Families & ports

Six prepositions, one trust boundary. @noy-db/hub encrypts every record before it leaves the client; everything else ships as a satellite package named after what it does — to-, on-, at-, in-, by-, as-. Each family binds exactly one frozen port on the hub, so satellites for the same job are swappable without touching the rest of your app. This page maps all six families to their catalog.

noy-db is an encrypted document store. Its core package, @noy-db/hub, encrypts every record before it is written to storage — the hub is the trust boundary: the line inside which plaintext and key material are allowed to exist. Everything else ships as a satellite: a separate npm package whose name starts with a preposition — to-, on-, at-, in-, by-, as-. That prefix is the package's family, and it tells you at a glance what the package does and what it is allowed to see.

Each family binds exactly one port: a frozen import subpath of the hub (@noy-db/hub/to, /on, /at, /in, /by, /as) whose export surface is golden-frozen — checked against a committed snapshot by a test, so the contract can only change deliberately, never by accident. Satellites bind their port and nothing else — never hub internals — which is why you can swap one member of a family for another without touching the rest of your application. The full mechanism is on the Ports page.

// A storage backend binds only the /to port — the ciphertext-facing contract.
// It never imports a hub-internal module:
import type { NoydbStore, EncryptedEnvelope } from '@noy-db/hub/to'

The prepositions read from the vault owner's perspective, and each family's port grants it exactly the visibility its job needs — nothing more:

• to- — data goes to a storage backend (to-file, to-browser-idb, to-postgres). Sees ciphertext only.
• on- — you get on (unlock the vault) via a method (on-password, on-webauthn, on-totp). Handles unlock material, never data keys.
• at- — a machine-held vault secret is encrypted ("sealed") at a host you control, so your own server code can open a vault (at-env, at-aws-kms). The one family that is deliberately not zero-knowledge.
• in- — the hub's public surface is adapted into a host runtime or protocol (in-react, in-nuxt, in-ai, in-rest). Reads decrypted data the same way your app code does.
• by- — sessions sync by way of a transport (by-peer over WebRTC, by-tabs across browser tabs). Never sees plaintext.
• as- — data is exported as a portable format (as-csv, as-xlsx, as-noydb). A pure read-side transform: decrypted records in, formatted bytes out.

Installing more than one satellite

Every satellite declares @noy-db/hub as a peer. From 0.7.0-pre.9 that peer is a caret range (^0.7.0-pre.9), so satellites cut at different times are jointly satisfiable — one hub can satisfy ^0.7.0-pre.9 and ^0.7.0-pre.10 at once — while still stopping at the next minor, so a satellite never claims to work against a hub line it has not seen.

npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.5   # ERESOLVE
npm i @noy-db/as-csv@0.7.0-pre.6 @noy-db/in-vue@0.7.0-pre.6   # ok — same cut
npm i @noy-db/as-csv@0.7.0-pre.9 @noy-db/in-vue@0.7.0-pre.8   # ERESOLVE — pre.8 still pins exactly
npm i @noy-db/as-csv@0.7.0-pre.9 @noy-db/in-vue@0.7.0-pre.9   # ok

Each family folder (labelled by its prefix in the sidebar) opens with a catalog Overview — every package grouped by category — and then a page per package.

Browse the pages in the sidebar, or jump into the Orientation map to pick capabilities and land on the exact pages you need. For the trust-boundary view of the same six families — what each may see, hold, or write — see Families; for the two-axis model (families vs. hub services) and the rules used to decide where a package belongs, see Classifying a package.