@noy-db/hub 0.4.0-pre.3 → 0.4.0-pre.5

package/dist/signer-MGGKPYAN.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-QZJEYZ4I.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-MGGKPYAN.js.map

package/dist/snapshots/index.js

@@ -1,19 +1,19 @@
 import {
   readPod,
   writePod
-} from "../chunk-MEKAMERX.js";
-import "../chunk-BVZGNMVM.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-YCAJDK4O.js";
+import "../chunk-YFFEF6HR.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/{stale-4UNPHWOU.js → stale-NBROTA66.js}

@@ -6,16 +6,16 @@ import {
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "./chunk-3XVOLB75.js";
-import "./chunk-PEY6ZTCF.js";
-import "./chunk-QXPOEAKR.js";
-import "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
-import "./chunk-5BB3N4KU.js";
+} from "./chunk-CKUYQO2P.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-5P5AAXYA.js";
-import "./chunk-5BHNQNBI.js";
-import "./chunk-IGM563N5.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MV_STALE_COLLECTION,
@@ -26,4 +26,4 @@ export {
   markMVStale,
   resolveStaleMVOnRead
 };
-//# sourceMappingURL=stale-4UNPHWOU.js.map
+//# sourceMappingURL=stale-NBROTA66.js.map

package/dist/storage-3R37QZLA.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-S4YERMGJ.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-3R37QZLA.js.map

package/dist/{store-coordination-provider-3AELCZ4Y.js → store-coordination-provider-P3IU5JHD.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-JA5B3SLH.js";
+} from "./chunk-M6QA2KK2.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5BHNQNBI.js";
+} from "./chunk-YTW6ZIPD.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-3AELCZ4Y.js.map
+//# sourceMappingURL=store-coordination-provider-P3IU5JHD.js.map

package/dist/sync/index.js

@@ -2,18 +2,18 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-QAFWRGVD.js";
+} from "../chunk-OGVE4IJW.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-F4COUZLL.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-TMR64XPL.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-EW4HFWGJ.js";
+} from "../chunk-YWZEDG7F.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -15,15 +15,15 @@ import {
   listMagicLinkGrants,
   magicLinkGrantRecordId,
   readMagicLinkGrantRecord,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
   revokeMagicLinkGrant,
-  rotatePassphrase,
+  rotateSecret,
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-UBF7HTOR.js";
+} from "../chunk-FIP7KI2P.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -41,8 +41,8 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-WJDYZP3U.js";
-import "../chunk-7B4GPCX7.js";
+} from "../chunk-3LJYHE7S.js";
+import "../chunk-6RPWILRH.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -51,26 +51,26 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-3O62PVDW.js";
+} from "../chunk-CJVEAVYH.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-QAFWRGVD.js";
+} from "../chunk-OGVE4IJW.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-F4COUZLL.js";
-import "../chunk-MSO2C3KG.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+import "../chunk-TMR64XPL.js";
+import "../chunk-LC7DSMHR.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   TeamNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,
@@ -108,12 +108,12 @@ export {
   persistKeyring,
   putCredential,
   readMagicLinkGrantRecord,
-  recoverPassphrase,
+  recoverSecret,
   recoverUser,
   removeAuthenticator,
   revoke,
   revokeMagicLinkGrant,
-  rotatePassphrase,
+  rotateSecret,
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry,

package/dist/tiers/index.js

@@ -11,19 +11,19 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-N4A3DCBT.js";
-import "../chunk-MSO2C3KG.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-FTCGEUOY.js";
+import "../chunk-LC7DSMHR.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
 import {
   TiersNotEnabledError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-FLHOTGOO.js";
+} from "../chunk-QVGEVZ5F.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-WQQRU6DO.js");
+      const { GuardExecutor } = await import("../executor-OHET7TF7.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-IGM563N5.js";
+} from "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-MXN66IIH.js → verify-5X37OXRY.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-LLVW4V7R.js";
+} from "./chunk-5WLDZZ6S.js";
 import {
   dualReadSealedSlot
-} from "./chunk-M25ZIEB2.js";
+} from "./chunk-5HSSTOOG.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-5P5AAXYA.js";
+} from "./chunk-7U6AB7DZ.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-IGM563N5.js";
+} from "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-MXN66IIH.js.map
+//# sourceMappingURL=verify-5X37OXRY.js.map

package/dist/{walk-H4YE52S2.js → walk-E3OVLBFR.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-EDC6MLXV.js";
+} from "./chunk-SEU6QHH4.js";
 import {
   loadPersistedSchema
-} from "./chunk-IGAIOGCN.js";
-import "./chunk-PEY6ZTCF.js";
-import "./chunk-QXPOEAKR.js";
-import "./chunk-LLVW4V7R.js";
-import "./chunk-M25ZIEB2.js";
-import "./chunk-5BB3N4KU.js";
+} from "./chunk-S4YERMGJ.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-5P5AAXYA.js";
-import "./chunk-5BHNQNBI.js";
-import "./chunk-IGM563N5.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-H4YE52S2.js.map
+//# sourceMappingURL=walk-E3OVLBFR.js.map

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-WEC3JGBA.js";
-import "../chunk-WJDYZP3U.js";
-import "../chunk-7B4GPCX7.js";
-import "../chunk-PEY6ZTCF.js";
-import "../chunk-QXPOEAKR.js";
-import "../chunk-LLVW4V7R.js";
-import "../chunk-M25ZIEB2.js";
-import "../chunk-5BB3N4KU.js";
+} from "../chunk-IGLU4ME7.js";
+import "../chunk-3LJYHE7S.js";
+import "../chunk-6RPWILRH.js";
+import "../chunk-GEEJPID6.js";
+import "../chunk-SC4JLMZI.js";
+import "../chunk-5WLDZZ6S.js";
+import "../chunk-5HSSTOOG.js";
+import "../chunk-G4MFQXYX.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5P5AAXYA.js";
-import "../chunk-5BHNQNBI.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-7U6AB7DZ.js";
+import "../chunk-YTW6ZIPD.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-audit/portability/export-accessible.d.ts

@@ -7,7 +7,7 @@
  * Reuses the existing bundle machinery: the access boundary is the caller's DEK
  * set (operator/client → `keyring.permissions`; owner/admin/viewer → all), so a
  * record outside the caller's keys can never enter the bundle. Re-keying to a
- * new owner reuses `writePod`'s `exportPassphrase` shorthand.
+ * new owner reuses `writePod`'s `exportSecret` shorthand.
  */
 import type { Vault } from '../../kernel/vault.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
@@ -22,16 +22,16 @@ export declare function resolveAccessibleCollections(keyring: UnlockedKeyring, s
 } | undefined, writableOnly?: boolean): string[] | undefined;
 /** Produce a (optionally re-keyed, scoped) `.noydb` bundle — no audit. */
 export declare function buildAccessibleBundle(vault: Vault, collections: string[] | undefined, reKey: {
-    passphrase: string;
+    secret: string;
 } | undefined, compression?: 'auto' | 'brotli' | 'gzip' | 'none'): Promise<Uint8Array>;
 export interface ExportAccessibleOptions {
     /**
      * Re-key the bundle so it is independently openable by a new owner with this
-     * passphrase (the receiving firm / the client themselves). Omit to inherit
+     * secret (the receiving firm / the client themselves). Omit to inherit
      * the source keyring (personal backup).
      */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Narrow the export to a subset of the caller's accessible collections. */
     readonly scope?: {

package/dist/with-audit/portability/request-withdrawal.d.ts

@@ -15,7 +15,7 @@
  * Requests live in the reserved `_user_withdrawal_requests` namespace. The
  * record body is plaintext metadata (collection names + disposition + legal
  * basis — none secret in this trust model; the owner sees the data anyway) and
- * carries NO passphrase: the re-key passphrase is supplied by the approver at
+ * carries NO secret: the re-key secret is supplied by the approver at
  * approval time and conveyed to the requester out-of-band, so no secret is
  * stored at rest.
  */
@@ -66,9 +66,9 @@ export declare function listWithdrawalRequests(vault: Vault, opts?: {
     status?: WithdrawalRequestStatus;
 }): Promise<WithdrawalRequest[]>;
 export interface ApproveWithdrawalOptions {
-    /** Re-key the handed-back bundle to a passphrase the requester will use. */
+    /** Re-key the handed-back bundle to a secret the requester will use. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
 }
 /**

package/dist/with-audit/portability/withdraw-accessible.d.ts

@@ -29,9 +29,9 @@ export interface FrozenSnapshotRef {
 export interface WithdrawAccessibleOptions {
     /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */
     readonly legalBasis: string;
-    /** Re-key the exported bundle to a new owner passphrase. */
+    /** Re-key the exported bundle to a new owner secret. */
     readonly reKey?: {
-        readonly passphrase: string;
+        readonly secret: string;
     };
     /** Source disposition. Default 'delete'. */
     readonly disposition?: 'delete' | 'freeze';

package/dist/with-audit/sealed-record/strategy.d.ts

@@ -13,7 +13,7 @@
  * @internal
  */
 import type { SealingContext } from '../../kernel/enclave/index.js';
-import type { RecipientSealer } from '../../with-party/team/managed-passphrase.js';
+import type { RecipientSealer } from '../../with-party/team/managed-secret.js';
 export interface SealedRecordStrategy {
     sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {
         expiresAt: string;

package/dist/with-cargo/adopt-partition.d.ts

@@ -9,7 +9,7 @@
  */
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import type { NoydbStore } from '../kernel/types.js';
-import type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
 import type { TransferSealPayload } from '../with-pod/bundle.js';
@@ -35,14 +35,14 @@ export interface CreateOwnerResult {
     readonly vaultName: string;
     readonly userId: string;
 }
-/** Standard-mode owner: recipient supplies the passphrase. */
+/** Standard-mode owner: recipient supplies the secret. */
 export interface CreateOwnerStandardOptions {
     readonly userId: string;
-    readonly passphrase: string;
+    readonly secret: string;
     readonly transferKey: Uint8Array;
 }
 /**
- * Managed-mode owner: the passphrase is minted + sealed under
+ * Managed-mode owner: the secret is minted + sealed under
  * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
  * (Shamir) recovery profile at creation, which needs the
@@ -50,7 +50,7 @@ export interface CreateOwnerStandardOptions {
  */
 export interface CreateOwnerManagedOptions {
     readonly userId: string;
-    readonly passphraseMode: 'managed';
+    readonly secretMode: 'managed';
     readonly sealingKey: SealingKeyProvider;
     readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
     readonly shamirRecovery: ShamirRecoveryProvider;
@@ -61,8 +61,8 @@ export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManaged
  * Mint the first owner keyring on an adopted-but-unowned partition,
  * then destroy the transfer seal.
  *
- * Standard mode: the recipient supplies a passphrase. Managed mode: the
- * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
+ * Standard mode: the recipient supplies a secret. Managed mode: the
+ * secret is minted + sealed under a `SealingKeyProvider` and a strong
  * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *

package/dist/with-cargo/index.d.ts

@@ -19,7 +19,7 @@ export { liberateVault } from '../with-party/custody/liberate.js';
 export type { LiberateOptions, LiberateResult } from '../with-party/custody/liberate.js';
 export { createDeedOwner, loadDeedMarker, isDeedVault } from '../with-party/team/deed.js';
 export type { DeedMarker } from '../with-party/team/deed.js';
-export type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
 export { withCargo } from './active.js';

package/dist/with-commit/history/time-machine.d.ts

@@ -5,7 +5,7 @@
  * ## Usage
  *
  * ```ts
- * const vault = await db.openVault('acme', { passphrase })
+ * const vault = await db.openVault('acme', { secret })
  * const q1End = vault.at('2026-03-31T23:59:59Z')
  * const invoice = await q1End.collection<Invoice>('invoices').get('inv-001')
  * // → the record as it stood at the close of Q1 2026
@@ -64,7 +64,7 @@ export interface VaultEngine {
     /** Vault name (the compartment). */
     readonly name: string;
     /**
-     * `true` when the vault was opened with a passphrase (the normal
+     * `true` when the vault was opened with a secret (the normal
      * case). `false` in plaintext-mode vaults (`encrypt: false`) — in
      * that case `envelope._data` is raw JSON and we skip the DEK lookup.
      */