer — that's the whole point of the design.
  *   - {@link resolveManagedSecret} — orchestrates the "generate +
  *     seal + persist on first open; unseal on reopen" flow.
- *     Returns the plaintext passphrase string that the rest of the
+ *     Returns the plaintext secret string that the rest of the
  *     `createNoydb` keyring path consumes.
  *
  * Deferred to follow-ups:
- *   - Block `rotate-passphrase` policy gate under managed mode.
+ *   - Block `rotate-secret` policy gate under managed mode.
  *   - Mandatory strong-recovery enforcement.
  *   - Recovery flow under managed mode (generates fresh sealed phrase).
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-passphrase mode
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
  *
  * @module
  */
 import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 /**
  * The contract concrete providers (per-platform key stores) implement
- * to seal and unseal a hub-generated random passphrase. The plaintext
- * passphrase NEVER leaves hub-controlled memory in unsealed form —
+ * to seal and unseal a hub-generated random secret. The plaintext
+ * secret NEVER leaves hub-controlled memory in unsealed form —
  * the provider receives the bytes, returns opaque sealed bytes, and
  * later reverses the operation. Hub treats the sealed bytes as
  * fully opaque.
@@ -69,7 +69,7 @@ import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 export interface SealingKeyProvider {
     /**
      * Non-sensitive identifier disclosed in the persisted envelope.
-     * Surfaced to consumers via `loadSealedPassphrase().providerId` so
+     * Surfaced to consumers via `loadSealedSecret().providerId` so
      * a vault opened with the wrong provider class can detect the
      * mismatch and surface a clear error. NOT secret — fine to log.
      *
@@ -78,8 +78,8 @@ export interface SealingKeyProvider {
      * parses this; it's purely audit metadata.
      */
     readonly id: string;
-    /** Seal raw passphrase bytes. Output bytes are opaque to hub. */
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    /** Seal raw secret bytes. Output bytes are opaque to hub. */
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     /**
      * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or
      * any other failure — hub treats a thrown error as "this provider
@@ -90,7 +90,7 @@ export interface SealingKeyProvider {
 /**
  * In-memory test provider. NOT secure — uses a deterministic
  * per-instance "key" (16-byte SHA-256 of `id`) XOR'd over the
- * passphrase plus a 4-byte provider-id fingerprint prefix. The XOR is
+ * secret plus a 4-byte provider-id fingerprint prefix. The XOR is
  * sufficient to make different `id` values produce mutually-unsealable
  * outputs (the contract tests for that), but offers ZERO real
  * confidentiality — never use outside tests.
@@ -104,7 +104,7 @@ export declare class MemorySealingKeyProvider implements SealingKeyProvider {
     constructor(opts: {
         id: string;
     });
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 }
 /**
@@ -201,17 +201,17 @@ export declare class MemoryRecipientSealer implements SealingKeyProvider, Recipi
     seal(plaintext: Uint8Array): Promise<Uint8Array>;
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }
-/** Reserved id for the managed-passphrase envelope under `_meta`. */
-export declare const SEALED_PASSPHRASE_RECORD_ID: "sealed-passphrase";
-/** Plaintext payload stored inside the `_meta/sealed-passphrase` envelope. */
-export interface SealedPassphrase {
+/** Reserved id for the managed-secret envelope under `_meta`. */
+export declare const SEALED_SECRET_RECORD_ID: "sealed-secret";
+/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */
+export interface SealedSecret {
     readonly _noydb_sealed: 1;
     readonly providerId: string;
     /** Sealed bytes. Base64-encoded on the wire; decoded on load. */
     readonly sealed: Uint8Array;
 }
 /**
- * Wire-format envelope persisted at `_meta/sealed-passphrase` for
+ * Wire-format envelope persisted at `_meta/sealed-secret` for
  * managed-mode vaults. The provider produces raw sealed bytes via
  * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch
  * metadata hub needs to pick the right provider on the unseal path.
@@ -237,8 +237,8 @@ export interface SealedEnvelope {
     readonly payload: string;
 }
 /**
- * Parse a `_meta/sealed-passphrase` `_data` JSON string into the
- * in-memory {@link SealedPassphrase} representation. Accepts both:
+ * Parse a `_meta/sealed-secret` `_data` JSON string into the
+ * in-memory {@link SealedSecret} representation. Accepts both:
  *
  *   1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —
  *      the current shape.
@@ -251,20 +251,20 @@ export interface SealedEnvelope {
  *
  * @internal — exported only for the migration safety-net test suite.
  */
-export declare function parseSealedEnvelope(raw: unknown): SealedPassphrase | undefined;
-export declare function saveSealedPassphrase(store: NoydbStore, vault: string, payload: {
+export declare function parseSealedEnvelope(raw: unknown): SealedSecret | undefined;
+export declare function saveSealedSecret(store: NoydbStore, vault: string, payload: {
     readonly providerId: string;
     readonly sealed: Uint8Array;
 }): Promise<void>;
-export declare function loadSealedPassphrase(store: NoydbStore, vault: string): Promise<SealedPassphrase | undefined>;
+export declare function loadSealedSecret(store: NoydbStore, vault: string): Promise<SealedSecret | undefined>;
 /**
- * Resolve the effective plaintext passphrase string for a managed-mode
+ * Resolve the effective plaintext secret string for a managed-mode
  * vault. Two paths:
  *
  *   1. **First open (no envelope persisted):** generate a 256-bit random
  *      via `crypto.getRandomValues`, base64-encode for use as a
- *      passphrase string, seal the underlying bytes under the
- *      provider, persist `_meta/sealed-passphrase`, return the
+ *      secret string, seal the underlying bytes under the
+ *      provider, persist `_meta/sealed-secret`, return the
  *      base64 string.
  *
  *   2. **Reopen (envelope exists):** read + unseal + decode → return.

package/dist/with-party/team/noydb-facade.d.ts

@@ -2,9 +2,9 @@
  * Noydb-side auth / recovery / enrollment facade.
  *
  * Holds the tier-2 authenticator enrollment/unlock wrappers, WebAuthn
- * enrollment, auth-config introspection, the tier-1 passphrase
+ * enrollment, auth-config introspection, the tier-1 secret
  * rotate/recover flows, the paper/Shamir recovery rotate/enroll flows,
- * managed-passphrase recovery, peer-recovery, tier-3 PIN unlock, and the
+ * managed-secret recovery, peer-recovery, tier-3 PIN unlock, and the
  * public `getKeyring` accessor.
  *
  * The near-parallel rotate/recover variants (managed vs user vs paper vs
@@ -16,17 +16,18 @@
  * (`assertRecoveryEnrolled`), `openVault`, and the one-shot
  * managed-recovery skip flag stay kernel-resident and arrive as callbacks.
  *
- * Internal service — reached through `noydb.rotatePassphrase(...)` etc.
+ * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
-import { type RotatePassphraseInput, type RecoverPassphraseInput, type RecoverPassphraseResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
+import type { RotateResult, RotateKeysOptions } from './keyring.js';
+import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
 import type { Vault } from '../../kernel/vault.js';
 import type { UnlockedKeyring } from './keyring.js';
 import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from './authenticators.js';
 import type { QuickUnlockStore, QuickUnlockState } from '../session/unlock-state.js';
-import type { PassphrasePolicy } from '../../kernel/validation.js';
+import type { SecretPolicy } from '../../kernel/validation.js';
 import type { ActiveTier, FactorProofBundle, GateName, GrantOptions, ReAuthOperation, RevokeOptions, VaultPolicy } from '../../kernel/types.js';
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
 type ResolvedNoydbOptions = NoydbOptions & {
@@ -34,7 +35,7 @@ type ResolvedNoydbOptions = NoydbOptions & {
 };
 /** Everything the moving auth/recovery/enrollment methods touched on the Noydb instance's `this.*`. */
 export interface TeamFacadeDeps {
-    /** Resolved Noydb options (store, user, passphraseMode, sealingKey, shamirRecovery, …). */
+    /** Resolved Noydb options (store, user, secretMode, sealingKey, shamirRecovery, …). */
     readonly options: ResolvedNoydbOptions;
     /** Live unlocked-keyring cache (Noydb-resident; read/written by reference). */
     readonly keyringCache: Map<string, UnlockedKeyring>;
@@ -72,7 +73,7 @@ export declare class TeamFacade {
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
     runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
-    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<void>, vault: string, collections: string[]): Promise<void>;
+    runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Add a tier-2 authenticator slot to the calling user's keyring.
      * Each slot independently wraps the SAME KEK under a method-specific
@@ -143,7 +144,7 @@ export declare class TeamFacade {
      * ```ts
      * import { enrollWebAuthn } from '@noy-db/on-webauthn'
      *
-     * await db.enrollWebAuthn('demo', async (keyring) => {
+     * await db.team.enrollWebAuthn('demo', async (keyring) => {
      *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
      *   return {
      *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -207,38 +208,38 @@ export declare class TeamFacade {
         description: string;
     }>>;
     /**
-     * Rotate the user's passphrase (user remembers old). Validates the
-     * new phrase against the configured `passphrase` policy, runs the
-     * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+     * Rotate the user's secret (user remembers old). Validates the
+     * new phrase against the configured `secret` policy, runs the
+     * `rotate-secret` gate, then re-derives + re-wraps every DEK.
      *
      * Tier-2 authenticator slots are dropped — each slot wraps the old
      * KEK and would need its derivation key to be re-presented. Re-enrol
      * via `db.enrollAuthenticator` after rotation.
      *
-     * @throws `WeakPassphraseError` on a weak new phrase.
+     * @throws `WeakSecretError` on a weak new phrase.
      * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-     * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+     * @throws `InvalidKeyError` when `oldSecret` is wrong.
      */
-    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
+    rotateSecret(vault: string, input: RotateSecretInput, factors?: FactorProofBundle): Promise<void>;
     /**
-     * Reset the passphrase using a recovery proof (user forgot the old).
+     * Reset the secret using a recovery proof (user forgot the old).
      * Currently supports the `'paper'` profile end-to-end; the
      * other profiles throw {@link RecoveryProfileNotImplementedError}.
      *
      * Burns the used recovery entry on success.
      */
-    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
+    recoverSecret(vault: string, input: RecoverSecretInput, factors?: FactorProofBundle): Promise<RecoverSecretResult>;
     /**
      * Deliberate paper-recovery-code regeneration. User knows their
-     * passphrase but wants a fresh sheet — they lost the printout or
+     * secret but wants a fresh sheet — they lost the printout or
      * suspect compromise of the off-site copy.
      *
-     * Symmetric to {@link rotatePassphrase} for the recovery profile:
+     * Symmetric to {@link rotateSecret} for the recovery profile:
      * gated, audit-trackable, ergonomic. Replaces (not appends) the
      * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
      *
      * Gated by the `rotate-recovery` policy gate:
-     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
      *     suffices, matching the lower-level flow's bar.
      *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
      *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -258,13 +259,13 @@ export declare class TeamFacade {
      *
      * @example Default count + show-once UI
      * ```ts
-     * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+     * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
      * showCodesToUser(newCodes)
      * ```
      *
      * @example STRICT-policy site with TOTP factor proof
      * ```ts
-     * await db.rotateRecovery(
+     * await db.team.rotateRecovery(
      *   'acme',
      *   { profile: 'paper', count: 10 },
      *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -278,7 +279,7 @@ export declare class TeamFacade {
      * **Atomic create-and-enroll for managed-mode vaults.**
      *
      * Bootstraps a managed-mode vault and enrolls strong recovery in
-     * a single ceremony. Under `passphraseMode: 'managed'`, every
+     * a single ceremony. Under `secretMode: 'managed'`, every
      * `openVault` call requires a strong recovery profile (Shamir
      * today) to be enrolled — otherwise it throws
      * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -297,11 +298,11 @@ export declare class TeamFacade {
      * ```ts
      * const db = await createNoydb({
      *   store, user: 'alice',
-     *   passphraseMode: 'managed',
+     *   secretMode: 'managed',
      *   sealingKey: macosKeychainSealingProvider({ ... }),
      * })
      *
-     * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+     * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
      *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
      * })
      * for (const r of recoveryEnrollments) {
@@ -320,20 +321,20 @@ export declare class TeamFacade {
         readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
     }>;
     /**
-     * **Recovery flow under managed-passphrase mode.**
+     * **Recovery flow under managed-secret mode.**
      *
-     * Replaces the sealed passphrase of a managed-mode vault with a
+     * Replaces the sealed secret of a managed-mode vault with a
      * fresh 256-bit random, sealed under the configured
-     * `SealingKeyProvider`. The user never sees the new passphrase.
+     * `SealingKeyProvider`. The user never sees the new secret.
      *
      * Internally:
      *   1. Verify the recovery proof (Shamir today) and unwrap the
      *      DEK set.
-     *   2. Mint a fresh 256-bit random as the new effective passphrase.
+     *   2. Mint a fresh 256-bit random as the new effective secret.
      *   3. Rewrap the DEK set under a fresh KEK derived from the new
-     *      passphrase (via the existing `recoverPassphrase` path).
+     *      secret (via the existing `recoverSecret` path).
      *   4. Seal the random bytes under the provider and overwrite
-     *      `_meta/sealed-passphrase`.
+     *      `_meta/sealed-secret`.
      *   5. Drop the keyring cache so the next operation re-derives.
      *
      * The vault's strong-recovery enrollment is preserved across
@@ -341,13 +342,13 @@ export declare class TeamFacade {
      *
      * @throws ValidationError if the Noydb instance is not in managed mode.
      */
-    recoverManagedPassphrase(vault: string, options: {
+    recoverManagedSecret(vault: string, options: {
         readonly recoveryProof: RecoveryProof;
-        readonly passphrasePolicy?: PassphrasePolicy;
+        readonly secretPolicy?: SecretPolicy;
     }): Promise<void>;
     /**
      * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-     * a fresh temp passphrase in a single store write. Closes the
+     * a fresh temp secret in a single store write. Closes the
      * partial-failure window (the previous compose-from-primitives
      * pattern was `db.revoke + db.grant`, two writes — if the issuer
      * cancelled between them the target was locked out entirely).
@@ -366,17 +367,17 @@ export declare class TeamFacade {
      * recovery / TOTP / email-OTP factor proof at the moment of
      * recovery, so the issuer affirmatively re-asserts identity.
      *
-     * The recipient should call `db.rotatePassphrase` on first session
+     * The recipient should call `db.rotateSecret` on first session
      * to choose their own phrase — the temp acts as a single-use
      * bridge.
      *
      * ```ts
-     * await db.recoverUser('acme', {
+     * await db.team.recoverUser('acme', {
      *   userId: 'bob',
-     *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+     *   secret: 'temporary-correct-horse-battery-staple-printer',
      * }, { factors: [{ kind: 'recovery' }] })
      * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-     * // and immediately calls db.rotatePassphrase to set his own.
+     * // and immediately calls db.rotateSecret to set his own.
      * ```
      *
      * @throws `NoAccessError` when no keyring exists for the target.
@@ -395,17 +396,17 @@ export declare class TeamFacade {
      * The hub wraps the user's DEK set (not the KEK) under a code-derived
      * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
      * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-     * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+     * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
      *
      * ```ts
      * import { mintPaperRecoveryEntry } from '@noy-db/hub'
      *
-     * const keyring = await db.getKeyring('acme')
+     * const keyring = await db.team.getKeyring('acme')
      * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
      * const entries = await Promise.all(
      *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
      * )
-     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
      * showCodesToUser(codes)
      * ```
      *
@@ -416,7 +417,7 @@ export declare class TeamFacade {
      * ```ts
      * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
      * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
      * ```
      */
     enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
@@ -473,7 +474,7 @@ export declare class TeamFacade {
      * and no `secret` / `getKeyring` is configured.
      *
      * ```ts
-     * const keyring = await db.getKeyring('acme')
+     * const keyring = await db.team.getKeyring('acme')
      * // keyring.deks: Map<collection, CryptoKey>
      * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
      * // keyring.role / .permissions / .authenticators