zip

@noy-db/as-zip · pnpm add @noy-db/as-zip Decrypts a collection's records and every attached blob and bundles them into one .zip. The archive is plaintext unless you pass password (WinZip-AES-256, below) — and even then it is protected by that password, not by the vault's keys.

What it does

as-zip is the "download this audit trail" / "migrate this case folder" primitive — a folder-per-record archive (records.json + a manifest.json index + attachments/<recordId>/<slot> blob files) that is browsable without tooling. It ships a zero-dependency, STORE-only zip writer (no deflate, since most attached blobs are already compressed). Pass password to encrypt every entry with WinZip-AES-256 — the archive stays a valid single-disk ZIP that 7-Zip, Archive Utility, and WinRAR prompt for the password on extract (see the interoperability matrix for exactly which third-party tools open these archives, and which archives the reader accepts). A symmetric fromBytes() reader reads a (optionally encrypted) archive back into an import plan.

Usage

import { toBytes } from '@noy-db/as-zip'

const bytes = await toBytes(vault, {
  records: { collection: 'invoices', filter: (r) => r.status === 'paid' },
  attachments: { slots: ['raw', 'thumb'] }, // optional; default '*' = every slot
  password: 'shared-with-recipient-2026',    // optional — WinZip-AES-256
})

import { fromBytes } from '@noy-db/as-zip'

const plan = await fromBytes(vault, bytes, {
  collection: 'invoices',
  password: 'shared-with-recipient-2026',
})
await plan.apply()

See also

• as-* family
• blob — single attachment, no archive
• noydb — encrypted-tier alternative for multi-recipient hand-offs