stable
Noydb
The db handle from createNoydb(): one unlocked Noydb session that opens vaults, owns the keyring, and runs the client-side crypto. Section map inside.
const db = await createNoydb(…) returns a Noydb — one unlocked session. It holds the encryption keys in memory while you work and hands them back to nobody.
A session is the top of the Noydb → Vault → Collection<T> hierarchy: it opens vaults, owns the keyring, and runs the client-side crypto.
In this section
- Noydb — the object reference for the
Noydbinstance: opening and reaching vaults, events and the write queue, policy and gates, and the session lifecycle. - cover — the owner-curated plaintext vault descriptor (
getCover/setCover). - Enclave — the crypto the session owns: the KEK/DEK/CEK hierarchy, the envelope format, and the in-memory enclave boundary.
- Secret & keyring — the vault secret and single-user keyring primitives, plus the users home: change / rotate / recover the secret, update and list users, read the keyring, and the user-directory toggle.
- Authentication — the strategy-free session-auth ladder: tier 1 (secret / getKeyring), tier-2 authenticators and their
on-*families, tier-3 quick-unlock, and auth introspection. - Auth recovery — regaining access when factors are lost: recovery-profile enrollment and the paper / Shamir recovery flows.
- Configuration — the full
createNoydbreference: every core option key in detailed tables. - Strategies — the complete
with*()service-strategy directory: all 32 slots and what each unlocks.