@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.6

package/dist/kernel/query/scan-builder.d.ts

@@ -58,9 +58,9 @@
  *   - `scan().join(...)` — tracked under  (streaming join)
  */
 import type { QueryField } from '../types.js';
-import type { ReducerBuilder } from '../../with-lookup/aggregate/reducers.js';
+import type { ReducerBuilder } from '../../with-lookup/reduce/reducers.js';
 import type { Clause, Operator } from './predicate.js';
-import type { AggregateSpec, AggregateResult } from '../../with-lookup/aggregate/aggregation.js';
+import type { ReduceSpec, ReduceResult } from '../../with-lookup/reduce/reduction.js';
 import type { JoinContext, JoinLeg } from './join.js';
 import type { ViaPipeline } from '../via/pipeline.js';
 /**
@@ -321,8 +321,8 @@ export declare class ScanBuilder<T, S extends keyof T = never, M extends keyof T
      * method has never run and must not start running as a side effect of
      * this gate).
      */
-    aggregate<Spec extends AggregateSpec>(spec: Spec): Promise<AggregateResult<Spec>>;
-    aggregate<Spec extends AggregateSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Promise<AggregateResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Promise<ReduceResult<Spec>>;
     /**
      * Evaluate the clause list against a single record. Linear in
      * the clause count; short-circuits on first false. Clauses on a

package/dist/kernel/types.d.ts

@@ -28,7 +28,7 @@ import type { SyncPolicy } from './sync-policy.js';
 import type { BlobStrategy } from '../port/with/blob-strategy.js';
 import type { ArchiveStrategy } from '../with-fork/archive/index.js';
 import type { IndexStrategy } from '../with-lookup/indexing/strategy.js';
-import type { AggregateStrategy } from '../with-lookup/aggregate/strategy.js';
+import type { ReduceStrategy } from '../with-lookup/reduce/strategy.js';
 import type { ConsentStrategy } from '../with-audit/consent/strategy.js';
 import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
@@ -55,11 +55,11 @@ import type { SyncStrategy } from '../with-party/team/sync-strategy.js';
 import type { GuardStrategyHandleAny } from '../with-audit/guards/types.js';
 import type { DerivationStrategyHandle } from '../with-formula/derivations/types.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import type { PassphrasePolicy } from './validation.js';
+import type { SecretPolicy } from './validation.js';
 import type { CoverSchema } from '../with-party/directory/cover/types.js';
 import type { MaterializedViewStrategyHandle } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewStrategyHandle } from '../with-formula/overlay-views/types.js';
-import type { SealingKeyProvider, RecipientHint } from '../with-party/team/managed-passphrase.js';
+import type { SealingKeyProvider, RecipientHint } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
 import type { CoordinationProvider } from '../port/by/types.js';
@@ -755,7 +755,7 @@ export type VaultPolicyOnDisk = Record<string, unknown>;
  * - `paper` — `on-recovery` codes (the standard end-to-end profile).
  * - `shamir` / `multi-channel` / `admin-mediated` — API surface ships;
  *   per-profile dispatch lands in follow-up issues. Calling
- *   `db.recoverPassphrase` against these throws
+ *   `db.recoverSecret` against these throws
  *   {@link RecoveryProfileNotImplementedError}.
  */
 export type RecoveryEnrollment = {
@@ -837,7 +837,7 @@ export interface KeyringAuthenticatorWrappingKEK extends KeyringAuthenticatorBas
  *
  * Trade-off: a slot of this kind reconstructs `UnlockedKeyring` with
  * `kek: null` after unlock. That is semantically correct for tier-2
- * (sensitive ops like `enrollAuthenticator` / `rotatePassphrase`
+ * (sensitive ops like `enrollAuthenticator` / `rotateSecret`
  * require a tier-1 unlock anyway) and matches how `@noy-db/on-pin`
  * already behaves at tier 3.
  *
@@ -877,12 +877,12 @@ export interface KeyringFile {
     readonly created_at: string;
     readonly granted_by: string;
     /**
-     * Passphrase canary — base64 AES-KW-wrapped form of a known constant
+     * Secret canary — base64 AES-KW-wrapped form of a known constant
      * 256-bit value, wrapped under the keyring's KEK.
      *
      * Optional: older keyrings load with no canary and fall back to
      * the multi-DEK corruption heuristic. Newer keyrings
-     * carry one and let `loadKeyring` distinguish wrong-passphrase
+     * carry one and let `loadKeyring` distinguish wrong-secret
      * from corruption even when ALL DEKs (including a single-DEK keyring's
      * sole DEK) are corrupted.
      *
@@ -1395,7 +1395,7 @@ export interface GrantOptions {
     readonly userId: string;
     readonly displayName: string;
     readonly role: Role;
-    readonly passphrase: string;
+    readonly secret: string;
     readonly permissions?: Permissions;
     /**
      * Optional `@noy-db/as-*` export capability. Omit or
@@ -1412,9 +1412,9 @@ export interface GrantOptions {
     /**
      * Skip phrase-format strength validation (issue #7). Defaults to
      * false — `grant()` rejects phrases that don't meet the configured
-     * `PassphrasePolicy`. Test fixtures and CLI scripts pass `true`.
+     * `SecretPolicy`. Test fixtures and CLI scripts pass `true`.
      */
-    readonly allowWeakPassphrase?: boolean;
+    readonly allowWeakSecret?: boolean;
     /**
      * Initial user-envelope payload for the new principal. Sealed under
      * the same vault DEK (the reserved `_users` collection's DEK) and
@@ -1612,7 +1612,7 @@ export interface SessionPolicy {
     readonly absoluteTimeoutMs?: number;
     /**
      * Operations that require the user to re-authenticate (re-enter their
-     * passphrase or perform a fresh WebAuthn assertion) before proceeding,
+     * secret or perform a fresh WebAuthn assertion) before proceeding,
      * even if the session is still alive.
      *
      * Common pattern: `requireReAuthFor: ['export', 'grant']` — allow
@@ -2200,16 +2200,16 @@ export interface NoydbOptions {
     readonly indexStrategy?: IndexStrategy;
     /**
      * tree-shake seam — optional aggregate strategy. Pass
-     * `withAggregate()` from `@noy-db/hub/aggregate` to enable
+     * `withReduce()` from `@noy-db/hub/reduce` to enable
      * `.aggregate()` and `.groupBy()` on Query. When omitted, those
      * methods throw with a pointer at the subpath; the ~886 LOC of
-     * Aggregation + GroupedQuery machinery never reaches the bundle.
+     * Reduction + GroupedQuery machinery never reaches the bundle.
      * Streaming `scan().aggregate()` works independently of this
-     * strategy — it doesn't use the `Aggregation` class.
+     * strategy — it doesn't use the `Reduction` class.
      *
      * @internal
      */
-    readonly aggregateStrategy?: AggregateStrategy;
+    readonly reduceStrategy?: ReduceStrategy;
     /**
      * tree-shake seam — optional CRDT strategy. Required when
      * any collection is declared with `crdt: 'lww-map' | 'rga' | 'yjs'`;
@@ -2400,7 +2400,7 @@ export interface NoydbOptions {
      * throw `TeamNotEnabledError` and the keyring grant/revoke/rotate engines
      * are reached only via opt-in — the always-on floor is single-user.
      * Single-user primitives (owner keyring, unlock, `listUsers`,
-     * `updateUser`, passphrase rotate/recover) stay ungated, as does the
+     * `updateUser`, secret rotate/recover) stay ungated, as does the
      * `createDeedOwner` free function (no createNoydb instance to gate
      * against).
      */
@@ -2484,12 +2484,12 @@ export interface NoydbOptions {
     readonly sync?: NoydbStore | SyncTarget | SyncTarget[];
     /** User identifier. */
     readonly user: string;
-    /** Passphrase for key derivation. Required unless encrypt is false or `getKeyring` is provided. */
+    /** Secret for key derivation. Required unless encrypt is false or `getKeyring` is provided. */
     readonly secret?: string;
     /**
      * Optional callback that returns an unlocked keyring for a given vault.
      * Use this to plug in WebAuthn / OIDC / Shamir / any unlock path that
-     * produces an `UnlockedKeyring` outside the passphrase model.
+     * produces an `UnlockedKeyring` outside the secret model.
      *
      * When set, `secret` MUST NOT also be set — `createNoydb` throws if both
      * are supplied. When neither is set (and `encrypt !== false`), `createNoydb`
@@ -2517,32 +2517,32 @@ export interface NoydbOptions {
      * ```
      *
      * Note: this callback is responsible for both the "open existing vault"
-     * and the "create new vault" cases. Unlike the passphrase path, there is
+     * and the "create new vault" cases. Unlike the secret path, there is
      * no automatic `NoAccessError` → `createOwnerKeyring` fallback, because
      * the callback owner has the UI context to decide which path to run.
-     * For first-time bootstrap, use a passphrase or recovery code, enroll
+     * For first-time bootstrap, use a secret or recovery code, enroll
      * WebAuthn from the unlocked keyring, then swap to `getKeyring` on
      * subsequent sessions.
      */
     readonly getKeyring?: (vault: string) => Promise<UnlockedKeyring>;
     /**
-     * Passphrase mode. Default `'standard'`.
+     * Secret mode. Default `'standard'`.
      *
      *   - `'standard'` — the legacy flow. `secret` supplies the
-     *     plaintext passphrase, the user knows it, and the policy gate
-     *     `rotate-passphrase` is enabled.
+     *     plaintext secret, the user knows it, and the policy gate
+     *     `rotate-secret` is enabled.
      *   - `'managed'` — rubber-hose-resistant mode. Hub generates a
-     *     256-bit random passphrase at first open and seals it under
+     *     256-bit random secret at first open and seals it under
      *     the provided `sealingKey`. The user never sees or types the
-     *     passphrase, defeating the $5-wrench attack. Mutually
+     *     secret, defeating the $5-wrench attack. Mutually
      *     exclusive with `secret` and `getKeyring`.
      *
-     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-passphrase mode
+     * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Managed-secret mode
      */
-    readonly passphraseMode?: 'standard' | 'managed';
+    readonly secretMode?: 'standard' | 'managed';
     /**
      * Provider that seals/unseals the auto-generated managed-mode
-     * passphrase. Required when `passphraseMode === 'managed'`; ignored
+     * secret. Required when `secretMode === 'managed'`; ignored
      * otherwise. Implementations live in per-platform packages
      * (`@noy-db/seal-macos-keychain`, `@noy-db/seal-wincred`,
      * `@noy-db/seal-libsecret`, `@noy-db/seal-aws-kms`, …).
@@ -2591,17 +2591,17 @@ export interface NoydbOptions {
      */
     readonly sessionPolicy?: SessionPolicy;
     /**
-     * Validate passphrase strength against the phrase format
+     * Validate secret strength against the phrase format
      * on first-time keyring creation. When
-     * `true`, weak phrases throw {@link WeakPassphraseError} from
-     * `createNoydb()` / `db.rotatePassphrase()`. Default: `false` for
+     * `true`, weak phrases throw {@link WeakSecretError} from
+     * `createNoydb()` / `db.team.rotateSecret()`. Default: `false` for
      * back-compat; planned to flip to `true` in a future major release.
      */
-    readonly validatePassphrase?: boolean;
+    readonly validateSecret?: boolean;
     /**
      * Vault-level policy gate document. When present, the hub
      * persists the merged policy at `_meta/policy` on first-time vault
-     * creation and gates sensitive operations (`db.rotatePassphrase`,
+     * creation and gates sensitive operations (`db.rotateSecret`,
      * `db.export*`, …) against it. Omitted ⇒ the engine uses
      * {@link PERSONAL_POLICY}. Use {@link STRICT_POLICY} for regulated
      * deployments.
@@ -2616,11 +2616,11 @@ export interface NoydbOptions {
     readonly policy?: VaultPolicy;
     /**
      * Mandatory recovery profile enrollment. Vaults with
-     * `recover-passphrase` enabled MUST register at least one profile
+     * `recover-secret` enabled MUST register at least one profile
      * before being production-ready, otherwise `createNoydb()` throws
      * {@link RecoveryNotEnrolledError}. Set
-     * `policy.gates['recover-passphrase'].enabled = false` to
-     * deliberately opt out of recovery (passphrase loss = data loss).
+     * `policy.gates['recover-secret'].enabled = false` to
+     * deliberately opt out of recovery (secret loss = data loss).
      *
      * The `'paper'` profile is supported end-to-end. Other
      * profiles ship the API shape and throw
@@ -2647,7 +2647,7 @@ export interface NoydbOptions {
      *   data records but not the keyring row, or a WebAuthn credential was rotated).
      *   **All previously encrypted data is unrecoverable after a reset.**
      *
-     * Only applies to the passphrase (`secret`) path. When `getKeyring` is used,
+     * Only applies to the secret (`secret`) path. When `getKeyring` is used,
      * the callback is responsible for handling stale-keyring detection itself.
      */
     readonly onInvalidKey?: 'error' | 'reset';
@@ -3037,7 +3037,7 @@ export interface WarningRules {
 }
 /**
  * Policy applied to one named gate. `enabled: false` disables the
- * action entirely (useful in managed-passphrase mode where rotation is
+ * action entirely (useful in managed-secret mode where rotation is
  * impossible by construction).
  */
 export interface GatePolicy {
@@ -3053,11 +3053,11 @@ export interface GatePolicy {
  * and use the same engine; the engine treats unknown names with no
  * configured policy as "no gate" (no-op).
  */
-export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enroll-authenticator' | 'remove-authenticator'
+export type BuiltInGateName = 'rotate-secret' | 'recover-secret' | 'enroll-authenticator' | 'remove-authenticator'
 /**
  * Authorize a deliberate paper-recovery-code regeneration —
- * `db.rotateRecovery`. Symmetric to `rotate-passphrase` for
- * the case where the user remembers their passphrase but wants a
+ * `db.rotateRecovery`. Symmetric to `rotate-secret` for
+ * the case where the user remembers their secret but wants a
  * fresh sheet (lost the printout, suspect compromise of the off-site
  * copy). PERSONAL allows tier-1; STRICT requires an off-device
  * factor so a stolen unlocked laptop cannot silently mint a new
@@ -3080,7 +3080,7 @@ export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enro
 /**
  * Authorize an atomic peer-recovery — `db.recoverUser`.
  * Distinct from `revoke-user` because peer-recovery is intentional
- * re-issuance of someone's keyring under a temp passphrase, NOT
+ * re-issuance of someone's keyring under a temp secret, NOT
  * removal. Allows owner→owner natively (matches the threat model:
  * a co-owner explicitly recovering another co-owner). Ships with a
  * factor-proof default in `STRICT_POLICY` so the issuer must
@@ -3139,12 +3139,12 @@ export type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enro
 export type GateName = BuiltInGateName | `app:${string}`;
 /**
  * Top-level policy object. Persisted at `_meta/policy` once at vault
- * creation. The `passphrase` block configures the strength rules
- * applied at every passphrase ingress; `gates` configures
+ * creation. The `secret` block configures the strength rules
+ * applied at every secret ingress; `gates` configures
  * the action-level requirements.
  */
 export interface VaultPolicy {
-    readonly passphrase?: PassphrasePolicy;
+    readonly secret?: SecretPolicy;
     readonly gates: Partial<Record<GateName, GatePolicy>>;
 }
 /** Concrete proof an actor presents to {@link checkGate}. */
@@ -3160,7 +3160,7 @@ export interface FactorProof {
  * Noydb method. Used as the optional last parameter of every method
  * that runs through `checkGate`: `db.grant`, `db.revoke`, `db.updateUser`,
  * `db.enrollAuthenticator`, `db.removeAuthenticator`, `db.updateAuthenticator`,
- * `db.enrollWebAuthn`, `db.rotatePassphrase`, `db.recoverPassphrase`,
+ * `db.enrollWebAuthn`, `db.rotateSecret`, `db.recoverSecret`,
  * `db.recoverUser`, `db.enrollUnlock`, `db.describeUserAuth`,
  * `db.describeAllUsersAuth`.
  *
@@ -3286,4 +3286,45 @@ export interface NoydbPolicyDeps {
  * synchronously — mirrors {@link UserApiFactory}.
  */
 export type NoydbPolicyFactory = (deps: NoydbPolicyDeps) => NoydbPolicyApi;
+/**
+ * Named field-set declarations for a collection's type-level shape (#839).
+ *
+ * Replaces the positional `Collection<T, S, Q, M>` tail at every surface a
+ * consumer touches. The positional form was unreadable and unsafe: `Q` and `M`
+ * are both `keyof T & string`, so swapping them type-checked silently, and
+ * reaching `M` meant writing placeholders —
+ * `collection<Sale, never, never, 'amount' | 'tax'>`.
+ *
+ * ```ts
+ * vault.collection<Sale, { money: 'amount' | 'tax' }>('sales')
+ * vault.collection<Invoice, { sensitive: 'ssn'; indexed: 'clientId' }>('invoices')
+ * ```
+ *
+ * Every member is optional; omitting one keeps that axis permissive, which is
+ * what the `[X] extends [never]` guards in {@link QueryField} /
+ * {@link IndexFieldName} encode. Those guards are NOT removable — they are the
+ * difference between "no indexes declared, so `where()` accepts any field" and
+ * "indexes declared, so `where()` is restricted to them" — so they are
+ * re-expressed against this shape rather than dropped.
+ */
+export interface CollectionShape<T> {
+    /** Fields sealed at rest; reads return {@link Sealed} handles. */
+    readonly sensitive?: keyof T & string;
+    /** Fields carrying a declared secondary index; narrows `where()` / `orderBy()`. */
+    readonly indexed?: keyof T & string;
+    /** Fields carrying a money descriptor. */
+    readonly money?: keyof T & string;
+}
+/** The `sensitive` field set of a {@link CollectionShape}, or `never` if unset. */
+export type SensitiveOf<T, O> = O extends {
+    sensitive: infer S;
+} ? (S & keyof T & string) : never;
+/** The `indexed` field set of a {@link CollectionShape}, or `never` if unset. */
+export type IndexedOf<T, O> = O extends {
+    indexed: infer Q;
+} ? (Q & keyof T & string) : never;
+/** The `money` field set of a {@link CollectionShape}, or `never` if unset. */
+export type MoneyOf<T, O> = O extends {
+    money: infer M;
+} ? (M & keyof T & string) : never;
 export {};

package/dist/kernel/validation.d.ts

@@ -1,8 +1,8 @@
 /**
- * Passphrase validation — phrase format (per the three-tier session-tiers
+ * Secret validation — phrase format (per the three-tier session-tiers
  * design, locked 2026-05-04).
  *
- * Passphrases are **phrases**: multiple simple words, easy to remember,
+ * Secrets are **phrases**: multiple simple words, easy to remember,
  * structurally constrained so a weak choice cannot silently collapse the
  * security floor. The format is intentionally narrow: lowercase letters
  * and single spaces only, no punctuation, no symbols, no digits.
@@ -12,17 +12,17 @@
  * - Per-word minimum: 3 characters (excludes "a", "is", "of").
  * - Adjacent repeats rejected ("the the").
  *
- * The hub runs validation default-on at every passphrase ingress
- * (`createOwnerKeyring`, `grant`, `rotatePassphrase`); test fixtures and
- * CLI scripts override via `{ allowWeakPassphrase: true }`.
+ * The hub runs validation default-on at every secret ingress
+ * (`createOwnerKeyring`, `grant`, `rotateSecret`); test fixtures and
+ * CLI scripts override via `{ allowWeakSecret: true }`.
  *
  * @module
  */
 import { NoydbError } from './errors.js';
 /** All reasons a phrase can be rejected. */
-export type WeakPassphraseReason = 'empty' | 'invalid-chars' | 'leading-or-trailing-space' | 'double-space' | 'too-few-words' | 'word-too-short' | 'repeated-adjacent';
-/** Per-vault knobs. Aligns with `VaultPolicy.passphrase`. */
-export interface PassphrasePolicy {
+export type WeakSecretReason = 'empty' | 'invalid-chars' | 'leading-or-trailing-space' | 'double-space' | 'too-few-words' | 'word-too-short' | 'repeated-adjacent';
+/** Per-vault knobs. Aligns with `VaultPolicy.secret`. */
+export interface SecretPolicy {
     /** Minimum number of words. Default 6. Strict policy uses 8. */
     readonly minWords?: number;
     /** Minimum characters per word. Default 3. */
@@ -42,7 +42,7 @@ export interface PassphrasePolicy {
      * // Thai + English mix with digits permitted
      * pattern: /^[\p{L}0-9 ]+( [\p{L}0-9 ]+)*$/u
      *
-     * // Allow uppercase + hyphens (passphrase-with-hyphens style)
+     * // Allow uppercase + hyphens (secret-with-hyphens style)
      * pattern: /^[A-Za-z]+([- ][A-Za-z]+)*$/
      * ```
      *
@@ -55,7 +55,7 @@ export interface PassphrasePolicy {
     readonly pattern?: RegExp;
     /**
      * Replace ALL validation entirely with a custom function. When set,
-     * none of the other PassphrasePolicy fields apply — the consumer
+     * none of the other SecretPolicy fields apply — the consumer
      * owns every rule (word splitting, character classes, entropy
      * thresholds, allowlist/denylist). Use sparingly; this is the
      * escape hatch for domain-specific phrase formats:
@@ -64,50 +64,50 @@ export interface PassphrasePolicy {
      *   - BIP-39 seed phrases (24 words, fixed wordlist, etc.)
      *   - Organization-specific HR password policies
      *
-     * The returned `PassphraseValidationResult` is what
-     * {@link assertStrongPassphrase} dispatches on — `ok: true` accepts;
-     * `ok: false` throws `WeakPassphraseError` with the supplied reason.
+     * The returned `SecretValidationResult` is what
+     * {@link assertStrongSecret} dispatches on — `ok: true` accepts;
+     * `ok: false` throws `WeakSecretError` with the supplied reason.
      *
      */
-    readonly customValidator?: (phrase: string) => PassphraseValidationResult;
+    readonly customValidator?: (phrase: string) => SecretValidationResult;
 }
 /** Result of a check. Discriminated union — compile-time exhaustive. */
-export type PassphraseValidationResult = {
+export type SecretValidationResult = {
     readonly ok: true;
     readonly words: number;
 } | {
     readonly ok: false;
-    readonly reason: WeakPassphraseReason;
+    readonly reason: WeakSecretReason;
     readonly minimum?: number;
     readonly got?: number;
 };
 /**
- * Thrown by `assertStrongPassphrase()` and by every hub ingress
- * point (`createOwnerKeyring`, `grant`, `rotatePassphrase`) when a
+ * Thrown by `assertStrongSecret()` and by every hub ingress
+ * point (`createOwnerKeyring`, `grant`, `rotateSecret`) when a
  * supplied phrase fails the structural rules above.
  */
-export declare class WeakPassphraseError extends NoydbError {
-    readonly reason: WeakPassphraseReason;
+export declare class WeakSecretError extends NoydbError {
+    readonly reason: WeakSecretReason;
     readonly suggestion: string;
-    constructor(reason: WeakPassphraseReason, suggestion: string);
+    constructor(reason: WeakSecretReason, suggestion: string);
 }
 /**
  * Inspect a phrase against the format rules and return a structured
  * verdict. Never throws — callers either branch on `ok` or pass the
- * result to {@link assertStrongPassphrase} for the throwing flavour.
+ * result to {@link assertStrongSecret} for the throwing flavour.
  */
-export declare function validatePassphrase(s: string, opts?: PassphrasePolicy): PassphraseValidationResult;
+export declare function validateSecret(s: string, opts?: SecretPolicy): SecretValidationResult;
 /**
- * Throw {@link WeakPassphraseError} when the phrase fails. Used by
- * `createOwnerKeyring`, `grant`, and `rotatePassphrase` at ingress.
+ * Throw {@link WeakSecretError} when the phrase fails. Used by
+ * `createOwnerKeyring`, `grant`, and `rotateSecret` at ingress.
  *
- * Pass `{ allowWeakPassphrase: true }` to bypass — intended for test
+ * Pass `{ allowWeakSecret: true }` to bypass — intended for test
  * fixtures, CLI scripts, and dev environments. The override never
  * loosens the cryptographic key derivation; it only relaxes the
  * structural-strength gate.
  */
-export declare function assertStrongPassphrase(s: string, opts?: PassphrasePolicy & {
-    allowWeakPassphrase?: boolean;
+export declare function assertStrongSecret(s: string, opts?: SecretPolicy & {
+    allowWeakSecret?: boolean;
 }): void;
 /**
  * Estimate the entropy of a phrase, given the EFF 7,776-word list as
@@ -117,14 +117,14 @@ export declare function assertStrongPassphrase(s: string, opts?: PassphrasePolic
  * estimates aren't comparable to phrase entropy, and surfacing 0 makes
  * weak inputs visible in any UI that displays an entropy meter.
  */
-export declare function estimateEntropy(passphrase: string): number;
+export declare function estimateEntropy(secret: string): number;
 /**
  * Internal compatibility shim. Older code paths used the throwing
- * `validatePassphrase(s)` directly; some still do via re-exports. Routes
- * to the new `assertStrongPassphrase` so the contract holds for both
+ * `validateSecret(s)` directly; some still do via re-exports. Routes
+ * to the new `assertStrongSecret` so the contract holds for both
  * shapes during the transition. New code should call
- * {@link assertStrongPassphrase} directly.
+ * {@link assertStrongSecret} directly.
  *
  * @internal
  */
-export declare function legacyAssertPassphrase(s: string): void;
+export declare function legacyAssertSecret(s: string): void;