noy-db
stable

Core vocabulary

Canonical definitions for the four structural terms every page relies on: hub, vault, collection, and capsule/enclave-aes.

The four structural terms below appear on nearly every page of this site. Each has exactly one meaning; where a word could plausibly cover two things (as hub often does in conversation), the distinctions are spelled out here.

Hub

@noy-db/hub — the core npm package, and by extension the library it ships. The word carries three closely-related senses, always resolvable from context:

  1. The package you install (pnpm add @noy-db/hub).
  2. The core library — the code that encrypts, decrypts, validates, and queries.
  3. The trust boundary — the architectural region inside which plaintext and keys may exist. Every satellite package (to-, on-, at-, in-, by-, as-) sits outside it and binds one published subpath; see Families.

What the hub is not: a server, a service you run, or a place data lives. It is a library inside your application process.

Vault

A vault is an isolated runtime data space with its own keys — typically one tenant, company, or user ("acme", "firm-2026"). A vault is what db.openVault(name) returns; your records, keyrings, and per-vault policy live in it. One Noydb session can open many vaults, and no key material is shared between them.

A vault is data, not code — it is stored (as ciphertext envelopes) in whatever store you configured, and exists at runtime as the decrypted working set the hub maintains for you.

Collection

A collection is a typed record set inside a vault (invoices, clients). Every record is addressed by the (vault, collection, id) triple. The TypeScript type parameter on vault.collection<T>(name) carries through get/put/query.

Kernel and enclave

The kernel is the always-on part of the hub — sessions, vaults, collections, encryption, keyring, schema, query — the layer documented under Core concepts. It cannot be opted out of; everything beyond it is an opt-in service.

The enclave is the kernel's innermost region: the only code that ever holds raw key material. Containment is strict — enclave ⊂ kernel ⊂ hub — and each ring only narrows what the code inside may touch; see Architecture for the containment nest and the invariant it enforces.

See also

  • Core concepts — the kernel, taught page by page.
  • Families — who everything outside the hub is to the vault.

Glossary

Deletion vocabulary