@noy-db/hub 0.6.0 → 0.7.0-pre.0

package/dist/via/computed/binding.d.ts

@@ -24,11 +24,11 @@
  * `EXPORT_REDACTION_MARKER` on every present() — the one enforcement seam
  * every via feature's taint already routes through.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { ComputedDescriptor } from './descriptor.js';
 export interface ComputedViaConfig {
     /** field name -> its virtual-mode descriptor. Materialized entries are never present here. */
     readonly virtualFields: ReadonlyMap<string, ComputedDescriptor>;
 }
-export declare function computedBinding(cfg: ComputedViaConfig): ViaBinding;
+export declare function computedVia(cfg: ComputedViaConfig): NoydbVia;
 export declare function linkComputedVia(): void;

package/dist/via/i18n/binding.d.ts

@@ -1,10 +1,10 @@
 /**
- * The i18n `ViaBinding` — wires the i18n engine (auto-translate/script
+ * The i18n `NoydbVia` — wires the i18n engine (auto-translate/script
  * enforcement/validation/densify on write; locale + dict-label presentation
  * on read) into the kernel's generic Via port. Mirrors
  * `via/money/binding.ts`'s #553 static-link pattern.
  *
- * LIVE (#623 Task 8 wired the cutover): `i18nBinding()`/`linkI18nVia()` are
+ * LIVE (#623 Task 8 wired the cutover): `i18nVia()`/`linkI18nVia()` are
  * the real put/read path for every i18n-declaring collection —
  * `collection.ts`'s `_putInternal`/`applyLocaleToRecord` (the call sites
  * this file's bodies were moved/adapted from) now delegate their i18n
@@ -14,7 +14,7 @@
  * `i18nText()`, `dictKey()`, `staticDict()` each call {@link linkI18nVia}
  * first — the same #553 pattern `money()` uses.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 /**
  * Config a collection's i18n declarations resolve to — the binding's
  * construction input. Fields are loosely typed (`unknown`) at this seam
@@ -32,5 +32,5 @@ export interface I18nViaConfig {
     i18nPutValidator?: (record: unknown) => void;
     collectionName: string;
 }
-export declare function i18nBinding(cfg: I18nViaConfig): ViaBinding;
+export declare function i18nVia(cfg: I18nViaConfig): NoydbVia;
 export declare function linkI18nVia(): void;

package/dist/via/lookup/binding.d.ts

@@ -1,5 +1,5 @@
 /**
- * The `'lookup'` `ViaBinding` — wires the lookup engine (present-time label
+ * The `'lookup'` `NoydbVia` — wires the lookup engine (present-time label
  * dressing across all three backing tiers) into the kernel's generic Via
  * port. Mirrors `via/i18n/binding.ts`'s #553 static-link pattern; the
  * present-time label-dressing algorithm below is adapted from
@@ -24,10 +24,10 @@
  * `hasStaticDisplay` branch already uses). `resolveOrderLabel` (#650 Task
  * 7) is the PER-CALL-locale sibling `orderBy(..., {by:'label'})` needs —
  * see its own doc comment below. `describeFragment` (#650 Task 7) is the
- * first-ever consumed `ViaBinding.describeFragment` implementation — see
+ * first-ever consumed `NoydbVia.describeFragment` implementation — see
  * `with-shape/introspection/describe.ts`'s `buildDescription`.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { LookupDescriptor, LookupBacking, Vocabulary, OnDelete } from './descriptor.js';
 import type { MaterializedBacking } from './registry.js';
 /**
@@ -66,7 +66,7 @@ export interface LookupViaConfig {
     readonly collectionName: string;
 }
 /**
- * One field's `lookup` descriptor as it appears on a `ViaBinding.
+ * One field's `lookup` descriptor as it appears on a `NoydbVia.
  * describeFragment()` payload (#650 Task 7 — the first real consumer,
  * `with-shape/introspection/describe.ts`'s `buildDescription`, imports this
  * type directly; `describe.ts` is NOT under `kernel/**`, so it's free to
@@ -95,5 +95,5 @@ export interface LookupDescribeFragmentEntry {
 export interface LookupDescribeFragment {
     readonly lookupFields: Record<string, LookupDescribeFragmentEntry>;
 }
-export declare function lookupBinding(cfg: LookupViaConfig): ViaBinding;
+export declare function lookupVia(cfg: LookupViaConfig): NoydbVia;
 export declare function linkLookupVia(): void;

package/dist/via/lookup/index.d.ts

@@ -13,5 +13,5 @@ export { LookupHandle, DictionaryHandle, DICT_COLLECTION_PREFIX, dictCollectionN
 export { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords, type DictReferencingCollection } from './registry.js';
 export { withLookup } from './active.js';
 export { lookup, enumOf, enumOf as enum, dict, type LookupDescriptor, type Vocabulary, type LookupBacking, type OnDelete } from './descriptor.js';
-export { lookupBinding, linkLookupVia, type LookupViaConfig } from './binding.js';
+export { lookupVia, linkLookupVia, type LookupViaConfig } from './binding.js';
 export type { LookupDescribeFragment, LookupDescribeFragmentEntry } from './binding.js';

package/dist/via/lookup/snapshot.d.ts

@@ -19,7 +19,7 @@
  *   - join dressing (`presentForJoin`, consumed by `kernel/query/join.ts`
  *     via `JoinableSource.presentForJoin`)
  *   - dimension sort (`compareForOrder`, consumed by
- *     `via/lookup/binding.ts`'s `ViaBinding.compareForOrder` closure)
+ *     `via/lookup/binding.ts`'s `NoydbVia.compareForOrder` closure)
  *   - per-call-locale order-label resolution (`resolveOrderLabel`, #650
  *     Task 7 — the `orderBy(..., {by:'label'})` channel `compareForOrder`
  *     structurally can't serve, no locale param; consumed by

package/dist/via/money/binding.d.ts

@@ -1,12 +1,12 @@
 /**
- * The money `ViaBinding` — wires the money engine (normalize/paths/where/
+ * The money `NoydbVia` — wires the money engine (normalize/paths/where/
  * money-reducer) into the kernel's generic Via port. `money()`
  * (descriptor.ts) calls {@link linkMoneyVia} at declaration time — the
  * same #553 static-link pattern the retired `linkMoneyEngine()` /
  * `kernel/money-runtime.ts` seam used, now the only one (Task 6 cut the
  * query DSL over to this binding and deleted the legacy seam).
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { MoneyDescriptor } from './descriptor.js';
 /** #669 — the money binder's config bag. `virtualMoneyFields` is the money∩virtual-mode-
  *  computed field-name intersection (`kernel/collection-config.ts#resolveVirtualMoneyFields`);
@@ -17,5 +17,5 @@ export interface MoneyBindingConfig {
     readonly moneyFields: Record<string, MoneyDescriptor>;
     readonly virtualMoneyFields?: ReadonlySet<string>;
 }
-export declare function moneyBinding(moneyFields: Record<string, MoneyDescriptor>, virtualMoneyFields?: ReadonlySet<string>): ViaBinding;
+export declare function moneyVia(moneyFields: Record<string, MoneyDescriptor>, virtualMoneyFields?: ReadonlySet<string>): NoydbVia;
 export declare function linkMoneyVia(): void;

package/dist/via/money/normalize.d.ts

@@ -78,7 +78,7 @@ export declare function quantizeMoneyFields<T extends Record<string, unknown>>(r
  */
 export declare function moneyScaledValue(stored: unknown, desc: MoneyDescriptor): bigint | null;
 /**
- * The `ViaBinding.canonicalizeIndexKey` implementation for money (#672) —
+ * The `NoydbVia.canonicalizeIndexKey` implementation for money (#672) —
  * bucket an eager index's money field entries by the BigInt-normalized
  * scaled-int string, not the raw stored bytes, so a pre-declaration /
  * non-canonical value (e.g. `'0100'`) lands under the SAME key a canonical

package/dist/via/money/where.d.ts

@@ -32,7 +32,7 @@ interface MoneyOperandEntry {
 }
 /**
  * The opaque `via` clause payload for a `where()` over a declared money
- * field (see `ViaBinding.buildClause` in kernel/via/index.ts). `entries` holds
+ * field (see `NoydbVia.buildClause` in kernel/via/index.ts). `entries` holds
  * one element for comparison ops, two for `between` (lo, hi — same
  * currency), N for `in`.
  */
@@ -42,14 +42,14 @@ export interface MoneyWhereOperand {
 }
 /**
  * Build the `via` clause payload ({@link MoneyWhereOperand}) for a
- * `where()` over a declared money field — the `ViaBinding.buildClause`
+ * `where()` over a declared money field — the `NoydbVia.buildClause`
  * implementation for money. The operand is quantized into stored
  * scaled-int space NOW — build time — so typos throw at the call site.
  */
 export declare function moneyFieldClause(field: string, op: Operator, value: unknown, desc: MoneyDescriptor): MoneyWhereOperand;
 /**
  * The `via` index-probe operand for a `where()` over a declared money
- * field (see `ViaBinding.indexProbe` in kernel/via/index.ts) — the STORED-form
+ * field (see `NoydbVia.indexProbe` in kernel/via/index.ts) — the STORED-form
  * value `CollectionIndexes.lookupEqual`/`lookupIn` (`with-lookup/indexing/
  * eager-indexes.ts`) can bucket directly.
  *

package/dist/walk-JNEOYCAU.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-HM4JSXX2.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-P6ASQOZR.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-YXA2TCTZ.js";
+import "./chunk-2LPVI4PX.js";
+import "./chunk-N4CNVSUF.js";
+import "./chunk-FOG7YEJP.js";
+import "./chunk-KDJGJR7F.js";
+import "./chunk-LKFKXS5K.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-W5LHQXZU.js";
+import "./chunk-RK7N4OQ5.js";
+import "./chunk-JBIV4FLR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-JNEOYCAU.js.map

package/dist/walk-JNEOYCAU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/with-cargo/adopt-partition.d.ts

@@ -9,8 +9,8 @@
  */
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import type { NoydbStore } from '../kernel/types.js';
-import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
-import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
+import type { NoydbSealer } from '../with-party/team/managed-secret.js';
+import type { NoydbShamir } from '../with-party/team/noydb-shamir.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
 import type { TransferSealPayload } from '../with-pod/pod.js';
 /**
@@ -43,7 +43,7 @@ export interface CreateOwnerStandardOptions {
 }
 /**
  * Managed-mode owner: the secret is minted + sealed under
- * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
+ * a `NoydbSealer` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
  * (Shamir) recovery profile at creation, which needs the
  * `shamirRecovery` provider injected.
@@ -51,9 +51,9 @@ export interface CreateOwnerStandardOptions {
 export interface CreateOwnerManagedOptions {
     readonly userId: string;
     readonly secretMode: 'managed';
-    readonly sealingKey: SealingKeyProvider;
+    readonly sealingKey: NoydbSealer;
     readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-    readonly shamirRecovery: ShamirRecoveryProvider;
+    readonly shamirRecovery: NoydbShamir;
     readonly transferKey: Uint8Array;
 }
 export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions;
@@ -62,7 +62,7 @@ export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManaged
  * then destroy the transfer seal.
  *
  * Standard mode: the recipient supplies a secret. Managed mode: the
- * secret is minted + sealed under a `SealingKeyProvider` and a strong
+ * secret is minted + sealed under a `NoydbSealer` and a strong
  * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *

package/dist/with-cargo/floor.d.ts

@@ -30,4 +30,4 @@ export type { ReduceResult, ReduceSpec, LiveReduction, } from '../with-lookup/re
 export type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 export type { FuseOptions } from '../with-lookup/search/fuse.js';
 export type { RetrieveHit, RetrieveOptions } from '../with-lookup/search/retrieve-types.js';
-export type { CoordinationProvider, WriterPresence, FenceState, DrainBarrierOptions, } from '../port/by/index.js';
+export type { NoydbMesh, WriterPresence, FenceDoc, DrainBarrierOptions, } from '../port/by/index.js';

package/dist/with-cargo/index.d.ts

@@ -19,7 +19,7 @@ export { liberateVault } from '../with-party/custody/liberate.js';
 export type { LiberateOptions, LiberateResult } from '../with-party/custody/liberate.js';
 export { createDeedOwner, loadDeedMarker, isDeedVault } from '../with-party/team/deed.js';
 export type { DeedMarker } from '../with-party/team/deed.js';
-export type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
+export type { NoydbSealer } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
 export { withCargo } from './active.js';

package/dist/with-party/team/deed.d.ts

@@ -4,7 +4,7 @@
  * A **Deed** is a vault owned by a *latent* principal who never
  * authenticates. The owner credential (the random secret that
  * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
+ * **non-firm** {@link NoydbSealer} — that sealing boundary is
  * the cryptographic *inalienability anchor*: whoever holds the
  * provider (the client / their KMS) is the only party that can ever
  * re-derive `KEK_owner`. A firm-side custodian operates the vault
@@ -30,7 +30,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { SealingKeyProvider } from './managed-secret.js';
+import type { NoydbSealer } from './managed-secret.js';
 /** Reserved id for the Deed marker under `_meta`. */
 export declare const DEED_RECORD_ID: "deed";
 /**
@@ -43,7 +43,7 @@ export interface DeedMarker {
     /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
     readonly ownerUserId: string;
     /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
+     * The `NoydbSealer.id` the owner credential is sealed under.
      * The inalienability anchor: only the holder of this (non-firm)
      * provider can re-derive `KEK_owner`. Audit metadata — never secret.
      */
@@ -74,7 +74,7 @@ export interface DeedMarker {
  * There is deliberately no firm-controlled fallback: the marker's
  * `sealedUnder` is the single cryptographic anchor of ownership.
  */
-export declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
+export declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: NoydbSealer): Promise<UnlockedKeyring>;
 /**
  * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
  * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no

package/dist/with-party/team/device-seal.d.ts

@@ -1,20 +1,20 @@
-import type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js';
+import type { NoydbDeviceSeal } from '../../port/with/device-seal-strategy.js';
 /**
  * Device-local sealer for the echo reveal-blob (spec decision 5).
- * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals
+ * DISTINCT from `NoydbSealer` (managed-secret mode, which seals
  * the WHOLE secret): this seals only the echo part, and only so an
  * enrolled device can display it during the unlock ceremony. The
  * sealed bytes may sit in the (untrusted) keyring file — attacker-B
  * resistance comes from `unseal` requiring this device's key store.
  *
  * The interface itself is declared on the `/with` port
- * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)
+ * ({@link NoydbDeviceSeal} from `port/with/device-seal-strategy.js`)
  * so the kernel spine can reference it without a static spine→service
  * import; re-exported here as the canonical consumer-facing home.
  */
-export type { DeviceSealProvider };
+export type { NoydbDeviceSeal };
 /** In-memory test provider — AES-GCM under a per-instance random key. */
-export declare class MemoryDeviceSealProvider implements DeviceSealProvider {
+export declare class MemoryDeviceSeal implements NoydbDeviceSeal {
     readonly id: string;
     private readonly keyPromise;
     constructor(opts: {

package/dist/with-party/team/echo-ceremony.d.ts

@@ -15,13 +15,13 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 import { type UnlockedKeyring } from './keyring.js';
 /** Options for {@link beginEchoUnlock}. */
 export interface BeginEchoUnlockOptions {
     readonly userId: string;
     readonly prompt: string;
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
 }
 /**
  * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —

package/dist/with-party/team/echo-secret.d.ts

@@ -11,7 +11,7 @@
  *   - Building the reveal blob per the hybrid reveal policy (spec decision
  *     4): `portable` (AES-GCM under the prompt, own salt), `sealed`
  *     (opaque to hub, unsealed only by the enrolling device's
- *     {@link DeviceSealProvider}), or `none`.
+ *     {@link NoydbDeviceSeal}), or `none`.
  *   - Resolving the echo for display (`resolveEchoReveal`, `null` ⇒
  *     degraded typed-echo path) and verifying a typed echo
  *     (`verifyTypedEcho`) for that degraded path.
@@ -30,14 +30,14 @@
  */
 import { type EchoSecretParts } from '../../kernel/enclave/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 /** Same iteration floor as the KEK (spec resolved question 1). */
 export declare const ECHO_KDF_ITERATIONS = 600000;
 export type EchoRevealChoice = {
     readonly kind: 'portable';
 } | {
     readonly kind: 'sealed';
-    readonly deviceSeal: DeviceSealProvider;
+    readonly deviceSeal: NoydbDeviceSeal;
 } | {
     readonly kind: 'none';
 };
@@ -52,5 +52,5 @@ export declare function verifyPrompt(block: KeyringEchoBlock, prompt: string): P
  * @throws WrongPromptError when the prompt cannot open the portable reveal
  * (callers should verifyPrompt first for a boolean check).
  */
-export declare function resolveEchoReveal(block: KeyringEchoBlock, prompt: string, deviceSeal?: DeviceSealProvider): Promise<string | null>;
+export declare function resolveEchoReveal(block: KeyringEchoBlock, prompt: string, deviceSeal?: NoydbDeviceSeal): Promise<string | null>;
 export declare function verifyTypedEcho(block: KeyringEchoBlock, echo: string): Promise<boolean>;

package/dist/with-party/team/index.d.ts

@@ -36,8 +36,8 @@ export { buildEchoBlock, verifyPrompt, resolveEchoReveal, verifyTypedEcho, } fro
 export type { EchoRevealChoice } from './echo-secret.js';
 export { beginEchoUnlock } from './echo-ceremony.js';
 export type { BeginEchoUnlockOptions, EchoCeremony } from './echo-ceremony.js';
-export { MemoryDeviceSealProvider } from './device-seal.js';
-export type { DeviceSealProvider } from './device-seal.js';
+export { MemoryDeviceSeal } from './device-seal.js';
+export type { NoydbDeviceSeal } from './device-seal.js';
 export type { EchoSecretParts } from '../../kernel/enclave/index.js';
 export type { KeyringEchoBlock, NoydbStore } from '../../kernel/types.js';
 export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -2,7 +2,7 @@ import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions,
 import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
 import type { KeyringTamperedReason } from '../../kernel/errors.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 /** In-memory representation of an unlocked keyring. */
 export interface UnlockedKeyring {
     readonly userId: string;
@@ -165,7 +165,7 @@ export interface CreateOwnerKeyringOptions extends SecretPolicy {
      * ⇒ `reveal: 'sealed'` (attacker-B resistance); absent ⇒ `reveal:
      * 'portable'` (spec resolved question 4). Ignored for a string secret.
      */
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
     /** Echo enrollment only: optional display hint for the masked echo. */
     readonly echoMaskHint?: string;
     /**

package/dist/with-party/team/managed-secret.d.ts

@@ -3,16 +3,16 @@
  *
  * A vault mode where the secret is machine-generated and never
  * exposed to the user, sealed under a developer-provided
- * {@link SealingKeyProvider} (macOS Keychain, Windows Credential
+ * {@link NoydbSealer} (macOS Keychain, Windows Credential
  * Manager, libsecret, AWS KMS, …). The user has no secret to give
  * up to coercion — they can't reveal what they don't know.
  *
  * ## Components in this file
  *
- *   - {@link SealingKeyProvider} — the interface concrete providers
+ *   - {@link NoydbSealer} — the interface concrete providers
  *     implement. Provider implementations live OUTSIDE hub (per-
  *     platform packages).
- *   - {@link MemorySealingKeyProvider} — in-memory test provider; uses
+ *   - {@link MemorySealer} — in-memory test provider; uses
  *     a deterministic per-instance "key" so two providers with
  *     different ids cannot unseal each other's outputs.
  *   - {@link RecipientHint} — public material a sender uses to seal
@@ -22,10 +22,10 @@
  *   - {@link RecipientSealer} — interface for asymmetric/granted
  *     providers that support recipient-target sealing (RSA-OAEP,
  *     cloud-KMS asymmetric, etc.); distinct from self-only
- *     {@link SealingKeyProvider} (macOS Keychain, WebAuthn-PRF).
+ *     {@link NoydbSealer} (macOS Keychain, WebAuthn-PRF).
  *   - {@link MemoryRecipientSealer} — in-process reference
  *     implementation of both `RecipientSealer` and
- *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;
+ *     `NoydbSealer` using real WebCrypto RSA-OAEP + AES-GCM;
  *     safe for tests and same-process sender/recipient scenarios.
  *   - {@link loadSealedSecret} / {@link saveSealedSecret} —
  *     plaintext envelope storage at `_meta/sealed-secret`.
@@ -66,7 +66,7 @@ import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
  * | Linux | `@noy-db/seal-libsecret` | libsecret / secret-service |
  * | Cloud / server | `@noy-db/seal-aws-kms` | AWS KMS Decrypt |
  */
-export interface SealingKeyProvider {
+export interface NoydbSealer {
     /**
      * Non-sensitive identifier disclosed in the persisted envelope.
      * Surfaced to consumers via `loadSealedSecret().providerId` so
@@ -97,13 +97,23 @@ export interface SealingKeyProvider {
  *
  * Replace with a real platform provider in production.
  */
-export declare class MemorySealingKeyProvider implements SealingKeyProvider {
+export declare class MemorySealer implements NoydbSealer {
     readonly id: string;
     private readonly fingerprint;
     private readonly keyBytes;
     constructor(opts: {
         id: string;
     });
+    /**
+     * Deterministic 4-byte integrity tag over the ciphertext, keyed by the
+     * same derived bytes. NOT a MAC and not forgery-resistant — a real
+     * provider authenticates with its backend. It exists because the contract
+     * says `unseal` MUST throw on tamper, and a double that silently returns
+     * corrupted bytes is not modelling the contract it stands in for. Without
+     * it, every managed-mode test ran against a provider that could not fail
+     * the way a real one must (found by @noy-db/test-sealer-conformance).
+     */
+    private tag;
     seal(secret: Uint8Array): Promise<Uint8Array>;
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 }
@@ -168,7 +178,7 @@ export declare function parseRsaOaepTlv(bytes: Uint8Array): {
  */
 export declare function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array): Promise<Uint8Array>;
 /**
- * Reference implementation of `RecipientSealer` + `SealingKeyProvider`.
+ * Reference implementation of `RecipientSealer` + `NoydbSealer`.
  * Uses WebCrypto RSA-OAEP-SHA256 (2048-bit) to wrap a fresh 32-byte
  * AES-GCM CEK, AES-GCM-encrypts plaintext under it, and packs the
  * result into a self-describing TLV:
@@ -190,7 +200,7 @@ export declare function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uin
  * keychain; use it for tests and for shipping bundles where the
  * recipient instance lives in the same process as the sender (rare).
  */
-export declare class MemoryRecipientSealer implements SealingKeyProvider, RecipientSealer {
+export declare class MemoryRecipientSealer implements NoydbSealer, RecipientSealer {
     readonly id: string;
     private readonly keypair;
     constructor(opts: {
@@ -213,7 +223,7 @@ export interface SealedSecret {
 /**
  * Wire-format envelope persisted at `_meta/sealed-secret` for
  * managed-mode vaults. The provider produces raw sealed bytes via
- * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch
+ * {@link NoydbSealer.seal}; this wrapper carries the dispatch
  * metadata hub needs to pick the right provider on the unseal path.
  *
  * Stability boundary: once shipped, the wire format only grows by
@@ -277,4 +287,4 @@ export declare function loadSealedSecret(store: NoydbStore, vault: string): Prom
  *
  * @internal — called from `createNoydb` / `getKeyringInternal`.
  */
-export declare function resolveManagedSecret(store: NoydbStore, vault: string, provider: SealingKeyProvider): Promise<string>;
+export declare function resolveManagedSecret(store: NoydbStore, vault: string, provider: NoydbSealer): Promise<string>;

package/dist/with-party/team/noydb-facade.d.ts

@@ -303,7 +303,7 @@ export declare class TeamFacade {
      * const db = await createNoydb({
      *   store, user: 'alice',
      *   secretMode: 'managed',
-     *   sealingKey: macosKeychainSealingProvider({ ... }),
+     *   sealingKey: atMacosKeychain({ ... }),
      * })
      *
      * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
@@ -329,7 +329,7 @@ export declare class TeamFacade {
      *
      * Replaces the sealed secret of a managed-mode vault with a
      * fresh 256-bit random, sealed under the configured
-     * `SealingKeyProvider`. The user never sees the new secret.
+     * `NoydbSealer`. The user never sees the new secret.
      *
      * Internally:
      *   1. Verify the recovery proof (Shamir today) and unwrap the

package/dist/with-party/team/{shamir-recovery-provider.d.ts → noydb-shamir.d.ts}

@@ -4,7 +4,7 @@
  * sees `RawShare` or the share codecs. Implemented by
  * `shamirRecoveryProvider()` from `@noy-db/on-shamir`.
  */
-export interface ShamirRecoveryProvider {
+export interface NoydbShamir {
     /** Split `secret` into `n` base32 share strings; any `k` recombine it. */
     splitToShares(secret: Uint8Array, k: number, n: number): string[];
     /**

package/dist/with-party/team/recovery.d.ts

@@ -25,7 +25,7 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import type { EnclaveKey } from '../../kernel/enclave/index.js';
 import { type WrappedDeksBlob } from './wrapped-deks.js';
-import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
+import type { NoydbShamir } from './noydb-shamir.js';
 /**
  * One paper recovery code as persisted in `_meta/recovery-paper`.
  *
@@ -146,7 +146,7 @@ export declare function saveShamirRecoveryEntries(store: NoydbStore, vault: stri
  * @param n - Total shares (k <= n <= 255).
  * @param label - Optional caller label.
  */
-export declare function mintShamirRecoveryEntry(provider: ShamirRecoveryProvider, deks: Map<string, EnclaveKey>, entryId: string, k: number, n: number, label?: string): Promise<{
+export declare function mintShamirRecoveryEntry(provider: NoydbShamir, deks: Map<string, EnclaveKey>, entryId: string, k: number, n: number, label?: string): Promise<{
     entry: ShamirRecoveryEntry;
     shareStrings: string[];
 }>;
@@ -161,7 +161,7 @@ export declare function mintShamirRecoveryEntry(provider: ShamirRecoveryProvider
  * because they came from a different enrollment or were tampered
  * with. Callers iterating multiple entries should catch.
  */
-export declare function unwrapDeksFromShamirEntry(provider: ShamirRecoveryProvider, entry: ShamirRecoveryEntry, shareStrings: readonly string[]): Promise<Map<string, EnclaveKey>>;
+export declare function unwrapDeksFromShamirEntry(provider: NoydbShamir, entry: ShamirRecoveryEntry, shareStrings: readonly string[]): Promise<Map<string, EnclaveKey>>;
 /**
  * Generate one paper-recovery entry from an unlocked DEK set.
  *

package/dist/with-party/team/rotate-recover.d.ts

@@ -19,10 +19,10 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
 import { type PaperRecoveryEntry } from './recovery.js';
-import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
+import type { NoydbShamir } from './noydb-shamir.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 import type { KeyringAuthenticator } from '../../kernel/types.js';
 import type { EnrollAuthenticatorOptions } from './authenticators.js';
 /**
@@ -38,7 +38,7 @@ interface RotateEchoOptions {
      * absent ⇒ `reveal: 'portable'`. Mirrors
      * {@link CreateOwnerKeyringOptions.deviceSeal}.
      */
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
     /** Optional display hint for the masked echo. */
     readonly maskHint?: string;
 }
@@ -189,7 +189,7 @@ export type RecoveryProof = {
         /** Optional disambiguator when multiple Shamir entries are enrolled.
          *  When omitted, hub tries each entry until one combines. */
         readonly entryId?: string;
-        /** K or more opaque share strings, as returned by `ShamirRecoveryProvider.splitToShares`. */
+        /** K or more opaque share strings, as returned by `NoydbShamir.splitToShares`. */
         readonly shares: ReadonlyArray<string>;
     };
 };
@@ -365,5 +365,5 @@ export type RecoveryEnrollmentInput = {
  * On success, the used recovery entry is burned (deleted from the
  * stored set).
  */
-export declare function recoverSecret(provider: ShamirRecoveryProvider | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverSecretInput): Promise<UnlockedKeyring>;
+export declare function recoverSecret(provider: NoydbShamir | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverSecretInput): Promise<UnlockedKeyring>;
 export {};

package/dist/with-pod/format.d.ts

@@ -132,7 +132,7 @@ export interface NoydbPodHeader {
      * Auto-unlock material indicator. When present, the bundle
      * body wraps the dump JSON in a structure carrying per-user
      * secrets — either plaintext (`'unsealed'`, public-by-design)
-     * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
+     * or sealed under a `NoydbSealer` (`'sealed'`, requires
      * matching provider on the recipient side).
      *
      * Visible pre-decompression so cloud listing UIs can warn before