@noy-db/hub 0.4.0-pre.3 → 0.4.0-pre.5

package/dist/kernel/noydb.d.ts

@@ -1,8 +1,5 @@
 import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
-import type { PassphrasePolicy } from './validation.js';
-import { type RotatePassphraseInput, type RecoverPassphraseInput, type RecoverPassphraseResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from '../with-party/team/rotate-recover.js';
-import type { RecoverUserOptions } from '../with-party/team/peer-recover.js';
-import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from '../with-party/team/recovery.js';
+import type { SecretPolicy } from './validation.js';
 import { type CoordinationProvider } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { SetCoverInput } from '../with-party/directory/cover/schema.js';
@@ -13,9 +10,6 @@ import { WriteHookRegistry, type WriteHook, type Unsubscribe } from '../port/wit
 import { ServiceBus } from '../port/with/service-bus.js';
 import { type TabCoordinationOptions, type TabRole, type TabPresence } from '../with-party/tab-coordination.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from '../with-party/team/authenticators.js';
-import { type QuickUnlockState } from '../with-party/session/unlock-state.js';
-import type { KeyringAuthenticator } from './types.js';
 import type { SyncEngine } from '../with-party/team/sync.js';
 import type { SyncTransaction } from '../with-party/team/sync-transaction.js';
 import { type SnapshotMeta } from '../with-fork/snapshots/strategy.js';
@@ -24,6 +18,7 @@ import { TxContext } from '../with-commit/tx/transaction.js';
 import type { DryRunResult } from '../with-commit/tx/dry-run.js';
 import { type ForgetStrategy } from '../with-audit/forget/strategy.js';
 import { type CustodyStrategy } from '../with-party/custody/strategy.js';
+import { TeamFacade } from '../with-party/team/noydb-facade.js';
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
 type ResolvedNoydbOptions = NoydbOptions & {
     readonly store: NoydbStore;
@@ -56,7 +51,7 @@ export declare class Noydb {
     private readonly keyringCache;
     private readonly syncEngines;
     /**
-     * Per-vault active session tier — defaults to `1` after a passphrase
+     * Per-vault active session tier — defaults to `1` after a secret
      * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
      * {@link checkGate} to evaluate `gate.minTier`.
      */
@@ -84,26 +79,38 @@ export declare class Noydb {
     private writeRelay;
     /** Per-vault policy enforcers. */
     private readonly policyEnforcers;
-    private readonly txStrategy;
-    private readonly forgetStrategy;
     /**
-     * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
-     * `withCustody()` was passed. Public so `Vault` routes `vault.custody.liberate`
-     * through it; grant/revoke route through it from this class. @internal
+     * Every opt-in service, resolved once (#838). Shared by reference with each
+     * `Vault` this instance opens and, through them, every `Collection` — so
+     * there is exactly one resolution and no construction path can disagree
+     * about which services are enabled (the #834 bug class).
      */
-    readonly custodyStrategy: CustodyStrategy;
+    private readonly strategies;
     /**
-     * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
-     * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
-     * engines are linked only by the active strategy, not by this file. */
-    private readonly teamStrategy;
-    private readonly sessionStrategy;
-    private readonly syncStrategy;
+     * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
+     * `withCustody()` was passed. Kept as a public accessor because `Vault`
+     * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+     * @internal
+     */
+    get custodyStrategy(): CustodyStrategy;
     private readonly snapshots;
     private readonly policyManager;
     /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
     private readonly policyCheckGate;
-    private readonly team;
+    /**
+     * Credential and multi-user operations — enrolment, secret rotation,
+     * recovery, quick-unlock (#846).
+     *
+     * Public because 23 methods on this class did nothing but restate a
+     * TeamFacade signature and forward to it, so every signature had to be
+     * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+     * reads the same and has one source of truth.
+     *
+     * A getter, not a field, so it appears in the prototype-based kernel API
+     * manifest — an instance field is invisible to it (the same reason
+     * `custodyStrategy` became one in #838).
+     */
+    get team(): TeamFacade;
     /**
      * Currently-running multi-record transaction, set by
      * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -282,9 +289,9 @@ export declare class Noydb {
      *
      * The walk is a two-step pipeline: first ask the adapter for the
      * universe of compartments it stores, then for each one attempt to
-     * load the calling user's keyring with the in-memory passphrase.
+     * load the calling user's keyring with the in-memory secret.
      * Compartments where the user has no keyring file (`NoAccessError`)
-     * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+     * or where the secret doesn't unwrap (`InvalidKeyError`) are
      * silently dropped from the result — the existence of those
      * compartments is **not** confirmed in the return value.
      *
@@ -305,15 +312,15 @@ export declare class Noydb {
      * **Known edge case.** A vault whose keyring file
      * happens to have an empty wrapped-DEKs map (because the owner
      * granted access before any collection was created) will pass the
-     * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+     * `loadKeyring` probe with *any* secret — there are no DEKs to
      * unwrap, so the integrity-checked unwrap that normally rejects
-     * wrong passphrases never runs. The result is that an unrelated
+     * wrong secrets never runs. The result is that an unrelated
      * principal who happens to know the user-id and the vault
      * name can show up in `listAccessibleVaults()` as having
      * access to that empty vault. They cannot read any actual
      * data (their DEK set is empty), so this is a metadata leak
      * (vault name + user-id), not a content leak. Hardening this
-     * via a passphrase canary in the keyring file is a deferred
+     * via a secret canary in the keyring file is a deferred
      * follow-up.
      *
      * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -406,15 +413,15 @@ export declare class Noydb {
      */
     _resolveBackend(vaultId: string): NoydbStore;
     /**
-     * Change the current user's passphrase for a vault.
+     * Change the current user's secret for a vault.
      *
-     * Validates the new passphrase against the strength rules. Pass
-     * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-     * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+     * Validates the new secret against the strength rules. Pass
+     * `{ allowWeakSecret: true }` to skip — typically only useful for
+     * fixtures and migrations. Pass a `SecretPolicy` to override the
      * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
      */
-    changeSecret(vault: string, newPassphrase: string, options?: PassphrasePolicy & {
-        allowWeakPassphrase?: boolean;
+    changeSecret(vault: string, newSecret: string, options?: SecretPolicy & {
+        allowWeakSecret?: boolean;
     }): Promise<void>;
     /** Push local changes to remote for a vault. */
     push(vault: string, options?: PushOptions): Promise<PushResult>;
@@ -672,7 +679,7 @@ export declare class Noydb {
      * denial; resolves with `void` on success.
      *
      * @param vault    The vault whose policy applies.
-     * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+     * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
      *                 or app-defined (`app:*`).
      * @param presented Caller-supplied factor proofs.
      */
@@ -687,12 +694,12 @@ export declare class Noydb {
      * Two enforcement modes:
      *
      * 1. **Managed-mode mandatory strong-recovery.** When
-     *    `passphraseMode === 'managed'`, the vault MUST have at least
+     *    `secretMode === 'managed'`, the vault MUST have at least
      *    one **strong** recovery profile (Shamir today). Paper alone is
      *    rejected because under managed mode the user has no memorized
-     *    passphrase, so losing the paper sheet = losing every record.
+     *    secret, so losing the paper sheet = losing every record.
      *    This check is unconditional — independent of `requireRecovery`
-     *    and the `recover-passphrase` gate.
+     *    and the `recover-secret` gate.
      *
      * 2. **Opt-in strict mandatory-recovery.** When
      *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -711,26 +718,6 @@ export declare class Noydb {
      * @internal
      */
     _setActiveTier(vault: string, tier: ActiveTier): void;
-    /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-    enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-    removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
-    /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-    listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
-    /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-    updateAuthenticator(vault: string, slotId: string, options: UpdateAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, factors?: FactorProofBundle): Promise<{
-        credentialId: string;
-    }>;
-    /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
-        id: string;
-        enrolledAt: string;
-        credentialId: string;
-    }>>;
-    /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-    unlockViaAuthenticator(vault: string, slotId: string, verify: (slot: KeyringAuthenticator) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring>;
     /**
      * Set the owner-curated cover for a vault. Throws
      * `ValidationError` if the developer did not opt the hub into
@@ -760,53 +747,6 @@ export declare class Noydb {
     getCover(vault: string, opts?: {
         readonly locale?: string;
     }): Promise<Cover | undefined>;
-    /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-    describeAuthConfig(vault: string): Promise<string>;
-    /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-    diagramAuthConfig(vault: string): Promise<string>;
-    /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-    describeUserAuth(vault: string, userId: string, factors?: FactorProofBundle): Promise<string>;
-    /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-    describeAllUsersAuth(vault: string, factors?: FactorProofBundle): Promise<Array<{
-        userId: string;
-        description: string;
-    }>>;
-    /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
-    /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
-    /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-    rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>;
-    /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-    openVaultAndEnrollRecovery(vault: string, opts: {
-        readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-        readonly locale?: string;
-    }): Promise<{
-        readonly vault: Vault;
-        readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
-    }>;
-    /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-    recoverManagedPassphrase(vault: string, options: {
-        readonly recoveryProof: RecoveryProof;
-        readonly passphrasePolicy?: PassphrasePolicy;
-    }): Promise<void>;
-    /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-    recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-    enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
-    /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-    listRecoveryEntries(vault: string): Promise<{
-        paper: ReadonlyArray<PaperRecoveryEntry>;
-        shamir: ReadonlyArray<ShamirRecoveryEntry>;
-    }>;
-    /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-    enrollUnlock(vault: string, state: QuickUnlockState, factors?: FactorProofBundle): Promise<void>;
-    /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-    unlockViaPin(vault: string, resume: (state: QuickUnlockState) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring | undefined>;
-    /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-    clearQuickUnlock(vault: string): void;
-    /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-    getKeyring(vault: string): Promise<UnlockedKeyring>;
     /**
      * Live-reference variant used by the hub's own code paths. Internal
      * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a

package/dist/kernel/types.d.ts

@@ -55,11 +55,11 @@ import type { SyncStrategy } from '../with-party/team/sync-strategy.js';
 import type { GuardStrategyHandleAny } from '../with-audit/guards/types.js';
 import type { DerivationStrategyHandle } from '../with-formula/derivations/types.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import type { PassphrasePolicy } from './validation.js';
+import type { SecretPolicy } from './validation.js';
 import type { CoverSchema } from '../with-party/directory/cover/types.js';
 import type { MaterializedViewStrategyHandle } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewStrategyHandle } from '../with-formula/overlay-views/types.js';
-import type { SealingKeyProvider, RecipientHint } from '../with-party/team/managed-passphrase.js';
+import type { SealingKeyProvider, RecipientHint } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
 import type { CoordinationProvider } from '../port/by/types.js';
@@ -755,7 +755,7 @@ export type VaultPolicyOnDisk = Record<string, unknown>;
  * - `paper` — `on-recovery` codes (the standard end-to-end profile).
  * - `shamir` / `multi-channel` / `admin-mediated` — API surface ships;
  *   per-profile dispatch lands in follow-up issues. Calling
- *   `db.recoverPassphrase` against these throws
+ *   `db.recoverSecret` against these throws
  *   {@link RecoveryProfileNotImplementedError}.
  */
 export type RecoveryEnrollment = {
@@ -837,7 +837,7 @@ export interface KeyringAuthenticatorWrappingKEK extends KeyringAuthenticatorBas
  *
  * Trade-off: a slot of this kind reconstructs `UnlockedKeyring` with
  * `kek: null` after unlock. That is semantically correct for tier-2
- * (sensitive ops like `enrollAuthenticator` / `rotatePassphrase`
+ * (sensitive ops like `enrollAuthenticator` / `rotateSecret`
  * require a tier-1 unlock anyway) and matches how `@noy-db/on-pin`
  * already behaves at tier 3.
  *
@@ -877,12 +877,12 @@ export interface KeyringFile {
     readonly created_at: string;
     readonly granted_by: string;
     /**
-     * Passphrase canary — base64 AES-KW-wrapped form of a known constant
+     * Secret canary — base64 AES-KW-wrapped form of a known constant
      * 256-bit value, wrapped under the keyring's KEK.
      *
      * Optional: older keyrings load with no canary and fall back to
      * the multi-DEK corruption heuristic. Newer keyrings
-     * carry one and let `loadKeyring` distinguish wrong-passphrase
+     * carry one and let `loadKeyring` distinguish wrong-secret
      * from corruption even when ALL DEKs (including a single-DEK keyring's
      * sole DEK) are corrupted.
      *
@@ -1395,7 +1395,7 @@ export interface GrantOptions {
     readonly userId: string;
     readonly displayName: string;
     readonly role: Role;
-    readonly passphrase: string;
+    readonly secret: string;
     readonly permissions?: Permissions;
     /**
      * Optional `@noy-db/as-*` export capability. Omit or
@@ -1412,9 +1412,9 @@ export interface GrantOptions {
     /**
      * Skip phrase-format strength validation (issue #7). Defaults to
      * false — `grant()` rejects phrases that don't meet the configured
-     * `PassphrasePolicy`. Test fixtures and CLI scripts pass `true`.
+     * `SecretPolicy`. Test fixtures and CLI scripts pass `true`.
      */
-    readonly allowWeakPassphrase?: boolean;
+    readonly allowWeakSecret?: boolean;
     /**
      * Initial user-envelope payload for the new principal. Sealed under
      * the same vault DEK (the reserved `_users` collection's DEK) and
@@ -1612,7 +1612,7 @@ export interface SessionPolicy {
     readonly absoluteTimeoutMs?: number;
     /**
      * Operations that require the user to re-authenticate (re-enter their
-     * passphrase or perform a fresh WebAuthn assertion) before proceeding,
+     * secret or perform a fresh WebAuthn assertion) before proceeding,
      * even if the session is still alive.
      *
      * Common pattern: `requireReAuthFor: ['export', 'grant']` — allow
@@ -2400,7 +2400,7 @@ export interface NoydbOptions {
      * throw `TeamNotEnabledError` and the keyring grant/revoke/rotate engines
      * are reached only via opt-in — the always-on floor is single-user.
      * Single-user primitives (owner keyring, unlock, `listUsers`,
-     * `updateUser`, passphrase rotate/recover) stay ungated, as does the
+     * `updateUser`, secret rotate/recover) stay ungated, as does the
      * `createDeedOwner` free function (no createNoydb instance to gate
      * against).
      */
@@ -2484,12 +2484,12 @@ export interface NoydbOptions {
     readonly sync?: NoydbStore | SyncTarget | SyncTarget[];
     /** User identifier. */
     readonly user: string;
-    /** Passphrase for key derivation. Required unless encrypt is false or `getKeyring` is provided. */
+    /** Secret for key derivation. Required unless encrypt is false or `getKeyring` is provided. */
     readonly secret?: string;
     /**
      * Optional callback that returns an unlocked keyring for a given vault.
      * Use this to plug in WebAuthn / OIDC / Shamir / any unlock path that
-     * produces an `UnlockedKeyring` outside the passphrase model.
+     * produces an `UnlockedKeyring` outside the secret model.
      *
      * When set, `secret` MUST NOT also be set — `createNoydb` throws if both
      * are supplied. When neither is set (and `encrypt !== false`), `createNoydb`
@@ -2517,32 +2517,32 @@ export interface NoydbOptions {
      * ```
      *
      * Note: this callback is responsible for both the "open existing vault"
-     * and the "create new vault" cases. Unlike the passphrase path, there is
+     * and the "create new vault" cases. Unlike the secret path, there is
      * no automatic `NoAccessError` → `createOwnerKeyring` fallback, because
      * the callback owner has the UI context to decide which path to run.
-     * For first-time bootstrap, use a passphrase or recovery code, enroll
+     * For first-time bootstrap, use a secret or recovery code, enroll
      * WebAuthn from the unlocked keyring, then swap to `getKeyring` on
      * subsequent sessions.
      */
     readonly getKeyring?: (vault: string) => Promise<UnlockedKeyring>;
     /**
-     * Passphrase mode. Default `'standard'`.
+     * Secret mode. Default `'standard'`.
      *
      *   - `'standard'` — the legacy flow. `secret` supplies the
-     *     plaintext passphrase, the user knows it, and the policy gate
-     *     `rotate-passphrase` is enabled.
+     *     plaintext secret, the user knows it, and the policy gate
+     *     `rotate-secret` is enabled.
      *   - `'managed'` — rubber-hose-resistant mode. Hub generates a
-     *     256-bit random passphrase at first open and seals it under
+     *     256-bit random secret at first open and seals it under
      *     the provided `sealingKey`. The user never sees or types the
-     *     passphrase, defeating the $5-wrench attack. Mutually
+     *     secret, defeating the $5-wrench attack. Mutually
      *     exclusive with `secret` and `getKeyring`.
      *
-     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-passphrase mode
+     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
      */
-    readonly passphraseMode?: 'standard' | 'managed';
+    readonly secretMode?: 'standard' | 'managed';
     /**
      * Provider that seals/unseals the auto-generated managed-mode
-     * passphrase. Required when `passphraseMode === 'managed'`; ignored
+     * secret. Required when `secretMode === 'managed'`; ignored
      * otherwise. Implementations live in per-platform packages
      * (`@noy-db/seal-macos-keychain`, `@noy-db/seal-wincred`,
      * `@noy-db/seal-libsecret`, `@noy-db/seal-aws-kms`, …).
@@ -2591,17 +2591,17 @@ export interface NoydbOptions {
      */
     readonly sessionPolicy?: SessionPolicy;
     /**
-     * Validate passphrase strength against the phrase format
+     * Validate secret strength against the phrase format
      * on first-time keyring creation. When
-     * `true`, weak phrases throw {@link WeakPassphraseError} from
-     * `createNoydb()` / `db.rotatePassphrase()`. Default: `false` for
+     * `true`, weak phrases throw {@link WeakSecretError} from
+     * `createNoydb()` / `db.team.rotateSecret()`. Default: `false` for
      * back-compat; planned to flip to `true` in a future major release.
      */
-    readonly validatePassphrase?: boolean;
+    readonly validateSecret?: boolean;
     /**
      * Vault-level policy gate document. When present, the hub
      * persists the merged policy at `_meta/policy` on first-time vault
-     * creation and gates sensitive operations (`db.rotatePassphrase`,
+     * creation and gates sensitive operations (`db.rotateSecret`,
      * `db.export*`, …) against it. Omitted ⇒ the engine uses
      * {@link PERSONAL_POLICY}. Use {@link STRICT_POLICY} for regulated
      * deployments.
@@ -2616,11 +2616,11 @@ export interface NoydbOptions {
     readonly policy?: VaultPolicy;
     /**
      * Mandatory recovery profile enrollment. Vaults with
-     * `recover-passphrase` enabled MUST register at least one profile
+     * `recover-secret` enabled MUST register at least one profile
      * before being production-ready, otherwise `createNoydb()` throws
      * {@link RecoveryNotEnrolledError}. Set
-     * `policy.gates['recover-passphrase'].enabled = false` to
-     * deliberately opt out of recovery (passphrase loss = data loss).
+     * `policy.gates['recover-secret'].enabled = false` to
+     * deliberately opt out of recovery (secret loss = data loss).
      *
      * The `'paper'` profile is supported end-to-end. Other
      * profiles ship the API shape and throw
@@ -2647,7 +2647,7 @@ export interface NoydbOptions {
      *   data records but not the keyring row, or a WebAuthn credential was rotated).
      *   **All previously encrypted data is unrecoverable after a reset.**
      *
-     * Only applies to the passphrase (`secret`) path. When `getKeyring` is used,
+     * Only applies to the secret (`secret`) path. When `getKeyring` is used,
      * the callback is responsible for handling stale-keyring detection itself.
      */
     readonly onInvalidKey?: 'error' | 'reset';
@@ -3037,7 +3037,7 @@ export interface WarningRules {
 }
 /**
  * Policy applied to one named gate. `enabled: false` disables the
- * action entirely (useful in managed-passphrase mode where rotation is
+ * action entirely (useful in managed-secret mode where rotation is
  * impossible by construction).
  */
 export interface GatePolicy {
@@ -3053,11 +3053,11 @@ export interface GatePolicy {
  * and use the same engine; the engine treats unknown names with no
  * configured policy as "no gate" (no-op).
  */
-export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enroll-authenticator' | 'remove-authenticator'
+export type BuiltInGateName = 'rotate-secret' | 'recover-secret' | 'enroll-authenticator' | 'remove-authenticator'
 /**
  * Authorize a deliberate paper-recovery-code regeneration —
- * `db.rotateRecovery`. Symmetric to `rotate-passphrase` for
- * the case where the user remembers their passphrase but wants a
+ * `db.rotateRecovery`. Symmetric to `rotate-secret` for
+ * the case where the user remembers their secret but wants a
  * fresh sheet (lost the printout, suspect compromise of the off-site
  * copy). PERSONAL allows tier-1; STRICT requires an off-device
  * factor so a stolen unlocked laptop cannot silently mint a new
@@ -3080,7 +3080,7 @@ export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enro
 /**
  * Authorize an atomic peer-recovery — `db.recoverUser`.
  * Distinct from `revoke-user` because peer-recovery is intentional
- * re-issuance of someone's keyring under a temp passphrase, NOT
+ * re-issuance of someone's keyring under a temp secret, NOT
  * removal. Allows owner→owner natively (matches the threat model:
  * a co-owner explicitly recovering another co-owner). Ships with a
  * factor-proof default in `STRICT_POLICY` so the issuer must
@@ -3139,12 +3139,12 @@ export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enro
 export type GateName = BuiltInGateName | `app:${string}`;
 /**
  * Top-level policy object. Persisted at `_meta/policy` once at vault
- * creation. The `passphrase` block configures the strength rules
- * applied at every passphrase ingress; `gates` configures
+ * creation. The `secret` block configures the strength rules
+ * applied at every secret ingress; `gates` configures
  * the action-level requirements.
  */
 export interface VaultPolicy {
-    readonly passphrase?: PassphrasePolicy;
+    readonly secret?: SecretPolicy;
     readonly gates: Partial<Record<GateName, GatePolicy>>;
 }
 /** Concrete proof an actor presents to {@link checkGate}. */
@@ -3160,7 +3160,7 @@ export interface FactorProof {
  * Noydb method. Used as the optional last parameter of every method
  * that runs through `checkGate`: `db.grant`, `db.revoke`, `db.updateUser`,
  * `db.enrollAuthenticator`, `db.removeAuthenticator`, `db.updateAuthenticator`,
- * `db.enrollWebAuthn`, `db.rotatePassphrase`, `db.recoverPassphrase`,
+ * `db.enrollWebAuthn`, `db.rotateSecret`, `db.recoverSecret`,
  * `db.recoverUser`, `db.enrollUnlock`, `db.describeUserAuth`,
  * `db.describeAllUsersAuth`.
  *
@@ -3286,4 +3286,45 @@ export interface NoydbPolicyDeps {
  * synchronously — mirrors {@link UserApiFactory}.
  */
 export type NoydbPolicyFactory = (deps: NoydbPolicyDeps) => NoydbPolicyApi;
+/**
+ * Named field-set declarations for a collection's type-level shape (#839).
+ *
+ * Replaces the positional `Collection<T, S, Q, M>` tail at every surface a
+ * consumer touches. The positional form was unreadable and unsafe: `Q` and `M`
+ * are both `keyof T & string`, so swapping them type-checked silently, and
+ * reaching `M` meant writing placeholders —
+ * `collection<Sale, never, never, 'amount' | 'tax'>`.
+ *
+ * ```ts
+ * vault.collection<Sale, { money: 'amount' | 'tax' }>('sales')
+ * vault.collection<Invoice, { sensitive: 'ssn'; indexed: 'clientId' }>('invoices')
+ * ```
+ *
+ * Every member is optional; omitting one keeps that axis permissive, which is
+ * what the `[X] extends [never]` guards in {@link QueryField} /
+ * {@link IndexFieldName} encode. Those guards are NOT removable — they are the
+ * difference between "no indexes declared, so `where()` accepts any field" and
+ * "indexes declared, so `where()` is restricted to them" — so they are
+ * re-expressed against this shape rather than dropped.
+ */
+export interface CollectionShape<T> {
+    /** Fields sealed at rest; reads return {@link Sealed} handles. */
+    readonly sensitive?: keyof T & string;
+    /** Fields carrying a declared secondary index; narrows `where()` / `orderBy()`. */
+    readonly indexed?: keyof T & string;
+    /** Fields carrying a money descriptor. */
+    readonly money?: keyof T & string;
+}
+/** The `sensitive` field set of a {@link CollectionShape}, or `never` if unset. */
+export type SensitiveOf<T, O> = O extends {
+    sensitive: infer S;
+} ? (S & keyof T & string) : never;
+/** The `indexed` field set of a {@link CollectionShape}, or `never` if unset. */
+export type IndexedOf<T, O> = O extends {
+    indexed: infer Q;
+} ? (Q & keyof T & string) : never;
+/** The `money` field set of a {@link CollectionShape}, or `never` if unset. */
+export type MoneyOf<T, O> = O extends {
+    money: infer M;
+} ? (M & keyof T & string) : never;
 export {};