pin
@noy-db/on-pin·pnpm add @noy-db/on-pinTier-3 quick-resume PIN, never a secret replacement.
What it does
enrollPin(keyring, { pin, ttlMs, maxAttempts }) takes an
already-unlocked keyring, PBKDF2-derives an AES-GCM key from the PIN, and
encrypts the serialized keyring into a PinResumeState — this requires
the keyring's DEKs to be extractable (the hub creates them extractable by
default). Default resume window is 15 minutes, default max attempts 5.
resumePin(state, { pin }) decrypts within the TTL and attempt budget,
throwing PinExpiredError or PinAttemptsExceededError as appropriate.
The returned keyring has kek: null — PIN resume reconstructs only the
DEKs, sufficient for reads/writes but not for opening additional vaults,
re-enrolling, or key rotation, which still need the full secret flow.
Usage
import { enrollPin, resumePin } from '@noy-db/on-pin'
const state = await enrollPin(keyring, { pin: '4821', ttlMs: 15 * 60 * 1000 })
// persist `state` locally (e.g. sessionStorage) for the resume window
const resumed = await resumePin(state, { pin: userEnteredPin })