@noy-db/hub 0.4.0-pre.1 → 0.4.0-pre.11

package/dist/with-party/session/session.d.ts

@@ -1,7 +1,7 @@
 /**
  * Session tokens —
  *
- * After a vault is unlocked (via passphrase, WebAuthn, OIDC, or magic-
+ * After a vault is unlocked (via secret, WebAuthn, OIDC, or magic-
  * link), the caller can call `createSession()` to get a session token that
  * allows re-establishing the KEK for the session lifetime without re-running
  * PBKDF2 or any interactive auth challenge.
@@ -75,7 +75,7 @@ export interface CreateSessionOptions {
 /**
  * Create a session for an already-unlocked keyring.
  *
- * Call this after any successful unlock (passphrase, WebAuthn, OIDC,
+ * Call this after any successful unlock (secret, WebAuthn, OIDC,
  * magic-link). The returned `sessionId` is the handle for later
  * `resolveSession()` and `revokeSession()` calls.
  *

package/dist/with-party/team/deed.d.ts

@@ -2,7 +2,7 @@
  * FR-6 — Deed: sealed / hidden-owner provisioning.
  *
  * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
+ * authenticates. The owner credential (the random secret that
  * derives `KEK_owner`) is minted machine-side and sealed under a
  * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
  * the cryptographic *inalienability anchor*: whoever holds the
@@ -13,10 +13,10 @@
  *
  * Provisioning reuses the managed-mode seam:
  *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     secret at `_meta/sealed-secret` (and unseals it on every
  *     subsequent open through the same provider).
  *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *     secret and writes the `_keyring/<ownerUserId>` file.
  *
  * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
  * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
@@ -30,7 +30,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { SealingKeyProvider } from './managed-passphrase.js';
+import type { SealingKeyProvider } from './managed-secret.js';
 /** Reserved id for the Deed marker under `_meta`. */
 export declare const DEED_RECORD_ID: "deed";
 /**
@@ -60,7 +60,7 @@ export interface DeedMarker {
 }
 /**
  * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * `sealing` (a NON-firm provider). Mints + seals the owner secret
  * via {@link resolveManagedSecret}, derives the owner keyring via
  * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
  * marker. Returns the unlocked owner keyring.
@@ -68,8 +68,8 @@ export interface DeedMarker {
  * The returned keyring is the only in-memory window onto `KEK_owner`
  * for this call; the persistent re-entry point is the sealing provider
  * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
+ * re-resolve the secret, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive secret is ever required).
  *
  * There is deliberately no firm-controlled fallback: the marker's
  * `sealedUnder` is the single cryptographic anchor of ownership.
@@ -85,7 +85,7 @@ export declare function loadDeedMarker(store: NoydbStore, vault: string): Promis
 export declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
 /**
  * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors
- * `saveSealedPassphrase`'s envelope shape: a standard
+ * `saveSealedSecret`'s envelope shape: a standard
  * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the
  * payload stored as plaintext JSON in `_data`. The marker is metadata,
  * not a secret — sealing it would defeat its purpose (auditors /

package/dist/with-party/team/index.d.ts

@@ -18,10 +18,11 @@ export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
 export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
-export { rotatePassphrase, recoverPassphrase, } from './rotate-recover.js';
-export type { RotatePassphraseInput, RecoverPassphraseInput, RecoverPassphraseResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
+export { rotateSecret, recoverSecret, } from './rotate-recover.js';
+export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
 export { recoverUser } from './peer-recover.js';
 export type { RecoverUserOptions } from './peer-recover.js';
 export { mintPaperRecoveryEntry, unwrapDeksFromPaperEntry, loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEntry, } from './recovery.js';
@@ -31,8 +32,4 @@ export type { WrappedDeksBlob } from './wrapped-deks.js';
 export { writeMagicLinkGrant, readMagicLinkGrantRecord, listMagicLinkGrants, unwrapMagicLinkGrant, revokeMagicLinkGrant, deriveMagicLinkContentKey, magicLinkGrantRecordId, isMagicLinkGrantExpired, } from './magic-link-grant.js';
 export { hasExportCapability, evaluateExportCapability, } from './keyring.js';
 export { hasImportCapability, evaluateImportCapability, } from './keyring.js';
-export { SyncEngine } from './sync.js';
-export { SyncTransaction } from './sync-transaction.js';
-export { PresenceHandle } from './presence.js';
-export { putCredential, getCredential, deleteCredential, listCredentials, credentialStatus, SYNC_CREDENTIALS_COLLECTION, } from './sync-credentials.js';
-export type { SyncCredential } from './sync-credentials.js';
+export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -1,6 +1,6 @@
-import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope as UserEnvelopeReader } from '../../kernel/types.js';
+import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type PassphrasePolicy } from '../../kernel/validation.js';
+import { type SecretPolicy } from '../../kernel/validation.js';
 /** In-memory representation of an unlocked keyring. */
 export interface UnlockedKeyring {
     readonly userId: string;
@@ -9,7 +9,7 @@ export interface UnlockedKeyring {
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
     /**
-     * The KEK, when this keyring was unlocked via tier 1 (passphrase) or
+     * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the
      * keyring was opened via:
      *
@@ -71,8 +71,15 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
+/** Options for {@link loadKeyring} (#846b). */
+export interface LoadKeyringOptions {
+    /** The user whose keyring to unlock. */
+    readonly userId: string;
+    /** That user's secret. */
+    readonly secret: string;
+}
 /** Load and unlock a user's keyring for a vault. */
-export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string): Promise<UnlockedKeyring>;
+export declare function loadKeyring(store: NoydbStore, vault: string, opts: LoadKeyringOptions): Promise<UnlockedKeyring>;
 /**
  * Open-policy pre-gate: decide create-vs-fail-closed **before** any
  * vault write. `openVault` must not self-provision an owner keyring into a
@@ -81,26 +88,38 @@ export declare function loadKeyring(adapter: NoydbStore, vault: string, userId:
  * `store.list`. Returns when the open may proceed (the caller is a member, or
  * the vault is genuinely-new and `create` is allowed, in which case the caller
  * falls through to the normal `createOwnerKeyring` path); throws `NoAccessError`
- * otherwise. Placed before managed-passphrase secret resolution (which persists
+ * otherwise. Placed before managed-secret secret resolution (which persists
  * on first open), so a fail-closed open writes nothing.
  */
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
+/**
+ * Options for {@link createOwnerKeyring} (#846b). The `SecretPolicy` knobs are
+ * flattened into the same bag rather than nested, so `assertStrongSecret` can
+ * take `opts` directly.
+ */
+export interface CreateOwnerKeyringOptions extends SecretPolicy {
+    /** The owner to create. */
+    readonly userId: string;
+    /** The owner's secret. */
+    readonly secret: string;
+    /** Gate creation on the phrase-format strength rules. Default false. */
+    readonly validate?: boolean;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
 /**
  * Create the initial owner keyring for a new vault.
  *
- * Pass `{ validate: true }` (or a `PassphrasePolicy`) to gate creation
+ * Pass `{ validate: true }` (or any `SecretPolicy` knob) to gate creation
  * on the phrase-format strength rules — `Noydb` threads this from
- * `NoydbOptions.validatePassphrase`. Direct callers (CLI, scripts,
+ * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
-export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string, passphraseOpts?: PassphrasePolicy & {
-    validate?: boolean;
-    allowWeakPassphrase?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function createOwnerKeyring(store: NoydbStore, vault: string, opts: CreateOwnerKeyringOptions): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
-export declare function grant(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
+export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
-export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
 /**
  * Mutate `role`, `displayName`, and/or `permissions` on an existing
  * keyring. Pure plaintext-header rewrite — no DEK rewrap, no KEK
@@ -125,33 +144,62 @@ export declare function revoke(adapter: NoydbStore, vault: string, callerKeyring
  * @throws `ValidationError` when the diff is empty (nothing to update).
  *
  */
-export declare function updateKeyringIdentity(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
+export declare function updateKeyringIdentity(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: UpdateUserOptions): Promise<void>;
 /**
  * Rotate DEKs for specified collections:
  * 1. Generate new DEKs
  * 2. Re-encrypt all records in affected collections
  * 3. Re-wrap new DEKs for all remaining users
  */
-export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]): Promise<void>;
 /**
- * Change the user's passphrase. Re-wraps every DEK under the new KEK.
+ * What a DEK rotation leaves behind (#854).
+ *
+ * A member's DEKs are wrapped under that member's KEK, and a KEK derives only
+ * from that member's secret — so the caller cannot re-wrap a fresh DEK for
+ * anyone else. That is the zero-knowledge property working as designed, but it
+ * means rotation necessarily DROPS the rotated collections from every other
+ * member's keyring rather than re-keying them.
+ *
+ * `needsRegrant` names exactly who lost what, so the caller can re-run
+ * `grant()` instead of discovering the access loss later.
+ */
+export interface RotateResult {
+    /** (member, collection) pairs whose access was dropped by the rotation. */
+    readonly needsRegrant: ReadonlyArray<{
+        readonly userId: string;
+        readonly collection: string;
+    }>;
+}
+/** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
+export interface RotateKeysOptions {
+    /** Collections whose DEKs are re-minted. */
+    readonly collections: readonly string[];
+}
+export declare function rotateKeys(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions): Promise<RotateResult>;
+/** Options for {@link changeSecret} (#846b). */
+export interface ChangeSecretOptions extends SecretPolicy {
+    /** The replacement secret. */
+    readonly newSecret: string;
+    /** Escape hatch for fixtures and migrations — skips the strength gate. */
+    readonly allowWeakSecret?: boolean;
+}
+/**
+ * Change the user's secret. Re-wraps every DEK under the new KEK.
  *
- * Validates the new passphrase against the strength rules unless
- * `allowWeakPassphrase: true` is passed. Mirrors `rotatePassphrase`'s
+ * Validates the new secret against the strength rules unless
+ * `allowWeakSecret: true` is passed. Mirrors `rotateSecret`'s
  * default-on validation contract.
  *
- * `db.rotatePassphrase()` adds a `checkGate('rotate-passphrase')` step
- * on top of this primitive and additionally requires the OLD passphrase
+ * `db.team.rotateSecret()` adds a `checkGate('rotate-secret')` step
+ * on top of this primitive and additionally requires the OLD secret
  * for re-derivation; `changeSecret` reuses the cached unlocked KEK so
- * the OLD passphrase is not retyped.
+ * the OLD secret is not retyped.
  */
-export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newPassphrase: string, passphraseOpts?: PassphrasePolicy & {
-    allowWeakPassphrase?: boolean;
-}): Promise<UnlockedKeyring>;
+export declare function changeSecret(store: NoydbStore, vault: string, keyring: UnlockedKeyring, opts: ChangeSecretOptions): Promise<UnlockedKeyring>;
 /**
  * Recipient slot in a re-keyed `.noydb` bundle. Each slot becomes its
- * own keyring file inside the bundle, sealed with its own passphrase.
- * Same role/permission semantics as `db.grant()` but no adapter side
+ * own keyring file inside the bundle, sealed with its own secret.
+ * Same role/permission semantics as `db.grant()` but no store side
  * effect — the slot only exists inside the bundle bytes.
  *
  * @public
@@ -161,8 +209,8 @@ export interface BundleRecipient {
     readonly id: string;
     /** Optional display name. Defaults to `id`. */
     readonly displayName?: string;
-    /** Passphrase the recipient will type to unlock. */
-    readonly passphrase: string;
+    /** Secret the recipient will type to unlock. */
+    readonly secret: string;
     /** Role on the destination vault. Defaults to `'viewer'`. */
     readonly role?: Role;
     /**
@@ -193,7 +241,7 @@ export interface BundleRecipient {
 }
 /**
  * Build a `KeyringFile` for one bundle recipient, given the source
- * vault's unwrapped DEKs. Mirrors `grant()` minus the adapter write —
+ * vault's unwrapped DEKs. Mirrors `grant()` minus the store write —
  * the produced file is meant to be embedded in the bundle's
  * `keyrings` map, never persisted to the source vault.
  *
@@ -204,7 +252,7 @@ export interface BundleRecipient {
  */
 export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
-export declare function listUsers(adapter: NoydbStore, vault: string): Promise<UserInfo[]>;
+export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**
  * Optional filter knobs for {@link listUsersWithEnvelopes}.
  *
@@ -254,18 +302,18 @@ export interface ListUsersOptions {
  * Order matches `listUsers()` (store-defined; sort if you need a
  * stable display order).
  */
-export declare function listUsersWithEnvelopes<T = unknown>(adapter: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
+export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, vault: string, userEnvelopeDek: EnclaveKey, callerRole: Role, options?: ListUsersOptions): Promise<Array<{
     user: UserInfo;
-    envelope: UserEnvelopeReader<T> | null;
+    envelope: UserEnvelope<T> | null;
 }>>;
 /** Ensure a DEK exists for a collection. Generates one if new. */
-export declare function ensureCollectionDEK(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */
 export declare function hasAccess(keyring: UnlockedKeyring, collectionName: string): boolean;
-/** Persist a keyring file to the adapter. */
-export declare function persistKeyring(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
+/** Persist a keyring file to the store. */
+export declare function persistKeyring(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<void>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
  * export tier.

package/dist/with-party/team/{managed-passphrase.d.ts → managed-secret.d.ts}

@@ -1,7 +1,7 @@
 /**
- * Managed-passphrase mode — rubber-hose-resistant vaults.
+ * Managed-secret mode — rubber-hose-resistant vaults.
  *
- * A vault mode where the passphrase is machine-generated and never
+ * A vault mode where the secret is machine-generated and never
  * exposed to the user, sealed under a developer-provided
  * {@link SealingKeyProvider} (macOS Keychain, Windows Credential
  * Manager, libsecret, AWS KMS, …). The user has no secret to give
@@ -27,31 +27,31 @@
  *     implementation of both `RecipientSealer` and
  *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;
  *     safe for tests and same-process sender/recipient scenarios.
- *   - {@link loadSealedPassphrase} / {@link saveSealedPassphrase} —
- *     plaintext envelope storage at `_meta/sealed-passphrase`.
+ *   - {@link loadSealedSecret} / {@link saveSealedSecret} —
+ *     plaintext envelope storage at `_meta/sealed-secret`.
  *     Mirrors the `_meta/handle` and `_meta/public-envelope` AES-
  *     GCM-bypassed patterns. The sealing layer (provider's job)
  *     is the security boundary; hub doesn't have a key to encrypt
  *     with at this layer — that's the whole point of the design.
  *   - {@link resolveManagedSecret} — orchestrates the "generate +
  *     seal + persist on first open; unseal on reopen" flow.
- *     Returns the plaintext passphrase string that the rest of the
+ *     Returns the plaintext secret string that the rest of the
  *     `createNoydb` keyring path consumes.
  *
  * Deferred to follow-ups:
- *   - Block `rotate-passphrase` policy gate under managed mode.
+ *   - Block `rotate-secret` policy gate under managed mode.
  *   - Mandatory strong-recovery enforcement.
  *   - Recovery flow under managed mode (generates fresh sealed phrase).
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-passphrase mode
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
  *
  * @module
  */
 import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 /**
  * The contract concrete providers (per-platform key stores) implement
- * to seal and unseal a hub-generated random passphrase. The plaintext
- * passphrase NEVER leaves hub-controlled memory in unsealed form —
+ * to seal and unseal a hub-generated random secret. The plaintext
+ * secret NEVER leaves hub-controlled memory in unsealed form —
  * the provider receives the bytes, returns opaque sealed bytes, and
  * later reverses the operation. Hub treats the sealed bytes as
  * fully opaque.
@@ -69,7 +69,7 @@ import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 export interface SealingKeyProvider {
     /**
      * Non-sensitive identifier disclosed in the persisted envelope.
-     * Surfaced to consumers via `loadSealedPassphrase().providerId` so
+     * Surfaced to consumers via `loadSealedSecret().providerId` so
      * a vault opened with the wrong provider class can detect the
      * mismatch and surface a clear error. NOT secret — fine to log.
      *
@@ -78,8 +78,8 @@ export interface SealingKeyProvider {
      * parses this; it's purely audit metadata.
      */
     readonly id: string;
-    /** Seal raw passphrase bytes. Output bytes are opaque to hub. */
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    /** Seal raw secret bytes. Output bytes are opaque to hub. */
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     /**
      * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or
      * any other failure — hub treats a thrown error as "this provider
@@ -90,7 +90,7 @@ export interface SealingKeyProvider {
 /**
  * In-memory test provider. NOT secure — uses a deterministic
  * per-instance "key" (16-byte SHA-256 of `id`) XOR'd over the
- * passphrase plus a 4-byte provider-id fingerprint prefix. The XOR is
+ * secret plus a 4-byte provider-id fingerprint prefix. The XOR is
  * sufficient to make different `id` values produce mutually-unsealable
  * outputs (the contract tests for that), but offers ZERO real
  * confidentiality — never use outside tests.
@@ -104,7 +104,7 @@ export declare class MemorySealingKeyProvider implements SealingKeyProvider {
     constructor(opts: {
         id: string;
     });
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 }
 /**
@@ -201,17 +201,17 @@ export declare class MemoryRecipientSealer implements SealingKeyProvider, Recipi
     seal(plaintext: Uint8Array): Promise<Uint8Array>;
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }
-/** Reserved id for the managed-passphrase envelope under `_meta`. */
-export declare const SEALED_PASSPHRASE_RECORD_ID: "sealed-passphrase";
-/** Plaintext payload stored inside the `_meta/sealed-passphrase` envelope. */
-export interface SealedPassphrase {
+/** Reserved id for the managed-secret envelope under `_meta`. */
+export declare const SEALED_SECRET_RECORD_ID: "sealed-secret";
+/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */
+export interface SealedSecret {
     readonly _noydb_sealed: 1;
     readonly providerId: string;
     /** Sealed bytes. Base64-encoded on the wire; decoded on load. */
     readonly sealed: Uint8Array;
 }
 /**
- * Wire-format envelope persisted at `_meta/sealed-passphrase` for
+ * Wire-format envelope persisted at `_meta/sealed-secret` for
  * managed-mode vaults. The provider produces raw sealed bytes via
  * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch
  * metadata hub needs to pick the right provider on the unseal path.
@@ -237,8 +237,8 @@ export interface SealedEnvelope {
     readonly payload: string;
 }
 /**
- * Parse a `_meta/sealed-passphrase` `_data` JSON string into the
- * in-memory {@link SealedPassphrase} representation. Accepts both:
+ * Parse a `_meta/sealed-secret` `_data` JSON string into the
+ * in-memory {@link SealedSecret} representation. Accepts both:
  *
  *   1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —
  *      the current shape.
@@ -251,20 +251,20 @@ export interface SealedEnvelope {
  *
  * @internal — exported only for the migration safety-net test suite.
  */
-export declare function parseSealedEnvelope(raw: unknown): SealedPassphrase | undefined;
-export declare function saveSealedPassphrase(store: NoydbStore, vault: string, payload: {
+export declare function parseSealedEnvelope(raw: unknown): SealedSecret | undefined;
+export declare function saveSealedSecret(store: NoydbStore, vault: string, payload: {
     readonly providerId: string;
     readonly sealed: Uint8Array;
 }): Promise<void>;
-export declare function loadSealedPassphrase(store: NoydbStore, vault: string): Promise<SealedPassphrase | undefined>;
+export declare function loadSealedSecret(store: NoydbStore, vault: string): Promise<SealedSecret | undefined>;
 /**
- * Resolve the effective plaintext passphrase string for a managed-mode
+ * Resolve the effective plaintext secret string for a managed-mode
  * vault. Two paths:
  *
  *   1. **First open (no envelope persisted):** generate a 256-bit random
  *      via `crypto.getRandomValues`, base64-encode for use as a
- *      passphrase string, seal the underlying bytes under the
- *      provider, persist `_meta/sealed-passphrase`, return the
+ *      secret string, seal the underlying bytes under the
+ *      provider, persist `_meta/sealed-secret`, return the
  *      base64 string.
  *
  *   2. **Reopen (envelope exists):** read + unseal + decode → return.