@noy-db/hub 0.4.0-pre.3 → 0.4.0-pre.5

package/dist/indexing/index.js

@@ -7,12 +7,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-CGPO3ZYB.js";
+} from "../chunk-BY5YBSXA.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts

package/dist/issue-F76PAGIR.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-YXIVUWDU.js";
+import "./chunk-QZJEYZ4I.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-F76PAGIR.js.map

package/dist/kernel/collection-config.d.ts

@@ -17,6 +17,7 @@
  * signature can't be exposed via a method without breaking `Collection<T>`
  * assignability to `Collection<unknown>`).
  */
+import type { StrategyBag } from '../port/with/strategies.js';
 import type { NoydbStore, ConflictPolicy, CollectionConflictResolver, HistoryConfig, TierMode, CrossTierAccessEvent, VdigFieldPolicy } from './types.js';
 import type { EnclaveKey } from './enclave/index.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
@@ -29,24 +30,15 @@ import type { SchemaFenceController } from '../with-shape/schema-update/fence-co
 import type { StandardSchemaV1 } from './schema.js';
 import type { LedgerStore } from '../with-commit/history/ledger/index.js';
 import type { CrdtMode } from '../with-commit/crdt/crdt.js';
-import type { CrdtStrategy } from './types.js';
-import { type HistoryStrategy } from '../with-commit/history/strategy.js';
-import { type I18nStrategy } from '../port/with/i18n-strategy.js';
-import { type SyncStrategy } from '../with-party/team/sync-strategy.js';
-import { type BlobStrategy } from '../port/with/blob-strategy.js';
-import { type AggregateStrategy } from '../with-lookup/aggregate/strategy.js';
-import { type TiersStrategy } from '../with-audit/tiers/strategy.js';
-import { type SearchStrategy } from '../with-lookup/search/strategy.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
 import type { BlobFieldsConfig } from '../with-shape/blobs/blob-compaction.js';
-import type { IndexStrategy } from '../with-lookup/indexing/strategy.js';
 import type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 import type { I18nTextDescriptor, DictKeyDescriptor, StaticDictDescriptor, DictionaryHandle } from '../port/with/i18n-strategy.js';
 import type { LookupDescriptor, MaterializedBacking } from '../port/with/lookup-strategy.js';
 import type { ComputedFields, ComputedFn, ComputedFieldEntry } from '../with-formula/computed/index.js';
 import type { RollupDeleteIntent } from './via/dispatch.js';
 import '../port/with/computed-strategy.js';
-import { type ClassifiedEntry, type ResolvedClassified, type ClassifiedGuardCtx, type ClassifiedStrategy, type ClassifiedViaConfig } from '../port/with/classified-strategy.js';
+import { type ClassifiedEntry, type ResolvedClassified, type ClassifiedGuardCtx, type ClassifiedViaConfig } from '../port/with/classified-strategy.js';
 import type { FieldRef, Grain } from './via/graph.js';
 import type { FieldMeta } from '../with-shape/introspection/field-meta.js';
 import type { CollectionMeta } from '../with-shape/introspection/meta.js';
@@ -60,7 +52,6 @@ import type { TxContext } from '../with-commit/tx/transaction.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
 import type { MVQueryContext } from '../with-formula/materialized-views/types.js';
 import type { Collection, OnDirtyCallback, CacheOptions } from './collection.js';
-import type { LazyStrategy } from '../port/with/lazy-strategy.js';
 import { ViaPipeline } from './via/pipeline.js';
 import { type ViaBinding, type ViaDescriptor } from './via/index.js';
 import { type ViaFieldSpec } from './via/compose.js';
@@ -74,6 +65,14 @@ export interface CollectionOpts<T> {
     name: string;
     keyring: UnlockedKeyring;
     encrypted: boolean;
+    /**
+     * Every opt-in service, resolved once by `createNoydb` (#838). Replaces the
+     * eleven optional `*Strategy` fields this interface used to declare, each of
+     * which re-applied a `?? NO_*` default that had already been applied
+     * upstream. Each entry is a tree-shake seam: an un-opted-in service holds
+     * its `NO_*` stub, so the real machinery never reaches the bundle.
+     */
+    strategies: StrategyBag;
     /**
      * Opt-in: keep the working set encrypted in RAM, decrypting on read (future phase).
      * Default false — the working set is plaintext.
@@ -113,13 +112,6 @@ export interface CollectionOpts<T> {
      * back to an unconditional store read on re-create.
      */
     tabCoordinated?: (() => boolean) | undefined;
-    /**
-     * tree-shake seam. When omitted, `collection.blob(id)` throws
-     * with a pointer at the `@noy-db/hub/blobs` subpath. When set (via
-     * `createNoydb({ blobStrategy: blobs() })`), blob storage is live.
-     * `@internal` by virtue of `BlobStrategy` being `@internal`.
-     */
-    blobStrategy?: BlobStrategy | undefined;
     objectStore?: ObjectProjection | undefined;
     blobFields?: BlobFieldsConfig | undefined;
     /**
@@ -132,26 +124,6 @@ export interface CollectionOpts<T> {
      * decryptable at rest under the flat `_blob` DEK (documented residue).
      */
     blobTierPolicy?: 'isolate' | 'dedup' | undefined;
-    aggregateStrategy?: AggregateStrategy | undefined;
-    crdtStrategy?: CrdtStrategy | undefined;
-    /**
-     * tree-shake seam — strategy for optional history/ledger/
-     * time-machine. When omitted, history snapshots and ledger appends
-     * become silent no-ops (data still writes); the read APIs
-     * (`history`, `getVersion`, `revert`, `diff`, `clearHistory`,
-     * `pruneRecordHistory`) throw with a pointer at `@noy-db/hub/history`.
-     */
-    historyStrategy?: HistoryStrategy | undefined;
-    i18nStrategy?: I18nStrategy | undefined;
-    syncStrategy?: SyncStrategy | undefined;
-    /**
-     * tree-shake seam. When omitted, indexing is off for this
-     * collection — every `.lazyQuery()` call throws, `.rebuildIndexes()`
-     * is a no-op, and `indexes: [...]` declarations are ignored. Enable
-     * by passing `withIndexing()` from `@noy-db/hub/indexing` at
-     * `createNoydb` time.
-     */
-    indexStrategy?: IndexStrategy | undefined;
     indexes?: IndexDef[] | undefined;
     /**
      * Auto-reconcile behavior for persisted-index drift on lazy-mode
@@ -183,12 +155,6 @@ export interface CollectionOpts<T> {
      * unbounded lazy cache defeats the purpose.
      */
     cache?: CacheOptions | undefined;
-    /**
-     * Lazy service seam (#267) — supplies the bounded-LRU working-set cache
-     * when `prefetch: false`. Omitted → the deprecated IMPLICIT_LAZY
-     * back-compat default (identical behavior + one-time warn).
-     */
-    lazyStrategy?: LazyStrategy | undefined;
     /**
      * Optional Standard Schema v1 validator (Zod, Valibot, ArkType,
      * Effect Schema, etc.). When set, every `put()` is validated before
@@ -274,8 +240,6 @@ export interface CollectionOpts<T> {
      * `undefined` when no forget strategy declares this collection (no-op).
      */
     addSubjectRef?: ((id: string, record: unknown) => Promise<void>) | undefined;
-    /** — tree-shake seam for `collection.reveal()`. Defaults to `NO_CLASSIFIED`. */
-    classifiedStrategy?: ClassifiedStrategy | undefined;
     /**
      * async callback that resolves a dict key to its label
      * for a given locale. Provided by the Vault.
@@ -433,20 +397,6 @@ export interface CollectionOpts<T> {
      * throw). Tier 0 is implicit and always available.
      */
     tiers?: readonly number[] | undefined;
-    /**
-     * tree-shake seam — strategy for the collection-level tier operations
-     * (`putAtTier`/`getAtTier`/`listAtTier`/`elevate`/`demote`). When omitted,
-     * every tier operation throws `TiersNotEnabledError`. Enable by passing
-     * `withTiers()` from `@noy-db/hub/tiers` at `createNoydb` time.
-     */
-    tiersStrategy?: TiersStrategy | undefined;
-    /**
-     * Search / retrieval capability strategy. When omitted, a collection's
-     * `search`/`retrieve`/`similarTo`/`warmIndex`/`flushIndex` methods and the
-     * embedding write-hook throw `SearchNotEnabledError`. Enable by passing
-     * `withSearch()` from `@noy-db/hub` at `createNoydb` time.
-     */
-    searchStrategy?: SearchStrategy | undefined;
     /**
      * what a lower-tier caller sees for above-tier
      * records. Default `'invisibility'`.
@@ -702,14 +652,9 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     writeHooks: WriteHookRegistry | undefined;
     subsystemBus: ServiceBus | undefined;
     activeTxId: (() => string | null) | undefined;
-    blobStrategy: BlobStrategy;
+    strategies: StrategyBag;
     objectStore: ObjectProjection | undefined;
     blobFields: BlobFieldsConfig | undefined;
-    aggregateStrategy: AggregateStrategy;
-    crdtStrategy: CrdtStrategy;
-    historyStrategy: HistoryStrategy;
-    i18nStrategy: I18nStrategy;
-    syncStrategy: SyncStrategy;
     reconcileOnOpen: "auto" | "off" | "dry-run";
     getDEK: (collectionName: string) => Promise<EnclaveKey>;
     onDirty: OnDirtyCallback | undefined;
@@ -742,7 +687,6 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
     moneyFields: Record<string, ViaDescriptor> | undefined;
     classified: ResolvedClassified | undefined;
     classifiedGuardCtx: ClassifiedGuardCtx;
-    classifiedStrategy: ClassifiedStrategy;
     computed: ComputedFields | undefined;
     computedEdges: readonly GraphEdge[];
     viaDepsEdges: readonly GraphEdge[];
@@ -794,8 +738,6 @@ export declare function resolveCollectionConfig<T>(opts: CollectionOpts<T>): {
         collectDelete(collection: string, id: string, intents: readonly RollupDeleteIntent[]): void;
     } | undefined;
     tiers: Set<number> | null;
-    tiersStrategy: TiersStrategy;
-    searchStrategy: SearchStrategy;
     tierMode: TierMode;
     blobTierPolicy: "isolate" | "dedup";
     onCrossTierAccess: ((event: CrossTierAccessEvent) => void) | undefined;

package/dist/kernel/collection.d.ts

@@ -96,24 +96,19 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
     private readonly historyConfigExplicit;
     /**
-     * tree-shake seam — the strategy that backs `collection.blob(id)`.
-     * Defaults to `NO_BLOBS`, a ~10-line stub that throws with an actionable
-     * message. Consumers opt into real blob storage by importing
-     * `{ blobs }` from `@noy-db/hub/blobs` and passing the returned
-     * strategy to `createNoydb({ blobStrategy: blobs() })`. With the
-     * default stub, none of the BlobSet / chunk / MIME-magic machinery
-     * reaches the bundle.
-     */
-    private readonly blobStrategy;
+     * Every opt-in service, resolved once by `createNoydb` (#838) and shared by
+     * reference with the owning `Vault` and `Noydb`.
+     *
+     * Each entry is a tree-shake seam. An un-opted-in service resolves to its
+     * `NO_*` stub — a tiny module that throws with an actionable message —
+     * so, for example, none of the BlobSet / chunk / MIME-magic machinery
+     * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
+     * passes `blobStrategy: blobs()` to `createNoydb`.
+     */
+    private readonly strategies;
     private readonly objectStore;
     private readonly blobFields;
     private readonly blobTierPolicy;
-    private readonly aggregateStrategy;
-    private readonly crdtStrategy;
-    private readonly tiersStrategy;
-    private readonly searchStrategy;
-    private readonly historyStrategy;
-    private readonly syncStrategy;
     private readonly cache;
     private hydrated;
     /**
@@ -275,12 +270,6 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
     /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
     private _markerDigestOnlyCache;
     private _markerPersisted;
-    /**
-     * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
-     * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
-     * `createNoydb()` option (opt in with `withClassified()`).
-     */
-    private readonly classifiedStrategy;
     /** Async callback provided by the Vault to open a dynamic dictionary handle (for label-map pre-computation in the search index). Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely. Mutable, assign-once — see {@link _reconcileReadState} (#671 item 1). */
     private getDictionary;
     /**
@@ -676,7 +665,6 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * right back out, defeating C6.
      */
     private _toCacheableRecord;
-    /** @internal Untracked put body — call {@link put}, not this. */
     private _putInternal;
     /**
      * Fire registered MV strategies whose dependency set includes this

package/dist/kernel/enclave/crypto.d.ts

@@ -22,7 +22,7 @@
  * ## Key lifecycle
  *
  * ```
- * passphrase + salt
+ * secret + salt
  *   └─► deriveKey()       → KEK (CryptoKey, extractable: false)
  *         └─► wrapKey()   → wrapped DEK bytes  [stored in keyring]
  *         └─► unwrapKey() → DEK (CryptoKey)    [memory only during session]
@@ -46,26 +46,26 @@
  * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).
  */
 export type EnclaveKey = CryptoKey;
-/** Derive a KEK from a passphrase and salt using PBKDF2-SHA256. */
-export declare function deriveKey(passphrase: string, salt: Uint8Array): Promise<CryptoKey>;
+/** Derive a KEK from a secret and salt using PBKDF2-SHA256. */
+export declare function deriveKey(secret: string, salt: Uint8Array): Promise<CryptoKey>;
 /**
- * Which AES algorithm/usage a {@link derivePassphraseKey} result is for:
+ * Which AES algorithm/usage a {@link deriveSecretKey} result is for:
  * `'aes-kw'` mints a key-wrapping key (`wrapKey`/`unwrapKey`, e.g. for
  * KEK derivation); `'aes-gcm'` mints a direct encrypt/decrypt key (e.g.
  * for the wrap-DEKs primitive in `with-party/team/wrapped-deks.ts`).
  */
-export type PassphraseKeyUsage = 'aes-kw' | 'aes-gcm';
+export type SecretKeyUsage = 'aes-kw' | 'aes-gcm';
 /**
- * Derive a non-extractable AES key from a passphrase/credential and salt
+ * Derive a non-extractable AES key from a secret/credential and salt
  * via PBKDF2-SHA256, generalizing {@link deriveKey}'s AES-KW derivation to
  * also cover AES-GCM-usage keys. Callers pin their own `iterations` and
  * `keyUsage` so an existing call site's exact parameters (and thus its
  * derived-key bytes) are preserved verbatim when migrated onto this
  * shared primitive — this is call-site consolidation, not a KDF change.
  */
-export declare function derivePassphraseKey(passphrase: string, salt: Uint8Array, params: {
+export declare function deriveSecretKey(secret: string, salt: Uint8Array, params: {
     iterations: number;
-    keyUsage: PassphraseKeyUsage;
+    keyUsage: SecretKeyUsage;
 }): Promise<CryptoKey>;
 /** Generate a random AES-256-GCM data encryption key. */
 export declare function generateDEK(): Promise<CryptoKey>;

package/dist/kernel/enclave/index.d.ts

@@ -56,8 +56,8 @@
  */
 export type { EnclaveKey, EncryptResult } from './crypto.js';
 export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
-export { deriveKey, derivePassphraseKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
-export type { PassphraseKeyUsage } from './crypto.js';
+export { deriveKey, deriveSecretKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
+export type { SecretKeyUsage } from './crypto.js';
 export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
 export type { RewrappedBody } from './record-keys/lifecycle.js';
 export { RecordCodec } from './record-keys/record-codec.js';

package/dist/kernel/errors.d.ts

@@ -10,7 +10,7 @@
  *       ├─ Crypto errors
  *       │    ├─ DecryptionError        — AES-GCM tag failure
  *       │    ├─ TamperedError          — ciphertext modified after write
- *       │    └─ InvalidKeyError        — wrong passphrase / corrupt keyring
+ *       │    └─ InvalidKeyError        — wrong secret / corrupt keyring
  *       ├─ Access errors
  *       │    ├─ NoAccessError          — no DEK for this collection
  *       │    ├─ ReadOnlyError          — ro permission, write attempted
@@ -78,9 +78,9 @@
  * import { NoydbError, InvalidKeyError, ConflictError } from '@noy-db/hub'
  *
  * try {
- *   await vault.unlock(passphrase)
+ *   await vault.unlock(secret)
  * } catch (e) {
- *   if (e instanceof InvalidKeyError) { showBadPassphraseUI(); return }
+ *   if (e instanceof InvalidKeyError) { showBadSecretUI(); return }
  *   if (e instanceof NoydbError) { logToSentry(e.code, e); return }
  *   throw e  // unexpected — re-throw
  * }
@@ -125,8 +125,8 @@ export declare class DebugReservedFieldError extends NoydbError {
 /**
  * Thrown when AES-GCM decryption fails.
  *
- * The most common cause is a wrong passphrase or a corrupted ciphertext.
- * A `DecryptionError` at the wrong passphrase level is caught internally
+ * The most common cause is a wrong secret or a corrupted ciphertext.
+ * A `DecryptionError` at the wrong secret level is caught internally
  * and re-thrown as `InvalidKeyError` — so in practice this surfaces for
  * per-record corruption rather than authentication failures.
  */
@@ -146,12 +146,12 @@ export declare class TamperedError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Thrown when key unwrapping fails, typically because the passphrase is wrong
+ * Thrown when key unwrapping fails, typically because the secret is wrong
  * or the keyring file is corrupted.
  *
  * NOYDB uses AES-KW (RFC 3394) to wrap DEKs with the KEK. If AES-KW
  * unwrapping fails, it means either the KEK was derived from the wrong
- * passphrase (PBKDF2 with 600K iterations) or the keyring bytes are
+ * secret (PBKDF2 with 600K iterations) or the keyring bytes are
  * corrupted. This is the error shown to the user on a failed unlock attempt.
  */
 export declare class InvalidKeyError extends NoydbError {
@@ -160,7 +160,7 @@ export declare class InvalidKeyError extends NoydbError {
 /**
  * Thrown when a keyring's wrapped-DEK set unwraps partially — at least
  * one DEK succeeds (proving the KEK is correct) but at least one fails.
- * The passphrase is right; the failed entries are corrupted.
+ * The secret is right; the failed entries are corrupted.
  *
  * This is distinct from {@link InvalidKeyError} so that
  * `NoydbOptions.onInvalidKey: 'reset'` does NOT fire — resetting on
@@ -273,7 +273,7 @@ export declare class ExportCapabilityError extends NoydbError {
  * Thrown when a keyring file's `expires_at` cutoff has passed.
  * Surfaced by `loadKeyring` before any DEK unwrap is attempted —
  * past the cutoff the slot refuses to open even with the right
- * passphrase. Distinct from PBKDF2 / unwrap errors so consumer code
+ * secret. Distinct from PBKDF2 / unwrap errors so consumer code
  * can show a precise "this bundle slot has expired" message instead
  * of the generic decryption-failure UX.
  *
@@ -948,14 +948,14 @@ export declare class BundleIntegrityError extends NoydbError {
 }
 /**
  * Thrown by `readPod` when the bundle carries
- * sealed per-user passphrases but no supplied `SealingKeyProvider`
+ * sealed per-user secrets but no supplied `SealingKeyProvider`
  * has a `.id` (= `pid`) matching the sealed entry's `pid`.
  *
  * Carries the failing pid + the user id so the recipient can
  * surface an actionable prompt:
  *
  * ```
- * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
+ * BundleSealMismatchError: bundle carries sealed secret for user "alice"
  *   under provider "macos-keychain:com.acme.app/alice@acme.example",
  *   but no registered provider matches that pid.
  * ```
@@ -1290,7 +1290,7 @@ export declare class CustodyNotEnabledError extends NoydbError {
  * (#267 keyring-grant → team split): enable multi-user grant/revoke/rotate
  * with `teamStrategy: withTeam()` from "@noy-db/hub/team" in createNoydb().
  * Single-user primitives (owner keyring, unlock, `listUsers`, `updateUser`,
- * passphrase rotate/recover) stay ungated.
+ * secret rotate/recover) stay ungated.
  */
 export declare class TeamNotEnabledError extends NoydbError {
     constructor(message?: string);
@@ -1386,7 +1386,7 @@ export declare class SessionNotFoundError extends NoydbError {
  *
  * The `operation` field names the specific operation that was blocked
  * (e.g. `'export'`, `'grant'`, `'rotate'`) so the caller can surface
- * a targeted prompt ("Please re-enter your passphrase to export data").
+ * a targeted prompt ("Please re-enter your secret to export data").
  */
 export declare class SessionPolicyError extends NoydbError {
     readonly operation: string;
@@ -1825,7 +1825,7 @@ export declare class PolicyDeniedError extends NoydbError {
 }
 /**
  * Raised by `createNoydb({ ... })` when the developer omits a recovery
- * profile and `recover-passphrase` is not explicitly disabled. Vaults
+ * profile and `recover-secret` is not explicitly disabled. Vaults
  * MUST have at least one recovery path enrolled before being
  * production-ready (paper, shamir, multi-channel, or admin-mediated).
  *
@@ -1835,10 +1835,10 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Raised by `openVault` when a managed-passphrase-mode vault has no
+ * Raised by `openVault` when a managed-secret-mode vault has no
  * STRONG recovery profile enrolled.
  *
- * Managed mode means the user never types a passphrase — the unlock
+ * Managed mode means the user never types a secret — the unlock
  * material lives in a `SealingKeyProvider` (`at-*` package). If that
  * provider's key is lost AND no strong recovery is enrolled, the
  * vault is irrecoverable. To prevent that footgun, managed-mode vaults
@@ -1846,11 +1846,11 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
  * multi-channel / admin-mediated when those ship).
  *
  * Paper recovery alone is NOT strong under managed mode: the user has
- * no memorized passphrase to fall back on, so losing the paper sheet =
+ * no memorized secret to fall back on, so losing the paper sheet =
  * losing every record permanently.
  *
- * Bootstrap with `db.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
- * to atomically create-and-enroll, or call `db.enrollRecovery(vault, { profile: "shamir", ... })`
+ * Bootstrap with `db.team.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
+ * to atomically create-and-enroll, or call `db.team.enrollRecovery(vault, { profile: "shamir", ... })`
  * separately before re-attempting `openVault`.
  */
 export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
@@ -1858,7 +1858,7 @@ export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
     constructor(vault: string);
 }
 /**
- * Raised by `db.recoverPassphrase` / `db.enrollRecovery` /
+ * Raised by `db.recoverSecret` / `db.enrollRecovery` /
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *