@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.5

package/dist/indexing/index.js

@@ -7,12 +7,12 @@ import {
   decodeIdxId,
   encodeIdxId,
   isIdxId
-} from "../chunk-CGPO3ZYB.js";
+} from "../chunk-BY5YBSXA.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-IGM563N5.js";
+import "../chunk-6SYOHUHM.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-lookup/indexing/active.ts

package/dist/issue-F76PAGIR.js

@@ -0,0 +1,19 @@
+import {
+  issueAttestationCore
+} from "./chunk-YXIVUWDU.js";
+import "./chunk-QZJEYZ4I.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-GEEJPID6.js";
+import "./chunk-SC4JLMZI.js";
+import "./chunk-5WLDZZ6S.js";
+import "./chunk-5HSSTOOG.js";
+import "./chunk-G4MFQXYX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-7U6AB7DZ.js";
+import "./chunk-YTW6ZIPD.js";
+import "./chunk-6SYOHUHM.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=issue-F76PAGIR.js.map

package/dist/kernel/collection.d.ts

@@ -665,7 +665,6 @@ export declare class Collection<T, S extends keyof T = never, Q extends keyof T
      * right back out, defeating C6.
      */
     private _toCacheableRecord;
-    /** @internal Untracked put body — call {@link put}, not this. */
     private _putInternal;
     /**
      * Fire registered MV strategies whose dependency set includes this

package/dist/kernel/enclave/crypto.d.ts

@@ -22,7 +22,7 @@
  * ## Key lifecycle
  *
  * ```
- * passphrase + salt
+ * secret + salt
  *   └─► deriveKey()       → KEK (CryptoKey, extractable: false)
  *         └─► wrapKey()   → wrapped DEK bytes  [stored in keyring]
  *         └─► unwrapKey() → DEK (CryptoKey)    [memory only during session]
@@ -46,26 +46,26 @@
  * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).
  */
 export type EnclaveKey = CryptoKey;
-/** Derive a KEK from a passphrase and salt using PBKDF2-SHA256. */
-export declare function deriveKey(passphrase: string, salt: Uint8Array): Promise<CryptoKey>;
+/** Derive a KEK from a secret and salt using PBKDF2-SHA256. */
+export declare function deriveKey(secret: string, salt: Uint8Array): Promise<CryptoKey>;
 /**
- * Which AES algorithm/usage a {@link derivePassphraseKey} result is for:
+ * Which AES algorithm/usage a {@link deriveSecretKey} result is for:
  * `'aes-kw'` mints a key-wrapping key (`wrapKey`/`unwrapKey`, e.g. for
  * KEK derivation); `'aes-gcm'` mints a direct encrypt/decrypt key (e.g.
  * for the wrap-DEKs primitive in `with-party/team/wrapped-deks.ts`).
  */
-export type PassphraseKeyUsage = 'aes-kw' | 'aes-gcm';
+export type SecretKeyUsage = 'aes-kw' | 'aes-gcm';
 /**
- * Derive a non-extractable AES key from a passphrase/credential and salt
+ * Derive a non-extractable AES key from a secret/credential and salt
  * via PBKDF2-SHA256, generalizing {@link deriveKey}'s AES-KW derivation to
  * also cover AES-GCM-usage keys. Callers pin their own `iterations` and
  * `keyUsage` so an existing call site's exact parameters (and thus its
  * derived-key bytes) are preserved verbatim when migrated onto this
  * shared primitive — this is call-site consolidation, not a KDF change.
  */
-export declare function derivePassphraseKey(passphrase: string, salt: Uint8Array, params: {
+export declare function deriveSecretKey(secret: string, salt: Uint8Array, params: {
     iterations: number;
-    keyUsage: PassphraseKeyUsage;
+    keyUsage: SecretKeyUsage;
 }): Promise<CryptoKey>;
 /** Generate a random AES-256-GCM data encryption key. */
 export declare function generateDEK(): Promise<CryptoKey>;

package/dist/kernel/enclave/index.d.ts

@@ -56,8 +56,8 @@
  */
 export type { EnclaveKey, EncryptResult } from './crypto.js';
 export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, } from './crypto.js';
-export { deriveKey, derivePassphraseKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
-export type { PassphraseKeyUsage } from './crypto.js';
+export { deriveKey, deriveSecretKey, generateDEK, generateSalt, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, } from './crypto.js';
+export type { SecretKeyUsage } from './crypto.js';
 export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
 export type { RewrappedBody } from './record-keys/lifecycle.js';
 export { RecordCodec } from './record-keys/record-codec.js';

package/dist/kernel/errors.d.ts

@@ -10,7 +10,7 @@
  *       ├─ Crypto errors
  *       │    ├─ DecryptionError        — AES-GCM tag failure
  *       │    ├─ TamperedError          — ciphertext modified after write
- *       │    └─ InvalidKeyError        — wrong passphrase / corrupt keyring
+ *       │    └─ InvalidKeyError        — wrong secret / corrupt keyring
  *       ├─ Access errors
  *       │    ├─ NoAccessError          — no DEK for this collection
  *       │    ├─ ReadOnlyError          — ro permission, write attempted
@@ -78,9 +78,9 @@
  * import { NoydbError, InvalidKeyError, ConflictError } from '@noy-db/hub'
  *
  * try {
- *   await vault.unlock(passphrase)
+ *   await vault.unlock(secret)
  * } catch (e) {
- *   if (e instanceof InvalidKeyError) { showBadPassphraseUI(); return }
+ *   if (e instanceof InvalidKeyError) { showBadSecretUI(); return }
  *   if (e instanceof NoydbError) { logToSentry(e.code, e); return }
  *   throw e  // unexpected — re-throw
  * }
@@ -125,8 +125,8 @@ export declare class DebugReservedFieldError extends NoydbError {
 /**
  * Thrown when AES-GCM decryption fails.
  *
- * The most common cause is a wrong passphrase or a corrupted ciphertext.
- * A `DecryptionError` at the wrong passphrase level is caught internally
+ * The most common cause is a wrong secret or a corrupted ciphertext.
+ * A `DecryptionError` at the wrong secret level is caught internally
  * and re-thrown as `InvalidKeyError` — so in practice this surfaces for
  * per-record corruption rather than authentication failures.
  */
@@ -146,12 +146,12 @@ export declare class TamperedError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Thrown when key unwrapping fails, typically because the passphrase is wrong
+ * Thrown when key unwrapping fails, typically because the secret is wrong
  * or the keyring file is corrupted.
  *
  * NOYDB uses AES-KW (RFC 3394) to wrap DEKs with the KEK. If AES-KW
  * unwrapping fails, it means either the KEK was derived from the wrong
- * passphrase (PBKDF2 with 600K iterations) or the keyring bytes are
+ * secret (PBKDF2 with 600K iterations) or the keyring bytes are
  * corrupted. This is the error shown to the user on a failed unlock attempt.
  */
 export declare class InvalidKeyError extends NoydbError {
@@ -160,7 +160,7 @@ export declare class InvalidKeyError extends NoydbError {
 /**
  * Thrown when a keyring's wrapped-DEK set unwraps partially — at least
  * one DEK succeeds (proving the KEK is correct) but at least one fails.
- * The passphrase is right; the failed entries are corrupted.
+ * The secret is right; the failed entries are corrupted.
  *
  * This is distinct from {@link InvalidKeyError} so that
  * `NoydbOptions.onInvalidKey: 'reset'` does NOT fire — resetting on
@@ -273,7 +273,7 @@ export declare class ExportCapabilityError extends NoydbError {
  * Thrown when a keyring file's `expires_at` cutoff has passed.
  * Surfaced by `loadKeyring` before any DEK unwrap is attempted —
  * past the cutoff the slot refuses to open even with the right
- * passphrase. Distinct from PBKDF2 / unwrap errors so consumer code
+ * secret. Distinct from PBKDF2 / unwrap errors so consumer code
  * can show a precise "this bundle slot has expired" message instead
  * of the generic decryption-failure UX.
  *
@@ -948,14 +948,14 @@ export declare class BundleIntegrityError extends NoydbError {
 }
 /**
  * Thrown by `readPod` when the bundle carries
- * sealed per-user passphrases but no supplied `SealingKeyProvider`
+ * sealed per-user secrets but no supplied `SealingKeyProvider`
  * has a `.id` (= `pid`) matching the sealed entry's `pid`.
  *
  * Carries the failing pid + the user id so the recipient can
  * surface an actionable prompt:
  *
  * ```
- * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
+ * BundleSealMismatchError: bundle carries sealed secret for user "alice"
  *   under provider "macos-keychain:com.acme.app/alice@acme.example",
  *   but no registered provider matches that pid.
  * ```
@@ -1290,7 +1290,7 @@ export declare class CustodyNotEnabledError extends NoydbError {
  * (#267 keyring-grant → team split): enable multi-user grant/revoke/rotate
  * with `teamStrategy: withTeam()` from "@noy-db/hub/team" in createNoydb().
  * Single-user primitives (owner keyring, unlock, `listUsers`, `updateUser`,
- * passphrase rotate/recover) stay ungated.
+ * secret rotate/recover) stay ungated.
  */
 export declare class TeamNotEnabledError extends NoydbError {
     constructor(message?: string);
@@ -1386,7 +1386,7 @@ export declare class SessionNotFoundError extends NoydbError {
  *
  * The `operation` field names the specific operation that was blocked
  * (e.g. `'export'`, `'grant'`, `'rotate'`) so the caller can surface
- * a targeted prompt ("Please re-enter your passphrase to export data").
+ * a targeted prompt ("Please re-enter your secret to export data").
  */
 export declare class SessionPolicyError extends NoydbError {
     readonly operation: string;
@@ -1825,7 +1825,7 @@ export declare class PolicyDeniedError extends NoydbError {
 }
 /**
  * Raised by `createNoydb({ ... })` when the developer omits a recovery
- * profile and `recover-passphrase` is not explicitly disabled. Vaults
+ * profile and `recover-secret` is not explicitly disabled. Vaults
  * MUST have at least one recovery path enrolled before being
  * production-ready (paper, shamir, multi-channel, or admin-mediated).
  *
@@ -1835,10 +1835,10 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
     constructor(message?: string);
 }
 /**
- * Raised by `openVault` when a managed-passphrase-mode vault has no
+ * Raised by `openVault` when a managed-secret-mode vault has no
  * STRONG recovery profile enrolled.
  *
- * Managed mode means the user never types a passphrase — the unlock
+ * Managed mode means the user never types a secret — the unlock
  * material lives in a `SealingKeyProvider` (`at-*` package). If that
  * provider's key is lost AND no strong recovery is enrolled, the
  * vault is irrecoverable. To prevent that footgun, managed-mode vaults
@@ -1846,11 +1846,11 @@ export declare class RecoveryNotEnrolledError extends NoydbError {
  * multi-channel / admin-mediated when those ship).
  *
  * Paper recovery alone is NOT strong under managed mode: the user has
- * no memorized passphrase to fall back on, so losing the paper sheet =
+ * no memorized secret to fall back on, so losing the paper sheet =
  * losing every record permanently.
  *
- * Bootstrap with `db.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
- * to atomically create-and-enroll, or call `db.enrollRecovery(vault, { profile: "shamir", ... })`
+ * Bootstrap with `db.team.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
+ * to atomically create-and-enroll, or call `db.team.enrollRecovery(vault, { profile: "shamir", ... })`
  * separately before re-attempting `openVault`.
  */
 export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
@@ -1858,7 +1858,7 @@ export declare class ManagedRecoveryNotEnrolledError extends NoydbError {
     constructor(vault: string);
 }
 /**
- * Raised by `db.recoverPassphrase` / `db.enrollRecovery` /
+ * Raised by `db.recoverSecret` / `db.enrollRecovery` /
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *

package/dist/kernel/noydb.d.ts

@@ -1,8 +1,5 @@
 import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
-import type { PassphrasePolicy } from './validation.js';
-import { type RotatePassphraseInput, type RecoverPassphraseInput, type RecoverPassphraseResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from '../with-party/team/rotate-recover.js';
-import type { RecoverUserOptions } from '../with-party/team/peer-recover.js';
-import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from '../with-party/team/recovery.js';
+import type { SecretPolicy } from './validation.js';
 import { type CoordinationProvider } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { SetCoverInput } from '../with-party/directory/cover/schema.js';
@@ -13,9 +10,6 @@ import { WriteHookRegistry, type WriteHook, type Unsubscribe } from '../port/wit
 import { ServiceBus } from '../port/with/service-bus.js';
 import { type TabCoordinationOptions, type TabRole, type TabPresence } from '../with-party/tab-coordination.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from '../with-party/team/authenticators.js';
-import { type QuickUnlockState } from '../with-party/session/unlock-state.js';
-import type { KeyringAuthenticator } from './types.js';
 import type { SyncEngine } from '../with-party/team/sync.js';
 import type { SyncTransaction } from '../with-party/team/sync-transaction.js';
 import { type SnapshotMeta } from '../with-fork/snapshots/strategy.js';
@@ -24,6 +18,7 @@ import { TxContext } from '../with-commit/tx/transaction.js';
 import type { DryRunResult } from '../with-commit/tx/dry-run.js';
 import { type ForgetStrategy } from '../with-audit/forget/strategy.js';
 import { type CustodyStrategy } from '../with-party/custody/strategy.js';
+import { TeamFacade } from '../with-party/team/noydb-facade.js';
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
 type ResolvedNoydbOptions = NoydbOptions & {
     readonly store: NoydbStore;
@@ -56,7 +51,7 @@ export declare class Noydb {
     private readonly keyringCache;
     private readonly syncEngines;
     /**
-     * Per-vault active session tier — defaults to `1` after a passphrase
+     * Per-vault active session tier — defaults to `1` after a secret
      * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
      * {@link checkGate} to evaluate `gate.minTier`.
      */
@@ -102,7 +97,20 @@ export declare class Noydb {
     private readonly policyManager;
     /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
     private readonly policyCheckGate;
-    private readonly team;
+    /**
+     * Credential and multi-user operations — enrolment, secret rotation,
+     * recovery, quick-unlock (#846).
+     *
+     * Public because 23 methods on this class did nothing but restate a
+     * TeamFacade signature and forward to it, so every signature had to be
+     * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+     * reads the same and has one source of truth.
+     *
+     * A getter, not a field, so it appears in the prototype-based kernel API
+     * manifest — an instance field is invisible to it (the same reason
+     * `custodyStrategy` became one in #838).
+     */
+    get team(): TeamFacade;
     /**
      * Currently-running multi-record transaction, set by
      * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -281,9 +289,9 @@ export declare class Noydb {
      *
      * The walk is a two-step pipeline: first ask the adapter for the
      * universe of compartments it stores, then for each one attempt to
-     * load the calling user's keyring with the in-memory passphrase.
+     * load the calling user's keyring with the in-memory secret.
      * Compartments where the user has no keyring file (`NoAccessError`)
-     * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+     * or where the secret doesn't unwrap (`InvalidKeyError`) are
      * silently dropped from the result — the existence of those
      * compartments is **not** confirmed in the return value.
      *
@@ -304,15 +312,15 @@ export declare class Noydb {
      * **Known edge case.** A vault whose keyring file
      * happens to have an empty wrapped-DEKs map (because the owner
      * granted access before any collection was created) will pass the
-     * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+     * `loadKeyring` probe with *any* secret — there are no DEKs to
      * unwrap, so the integrity-checked unwrap that normally rejects
-     * wrong passphrases never runs. The result is that an unrelated
+     * wrong secrets never runs. The result is that an unrelated
      * principal who happens to know the user-id and the vault
      * name can show up in `listAccessibleVaults()` as having
      * access to that empty vault. They cannot read any actual
      * data (their DEK set is empty), so this is a metadata leak
      * (vault name + user-id), not a content leak. Hardening this
-     * via a passphrase canary in the keyring file is a deferred
+     * via a secret canary in the keyring file is a deferred
      * follow-up.
      *
      * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -405,15 +413,15 @@ export declare class Noydb {
      */
     _resolveBackend(vaultId: string): NoydbStore;
     /**
-     * Change the current user's passphrase for a vault.
+     * Change the current user's secret for a vault.
      *
-     * Validates the new passphrase against the strength rules. Pass
-     * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-     * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+     * Validates the new secret against the strength rules. Pass
+     * `{ allowWeakSecret: true }` to skip — typically only useful for
+     * fixtures and migrations. Pass a `SecretPolicy` to override the
      * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
      */
-    changeSecret(vault: string, newPassphrase: string, options?: PassphrasePolicy & {
-        allowWeakPassphrase?: boolean;
+    changeSecret(vault: string, newSecret: string, options?: SecretPolicy & {
+        allowWeakSecret?: boolean;
     }): Promise<void>;
     /** Push local changes to remote for a vault. */
     push(vault: string, options?: PushOptions): Promise<PushResult>;
@@ -671,7 +679,7 @@ export declare class Noydb {
      * denial; resolves with `void` on success.
      *
      * @param vault    The vault whose policy applies.
-     * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+     * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
      *                 or app-defined (`app:*`).
      * @param presented Caller-supplied factor proofs.
      */
@@ -686,12 +694,12 @@ export declare class Noydb {
      * Two enforcement modes:
      *
      * 1. **Managed-mode mandatory strong-recovery.** When
-     *    `passphraseMode === 'managed'`, the vault MUST have at least
+     *    `secretMode === 'managed'`, the vault MUST have at least
      *    one **strong** recovery profile (Shamir today). Paper alone is
      *    rejected because under managed mode the user has no memorized
-     *    passphrase, so losing the paper sheet = losing every record.
+     *    secret, so losing the paper sheet = losing every record.
      *    This check is unconditional — independent of `requireRecovery`
-     *    and the `recover-passphrase` gate.
+     *    and the `recover-secret` gate.
      *
      * 2. **Opt-in strict mandatory-recovery.** When
      *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -710,26 +718,6 @@ export declare class Noydb {
      * @internal
      */
     _setActiveTier(vault: string, tier: ActiveTier): void;
-    /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-    enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-    removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
-    /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-    listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
-    /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-    updateAuthenticator(vault: string, slotId: string, options: UpdateAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, factors?: FactorProofBundle): Promise<{
-        credentialId: string;
-    }>;
-    /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
-        id: string;
-        enrolledAt: string;
-        credentialId: string;
-    }>>;
-    /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-    unlockViaAuthenticator(vault: string, slotId: string, verify: (slot: KeyringAuthenticator) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring>;
     /**
      * Set the owner-curated cover for a vault. Throws
      * `ValidationError` if the developer did not opt the hub into
@@ -759,53 +747,6 @@ export declare class Noydb {
     getCover(vault: string, opts?: {
         readonly locale?: string;
     }): Promise<Cover | undefined>;
-    /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-    describeAuthConfig(vault: string): Promise<string>;
-    /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-    diagramAuthConfig(vault: string): Promise<string>;
-    /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-    describeUserAuth(vault: string, userId: string, factors?: FactorProofBundle): Promise<string>;
-    /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-    describeAllUsersAuth(vault: string, factors?: FactorProofBundle): Promise<Array<{
-        userId: string;
-        description: string;
-    }>>;
-    /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
-    /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
-    /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-    rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>;
-    /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-    openVaultAndEnrollRecovery(vault: string, opts: {
-        readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-        readonly locale?: string;
-    }): Promise<{
-        readonly vault: Vault;
-        readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
-    }>;
-    /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-    recoverManagedPassphrase(vault: string, options: {
-        readonly recoveryProof: RecoveryProof;
-        readonly passphrasePolicy?: PassphrasePolicy;
-    }): Promise<void>;
-    /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-    recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-    enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
-    /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-    listRecoveryEntries(vault: string): Promise<{
-        paper: ReadonlyArray<PaperRecoveryEntry>;
-        shamir: ReadonlyArray<ShamirRecoveryEntry>;
-    }>;
-    /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-    enrollUnlock(vault: string, state: QuickUnlockState, factors?: FactorProofBundle): Promise<void>;
-    /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-    unlockViaPin(vault: string, resume: (state: QuickUnlockState) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring | undefined>;
-    /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-    clearQuickUnlock(vault: string): void;
-    /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-    getKeyring(vault: string): Promise<UnlockedKeyring>;
     /**
      * Live-reference variant used by the hub's own code paths. Internal
      * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a