Auth recovery

Recovery is how a vault regains access when the factors that normally open it are lost — a forgotten secret, a lost passkey, a wiped device. Because noy-db is zero-knowledge, there is no server-side reset: recovery works only if a recovery profile was enrolled ahead of time, holding a separate path to the DEKs that does not collapse the security model.

Two profiles are implemented end to end:

• paper — single-use codes; a matching code unwraps the cached DEKs, then rewraps them under a fresh KEK. Backed by on-recovery.
• shamir — K-of-N shares reconstruct the DEK set; requires a NoydbShamir (from on-shamir) at createNoydb() time.

The reserved multi-channel and admin-mediated profiles ship only their API shape and throw RecoveryProfileNotImplementedError in use. The profile lifecycle, the two shipped presets' recover-secret gate, and managed-secret mode are covered in depth on session-tiers → Rotate and recover. Secret reset itself — from a remembered secret (rotateSecret) or a recovery proof (recoverSecret) — lives on Secret & keyring; this page covers enrolling and managing the profiles and the recovery flows built on them.

Recovery profiles

Enroll, list, and regenerate the paper / Shamir recovery profiles a vault can recover through.

enrollRecovery()

enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>

Persist a recovery enrollment — a 'paper' code sheet or a 'shamir' K-of-N entry. The result carries the material to surface once (the paper codes, or the Shamir shares); the hub does not retain it.

• vault — the vault to enroll recovery for.
• enrollment — a RecoveryEnrollmentInput selecting the profile and its parameters (e.g. { profile: 'paper', entries } or { profile: 'shamir', k, n }).

listRecoveryEntries()

listRecoveryEntries(vault: string): Promise<{ paper: ReadonlyArray<PaperRecoveryEntry>; shamir: ReadonlyArray<ShamirRecoveryEntry> }>

Read the persisted recovery entries, split into the paper and shamir sets. Used by describeAuthConfig and for showing a vault's recovery posture.

• vault — the vault whose recovery entries to read.

rotateRecovery()

rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>

Regenerate the recovery material for an already-enrolled profile — reissue a paper sheet, or re-share a Shamir entry — replacing the existing entry rather than minting one from scratch (it throws if none is enrolled). When a vault has multiple Shamir entries, pass entryId to disambiguate which one to rotate.

• vault — the vault whose recovery material to rotate.
• options — a RotateRecoveryOptions naming the profile (and entryId for a specific Shamir entry).
• factors — factor proofs presented when the policy gate demands them.

Recovery flows

The flows that consume a recovery profile: bootstrapping a managed-secret vault, resetting a managed secret, and peer-recovering another user's keyring.

openVaultAndEnrollRecovery()

openVaultAndEnrollRecovery(vault: string, opts: { recovery: ReadonlyArray<RecoveryEnrollmentInput>; locale?: string }): Promise<{ vault: Vault; recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult> }>

Atomic create-and-enroll — required for managed-secret vaults, where recover-secret cannot be left unenrolled (a managed-mode vault has no user-known secret to fall back on, so it needs at least one strong Shamir profile). Opens the vault and enrolls the supplied recovery profiles in one step.

• vault — the vault to open and enroll.
• opts.recovery — the recovery profiles to enroll (managed mode requires at least one strong / Shamir profile).
• opts.locale — optional default locale for the opened vault.

recoverManagedSecret()

recoverManagedSecret(vault: string, options: { recoveryProof: RecoveryProof; secretPolicy?: SecretPolicy }): Promise<void>

Reset a managed-mode secret under a fresh sealing key. In managed mode rotateSecret is unavailable — the auto-generated secret can only be replaced by recovering it — so this is the sanctioned managed-mode reset. Requires sealingKey to be supplied at createNoydb().

• vault — the managed-mode vault to recover.
• options.recoveryProof — the RecoveryProof (paper code or Shamir reconstruction) authorizing the reset.
• options.secretPolicy — optional strength rules for the regenerated secret.

recoverUser()

recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>

Atomic peer-recovery of an existing user's keyring — re-establish a member's access from a recovery proof without a full re-grant ceremony.

• vault — the vault whose user to recover.
• options — a RecoverUserOptions naming the target user and the recovery proof.
• factors — factor proofs presented when the policy gate demands them.