@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.5

package/dist/with-cargo/index.d.ts

@@ -19,7 +19,7 @@ export { liberateVault } from '../with-party/custody/liberate.js';
 export type { LiberateOptions, LiberateResult } from '../with-party/custody/liberate.js';
 export { createDeedOwner, loadDeedMarker, isDeedVault } from '../with-party/team/deed.js';
 export type { DeedMarker } from '../with-party/team/deed.js';
-export type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
+export type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
 export { withCargo } from './active.js';

package/dist/with-commit/history/time-machine.d.ts

@@ -5,7 +5,7 @@
  * ## Usage
  *
  * ```ts
- * const vault = await db.openVault('acme', { passphrase })
+ * const vault = await db.openVault('acme', { secret })
  * const q1End = vault.at('2026-03-31T23:59:59Z')
  * const invoice = await q1End.collection<Invoice>('invoices').get('inv-001')
  * // → the record as it stood at the close of Q1 2026
@@ -64,7 +64,7 @@ export interface VaultEngine {
     /** Vault name (the compartment). */
     readonly name: string;
     /**
-     * `true` when the vault was opened with a passphrase (the normal
+     * `true` when the vault was opened with a secret (the normal
      * case). `false` in plaintext-mode vaults (`encrypt: false`) — in
      * that case `envelope._data` is raw JSON and we skip the DEK lookup.
      */

package/dist/with-formula/derivations/dispatch.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Derivation dispatch, lifted out of the kernel spine (#842 part b).
+ *
+ * `Collection` carried ~380 lines of dispatch logic that belongs to the
+ * derivation service, not to the always-on kernel. These are free functions
+ * taking an explicit context so the spine keeps only a thin delegator.
+ *
+ * ## How the spine reaches this module
+ *
+ * By dynamic `import()`, never a static one. `check-architecture.mjs`'s
+ * `port-layering` check forbids the spine from statically importing a
+ * `with-*` service; `collection.ts` is grandfathered for ten
+ * `with-formula/*` specifiers, but that list is frozen per file and a new
+ * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and
+ * it keeps this chunk out of the floor bundle for consumers who never fire a
+ * derivation.
+ *
+ * The `Collection` type reference below points back at the spine. That is
+ * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at
+ * build, so no runtime cycle exists.
+ *
+ * @internal
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import type { TxContext } from '../../with-commit/tx/transaction.js';
+import type { DerivationRegistry } from './registry.js';
+import type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js';
+import type { Collection } from '../../kernel/collection.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EncryptedEnvelope } from '../../kernel/types.js';
+import type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js';
+/** The per-write dispatch context threaded into `putDerivedOutput`. */
+interface DispatchCtx {
+    emit: (e: string, p: unknown) => void;
+    source: {
+        readonly collection: string;
+        readonly id: string;
+    };
+    audit: ReturnType<typeof ledgerAuditHook>;
+}
+/**
+ * What the dispatchers need from the collection that owns them. Passing this
+ * explicitly is what lets the logic live outside the class.
+ */
+export interface DerivationDeleteCtx {
+    readonly derivationSource: {
+        registry(): DerivationRegistry;
+        getCollection(name: string): Collection<Record<string, unknown>>;
+        getActiveTxContext(): TxContext | null;
+        getReadOnlyFacade(): ReadOnlyVaultFacade;
+    };
+    /** The collection the delete happened in. */
+    readonly collectionName: string;
+    readonly adapter: NoydbStore;
+    readonly vault: string;
+    readonly getDEK: (collectionName: string) => Promise<EnclaveKey>;
+    readonly storeCiphertext: boolean;
+}
+/**
+ * Erase the derived rows a deleted source record fanned out to, and drop the
+ * fan-out sidecars that recorded them.
+ *
+ * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.
+ *   Restricted to a source-triggered strategy writing into a DIFFERENT
+ *   collection — the self-denorm case would re-delete the record just
+ *   tombstoned, and triggerBy/sibling strategies derive under a different id.
+ * @returns rows ACTUALLY deleted, not edges visited (#622).
+ */
+export declare function dispatchArrayDerivationsOnDelete(ctx: DerivationDeleteCtx, id: string, eraseRecordShapeToo?: boolean): Promise<number>;
+/** Adds what the on-write derivation dispatch needs beyond the delete path. */
+export interface DerivationDispatchCtx extends DerivationDeleteCtx {
+    /** Via pipeline, for decoding the stored form back to canonical money shape. */
+    readonly via: {
+        canonicalizeStored(r: Record<string, unknown>): Record<string, unknown>;
+    } | undefined;
+    /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */
+    readonly recomputeRollup: (spec: any, parentId: string, source: {
+        readonly collection: string;
+        readonly id: string;
+    }, wave?: WaveContext) => Promise<unknown>;
+    /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */
+    readonly dispatchCtx: (source: {
+        readonly collection: string;
+        readonly id: string;
+    }) => DispatchCtx;
+    /** Registers a write on the active transaction for rollback. */
+    readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void;
+}
+/**
+ * Fire registered derivation strategies for this source collection.
+ *
+ * Eager mode runs `derive` inline and writes each output; lazy mode records a
+ * stale mark for cold-session recompute. Rollups are handled here rather than
+ * by the executor — a write to the child recomputes the parent aggregate, and
+ * a write to the parent recomputes its own.
+ */
+export declare function dispatchDerivations(ctx: DerivationDispatchCtx, id: string, record: Record<string, unknown>, version: number, wave?: WaveContext): Promise<void>;
+export {};

package/dist/with-formula/materialized-views/dispatch.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Materialized-view dispatch, lifted out of the kernel spine (#842 part b).
+ *
+ * Reached from `Collection` by dynamic `import()` only — `port-layering`
+ * forbids a static spine→`with-*` import, and rejects a type-only one too
+ * (it scans import statements, not their erasure). See
+ * `with-formula/derivations/dispatch.ts` for the same note.
+ *
+ * The `Collection` reference below is TYPE-ONLY and points inward
+ * (service → kernel), so it is both allowed and erased at build.
+ *
+ * @internal
+ */
+import type { TxContext } from '../../with-commit/tx/transaction.js';
+import type { Collection } from '../../kernel/collection.js';
+import type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js';
+import type { MaterializedViewRegistry } from './registry.js';
+import type { MVQueryContext } from './types.js';
+/** The per-write dispatch context the MV executor threads through. */
+interface DispatchCtx {
+    emit: (e: string, p: unknown) => void;
+    source: {
+        readonly collection: string;
+        readonly id: string;
+    };
+    audit: ReturnType<typeof ledgerAuditHook>;
+}
+/** What the MV dispatchers need from the collection that owns them. */
+export interface MvDispatchCtx {
+    readonly materializedViewSource: {
+        registry(): MaterializedViewRegistry;
+        getCollection(name: string): Collection<any>;
+        getActiveTxContext(): TxContext | null;
+        getQueryContext(): MVQueryContext;
+    };
+    /** The collection the delete happened in. */
+    readonly collectionName: string;
+    /** Builds the per-write dispatch context the executor threads through. */
+    readonly dispatchCtx: (source: {
+        readonly collection: string;
+        readonly id: string;
+    }) => DispatchCtx;
+}
+/**
+ * Fire every MV whose dependency set includes this collection, on write.
+ *
+ * Skips entirely when the record being written is itself an MV-emitted row
+ * (it carries `_materializedFrom`) — a defensive guard against missed cycle
+ * detection.
+ *
+ * @param wave #638 Task 4 — the sync/cutover/restore dispatch wave. An eager
+ *   MV already refreshed in this wave is skipped, deduped per target on the
+ *   spec name.
+ */
+export declare function dispatchMaterializedViews(ctx: MvDispatchCtx, id: string, record: Record<string, unknown>, wave?: WaveContext): Promise<void>;
+/**
+ * Mirror of {@link dispatchMaterializedViews} for the delete/forget path. There is
+ * no `_materializedFrom` skip — the record is gone — and the `internal` gate
+ * at `_doDelete` is the recursion guard.
+ *
+ * @returns rows TOMBSTONED across every MV sourced here (#638 T6). Eager and
+ *   lazy/manual `invalidateMVAtRest` purges both contribute (#761 item 1,
+ *   previously eager-only): lazy persists a stale mark for cold-session
+ *   recompute, manual serves empty until `refreshView()`.
+ *   `residueUndecodable` / `residueDeclined` (#776/#785) carry
+ *   `outputCollection:id` entries whose ownership stamp `invalidateMVAtRest`
+ *   could not decode, respectively decoded and stamp-matched but declined to
+ *   erase — surfaced, not erased.
+ */
+export declare function dispatchMaterializedViewsOnDelete(ctx: MvDispatchCtx, id: string): Promise<{
+    deleted: number;
+    residueUndecodable: string[];
+    residueDeclined: string[];
+}>;
+export {};

package/dist/with-party/custody/liberate.d.ts

@@ -24,7 +24,7 @@
  * unseal the original sealed owner. The old sealed-owner credential is left
  * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still
  * sealed under the non-firm provider), never impersonated. The new owner is a
- * DISTINCT principal under a fresh KEK derived from `newOwnerPassphrase`. This
+ * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This
  * preserves the inalienability floor: the act of claiming ownership is itself
  * auditable and produces a different principal, rather than silently assuming
  * the latent owner's identity.
@@ -47,8 +47,8 @@ import type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-ac
 export interface LiberateOptions {
     /** The id of the new owner principal the custodian mints by claiming ownership. */
     readonly newOwnerId: string;
-    /** The passphrase that derives the new owner's KEK (the DEKs are re-wrapped under it). */
-    readonly newOwnerPassphrase: string;
+    /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */
+    readonly newOwnerSecret: string;
     /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */
     readonly legalBasis: string;
     readonly factors?: FactorProofBundle;

package/dist/with-party/session/dev-unlock.d.ts

@@ -2,11 +2,11 @@
  * Dev-mode persistent unlock —
  *
  * Solves the developer inner-loop friction: hot-reload destroys the session
- * (page navigation semantics), forcing a passphrase re-entry every refresh.
+ * (page navigation semantics), forcing a secret re-entry every refresh.
  *
  * This module provides an opt-in, deliberately-named escape hatch that lets
  * developers store the keyring payload in sessionStorage or localStorage so
- * the vault auto-unlocks on every page load — without a passphrase,
+ * the vault auto-unlocks on every page load — without a secret,
  * without a biometric prompt, without any OIDC flow.
  *
  * ⚠️ WARNING — this is a loaded footgun ⚠️

package/dist/with-party/session/session.d.ts

@@ -1,7 +1,7 @@
 /**
  * Session tokens —
  *
- * After a vault is unlocked (via passphrase, WebAuthn, OIDC, or magic-
+ * After a vault is unlocked (via secret, WebAuthn, OIDC, or magic-
  * link), the caller can call `createSession()` to get a session token that
  * allows re-establishing the KEK for the session lifetime without re-running
  * PBKDF2 or any interactive auth challenge.
@@ -75,7 +75,7 @@ export interface CreateSessionOptions {
 /**
  * Create a session for an already-unlocked keyring.
  *
- * Call this after any successful unlock (passphrase, WebAuthn, OIDC,
+ * Call this after any successful unlock (secret, WebAuthn, OIDC,
  * magic-link). The returned `sessionId` is the handle for later
  * `resolveSession()` and `revokeSession()` calls.
  *

package/dist/with-party/team/deed.d.ts

@@ -2,7 +2,7 @@
  * FR-6 — Deed: sealed / hidden-owner provisioning.
  *
  * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
+ * authenticates. The owner credential (the random secret that
  * derives `KEK_owner`) is minted machine-side and sealed under a
  * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
  * the cryptographic *inalienability anchor*: whoever holds the
@@ -13,10 +13,10 @@
  *
  * Provisioning reuses the managed-mode seam:
  *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     secret at `_meta/sealed-secret` (and unseals it on every
  *     subsequent open through the same provider).
  *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *     secret and writes the `_keyring/<ownerUserId>` file.
  *
  * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
  * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
@@ -30,7 +30,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { SealingKeyProvider } from './managed-passphrase.js';
+import type { SealingKeyProvider } from './managed-secret.js';
 /** Reserved id for the Deed marker under `_meta`. */
 export declare const DEED_RECORD_ID: "deed";
 /**
@@ -60,7 +60,7 @@ export interface DeedMarker {
 }
 /**
  * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * `sealing` (a NON-firm provider). Mints + seals the owner secret
  * via {@link resolveManagedSecret}, derives the owner keyring via
  * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
  * marker. Returns the unlocked owner keyring.
@@ -68,8 +68,8 @@ export interface DeedMarker {
  * The returned keyring is the only in-memory window onto `KEK_owner`
  * for this call; the persistent re-entry point is the sealing provider
  * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
+ * re-resolve the secret, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive secret is ever required).
  *
  * There is deliberately no firm-controlled fallback: the marker's
  * `sealedUnder` is the single cryptographic anchor of ownership.
@@ -85,7 +85,7 @@ export declare function loadDeedMarker(store: NoydbStore, vault: string): Promis
 export declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
 /**
  * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors
- * `saveSealedPassphrase`'s envelope shape: a standard
+ * `saveSealedSecret`'s envelope shape: a standard
  * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the
  * payload stored as plaintext JSON in `_data`. The marker is metadata,
  * not a secret — sealing it would defeat its purpose (auditors /

package/dist/with-party/team/index.d.ts

@@ -20,8 +20,8 @@ export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers
 export type { BundleRecipient, ListUsersOptions } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
-export { rotatePassphrase, recoverPassphrase, } from './rotate-recover.js';
-export type { RotatePassphraseInput, RecoverPassphraseInput, RecoverPassphraseResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
+export { rotateSecret, recoverSecret, } from './rotate-recover.js';
+export type { RotateSecretInput, RecoverSecretInput, RecoverSecretResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './rotate-recover.js';
 export { recoverUser } from './peer-recover.js';
 export type { RecoverUserOptions } from './peer-recover.js';
 export { mintPaperRecoveryEntry, unwrapDeksFromPaperEntry, loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEntry, } from './recovery.js';

package/dist/with-party/team/keyring.d.ts

@@ -1,6 +1,6 @@
 import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
-import { type PassphrasePolicy } from '../../kernel/validation.js';
+import { type SecretPolicy } from '../../kernel/validation.js';
 /** In-memory representation of an unlocked keyring. */
 export interface UnlockedKeyring {
     readonly userId: string;
@@ -9,7 +9,7 @@ export interface UnlockedKeyring {
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
     /**
-     * The KEK, when this keyring was unlocked via tier 1 (passphrase) or
+     * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the
      * keyring was opened via:
      *
@@ -72,7 +72,7 @@ export interface UnlockedKeyring {
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
 /** Load and unlock a user's keyring for a vault. */
-export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string): Promise<UnlockedKeyring>;
+export declare function loadKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string): Promise<UnlockedKeyring>;
 /**
  * Open-policy pre-gate: decide create-vs-fail-closed **before** any
  * vault write. `openVault` must not self-provision an owner keyring into a
@@ -81,21 +81,21 @@ export declare function loadKeyring(adapter: NoydbStore, vault: string, userId:
  * `store.list`. Returns when the open may proceed (the caller is a member, or
  * the vault is genuinely-new and `create` is allowed, in which case the caller
  * falls through to the normal `createOwnerKeyring` path); throws `NoAccessError`
- * otherwise. Placed before managed-passphrase secret resolution (which persists
+ * otherwise. Placed before managed-secret secret resolution (which persists
  * on first open), so a fail-closed open writes nothing.
  */
 export declare function assertKeyringOpenAllowed(store: NoydbStore, vault: string, userId: string, create: boolean): Promise<void>;
 /**
  * Create the initial owner keyring for a new vault.
  *
- * Pass `{ validate: true }` (or a `PassphrasePolicy`) to gate creation
+ * Pass `{ validate: true }` (or a `SecretPolicy`) to gate creation
  * on the phrase-format strength rules — `Noydb` threads this from
- * `NoydbOptions.validatePassphrase`. Direct callers (CLI, scripts,
+ * `NoydbOptions.validateSecret`. Direct callers (CLI, scripts,
  * test fixtures) opt in explicitly.
  */
-export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, passphrase: string, passphraseOpts?: PassphrasePolicy & {
+export declare function createOwnerKeyring(adapter: NoydbStore, vault: string, userId: string, secret: string, secretOpts?: SecretPolicy & {
     validate?: boolean;
-    allowWeakPassphrase?: boolean;
+    allowWeakSecret?: boolean;
 }): Promise<UnlockedKeyring>;
 /** Grant access to a new user. Caller must have grant privilege. */
 export declare function grant(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
@@ -134,23 +134,23 @@ export declare function updateKeyringIdentity(adapter: NoydbStore, vault: string
  */
 export declare function rotateKeys(adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]): Promise<void>;
 /**
- * Change the user's passphrase. Re-wraps every DEK under the new KEK.
+ * Change the user's secret. Re-wraps every DEK under the new KEK.
  *
- * Validates the new passphrase against the strength rules unless
- * `allowWeakPassphrase: true` is passed. Mirrors `rotatePassphrase`'s
+ * Validates the new secret against the strength rules unless
+ * `allowWeakSecret: true` is passed. Mirrors `rotateSecret`'s
  * default-on validation contract.
  *
- * `db.rotatePassphrase()` adds a `checkGate('rotate-passphrase')` step
- * on top of this primitive and additionally requires the OLD passphrase
+ * `db.team.rotateSecret()` adds a `checkGate('rotate-secret')` step
+ * on top of this primitive and additionally requires the OLD secret
  * for re-derivation; `changeSecret` reuses the cached unlocked KEK so
- * the OLD passphrase is not retyped.
+ * the OLD secret is not retyped.
  */
-export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newPassphrase: string, passphraseOpts?: PassphrasePolicy & {
-    allowWeakPassphrase?: boolean;
+export declare function changeSecret(adapter: NoydbStore, vault: string, keyring: UnlockedKeyring, newSecret: string, secretOpts?: SecretPolicy & {
+    allowWeakSecret?: boolean;
 }): Promise<UnlockedKeyring>;
 /**
  * Recipient slot in a re-keyed `.noydb` bundle. Each slot becomes its
- * own keyring file inside the bundle, sealed with its own passphrase.
+ * own keyring file inside the bundle, sealed with its own secret.
  * Same role/permission semantics as `db.grant()` but no adapter side
  * effect — the slot only exists inside the bundle bytes.
  *
@@ -161,8 +161,8 @@ export interface BundleRecipient {
     readonly id: string;
     /** Optional display name. Defaults to `id`. */
     readonly displayName?: string;
-    /** Passphrase the recipient will type to unlock. */
-    readonly passphrase: string;
+    /** Secret the recipient will type to unlock. */
+    readonly secret: string;
     /** Role on the destination vault. Defaults to `'viewer'`. */
     readonly role?: Role;
     /**

package/dist/with-party/team/{managed-passphrase.d.ts → managed-secret.d.ts}

@@ -1,7 +1,7 @@
 /**
- * Managed-passphrase mode — rubber-hose-resistant vaults.
+ * Managed-secret mode — rubber-hose-resistant vaults.
  *
- * A vault mode where the passphrase is machine-generated and never
+ * A vault mode where the secret is machine-generated and never
  * exposed to the user, sealed under a developer-provided
  * {@link SealingKeyProvider} (macOS Keychain, Windows Credential
  * Manager, libsecret, AWS KMS, …). The user has no secret to give
@@ -27,31 +27,31 @@
  *     implementation of both `RecipientSealer` and
  *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;
  *     safe for tests and same-process sender/recipient scenarios.
- *   - {@link loadSealedPassphrase} / {@link saveSealedPassphrase} —
- *     plaintext envelope storage at `_meta/sealed-passphrase`.
+ *   - {@link loadSealedSecret} / {@link saveSealedSecret} —
+ *     plaintext envelope storage at `_meta/sealed-secret`.
  *     Mirrors the `_meta/handle` and `_meta/public-envelope` AES-
  *     GCM-bypassed patterns. The sealing layer (provider's job)
  *     is the security boundary; hub doesn't have a key to encrypt
  *     with at this layer — that's the whole point of the design.
  *   - {@link resolveManagedSecret} — orchestrates the "generate +
  *     seal + persist on first open; unseal on reopen" flow.
- *     Returns the plaintext passphrase string that the rest of the
+ *     Returns the plaintext secret string that the rest of the
  *     `createNoydb` keyring path consumes.
  *
  * Deferred to follow-ups:
- *   - Block `rotate-passphrase` policy gate under managed mode.
+ *   - Block `rotate-secret` policy gate under managed mode.
  *   - Mandatory strong-recovery enforcement.
  *   - Recovery flow under managed mode (generates fresh sealed phrase).
  *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-passphrase mode
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
  *
  * @module
  */
 import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 /**
  * The contract concrete providers (per-platform key stores) implement
- * to seal and unseal a hub-generated random passphrase. The plaintext
- * passphrase NEVER leaves hub-controlled memory in unsealed form —
+ * to seal and unseal a hub-generated random secret. The plaintext
+ * secret NEVER leaves hub-controlled memory in unsealed form —
  * the provider receives the bytes, returns opaque sealed bytes, and
  * later reverses the operation. Hub treats the sealed bytes as
  * fully opaque.
@@ -69,7 +69,7 @@ import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
 export interface SealingKeyProvider {
     /**
      * Non-sensitive identifier disclosed in the persisted envelope.
-     * Surfaced to consumers via `loadSealedPassphrase().providerId` so
+     * Surfaced to consumers via `loadSealedSecret().providerId` so
      * a vault opened with the wrong provider class can detect the
      * mismatch and surface a clear error. NOT secret — fine to log.
      *
@@ -78,8 +78,8 @@ export interface SealingKeyProvider {
      * parses this; it's purely audit metadata.
      */
     readonly id: string;
-    /** Seal raw passphrase bytes. Output bytes are opaque to hub. */
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    /** Seal raw secret bytes. Output bytes are opaque to hub. */
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     /**
      * Reverse {@link seal}. MUST throw on tamper, wrong-provider, or
      * any other failure — hub treats a thrown error as "this provider
@@ -90,7 +90,7 @@ export interface SealingKeyProvider {
 /**
  * In-memory test provider. NOT secure — uses a deterministic
  * per-instance "key" (16-byte SHA-256 of `id`) XOR'd over the
- * passphrase plus a 4-byte provider-id fingerprint prefix. The XOR is
+ * secret plus a 4-byte provider-id fingerprint prefix. The XOR is
  * sufficient to make different `id` values produce mutually-unsealable
  * outputs (the contract tests for that), but offers ZERO real
  * confidentiality — never use outside tests.
@@ -104,7 +104,7 @@ export declare class MemorySealingKeyProvider implements SealingKeyProvider {
     constructor(opts: {
         id: string;
     });
-    seal(passphrase: Uint8Array): Promise<Uint8Array>;
+    seal(secret: Uint8Array): Promise<Uint8Array>;
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 }
 /**
@@ -201,17 +201,17 @@ export declare class MemoryRecipientSealer implements SealingKeyProvider, Recipi
     seal(plaintext: Uint8Array): Promise<Uint8Array>;
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }
-/** Reserved id for the managed-passphrase envelope under `_meta`. */
-export declare const SEALED_PASSPHRASE_RECORD_ID: "sealed-passphrase";
-/** Plaintext payload stored inside the `_meta/sealed-passphrase` envelope. */
-export interface SealedPassphrase {
+/** Reserved id for the managed-secret envelope under `_meta`. */
+export declare const SEALED_SECRET_RECORD_ID: "sealed-secret";
+/** Plaintext payload stored inside the `_meta/sealed-secret` envelope. */
+export interface SealedSecret {
     readonly _noydb_sealed: 1;
     readonly providerId: string;
     /** Sealed bytes. Base64-encoded on the wire; decoded on load. */
     readonly sealed: Uint8Array;
 }
 /**
- * Wire-format envelope persisted at `_meta/sealed-passphrase` for
+ * Wire-format envelope persisted at `_meta/sealed-secret` for
  * managed-mode vaults. The provider produces raw sealed bytes via
  * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch
  * metadata hub needs to pick the right provider on the unseal path.
@@ -237,8 +237,8 @@ export interface SealedEnvelope {
     readonly payload: string;
 }
 /**
- * Parse a `_meta/sealed-passphrase` `_data` JSON string into the
- * in-memory {@link SealedPassphrase} representation. Accepts both:
+ * Parse a `_meta/sealed-secret` `_data` JSON string into the
+ * in-memory {@link SealedSecret} representation. Accepts both:
  *
  *   1. v1 wire format `{ v: 1, _noydb_sealed: 1, pid, payload }` —
  *      the current shape.
@@ -251,20 +251,20 @@ export interface SealedEnvelope {
  *
  * @internal — exported only for the migration safety-net test suite.
  */
-export declare function parseSealedEnvelope(raw: unknown): SealedPassphrase | undefined;
-export declare function saveSealedPassphrase(store: NoydbStore, vault: string, payload: {
+export declare function parseSealedEnvelope(raw: unknown): SealedSecret | undefined;
+export declare function saveSealedSecret(store: NoydbStore, vault: string, payload: {
     readonly providerId: string;
     readonly sealed: Uint8Array;
 }): Promise<void>;
-export declare function loadSealedPassphrase(store: NoydbStore, vault: string): Promise<SealedPassphrase | undefined>;
+export declare function loadSealedSecret(store: NoydbStore, vault: string): Promise<SealedSecret | undefined>;
 /**
- * Resolve the effective plaintext passphrase string for a managed-mode
+ * Resolve the effective plaintext secret string for a managed-mode
  * vault. Two paths:
  *
  *   1. **First open (no envelope persisted):** generate a 256-bit random
  *      via `crypto.getRandomValues`, base64-encode for use as a
- *      passphrase string, seal the underlying bytes under the
- *      provider, persist `_meta/sealed-passphrase`, return the
+ *      secret string, seal the underlying bytes under the
+ *      provider, persist `_meta/sealed-secret`, return the
  *      base64 string.
  *
  *   2. **Reopen (envelope exists):** read + unseal + decode → return.