[{"data":1,"prerenderedAt":2846},["ShallowReactive",2],{"navigation":3,"\u002Frecipes\u002Faws-kms-pdf-attestation":927},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":519,"access":12,"apiToc":929,"body":930,"category":2838,"description":2839,"extension":2840,"meta":2841,"navigation":2838,"nest":2838,"path":520,"seo":2842,"sinceVersion":2838,"status":2843,"stem":521,"subtitle":2838,"tier":2844,"tocExternal":2838,"__hash__":2845},"docs\u002Frecipes\u002Faws-kms-pdf-attestation.md",false,{"type":931,"value":932,"toc":2826},"minimark",[933,937,968,981,1004,1016,1041,1046,1109,1113,1161,1165,1181,1757,1853,1872,1876,1885,2097,2120,2124,2127,2174,2266,2294,2298,2301,2458,2480,2484,2495,2665,2709,2731,2735,2769,2773,2789,2796,2800,2822],[934,935,519],"h1",{"id":936},"aws-kms-attestation",[938,939,940],"blockquote",{},[941,942,943,947,948,951,952,956,957,960,961,956,964,967],"p",{},[944,945,946],"strong",{},"Audience:"," teams that issue PDF documents (invoices, certificates, statements) and want to render the attestation QR server-side, sealed under a key held in AWS KMS.\n",[944,949,950],{},"Bundle:"," core + ",[953,954,955],"code",{},"withAttestation()"," (",[953,958,959],{},"@noy-db\u002Fhub\u002Fattestation",") + ",[953,962,963],{},"@noy-db\u002Fat-aws-kms",[953,965,966],{},"atAwsKms",") — the render Lambda itself is hub-free.",[941,969,970,971,980],{},"Verified by: ",[972,973,977],"a",{"href":974,"rel":975},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Fshowcases\u002Fsrc\u002Frecipe-aws-kms-pdf-attestation.recipe.test.ts",[976],"nofollow",[953,978,979],{},"showcases\u002Fsrc\u002Frecipe-aws-kms-pdf-attestation.recipe.test.ts"," — the CI-safe generation-side slice of this recipe.",[941,982,983,984,987,988,991,992,995,996,999,1000,1003],{},"You issue documents — invoices, certificates, statements — and want anyone\nholding a printed or forwarded copy to check, ",[944,985,986],{},"fully offline",", that it is\nauthentic and unaltered. noy-db's ",[972,989,990],{"href":610},"attestation service","\ncovers the trust part: the issuing firm signs a per-field commitment over the\ndocument's declared fields and encodes it as a QR credential. This recipe is\nthe ",[944,993,994],{},"generation half",": a small, deployable AWS Lambda that takes a\nKMS-encrypted document record from S3, decrypts it, and renders an HTML\ninvoice to PDF with the attestation ",[944,997,998],{},"QR embedded as vector SVG"," — so the QR\nsurvives print and rescan. It pairs with the\n",[972,1001,1002],{"href":516},"offline verifier recipe",", which checks the QR\nwith no server involved.",[941,1005,1006,1007,1010,1011,1015],{},"Along the way it exercises ",[944,1008,1009],{},"sealing"," — encrypting a payload under a key held\nby infrastructure you control, here AWS KMS via\n",[972,1012,1013],{"href":170},[953,1014,963],{},". The Lambda itself never opens a noy-db\nvault: it only decrypts one small render payload per request.",[1017,1018,1021],"callout",{"color":1019,"icon":1020},"neutral","i-lucide-package",[941,1022,1023,1024,1030,1031,1034,1035,1034,1037,1040],{},"Recipes are reference source, not npm packages. The full working code —\nincluding the CDK deploy stack — lives at\n",[972,1025,1028],{"href":1026,"rel":1027},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Ftree\u002Fmain\u002Frecipes\u002Faws-kms-pdf-attestation",[976],[953,1029,521],{},";\ncopy what you need into your project. The published packages it builds on\n(",[953,1032,1033],{},"@noy-db\u002Fhub",", ",[953,1036,963],{},[953,1038,1039],{},"@noy-db\u002Fattestation",") are on npm.",[1042,1043,1045],"h2",{"id":1044},"what-it-shows","What it shows",[1047,1048,1049,1063,1078,1100],"ul",{},[1050,1051,1052,1055,1056,1059,1060,1062],"li",{},[944,1053,1054],{},"Issue (hub):"," ",[953,1057,1058],{},"vault.issueAttestation()"," — the firm mints the signed QR\ncredential for a record. Opt-in via ",[953,1061,955],{},".",[1050,1064,1065,1055,1068,1070,1071,1073,1074,1077],{},[944,1066,1067],{},"Seal (at-aws-kms):",[953,1069,966],{}," from ",[953,1072,963],{},"\nKMS-encrypts the render payload ",[953,1075,1076],{},"{ docId, fields, qr }"," before it touches S3.",[1050,1079,1080,1083,1084,1087,1088,1091,1092,1095,1096,1099],{},[944,1081,1082],{},"Render (hub-free Lambda):"," S3 ",[953,1085,1086],{},"GetObject"," → KMS ",[953,1089,1090],{},"Decrypt"," → HTML with an\ninline-SVG QR → headless Chromium (",[953,1093,1094],{},"puppeteer-core"," + ",[953,1097,1098],{},"@sparticuz\u002Fchromium",")\n→ PDF.",[1050,1101,1102,1105,1106,1062],{},[944,1103,1104],{},"Verify (third party):"," the embedded QR still verifies offline via the\nverifier recipe's ",[953,1107,1108],{},"verifyDocument()",[1042,1110,1112],{"id":1111},"data-flow","Data flow",[1114,1115,1116,1128,1140,1149],"ol",{},[1050,1117,1118,1055,1121,1124,1125,1062],{},[944,1119,1120],{},"Issue (firm, hub):",[953,1122,1123],{},"vault.issueAttestation('invoices', id)"," →\n",[953,1126,1127],{},"{ docId, qr, keyId, publicKeyB64 }",[1050,1129,1130,1055,1133,1136,1137,1062],{},[944,1131,1132],{},"Seal (firm):",[953,1134,1135],{},"sealAndUpload({ docId, fields, qr })"," — KMS Encrypt →\nS3 ",[953,1138,1139],{},"docs\u002F\u003CdocId>",[1050,1141,1142,1055,1145,1148],{},[944,1143,1144],{},"Render (Lambda):",[953,1146,1147],{},"GET \u003Cfunction-url>?d=\u003CdocId>&exp=…&sig=…"," → verify\nthe signed link → S3 GetObject → KMS Decrypt → PDF with the vector QR.",[1050,1150,1151,1154,1155,1157,1158,1062],{},[944,1152,1153],{},"Verify (third party, offline):"," scan the QR on the PDF →\n",[953,1156,1108],{}," → ",[953,1159,1160],{},"authentic-valid",[1042,1162,1164],{"id":1163},"step-1-issue-the-attestation-firm-side-hub","Step 1 — Issue the attestation (firm side, hub)",[941,1166,1167,1168,1172,1173,1176,1177,1180],{},"The firm declares which fields the QR commits to (an ",[1169,1170,1171],"em",{},"attestation\nfield-schema","), writes the record, and mints the credential. Normalizers make\nthe stored value and what a human later reads off the paper compare equal\n(",[953,1174,1175],{},"1234.5"," and ",[953,1178,1179],{},"\"1234.50\""," both normalize to the same cents value).",[1182,1183,1188],"pre",{"className":1184,"code":1185,"language":1186,"meta":1187,"style":1187},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\nimport { withAttestation } from '@noy-db\u002Fhub\u002Fattestation'\nimport { toMemory } from '@noy-db\u002Fto-memory'\nimport type { AttestationFieldSchema } from '@noy-db\u002Fattestation'\n\nconst attestation: AttestationFieldSchema = {\n  fields: [\n    { path: 'invoiceNo', normalize: 'alnum-upper' },\n    { path: 'total',     normalize: 'cents' },\n    { path: 'issueDate', normalize: 'iso-date' },\n  ],\n}\n\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'firm',\n  secret: 'firm-pass-2026',\n  attestationStrategy: withAttestation(), \u002F\u002F attestation is opt-in\n})\nconst vault = await db.openVault('books')\n\nawait vault\n  .collection('invoices', { attestation })\n  .put('inv-1', { id: 'inv-1', invoiceNo: 'INV-1042', total: 1234.5, issueDate: '2026-05-29' })\n\nconst { docId, qr, keyId, publicKeyB64 } = await vault.issueAttestation('invoices', 'inv-1')\n","ts","",[953,1189,1190,1222,1242,1263,1286,1293,1315,1327,1364,1396,1427,1436,1442,1447,1470,1485,1502,1519,1537,1546,1577,1582,1591,1620,1695,1700],{"__ignoreMap":1187},[1191,1192,1195,1199,1203,1207,1210,1213,1216,1219],"span",{"class":1193,"line":1194},"line",1,[1191,1196,1198],{"class":1197},"s7zQu","import",[1191,1200,1202],{"class":1201},"sMK4o"," {",[1191,1204,1206],{"class":1205},"sTEyZ"," createNoydb",[1191,1208,1209],{"class":1201}," }",[1191,1211,1212],{"class":1197}," from",[1191,1214,1215],{"class":1201}," '",[1191,1217,1033],{"class":1218},"sfazB",[1191,1220,1221],{"class":1201},"'\n",[1191,1223,1225,1227,1229,1232,1234,1236,1238,1240],{"class":1193,"line":1224},2,[1191,1226,1198],{"class":1197},[1191,1228,1202],{"class":1201},[1191,1230,1231],{"class":1205}," withAttestation",[1191,1233,1209],{"class":1201},[1191,1235,1212],{"class":1197},[1191,1237,1215],{"class":1201},[1191,1239,959],{"class":1218},[1191,1241,1221],{"class":1201},[1191,1243,1245,1247,1249,1252,1254,1256,1258,1261],{"class":1193,"line":1244},3,[1191,1246,1198],{"class":1197},[1191,1248,1202],{"class":1201},[1191,1250,1251],{"class":1205}," toMemory",[1191,1253,1209],{"class":1201},[1191,1255,1212],{"class":1197},[1191,1257,1215],{"class":1201},[1191,1259,1260],{"class":1218},"@noy-db\u002Fto-memory",[1191,1262,1221],{"class":1201},[1191,1264,1266,1268,1271,1273,1276,1278,1280,1282,1284],{"class":1193,"line":1265},4,[1191,1267,1198],{"class":1197},[1191,1269,1270],{"class":1197}," type",[1191,1272,1202],{"class":1201},[1191,1274,1275],{"class":1205}," AttestationFieldSchema",[1191,1277,1209],{"class":1201},[1191,1279,1212],{"class":1197},[1191,1281,1215],{"class":1201},[1191,1283,1039],{"class":1218},[1191,1285,1221],{"class":1201},[1191,1287,1289],{"class":1193,"line":1288},5,[1191,1290,1292],{"emptyLinePlaceholder":1291},true,"\n",[1191,1294,1296,1300,1303,1306,1309,1312],{"class":1193,"line":1295},6,[1191,1297,1299],{"class":1298},"spNyl","const",[1191,1301,1302],{"class":1205}," attestation",[1191,1304,1305],{"class":1201},":",[1191,1307,1275],{"class":1308},"sBMFI",[1191,1310,1311],{"class":1201}," =",[1191,1313,1314],{"class":1201}," {\n",[1191,1316,1318,1322,1324],{"class":1193,"line":1317},7,[1191,1319,1321],{"class":1320},"swJcz","  fields",[1191,1323,1305],{"class":1201},[1191,1325,1326],{"class":1205}," [\n",[1191,1328,1330,1333,1336,1338,1340,1343,1346,1349,1352,1354,1356,1359,1361],{"class":1193,"line":1329},8,[1191,1331,1332],{"class":1201},"    {",[1191,1334,1335],{"class":1320}," path",[1191,1337,1305],{"class":1201},[1191,1339,1215],{"class":1201},[1191,1341,1342],{"class":1218},"invoiceNo",[1191,1344,1345],{"class":1201},"'",[1191,1347,1348],{"class":1201},",",[1191,1350,1351],{"class":1320}," normalize",[1191,1353,1305],{"class":1201},[1191,1355,1215],{"class":1201},[1191,1357,1358],{"class":1218},"alnum-upper",[1191,1360,1345],{"class":1201},[1191,1362,1363],{"class":1201}," },\n",[1191,1365,1367,1369,1371,1373,1375,1378,1380,1382,1385,1387,1389,1392,1394],{"class":1193,"line":1366},9,[1191,1368,1332],{"class":1201},[1191,1370,1335],{"class":1320},[1191,1372,1305],{"class":1201},[1191,1374,1215],{"class":1201},[1191,1376,1377],{"class":1218},"total",[1191,1379,1345],{"class":1201},[1191,1381,1348],{"class":1201},[1191,1383,1384],{"class":1320},"     normalize",[1191,1386,1305],{"class":1201},[1191,1388,1215],{"class":1201},[1191,1390,1391],{"class":1218},"cents",[1191,1393,1345],{"class":1201},[1191,1395,1363],{"class":1201},[1191,1397,1399,1401,1403,1405,1407,1410,1412,1414,1416,1418,1420,1423,1425],{"class":1193,"line":1398},10,[1191,1400,1332],{"class":1201},[1191,1402,1335],{"class":1320},[1191,1404,1305],{"class":1201},[1191,1406,1215],{"class":1201},[1191,1408,1409],{"class":1218},"issueDate",[1191,1411,1345],{"class":1201},[1191,1413,1348],{"class":1201},[1191,1415,1351],{"class":1320},[1191,1417,1305],{"class":1201},[1191,1419,1215],{"class":1201},[1191,1421,1422],{"class":1218},"iso-date",[1191,1424,1345],{"class":1201},[1191,1426,1363],{"class":1201},[1191,1428,1430,1433],{"class":1193,"line":1429},11,[1191,1431,1432],{"class":1205},"  ]",[1191,1434,1435],{"class":1201},",\n",[1191,1437,1439],{"class":1193,"line":1438},12,[1191,1440,1441],{"class":1201},"}\n",[1191,1443,1445],{"class":1193,"line":1444},13,[1191,1446,1292],{"emptyLinePlaceholder":1291},[1191,1448,1450,1452,1455,1458,1461,1464,1467],{"class":1193,"line":1449},14,[1191,1451,1299],{"class":1298},[1191,1453,1454],{"class":1205}," db ",[1191,1456,1457],{"class":1201},"=",[1191,1459,1460],{"class":1197}," await",[1191,1462,1206],{"class":1463},"s2Zo4",[1191,1465,1466],{"class":1205},"(",[1191,1468,1469],{"class":1201},"{\n",[1191,1471,1473,1476,1478,1480,1483],{"class":1193,"line":1472},15,[1191,1474,1475],{"class":1320},"  store",[1191,1477,1305],{"class":1201},[1191,1479,1251],{"class":1463},[1191,1481,1482],{"class":1205},"()",[1191,1484,1435],{"class":1201},[1191,1486,1488,1491,1493,1495,1498,1500],{"class":1193,"line":1487},16,[1191,1489,1490],{"class":1320},"  user",[1191,1492,1305],{"class":1201},[1191,1494,1215],{"class":1201},[1191,1496,1497],{"class":1218},"firm",[1191,1499,1345],{"class":1201},[1191,1501,1435],{"class":1201},[1191,1503,1505,1508,1510,1512,1515,1517],{"class":1193,"line":1504},17,[1191,1506,1507],{"class":1320},"  secret",[1191,1509,1305],{"class":1201},[1191,1511,1215],{"class":1201},[1191,1513,1514],{"class":1218},"firm-pass-2026",[1191,1516,1345],{"class":1201},[1191,1518,1435],{"class":1201},[1191,1520,1522,1525,1527,1529,1531,1533],{"class":1193,"line":1521},18,[1191,1523,1524],{"class":1320},"  attestationStrategy",[1191,1526,1305],{"class":1201},[1191,1528,1231],{"class":1463},[1191,1530,1482],{"class":1205},[1191,1532,1348],{"class":1201},[1191,1534,1536],{"class":1535},"sHwdD"," \u002F\u002F attestation is opt-in\n",[1191,1538,1540,1543],{"class":1193,"line":1539},19,[1191,1541,1542],{"class":1201},"}",[1191,1544,1545],{"class":1205},")\n",[1191,1547,1549,1551,1554,1556,1558,1561,1563,1566,1568,1570,1573,1575],{"class":1193,"line":1548},20,[1191,1550,1299],{"class":1298},[1191,1552,1553],{"class":1205}," vault ",[1191,1555,1457],{"class":1201},[1191,1557,1460],{"class":1197},[1191,1559,1560],{"class":1205}," db",[1191,1562,1062],{"class":1201},[1191,1564,1565],{"class":1463},"openVault",[1191,1567,1466],{"class":1205},[1191,1569,1345],{"class":1201},[1191,1571,1572],{"class":1218},"books",[1191,1574,1345],{"class":1201},[1191,1576,1545],{"class":1205},[1191,1578,1580],{"class":1193,"line":1579},21,[1191,1581,1292],{"emptyLinePlaceholder":1291},[1191,1583,1585,1588],{"class":1193,"line":1584},22,[1191,1586,1587],{"class":1197},"await",[1191,1589,1590],{"class":1205}," vault\n",[1191,1592,1594,1597,1600,1602,1604,1607,1609,1611,1613,1616,1618],{"class":1193,"line":1593},23,[1191,1595,1596],{"class":1201},"  .",[1191,1598,1599],{"class":1463},"collection",[1191,1601,1466],{"class":1205},[1191,1603,1345],{"class":1201},[1191,1605,1606],{"class":1218},"invoices",[1191,1608,1345],{"class":1201},[1191,1610,1348],{"class":1201},[1191,1612,1202],{"class":1201},[1191,1614,1615],{"class":1205}," attestation ",[1191,1617,1542],{"class":1201},[1191,1619,1545],{"class":1205},[1191,1621,1623,1625,1628,1630,1632,1635,1637,1639,1641,1644,1646,1648,1650,1652,1654,1657,1659,1661,1664,1666,1668,1671,1673,1677,1679,1682,1684,1686,1689,1691,1693],{"class":1193,"line":1622},24,[1191,1624,1596],{"class":1201},[1191,1626,1627],{"class":1463},"put",[1191,1629,1466],{"class":1205},[1191,1631,1345],{"class":1201},[1191,1633,1634],{"class":1218},"inv-1",[1191,1636,1345],{"class":1201},[1191,1638,1348],{"class":1201},[1191,1640,1202],{"class":1201},[1191,1642,1643],{"class":1320}," id",[1191,1645,1305],{"class":1201},[1191,1647,1215],{"class":1201},[1191,1649,1634],{"class":1218},[1191,1651,1345],{"class":1201},[1191,1653,1348],{"class":1201},[1191,1655,1656],{"class":1320}," invoiceNo",[1191,1658,1305],{"class":1201},[1191,1660,1215],{"class":1201},[1191,1662,1663],{"class":1218},"INV-1042",[1191,1665,1345],{"class":1201},[1191,1667,1348],{"class":1201},[1191,1669,1670],{"class":1320}," total",[1191,1672,1305],{"class":1201},[1191,1674,1676],{"class":1675},"sbssI"," 1234.5",[1191,1678,1348],{"class":1201},[1191,1680,1681],{"class":1320}," issueDate",[1191,1683,1305],{"class":1201},[1191,1685,1215],{"class":1201},[1191,1687,1688],{"class":1218},"2026-05-29",[1191,1690,1345],{"class":1201},[1191,1692,1209],{"class":1201},[1191,1694,1545],{"class":1205},[1191,1696,1698],{"class":1193,"line":1697},25,[1191,1699,1292],{"emptyLinePlaceholder":1291},[1191,1701,1703,1705,1707,1710,1712,1715,1717,1720,1722,1725,1727,1729,1731,1734,1736,1739,1741,1743,1745,1747,1749,1751,1753,1755],{"class":1193,"line":1702},26,[1191,1704,1299],{"class":1298},[1191,1706,1202],{"class":1201},[1191,1708,1709],{"class":1205}," docId",[1191,1711,1348],{"class":1201},[1191,1713,1714],{"class":1205}," qr",[1191,1716,1348],{"class":1201},[1191,1718,1719],{"class":1205}," keyId",[1191,1721,1348],{"class":1201},[1191,1723,1724],{"class":1205}," publicKeyB64 ",[1191,1726,1542],{"class":1201},[1191,1728,1311],{"class":1201},[1191,1730,1460],{"class":1197},[1191,1732,1733],{"class":1205}," vault",[1191,1735,1062],{"class":1201},[1191,1737,1738],{"class":1463},"issueAttestation",[1191,1740,1466],{"class":1205},[1191,1742,1345],{"class":1201},[1191,1744,1606],{"class":1218},[1191,1746,1345],{"class":1201},[1191,1748,1348],{"class":1201},[1191,1750,1215],{"class":1201},[1191,1752,1634],{"class":1218},[1191,1754,1345],{"class":1201},[1191,1756,1545],{"class":1205},[1182,1758,1761],{"className":1759,"code":1760,"language":141,"meta":1187,"style":1187},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"docId\": \"01JWK4Y4B7Q6…\",\n  \"qr\": \"eyJ2IjoxLCJkb2NJZCI6IjAxSldLNFk0…\",\n  \"keyId\": \"k1_Zm5vcXAx…\",\n  \"publicKeyB64\": \"hV3nJq0T…\"\n}\n",[953,1762,1763,1767,1790,1810,1830,1849],{"__ignoreMap":1187},[1191,1764,1765],{"class":1193,"line":1194},[1191,1766,1469],{"class":1201},[1191,1768,1769,1772,1775,1778,1780,1783,1786,1788],{"class":1193,"line":1224},[1191,1770,1771],{"class":1201},"  \"",[1191,1773,1774],{"class":1298},"docId",[1191,1776,1777],{"class":1201},"\"",[1191,1779,1305],{"class":1201},[1191,1781,1782],{"class":1201}," \"",[1191,1784,1785],{"class":1218},"01JWK4Y4B7Q6…",[1191,1787,1777],{"class":1201},[1191,1789,1435],{"class":1201},[1191,1791,1792,1794,1797,1799,1801,1803,1806,1808],{"class":1193,"line":1244},[1191,1793,1771],{"class":1201},[1191,1795,1796],{"class":1298},"qr",[1191,1798,1777],{"class":1201},[1191,1800,1305],{"class":1201},[1191,1802,1782],{"class":1201},[1191,1804,1805],{"class":1218},"eyJ2IjoxLCJkb2NJZCI6IjAxSldLNFk0…",[1191,1807,1777],{"class":1201},[1191,1809,1435],{"class":1201},[1191,1811,1812,1814,1817,1819,1821,1823,1826,1828],{"class":1193,"line":1265},[1191,1813,1771],{"class":1201},[1191,1815,1816],{"class":1298},"keyId",[1191,1818,1777],{"class":1201},[1191,1820,1305],{"class":1201},[1191,1822,1782],{"class":1201},[1191,1824,1825],{"class":1218},"k1_Zm5vcXAx…",[1191,1827,1777],{"class":1201},[1191,1829,1435],{"class":1201},[1191,1831,1832,1834,1837,1839,1841,1843,1846],{"class":1193,"line":1288},[1191,1833,1771],{"class":1201},[1191,1835,1836],{"class":1298},"publicKeyB64",[1191,1838,1777],{"class":1201},[1191,1840,1305],{"class":1201},[1191,1842,1782],{"class":1201},[1191,1844,1845],{"class":1218},"hV3nJq0T…",[1191,1847,1848],{"class":1201},"\"\n",[1191,1850,1851],{"class":1193,"line":1295},[1191,1852,1441],{"class":1201},[941,1854,1855,1857,1858,1861,1862,1864,1865,1867,1868,1871],{},[953,1856,1796],{}," is a base64url-encoded JSON payload\n",[953,1859,1860],{},"{ v, docId, salt, alg: 'ed25519', keyId, fieldHashes, sig }"," — salted\nper-field hashes plus the firm's Ed25519 signature. ",[953,1863,1816],{}," is a fingerprint\nof the signing public key, so the verifier can pick the right key after\nrotation. ",[953,1866,1836],{}," (also available later via\n",[953,1869,1870],{},"vault.getDocumentSigningPublicKey()",") is what you hand to verifiers.",[1042,1873,1875],{"id":1874},"step-2-seal-and-upload-the-render-payload","Step 2 — Seal and upload the render payload",[941,1877,1878,1879,1881,1882,1884],{},"The firm KMS-encrypts (seals) the small render payload and puts the ciphertext\nin S3. This is ",[953,1880,963],{}," in action — the same\n",[953,1883,966],{}," used to seal vault secrets at a trusted host:",[1182,1886,1888],{"className":1184,"code":1887,"language":1186,"meta":1187,"style":1187},"import { sealAndUpload } from '@noy-db\u002Frecipe-aws-kms-pdf-attestation\u002Fseal'\nimport type { RenderPayload } from '@noy-db\u002Frecipe-aws-kms-pdf-attestation'\n\nconst payload: RenderPayload = {\n  docId,\n  qr,\n  fields: { invoiceNo: 'INV-1042', total: 1234.5, issueDate: '2026-05-29' },\n}\n\nawait sealAndUpload(payload, {\n  keyId: 'arn:aws:kms:eu-west-1:123456789012:key\u002Fabc',\n  bucket: 'firm-docs',\n  key: `docs\u002F${docId}`,\n})\n\u002F\u002F → S3 object docs\u002F\u003CdocId> now holds the KMS ciphertext; AWS credentials\n\u002F\u002F   come from the SDK's ambient chain (IAM role, env vars, ~\u002F.aws\u002Fcredentials)\n",[953,1889,1890,1910,1932,1936,1951,1958,1965,2005,2009,2013,2026,2042,2058,2081,2087,2092],{"__ignoreMap":1187},[1191,1891,1892,1894,1896,1899,1901,1903,1905,1908],{"class":1193,"line":1194},[1191,1893,1198],{"class":1197},[1191,1895,1202],{"class":1201},[1191,1897,1898],{"class":1205}," sealAndUpload",[1191,1900,1209],{"class":1201},[1191,1902,1212],{"class":1197},[1191,1904,1215],{"class":1201},[1191,1906,1907],{"class":1218},"@noy-db\u002Frecipe-aws-kms-pdf-attestation\u002Fseal",[1191,1909,1221],{"class":1201},[1191,1911,1912,1914,1916,1918,1921,1923,1925,1927,1930],{"class":1193,"line":1224},[1191,1913,1198],{"class":1197},[1191,1915,1270],{"class":1197},[1191,1917,1202],{"class":1201},[1191,1919,1920],{"class":1205}," RenderPayload",[1191,1922,1209],{"class":1201},[1191,1924,1212],{"class":1197},[1191,1926,1215],{"class":1201},[1191,1928,1929],{"class":1218},"@noy-db\u002Frecipe-aws-kms-pdf-attestation",[1191,1931,1221],{"class":1201},[1191,1933,1934],{"class":1193,"line":1244},[1191,1935,1292],{"emptyLinePlaceholder":1291},[1191,1937,1938,1940,1943,1945,1947,1949],{"class":1193,"line":1265},[1191,1939,1299],{"class":1298},[1191,1941,1942],{"class":1205}," payload",[1191,1944,1305],{"class":1201},[1191,1946,1920],{"class":1308},[1191,1948,1311],{"class":1201},[1191,1950,1314],{"class":1201},[1191,1952,1953,1956],{"class":1193,"line":1288},[1191,1954,1955],{"class":1205},"  docId",[1191,1957,1435],{"class":1201},[1191,1959,1960,1963],{"class":1193,"line":1295},[1191,1961,1962],{"class":1205},"  qr",[1191,1964,1435],{"class":1201},[1191,1966,1967,1969,1971,1973,1975,1977,1979,1981,1983,1985,1987,1989,1991,1993,1995,1997,1999,2001,2003],{"class":1193,"line":1317},[1191,1968,1321],{"class":1320},[1191,1970,1305],{"class":1201},[1191,1972,1202],{"class":1201},[1191,1974,1656],{"class":1320},[1191,1976,1305],{"class":1201},[1191,1978,1215],{"class":1201},[1191,1980,1663],{"class":1218},[1191,1982,1345],{"class":1201},[1191,1984,1348],{"class":1201},[1191,1986,1670],{"class":1320},[1191,1988,1305],{"class":1201},[1191,1990,1676],{"class":1675},[1191,1992,1348],{"class":1201},[1191,1994,1681],{"class":1320},[1191,1996,1305],{"class":1201},[1191,1998,1215],{"class":1201},[1191,2000,1688],{"class":1218},[1191,2002,1345],{"class":1201},[1191,2004,1363],{"class":1201},[1191,2006,2007],{"class":1193,"line":1329},[1191,2008,1441],{"class":1201},[1191,2010,2011],{"class":1193,"line":1366},[1191,2012,1292],{"emptyLinePlaceholder":1291},[1191,2014,2015,2017,2019,2022,2024],{"class":1193,"line":1398},[1191,2016,1587],{"class":1197},[1191,2018,1898],{"class":1463},[1191,2020,2021],{"class":1205},"(payload",[1191,2023,1348],{"class":1201},[1191,2025,1314],{"class":1201},[1191,2027,2028,2031,2033,2035,2038,2040],{"class":1193,"line":1429},[1191,2029,2030],{"class":1320},"  keyId",[1191,2032,1305],{"class":1201},[1191,2034,1215],{"class":1201},[1191,2036,2037],{"class":1218},"arn:aws:kms:eu-west-1:123456789012:key\u002Fabc",[1191,2039,1345],{"class":1201},[1191,2041,1435],{"class":1201},[1191,2043,2044,2047,2049,2051,2054,2056],{"class":1193,"line":1438},[1191,2045,2046],{"class":1320},"  bucket",[1191,2048,1305],{"class":1201},[1191,2050,1215],{"class":1201},[1191,2052,2053],{"class":1218},"firm-docs",[1191,2055,1345],{"class":1201},[1191,2057,1435],{"class":1201},[1191,2059,2060,2063,2065,2068,2071,2074,2076,2079],{"class":1193,"line":1444},[1191,2061,2062],{"class":1320},"  key",[1191,2064,1305],{"class":1201},[1191,2066,2067],{"class":1201}," `",[1191,2069,2070],{"class":1218},"docs\u002F",[1191,2072,2073],{"class":1201},"${",[1191,2075,1774],{"class":1205},[1191,2077,2078],{"class":1201},"}`",[1191,2080,1435],{"class":1201},[1191,2082,2083,2085],{"class":1193,"line":1449},[1191,2084,1542],{"class":1201},[1191,2086,1545],{"class":1205},[1191,2088,2089],{"class":1193,"line":1472},[1191,2090,2091],{"class":1535},"\u002F\u002F → S3 object docs\u002F\u003CdocId> now holds the KMS ciphertext; AWS credentials\n",[1191,2093,2094],{"class":1193,"line":1487},[1191,2095,2096],{"class":1535},"\u002F\u002F   come from the SDK's ambient chain (IAM role, env vars, ~\u002F.aws\u002Fcredentials)\n",[941,2098,2099,2100,2103,2104,2107,2108,2111,2112,2115,2116,2119],{},"Under the hood it is three lines: ",[953,2101,2102],{},"atAwsKms({ keyId }).seal(bytes)","\n→ ",[953,2105,2106],{},"PutObjectCommand",". The payload is capped at ",[944,2109,2110],{},"4 KB"," (the AWS KMS ",[953,2113,2114],{},"Encrypt","\nplaintext limit); ",[953,2117,2118],{},"encodeRenderPayload"," throws past that. Attestation payloads\n(declared fields + QR string) are normally far under it.",[1042,2121,2123],{"id":2122},"step-3-the-render-lambda","Step 3 — The render Lambda",[941,2125,2126],{},"The deployed handler is hub-free — it never opens a vault. Per request it:",[1114,2128,2129,2136,2147,2171],{},[1050,2130,2131,2132,2135],{},"verifies the signed share link (see below) — otherwise ",[944,2133,2134],{},"403",";",[1050,2137,2138,2140,2141,2143,2144,2135],{},[953,2139,1086],{}," on ",[953,2142,1139],{}," — missing → ",[944,2145,2146],{},"404",[1050,2148,2149,2150,1157,2152,1157,2155,2158,2159,2162,2163,2166,2167,2170],{},"KMS ",[953,2151,1090],{},[953,2153,2154],{},"decodeRenderPayload",[953,2156,2157],{},"buildInvoiceHtml"," (QR as inline\n",[953,2160,2161],{},"\u003Csvg>",", drawn with ",[953,2164,2165],{},"qrcode",") → ",[953,2168,2169],{},"renderPdf"," via headless Chromium;",[1050,2172,2173],{},"returns the PDF:",[1182,2175,2177],{"className":1759,"code":2176,"language":141,"meta":1187,"style":1187},"{\n  \"statusCode\": 200,\n  \"headers\": { \"content-type\": \"application\u002Fpdf\" },\n  \"isBase64Encoded\": true,\n  \"body\": \"JVBERi0xLjQK…\"\n}\n",[953,2178,2179,2183,2199,2230,2244,2262],{"__ignoreMap":1187},[1191,2180,2181],{"class":1193,"line":1194},[1191,2182,1469],{"class":1201},[1191,2184,2185,2187,2190,2192,2194,2197],{"class":1193,"line":1224},[1191,2186,1771],{"class":1201},[1191,2188,2189],{"class":1298},"statusCode",[1191,2191,1777],{"class":1201},[1191,2193,1305],{"class":1201},[1191,2195,2196],{"class":1675}," 200",[1191,2198,1435],{"class":1201},[1191,2200,2201,2203,2206,2208,2210,2212,2214,2217,2219,2221,2223,2226,2228],{"class":1193,"line":1244},[1191,2202,1771],{"class":1201},[1191,2204,2205],{"class":1298},"headers",[1191,2207,1777],{"class":1201},[1191,2209,1305],{"class":1201},[1191,2211,1202],{"class":1201},[1191,2213,1782],{"class":1201},[1191,2215,2216],{"class":1308},"content-type",[1191,2218,1777],{"class":1201},[1191,2220,1305],{"class":1201},[1191,2222,1782],{"class":1201},[1191,2224,2225],{"class":1218},"application\u002Fpdf",[1191,2227,1777],{"class":1201},[1191,2229,1363],{"class":1201},[1191,2231,2232,2234,2237,2239,2241],{"class":1193,"line":1265},[1191,2233,1771],{"class":1201},[1191,2235,2236],{"class":1298},"isBase64Encoded",[1191,2238,1777],{"class":1201},[1191,2240,1305],{"class":1201},[1191,2242,2243],{"class":1201}," true,\n",[1191,2245,2246,2248,2251,2253,2255,2257,2260],{"class":1193,"line":1288},[1191,2247,1771],{"class":1201},[1191,2249,2250],{"class":1298},"body",[1191,2252,1777],{"class":1201},[1191,2254,1305],{"class":1201},[1191,2256,1782],{"class":1201},[1191,2258,2259],{"class":1218},"JVBERi0xLjQK…",[1191,2261,1848],{"class":1201},[1191,2263,2264],{"class":1193,"line":1295},[1191,2265,1441],{"class":1201},[941,2267,2268,2269,1034,2272,1435,2275,2278,2279,2282,2283,2286,2287,2290,2291,2293],{},"Configuration is four environment variables: ",[953,2270,2271],{},"DOCS_BUCKET",[953,2273,2274],{},"KMS_KEY_ID",[953,2276,2277],{},"DOCS_PREFIX"," (default ",[953,2280,2281],{},"docs","), and ",[953,2284,2285],{},"SHARE_SECRET_ARN"," (a Secrets Manager ARN;\nthe secret value is fetched once per cold start and cached). The handler\nfactory ",[953,2288,2289],{},"makeHandler(deps)"," takes the S3\u002FKMS clients and ",[953,2292,2169],{}," as\ninjected dependencies, so the whole flow unit-tests with mocks and no AWS.",[1042,2295,2297],{"id":2296},"step-4-verify-the-qr-offline","Step 4 — Verify the QR offline",[941,2299,2300],{},"Anyone with the PDF (or a print of it) recomputes the commitment from what\nthey can read on the paper and checks the signature — no network, no firm\ninvolvement:",[1182,2302,2304],{"className":1184,"code":2303,"language":1186,"meta":1187,"style":1187},"import { verifyDocument } from '@noy-db\u002Frecipe-attestation-verifier'\n\nconst printed = { invoiceNo: 'INV-1042', total: '1234.50', issueDate: '2026-05-29' }\nconst verdict = await verifyDocument(qr, printed, {\n  publicKeys: { [keyId]: publicKeyB64 },\n  fieldSchema: attestation,\n})\nverdict.outcome \u002F\u002F → 'authentic-valid'\n",[953,2305,2306,2326,2330,2379,2404,2428,2439,2445],{"__ignoreMap":1187},[1191,2307,2308,2310,2312,2315,2317,2319,2321,2324],{"class":1193,"line":1194},[1191,2309,1198],{"class":1197},[1191,2311,1202],{"class":1201},[1191,2313,2314],{"class":1205}," verifyDocument",[1191,2316,1209],{"class":1201},[1191,2318,1212],{"class":1197},[1191,2320,1215],{"class":1201},[1191,2322,2323],{"class":1218},"@noy-db\u002Frecipe-attestation-verifier",[1191,2325,1221],{"class":1201},[1191,2327,2328],{"class":1193,"line":1224},[1191,2329,1292],{"emptyLinePlaceholder":1291},[1191,2331,2332,2334,2337,2339,2341,2343,2345,2347,2349,2351,2353,2355,2357,2359,2362,2364,2366,2368,2370,2372,2374,2376],{"class":1193,"line":1244},[1191,2333,1299],{"class":1298},[1191,2335,2336],{"class":1205}," printed ",[1191,2338,1457],{"class":1201},[1191,2340,1202],{"class":1201},[1191,2342,1656],{"class":1320},[1191,2344,1305],{"class":1201},[1191,2346,1215],{"class":1201},[1191,2348,1663],{"class":1218},[1191,2350,1345],{"class":1201},[1191,2352,1348],{"class":1201},[1191,2354,1670],{"class":1320},[1191,2356,1305],{"class":1201},[1191,2358,1215],{"class":1201},[1191,2360,2361],{"class":1218},"1234.50",[1191,2363,1345],{"class":1201},[1191,2365,1348],{"class":1201},[1191,2367,1681],{"class":1320},[1191,2369,1305],{"class":1201},[1191,2371,1215],{"class":1201},[1191,2373,1688],{"class":1218},[1191,2375,1345],{"class":1201},[1191,2377,2378],{"class":1201}," }\n",[1191,2380,2381,2383,2386,2388,2390,2392,2395,2397,2400,2402],{"class":1193,"line":1265},[1191,2382,1299],{"class":1298},[1191,2384,2385],{"class":1205}," verdict ",[1191,2387,1457],{"class":1201},[1191,2389,1460],{"class":1197},[1191,2391,2314],{"class":1463},[1191,2393,2394],{"class":1205},"(qr",[1191,2396,1348],{"class":1201},[1191,2398,2399],{"class":1205}," printed",[1191,2401,1348],{"class":1201},[1191,2403,1314],{"class":1201},[1191,2405,2406,2409,2411,2413,2416,2418,2421,2423,2425],{"class":1193,"line":1288},[1191,2407,2408],{"class":1320},"  publicKeys",[1191,2410,1305],{"class":1201},[1191,2412,1202],{"class":1201},[1191,2414,2415],{"class":1320}," [",[1191,2417,1816],{"class":1205},[1191,2419,2420],{"class":1320},"]",[1191,2422,1305],{"class":1201},[1191,2424,1724],{"class":1205},[1191,2426,2427],{"class":1201},"},\n",[1191,2429,2430,2433,2435,2437],{"class":1193,"line":1295},[1191,2431,2432],{"class":1320},"  fieldSchema",[1191,2434,1305],{"class":1201},[1191,2436,1302],{"class":1205},[1191,2438,1435],{"class":1201},[1191,2440,2441,2443],{"class":1193,"line":1317},[1191,2442,1542],{"class":1201},[1191,2444,1545],{"class":1205},[1191,2446,2447,2450,2452,2455],{"class":1193,"line":1329},[1191,2448,2449],{"class":1205},"verdict",[1191,2451,1062],{"class":1201},[1191,2453,2454],{"class":1205},"outcome ",[1191,2456,2457],{"class":1535},"\u002F\u002F → 'authentic-valid'\n",[941,2459,2460,2461,2464,2465,1034,2468,1034,2471,1034,2474,2477,2478,1062],{},"Other outcomes: ",[953,2462,2463],{},"altered"," (with the differing field localized),\n",[953,2466,2467],{},"signature-invalid",[953,2469,2470],{},"authentic-revoked",[953,2472,2473],{},"unknown-key",[953,2475,2476],{},"unreadable-qr",". The\nfull verifier — including a self-contained static HTML page — is the\n",[972,2479,1002],{"href":516},[1042,2481,2483],{"id":2482},"gating-the-endpoint-stateless-signed-share-links","Gating the endpoint — stateless signed share links",[941,2485,2486,2487,2490,2491,2494],{},"The render endpoint returns decrypted document content, so it must not be\nopen. Instead of an AWS authorizer, Cognito, or any identity provider, the\nLambda gates itself with a ",[944,2488,2489],{},"stateless signed magic link",": an HMAC-SHA256\nover ",[953,2492,2493],{},"canonicalJson({ v, docId, exp })"," keyed by a Secrets Manager secret.",[1182,2496,2498],{"className":1184,"code":2497,"language":1186,"meta":1187,"style":1187},"import { mintShareLink } from '@noy-db\u002Frecipe-aws-kms-pdf-attestation\u002Fshare-link'\n\n\u002F\u002F The share-signing secret is an ASCII string (here from Secrets Manager or an\n\u002F\u002F env var); its utf8 bytes are the HMAC key — mint and verify must encode it\n\u002F\u002F identically.\nconst shareSecret = new TextEncoder().encode(process.env.SHARE_SECRET!)\n\nconst url = await mintShareLink(docId, {\n  secret: shareSecret,\n  baseUrl: 'https:\u002F\u002Fabc123.lambda-url.eu-west-1.on.aws\u002F',\n  ttlMs: 60 * 60 * 1000,               \u002F\u002F optional; default 24 h, capped at 7 d\n})\n\u002F\u002F → 'https:\u002F\u002Fabc123.lambda-url.eu-west-1.on.aws\u002F?d=01JWK4Y4B7Q6…&exp=1751975432000&sig=tJ9vJq…'\n",[953,2499,2500,2520,2524,2529,2534,2539,2578,2582,2602,2613,2629,2654,2660],{"__ignoreMap":1187},[1191,2501,2502,2504,2506,2509,2511,2513,2515,2518],{"class":1193,"line":1194},[1191,2503,1198],{"class":1197},[1191,2505,1202],{"class":1201},[1191,2507,2508],{"class":1205}," mintShareLink",[1191,2510,1209],{"class":1201},[1191,2512,1212],{"class":1197},[1191,2514,1215],{"class":1201},[1191,2516,2517],{"class":1218},"@noy-db\u002Frecipe-aws-kms-pdf-attestation\u002Fshare-link",[1191,2519,1221],{"class":1201},[1191,2521,2522],{"class":1193,"line":1224},[1191,2523,1292],{"emptyLinePlaceholder":1291},[1191,2525,2526],{"class":1193,"line":1244},[1191,2527,2528],{"class":1535},"\u002F\u002F The share-signing secret is an ASCII string (here from Secrets Manager or an\n",[1191,2530,2531],{"class":1193,"line":1265},[1191,2532,2533],{"class":1535},"\u002F\u002F env var); its utf8 bytes are the HMAC key — mint and verify must encode it\n",[1191,2535,2536],{"class":1193,"line":1288},[1191,2537,2538],{"class":1535},"\u002F\u002F identically.\n",[1191,2540,2541,2543,2546,2548,2551,2554,2556,2558,2561,2564,2566,2568,2570,2573,2576],{"class":1193,"line":1295},[1191,2542,1299],{"class":1298},[1191,2544,2545],{"class":1205}," shareSecret ",[1191,2547,1457],{"class":1201},[1191,2549,2550],{"class":1201}," new",[1191,2552,2553],{"class":1463}," TextEncoder",[1191,2555,1482],{"class":1205},[1191,2557,1062],{"class":1201},[1191,2559,2560],{"class":1463},"encode",[1191,2562,2563],{"class":1205},"(process",[1191,2565,1062],{"class":1201},[1191,2567,183],{"class":1205},[1191,2569,1062],{"class":1201},[1191,2571,2572],{"class":1205},"SHARE_SECRET",[1191,2574,2575],{"class":1201},"!",[1191,2577,1545],{"class":1205},[1191,2579,2580],{"class":1193,"line":1317},[1191,2581,1292],{"emptyLinePlaceholder":1291},[1191,2583,2584,2586,2589,2591,2593,2595,2598,2600],{"class":1193,"line":1329},[1191,2585,1299],{"class":1298},[1191,2587,2588],{"class":1205}," url ",[1191,2590,1457],{"class":1201},[1191,2592,1460],{"class":1197},[1191,2594,2508],{"class":1463},[1191,2596,2597],{"class":1205},"(docId",[1191,2599,1348],{"class":1201},[1191,2601,1314],{"class":1201},[1191,2603,2604,2606,2608,2611],{"class":1193,"line":1366},[1191,2605,1507],{"class":1320},[1191,2607,1305],{"class":1201},[1191,2609,2610],{"class":1205}," shareSecret",[1191,2612,1435],{"class":1201},[1191,2614,2615,2618,2620,2622,2625,2627],{"class":1193,"line":1398},[1191,2616,2617],{"class":1320},"  baseUrl",[1191,2619,1305],{"class":1201},[1191,2621,1215],{"class":1201},[1191,2623,2624],{"class":1218},"https:\u002F\u002Fabc123.lambda-url.eu-west-1.on.aws\u002F",[1191,2626,1345],{"class":1201},[1191,2628,1435],{"class":1201},[1191,2630,2631,2634,2636,2639,2642,2644,2646,2649,2651],{"class":1193,"line":1429},[1191,2632,2633],{"class":1320},"  ttlMs",[1191,2635,1305],{"class":1201},[1191,2637,2638],{"class":1675}," 60",[1191,2640,2641],{"class":1201}," *",[1191,2643,2638],{"class":1675},[1191,2645,2641],{"class":1201},[1191,2647,2648],{"class":1675}," 1000",[1191,2650,1348],{"class":1201},[1191,2652,2653],{"class":1535},"               \u002F\u002F optional; default 24 h, capped at 7 d\n",[1191,2655,2656,2658],{"class":1193,"line":1438},[1191,2657,1542],{"class":1201},[1191,2659,1545],{"class":1205},[1191,2661,2662],{"class":1193,"line":1444},[1191,2663,2664],{"class":1535},"\u002F\u002F → 'https:\u002F\u002Fabc123.lambda-url.eu-west-1.on.aws\u002F?d=01JWK4Y4B7Q6…&exp=1751975432000&sig=tJ9vJq…'\n",[941,2666,2667,2668,2671,2672,2675,2676,2679,2680,2683,2684,2687,2688,2687,2691,2694,2695,2698,2699,2701,2702,2705,2706,2708],{},"On the Lambda side, ",[953,2669,2670],{},"verifyShareToken"," checks the signature in constant time\nand returns either ",[953,2673,2674],{},"{ ok: true, docId }"," or ",[953,2677,2678],{},"{ ok: false, reason }"," with\n",[953,2681,2682],{},"reason"," one of ",[953,2685,2686],{},"missing-token"," \u002F ",[953,2689,2690],{},"malformed",[953,2692,2693],{},"expired"," \u002F\n",[953,2696,2697],{},"invalid-signature"," — each rejected with ",[944,2700,2134],{},". A bare ",[953,2703,2704],{},"?docId="," request is\n",[953,2707,2686],{},": there is no unauthenticated path. Properties to be aware of:",[1047,2710,2711,2718,2724],{},[1050,2712,2713,2714,2717],{},"Links are ",[944,2715,2716],{},"bearer capabilities",": multi-use within their TTL, safe to\nforward by design.",[1050,2719,2720,2723],{},[944,2721,2722],{},"Revocation = rotate the share secret"," — every live link is invalidated\nat once. Rotating the share secret never touches the KMS data key, so\ndocument access and link revocation stay independent.",[1050,2725,2726,2727,2730],{},"The Lambda Function URL stays ",[953,2728,2729],{},"authType: NONE"," at the AWS layer — the\nLambda itself is the gate.",[1042,2732,2734],{"id":2733},"trust-model-and-limits","Trust model and limits",[1047,2736,2737,2744,2758,2764],{},[1050,2738,2739,2740,2743],{},"The QR carries the signed per-field commitment; the PDF is ",[944,2741,2742],{},"generated,\nnever verified server-side",". Trust lives in the offline verification, not\nin the rendering endpoint.",[1050,2745,2746,2747,2750,2751,2757],{},"The KMS key holder (your AWS account) ",[1169,2748,2749],{},"can"," decrypt the render payloads —\nthat is the deliberate ",[972,2752,2753,2756],{"href":170},[953,2754,2755],{},"at-*"," trust boundary",". The payload is\nonly the declared fields plus the QR, not the vault.",[1050,2759,2760,2761,2763],{},"Render payloads are limited to 4 KB by KMS ",[953,2762,2114],{},"; envelope encryption\nfor larger payloads is out of this recipe's scope.",[1050,2765,2766,2768],{},[953,2767,2169],{}," needs a Chromium binary, so the PDF step only runs deployed (or\nlocally with Chromium available) — not in plain CI.",[1042,2770,2772],{"id":2771},"deploying-and-testing","Deploying and testing",[941,2774,2775,2776,2779,2780,2783,2784,1062],{},"The recipe ships a CDK stack (",[953,2777,2778],{},"infra\u002F",") that provisions the whole thing with\nleast-privilege grants: a rotation-enabled KMS key, a private S3 bucket, a\nSecrets Manager–generated share secret (256-bit, never present in the\ntemplate), and the render Lambda as an ",[944,2781,2782],{},"arm64 zip function + public Chromium\nLambda layer"," — ~1.7 MB artifact, no Docker or ECR in the deploy path (a\ncontainer variant is included for air-gapped setups). Step-by-step deploy,\nlive verification, and teardown are in the recipe's\n",[972,2785,2788],{"href":2786,"rel":2787},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Frecipes\u002Faws-kms-pdf-attestation\u002FRUNBOOK.md",[976],"RUNBOOK",[941,2790,2791,2792,2795],{},"The data path — issue → seal → decrypt → render HTML → offline verify — is\ncovered by an AWS-free test slice in the repository's test suite (mock KMS and\nS3 clients, no Chromium); the recipe's own ",[953,2793,2794],{},"pnpm test"," exercises each module\nthe same way, with the S3\u002FKMS clients injected as mocks.",[1042,2797,2799],{"id":2798},"see-also","See also",[1047,2801,2802,2807,2813],{},[1050,2803,2804,2806],{},[972,2805,990],{"href":610}," — the issue\u002Frevoke API inside the hub",[1050,2808,2809,2812],{},[972,2810,2811],{"href":516},"Offline document-attestation verifier"," — the other half",[1050,2814,2815,2821],{},[972,2816,2817,2820],{"href":170},[953,2818,2819],{},"@noy-db\u002Fat-*"," family"," — sealing-key providers and their trust boundary",[2823,2824,2825],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":1187,"searchDepth":1244,"depth":1244,"links":2827},[2828,2829,2830,2831,2832,2833,2834,2835,2836,2837],{"id":1044,"depth":1224,"text":1045},{"id":1111,"depth":1224,"text":1112},{"id":1163,"depth":1224,"text":1164},{"id":1874,"depth":1224,"text":1875},{"id":2122,"depth":1224,"text":2123},{"id":2296,"depth":1224,"text":2297},{"id":2482,"depth":1224,"text":2483},{"id":2733,"depth":1224,"text":2734},{"id":2771,"depth":1224,"text":2772},{"id":2798,"depth":1224,"text":2799},null,"Deploy an AWS Lambda that KMS-decrypts a sealed record from S3 and renders a PDF with the attestation QR embedded — verifiable fully offline.","md",{},{"title":519,"description":2839},"stable","important","pmhz8zp1zDYYN0fb5owR8jkg46E0Lv8LlWNcIk7g6oM",1791896575270]