noy-db
stable

noydb

Encrypted .noydb bundle export — ciphertext in, ciphertext out. The sole encrypted-tier package.

@noy-db/as-noydb · pnpm add @noy-db/as-noydb Wraps writePod() — a whole-vault encrypted backup artefact.

What it does

as-noydb is the only member of the encrypted tier: the bundle it produces is ciphertext end to end, inert without the vault's KEK (key-encryption key). Because no plaintext ever crosses the boundary, write() has no acknowledgeRisks gate — the discipline that matters is never storing the secret next to the bundle, not whether the bytes are written. peek() inspects a received bundle's minimal header (handle, format version, body size, body hash) without decrypting the body, for due diligence before importing. There is no reader — bundle import is whole-vault, not a per-record diff.

Usage

import { toBytes, write, download, peek } from '@noy-db/as-noydb'

const bundle = await toBytes(vault)          // → Uint8Array, ciphertext end to end
await write(vault, './backup.noydb')          // Node disk write — no acknowledgeRisks needed
await download(vault, { filename: 'backup.noydb' }) // browser save-as prompt

const header = peek(bundle)
// → { formatVersion: 1, handle: '01J9…', bodyBytes: 18432, bodySha256: '9f2c…' }

Gated by exportCapability.bundle, on by default for owner/admin and off for every other role — see the family gate.

See also

  • as-* family
  • zip — plaintext-tier composite alternative for hand-offs
  • blob — single-attachment plaintext alternative

ndjson

sql