@noy-db/hub 0.4.0-pre.4 → 0.4.0-pre.6

package/dist/with-party/team/noydb-facade.d.ts

@@ -2,9 +2,9 @@
  * Noydb-side auth / recovery / enrollment facade.
  *
  * Holds the tier-2 authenticator enrollment/unlock wrappers, WebAuthn
- * enrollment, auth-config introspection, the tier-1 passphrase
+ * enrollment, auth-config introspection, the tier-1 secret
  * rotate/recover flows, the paper/Shamir recovery rotate/enroll flows,
- * managed-passphrase recovery, peer-recovery, tier-3 PIN unlock, and the
+ * managed-secret recovery, peer-recovery, tier-3 PIN unlock, and the
  * public `getKeyring` accessor.
  *
  * The near-parallel rotate/recover variants (managed vs user vs paper vs
@@ -16,17 +16,18 @@
  * (`assertRecoveryEnrolled`), `openVault`, and the one-shot
  * managed-recovery skip flag stay kernel-resident and arrive as callbacks.
  *
- * Internal service — reached through `noydb.rotatePassphrase(...)` etc.
+ * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
-import { type RotatePassphraseInput, type RecoverPassphraseInput, type RecoverPassphraseResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
+import type { RotateResult } from './keyring.js';
+import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
 import type { Vault } from '../../kernel/vault.js';
 import type { UnlockedKeyring } from './keyring.js';
 import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from './authenticators.js';
 import type { QuickUnlockStore, QuickUnlockState } from '../session/unlock-state.js';
-import type { PassphrasePolicy } from '../../kernel/validation.js';
+import type { SecretPolicy } from '../../kernel/validation.js';
 import type { ActiveTier, FactorProofBundle, GateName, GrantOptions, ReAuthOperation, RevokeOptions, VaultPolicy } from '../../kernel/types.js';
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
 type ResolvedNoydbOptions = NoydbOptions & {
@@ -34,7 +35,7 @@ type ResolvedNoydbOptions = NoydbOptions & {
 };
 /** Everything the moving auth/recovery/enrollment methods touched on the Noydb instance's `this.*`. */
 export interface TeamFacadeDeps {
-    /** Resolved Noydb options (store, user, passphraseMode, sealingKey, shamirRecovery, …). */
+    /** Resolved Noydb options (store, user, secretMode, sealingKey, shamirRecovery, …). */
     readonly options: ResolvedNoydbOptions;
     /** Live unlocked-keyring cache (Noydb-resident; read/written by reference). */
     readonly keyringCache: Map<string, UnlockedKeyring>;
@@ -72,7 +73,7 @@ export declare class TeamFacade {
     /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
     runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
-    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<void>, vault: string, collections: string[]): Promise<void>;
+    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
     /**
      * Add a tier-2 authenticator slot to the calling user's keyring.
      * Each slot independently wraps the SAME KEK under a method-specific
@@ -143,7 +144,7 @@ export declare class TeamFacade {
      * ```ts
      * import { enrollWebAuthn } from '@noy-db/on-webauthn'
      *
-     * await db.enrollWebAuthn('demo', async (keyring) => {
+     * await db.team.enrollWebAuthn('demo', async (keyring) => {
      *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
      *   return {
      *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
@@ -207,38 +208,38 @@ export declare class TeamFacade {
         description: string;
     }>>;
     /**
-     * Rotate the user's passphrase (user remembers old). Validates the
-     * new phrase against the configured `passphrase` policy, runs the
-     * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+     * Rotate the user's secret (user remembers old). Validates the
+     * new phrase against the configured `secret` policy, runs the
+     * `rotate-secret` gate, then re-derives + re-wraps every DEK.
      *
      * Tier-2 authenticator slots are dropped — each slot wraps the old
      * KEK and would need its derivation key to be re-presented. Re-enrol
      * via `db.enrollAuthenticator` after rotation.
      *
-     * @throws `WeakPassphraseError` on a weak new phrase.
+     * @throws `WeakSecretError` on a weak new phrase.
      * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
-     * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+     * @throws `InvalidKeyError` when `oldSecret` is wrong.
      */
-    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
+    rotateSecret(vault: string, input: RotateSecretInput, factors?: FactorProofBundle): Promise<void>;
     /**
-     * Reset the passphrase using a recovery proof (user forgot the old).
+     * Reset the secret using a recovery proof (user forgot the old).
      * Currently supports the `'paper'` profile end-to-end; the
      * other profiles throw {@link RecoveryProfileNotImplementedError}.
      *
      * Burns the used recovery entry on success.
      */
-    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
+    recoverSecret(vault: string, input: RecoverSecretInput, factors?: FactorProofBundle): Promise<RecoverSecretResult>;
     /**
      * Deliberate paper-recovery-code regeneration. User knows their
-     * passphrase but wants a fresh sheet — they lost the printout or
+     * secret but wants a fresh sheet — they lost the printout or
      * suspect compromise of the off-site copy.
      *
-     * Symmetric to {@link rotatePassphrase} for the recovery profile:
+     * Symmetric to {@link rotateSecret} for the recovery profile:
      * gated, audit-trackable, ergonomic. Replaces (not appends) the
      * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
      *
      * Gated by the `rotate-recovery` policy gate:
-     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the secret
      *     suffices, matching the lower-level flow's bar.
      *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
      *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
@@ -258,13 +259,13 @@ export declare class TeamFacade {
      *
      * @example Default count + show-once UI
      * ```ts
-     * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+     * const { newCodes } = await db.team.rotateRecovery('acme', { profile: 'paper' })
      * showCodesToUser(newCodes)
      * ```
      *
      * @example STRICT-policy site with TOTP factor proof
      * ```ts
-     * await db.rotateRecovery(
+     * await db.team.rotateRecovery(
      *   'acme',
      *   { profile: 'paper', count: 10 },
      *   { factors: [{ kind: 'totp', proof: '123456' }] },
@@ -278,7 +279,7 @@ export declare class TeamFacade {
      * **Atomic create-and-enroll for managed-mode vaults.**
      *
      * Bootstraps a managed-mode vault and enrolls strong recovery in
-     * a single ceremony. Under `passphraseMode: 'managed'`, every
+     * a single ceremony. Under `secretMode: 'managed'`, every
      * `openVault` call requires a strong recovery profile (Shamir
      * today) to be enrolled — otherwise it throws
      * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
@@ -297,11 +298,11 @@ export declare class TeamFacade {
      * ```ts
      * const db = await createNoydb({
      *   store, user: 'alice',
-     *   passphraseMode: 'managed',
+     *   secretMode: 'managed',
      *   sealingKey: macosKeychainSealingProvider({ ... }),
      * })
      *
-     * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+     * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
      *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
      * })
      * for (const r of recoveryEnrollments) {
@@ -320,20 +321,20 @@ export declare class TeamFacade {
         readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
     }>;
     /**
-     * **Recovery flow under managed-passphrase mode.**
+     * **Recovery flow under managed-secret mode.**
      *
-     * Replaces the sealed passphrase of a managed-mode vault with a
+     * Replaces the sealed secret of a managed-mode vault with a
      * fresh 256-bit random, sealed under the configured
-     * `SealingKeyProvider`. The user never sees the new passphrase.
+     * `SealingKeyProvider`. The user never sees the new secret.
      *
      * Internally:
      *   1. Verify the recovery proof (Shamir today) and unwrap the
      *      DEK set.
-     *   2. Mint a fresh 256-bit random as the new effective passphrase.
+     *   2. Mint a fresh 256-bit random as the new effective secret.
      *   3. Rewrap the DEK set under a fresh KEK derived from the new
-     *      passphrase (via the existing `recoverPassphrase` path).
+     *      secret (via the existing `recoverSecret` path).
      *   4. Seal the random bytes under the provider and overwrite
-     *      `_meta/sealed-passphrase`.
+     *      `_meta/sealed-secret`.
      *   5. Drop the keyring cache so the next operation re-derives.
      *
      * The vault's strong-recovery enrollment is preserved across
@@ -341,13 +342,13 @@ export declare class TeamFacade {
      *
      * @throws ValidationError if the Noydb instance is not in managed mode.
      */
-    recoverManagedPassphrase(vault: string, options: {
+    recoverManagedSecret(vault: string, options: {
         readonly recoveryProof: RecoveryProof;
-        readonly passphrasePolicy?: PassphrasePolicy;
+        readonly secretPolicy?: SecretPolicy;
     }): Promise<void>;
     /**
      * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
-     * a fresh temp passphrase in a single store write. Closes the
+     * a fresh temp secret in a single store write. Closes the
      * partial-failure window (the previous compose-from-primitives
      * pattern was `db.revoke + db.grant`, two writes — if the issuer
      * cancelled between them the target was locked out entirely).
@@ -366,17 +367,17 @@ export declare class TeamFacade {
      * recovery / TOTP / email-OTP factor proof at the moment of
      * recovery, so the issuer affirmatively re-asserts identity.
      *
-     * The recipient should call `db.rotatePassphrase` on first session
+     * The recipient should call `db.rotateSecret` on first session
      * to choose their own phrase — the temp acts as a single-use
      * bridge.
      *
      * ```ts
-     * await db.recoverUser('acme', {
+     * await db.team.recoverUser('acme', {
      *   userId: 'bob',
-     *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+     *   secret: 'temporary-correct-horse-battery-staple-printer',
      * }, { factors: [{ kind: 'recovery' }] })
      * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
-     * // and immediately calls db.rotatePassphrase to set his own.
+     * // and immediately calls db.rotateSecret to set his own.
      * ```
      *
      * @throws `NoAccessError` when no keyring exists for the target.
@@ -395,17 +396,17 @@ export declare class TeamFacade {
      * The hub wraps the user's DEK set (not the KEK) under a code-derived
      * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
      * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
-     * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+     * pair it with `db.team.getKeyring(vault)` to obtain the live DEK set:
      *
      * ```ts
      * import { mintPaperRecoveryEntry } from '@noy-db/hub'
      *
-     * const keyring = await db.getKeyring('acme')
+     * const keyring = await db.team.getKeyring('acme')
      * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
      * const entries = await Promise.all(
      *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
      * )
-     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
      * showCodesToUser(codes)
      * ```
      *
@@ -416,7 +417,7 @@ export declare class TeamFacade {
      * ```ts
      * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
      * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
-     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * await db.team.enrollRecovery('acme', { profile: 'paper', entries })
      * ```
      */
     enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
@@ -473,7 +474,7 @@ export declare class TeamFacade {
      * and no `secret` / `getKeyring` is configured.
      *
      * ```ts
-     * const keyring = await db.getKeyring('acme')
+     * const keyring = await db.team.getKeyring('acme')
      * // keyring.deks: Map<collection, CryptoKey>
      * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
      * // keyring.role / .permissions / .authenticators

package/dist/with-party/team/peer-recover.d.ts

@@ -22,7 +22,7 @@
  *      gate `peer-recover-user` carries the freshness requirement.
  *   5. **Tier-2 slots dropped.** The slots wrap the OLD KEK under
  *      method-derived keys; after recovery the KEK is re-derived
- *      from the new temp passphrase. Match `rotatePassphrase`'s
+ *      from the new temp secret. Match `rotateSecret`'s
  *      precedent — the recovered user re-enrols slots after picking
  *      their own phrase.
  *
@@ -34,47 +34,47 @@
  * @module
  */
 import type { NoydbStore, Role } from '../../kernel/types.js';
-import { type PassphrasePolicy } from '../../kernel/validation.js';
+import { type SecretPolicy } from '../../kernel/validation.js';
 import type { UnlockedKeyring } from './keyring.js';
 /** Input shape for {@link recoverUser}. */
 export interface RecoverUserOptions {
     /** Target user id whose keyring is being recovered. */
     readonly userId: string;
     /**
-     * Temporary passphrase under which the new keyring is wrapped.
-     * The recipient should call `db.rotatePassphrase` immediately on
+     * Temporary secret under which the new keyring is wrapped.
+     * The recipient should call `db.rotateSecret` immediately on
      * acceptance to choose their own phrase — this temp acts as a
      * single-use bridge in invite / peer-recovery flows.
      */
-    readonly passphrase: string;
+    readonly secret: string;
     /** Override the target's role. Defaults to the existing target's role. */
     readonly role?: Role;
     /** Override the target's display name. Defaults to existing. */
     readonly displayName?: string;
     /** Validate phrase strength against the configured policy. */
-    readonly validatePassphrase?: boolean;
+    readonly validateSecret?: boolean;
     /**
-     * Skip phrase strength validation even when `validatePassphrase` is
+     * Skip phrase strength validation even when `validateSecret` is
      * set. The escape hatch matches `grant`'s shape — used when the
      * temp phrase is a high-entropy one-shot string that doesn't need
      * to satisfy the human-typeable rules.
      */
-    readonly allowWeakPassphrase?: boolean;
+    readonly allowWeakSecret?: boolean;
     /**
      * Optional explicit phrase policy override (passed through to
-     * `assertStrongPassphrase`). Mirrors how `grant` accepts a custom
-     * `PassphrasePolicy` for app-specific tightening.
+     * `assertStrongSecret`). Mirrors how `grant` accepts a custom
+     * `SecretPolicy` for app-specific tightening.
      */
-    readonly passphrasePolicy?: PassphrasePolicy;
+    readonly secretPolicy?: SecretPolicy;
 }
 /**
  * Atomically rewrap the target user's keyring under a fresh temp
- * passphrase. Single store write; no revoke step; no key rotation.
+ * secret. Single store write; no revoke step; no key rotation.
  *
  * Caller's responsibilities (NOT enforced here):
  *   - Run the `peer-recover-user` policy gate first via
  *     `Noydb.checkGate` to enforce the freshness factor proof.
- *   - Communicate the temp passphrase to the recipient via a secure
+ *   - Communicate the temp secret to the recipient via a secure
  *     channel (URL fragment, in-person, etc.) — the hub does not
  *     transport secrets.
  */

package/dist/with-party/team/recovery.d.ts

@@ -34,7 +34,7 @@ import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
  * we wrap a serialized DEK set: the entry holds the AES-GCM
  * ciphertext of `{ deks: { collection: rawDekBase64 } }`. Recovery
  * deserializes the DEK set, then mints a fresh KEK from the new
- * passphrase and rewraps the DEKs under it.
+ * secret and rewraps the DEKs under it.
  *
  * This is the same pattern `@noy-db/on-pin` uses for tier-3 quick
  * resume — the cryptographic guarantee is identical (AES-GCM with a
@@ -67,8 +67,8 @@ export declare function hasRecoveryEnrolled(store: NoydbStore, vault: string): P
 /**
  * Whether at least one **strong** recovery profile is enrolled.
  *
- * "Strong" excludes paper-alone — under managed-passphrase mode the
- * user has no memorized passphrase, so a stolen/lost paper sheet
+ * "Strong" excludes paper-alone — under managed-secret mode the
+ * user has no memorized secret, so a stolen/lost paper sheet
  * would be a single point of total loss. Strong profiles today:
  *
  *   - `shamir` (k-of-n threshold; survives loss of up to n-k shares)
@@ -167,7 +167,7 @@ export declare function unwrapDeksFromShamirEntry(provider: ShamirRecoveryProvid
  *
  * Returns the serializable entry (persisted via
  * {@link savePaperRecoveryEntries}). The recovery flow unwraps the
- * DEK set, then mints a fresh KEK from the user's new passphrase.
+ * DEK set, then mints a fresh KEK from the user's new secret.
  *
  * Thin wrapper over {@link mintWrappedDeksBlob} — the crypto
  * lives in the shared primitive; this function just adds paper-
@@ -182,7 +182,7 @@ export declare function unwrapDeksFromShamirEntry(provider: ShamirRecoveryProvid
 export declare function mintPaperRecoveryEntry(deks: Map<string, EnclaveKey>, code: string, codeId: string): Promise<PaperRecoveryEntry>;
 /**
  * Decrypt a recovery entry to recover the raw DEK set. Used by the
- * `recoverPassphrase` flow after the user's code has been parsed.
+ * `recoverSecret` flow after the user's code has been parsed.
  *
  * Thin wrapper over {@link unwrapDeksFromBlob}.
  *

package/dist/with-party/team/rotate-recover.d.ts

@@ -1,12 +1,12 @@
 /**
- * Tier-1 change flows — `rotatePassphrase` (user remembers old) and
- * `recoverPassphrase` (user supplies a recovery proof).
+ * Tier-1 change flows — `rotateSecret` (user remembers old) and
+ * `recoverSecret` (user supplies a recovery proof).
  *
  * The two flows share the post-verification half — fresh salt, fresh
  * KEK, rewrap every DEK — and differ only in how they re-derive the
  * old KEK:
  *
- * - **Rotate**: derive from the supplied `oldPassphrase`.
+ * - **Rotate**: derive from the supplied `oldSecret`.
  * - **Recover (paper)**: unwrap from a `RecoveryCodeEntry` using a
  *   user-supplied recovery code. The entry is burned on success.
  *
@@ -20,12 +20,12 @@ import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
 import { type PaperRecoveryEntry } from './recovery.js';
 import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
-import { type PassphrasePolicy } from '../../kernel/validation.js';
+import { type SecretPolicy } from '../../kernel/validation.js';
 import type { UnlockedKeyring } from './keyring.js';
 import type { KeyringAuthenticator } from '../../kernel/types.js';
 import type { EnrollAuthenticatorOptions } from './authenticators.js';
 /**
- * Context handed to a {@link SlotRewrapCeremony} when `rotatePassphrase`
+ * Context handed to a {@link SlotRewrapCeremony} when `rotateSecret`
  * preserves a tier-2 slot. The ceremony's job is to re-derive its
  * method-specific wrapping material (PRF assertion, PBKDF2 of the
  * password, etc.) and wrap the freshly rewrapped DEK set under
@@ -57,25 +57,25 @@ export interface SlotRewrapContext {
     readonly oldSlot: KeyringAuthenticator;
 }
 /**
- * Callback that re-enrolls one tier-2 slot during `rotatePassphrase`.
+ * Callback that re-enrolls one tier-2 slot during `rotateSecret`.
  * Returns the new slot's `EnrollAuthenticatorOptions` — same shape
  * the consumer would pass to `db.enrollAuthenticator` for a fresh
  * enrollment. Hub persists the result atomically with the rotation.
  */
 export type SlotRewrapCeremony = (ctx: SlotRewrapContext) => Promise<EnrollAuthenticatorOptions>;
-/** Caller payload for {@link rotatePassphrase}. */
-export interface RotatePassphraseInput {
-    readonly oldPassphrase: string;
-    readonly newPassphrase: string;
-    readonly passphrasePolicy?: PassphrasePolicy;
-    readonly allowWeakPassphrase?: boolean;
+/** Caller payload for {@link rotateSecret}. */
+export interface RotateSecretInput {
+    readonly oldSecret: string;
+    readonly newSecret: string;
+    readonly secretPolicy?: SecretPolicy;
+    readonly allowWeakSecret?: boolean;
     /**
      * Map of slot id → re-enrolment ceremony. Slots whose id appears
      * here are PRESERVED across rotation (the ceremony re-derives the
      * method-specific wrapping under the new keyring); slots whose id
      * is absent are DROPPED (the pre-slot-ceremony behavior).
      *
-     * Without this map, `rotatePassphrase` wipes every tier-2 slot. Consumers building a
+     * Without this map, `rotateSecret` wipes every tier-2 slot. Consumers building a
      * "rotate without losing my biometric" flow supply ceremonies for
      * each slot they want to keep.
      *
@@ -90,8 +90,8 @@ export interface RotatePassphraseInput {
     };
 }
 /**
- * Re-derive the user's KEK from `oldPassphrase`, rewrap every DEK
- * under a freshly-derived KEK from `newPassphrase`, and persist.
+ * Re-derive the user's KEK from `oldSecret`, rewrap every DEK
+ * under a freshly-derived KEK from `newSecret`, and persist.
  *
  * Tier-2 authenticator slots are dropped UNLESS the caller supplies
  * a `slotCeremonies` map — each ceremony re-derives its
@@ -99,14 +99,14 @@ export interface RotatePassphraseInput {
  * the rewrapped slots atomically with the rotation. Slots whose id
  * isn't in the map are still dropped.
  *
- * @throws `InvalidKeyError` if `oldPassphrase` does not unwrap the keyring.
- * @throws `WeakPassphraseError` if `newPassphrase` fails the strength rule.
+ * @throws `InvalidKeyError` if `oldSecret` does not unwrap the keyring.
+ * @throws `WeakSecretError` if `newSecret` fails the strength rule.
  * @throws `ValidationError` if a ceremony's result mismatches the
  *         slot's id or method (anti-slot-swap guard).
  */
-export declare function rotatePassphrase(store: NoydbStore, vault: string, userId: string, input: RotatePassphraseInput): Promise<UnlockedKeyring>;
+export declare function rotateSecret(store: NoydbStore, vault: string, userId: string, input: RotateSecretInput): Promise<UnlockedKeyring>;
 /**
- * Caller payload for {@link recoverPassphrase}.
+ * Caller payload for {@link recoverSecret}.
  *
  * `paper` and `shamir` are wired end-to-end.
  * The remaining two profiles (`multi-channel`, `admin-mediated`)
@@ -129,11 +129,11 @@ export type RecoveryProof = {
         readonly shares: ReadonlyArray<string>;
     };
 };
-export interface RecoverPassphraseInput {
-    readonly newPassphrase: string;
+export interface RecoverSecretInput {
+    readonly newSecret: string;
     readonly recoveryProof: RecoveryProof;
-    readonly passphrasePolicy?: PassphrasePolicy;
-    readonly allowWeakPassphrase?: boolean;
+    readonly secretPolicy?: SecretPolicy;
+    readonly allowWeakSecret?: boolean;
     /**
      * After a successful paper-recovery, replace ALL remaining recovery
      * entries with freshly-minted ones. Defaults to `true` (defensive).
@@ -177,27 +177,27 @@ export interface RecoverPassphraseInput {
     readonly codeGenerator?: () => string;
 }
 /**
- * Return shape of `db.recoverPassphrase`. `newCodes` is populated when
+ * Return shape of `db.recoverSecret`. `newCodes` is populated when
  * `rotateRemainingCodes` was enabled and at least one entry was
  * rotated; an empty array means no rotation happened (rotation
  * disabled, or no remaining codes after burn). Show the codes to the
  * user once — they are the canonical credential for future recovery
  * and CANNOT be retrieved again.
  */
-export interface RecoverPassphraseResult {
+export interface RecoverSecretResult {
     readonly newCodes: readonly string[];
 }
 /**
  * Input for {@link Noydb.rotateRecovery} — deliberate
  * recovery-credential regeneration when the user knows their
- * passphrase but wants a fresh sheet (paper) or fresh shares
- * (shamir). Symmetric to {@link RotatePassphraseInput}.
+ * secret but wants a fresh sheet (paper) or fresh shares
+ * (shamir). Symmetric to {@link RotateSecretInput}.
  */
 export type RotateRecoveryOptions = {
     readonly profile: 'paper';
     /** How many fresh codes to mint. Default: existing sheet size. */
     readonly count?: number;
-    /** Optional code generator — see {@link RecoverPassphraseInput.codeGenerator}. */
+    /** Optional code generator — see {@link RecoverSecretInput.codeGenerator}. */
     readonly codeGenerator?: () => string;
 } | {
     readonly profile: 'shamir';
@@ -265,11 +265,11 @@ export type RecoveryEnrollmentInput = {
     readonly entryId?: string;
 };
 /**
- * Reset the user's passphrase using a recovery proof.
+ * Reset the user's secret using a recovery proof.
  * Supports `'paper'` and `'shamir'` profiles. The other profiles throw
  * {@link RecoveryProfileNotImplementedError}.
  *
  * On success, the used recovery entry is burned (deleted from the
  * stored set).
  */
-export declare function recoverPassphrase(provider: ShamirRecoveryProvider | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverPassphraseInput): Promise<UnlockedKeyring>;
+export declare function recoverSecret(provider: ShamirRecoveryProvider | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverSecretInput): Promise<UnlockedKeyring>;