[{"data":1,"prerenderedAt":2977},["ShallowReactive",2],{"navigation":3,"\u002Frecipes\u002Fpasswordless-oidc":927},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":555,"access":12,"apiToc":929,"body":930,"category":2969,"description":2970,"extension":2971,"meta":2972,"navigation":2969,"nest":2969,"path":556,"seo":2973,"sinceVersion":2969,"status":2974,"stem":557,"subtitle":2969,"tier":2975,"tocExternal":2969,"__hash__":2976},"docs\u002Frecipes\u002Fpasswordless-oidc.md",false,{"type":931,"value":932,"toc":2957},"minimark",[933,937,969,1001,1011,1016,1034,1140,1153,1157,1229,1233,1312,1316,1327,1522,1526,1545,1597,1600,1604,1631,2301,2310,2314,2328,2493,2502,2572,2593,2734,2738,2760,2850,2853,2923,2927,2953],[934,935,555],"h1",{"id":936},"passwordless-oidc-aws-cognito",[938,939,940],"blockquote",{},[941,942,943,947,948,951,952,955,956,960,961,964,965],"p",{},[944,945,946],"strong",{},"Audience:"," an app developer who wants users to sign in ",[944,949,950],{},"passwordlessly"," (email one-time-code or a passkey) and open their vault, with the least infrastructure to run yourself.\n",[944,953,954],{},"Bundle:"," core + ",[957,958,959],"code",{},"@noy-db\u002Fon-oidc"," (client) + ",[944,962,963],{},"one"," key-connector server you host + a managed OIDC provider (AWS Cognito). ",[966,967,968],"em",{},"(★ required)",[941,970,971,972,981,982,985,986,989,990,993,994,997,998],{},"Verified by: ",[973,974,978],"a",{"href":975,"rel":976},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Fshowcases\u002Fsrc\u002Frecipe-passwordless-oidc.recipe.test.ts",[977],"nofollow",[957,979,980],{},"showcases\u002Fsrc\u002Frecipe-passwordless-oidc.recipe.test.ts"," — the client code below is the same code that runs there. CI can't reach real Cognito, so the test signs a ",[944,983,984],{},"Cognito-shaped"," RS256 ID token locally and verifies it against a local JWKS through an in-memory key-connector; the exact same ",[957,987,988],{},"enrollOidc","\u002F",[957,991,992],{},"unlockOidc"," calls and the same ",[957,995,996],{},"verifyIdToken()"," run against real Cognito in production. ",[966,999,1000],{},"(★)",[941,1002,1003,1004,1007,1008],{},"Give users a login they never type a vault secret for: they authenticate to AWS Cognito — an emailed one-time code, or a passkey — and that federated identity unlocks their noy-db vault as a ",[944,1005,1006],{},"tier-2"," session. Cognito runs the sign-in ceremony and the account directory so you don't; noy-db stays zero-knowledge because the ID token alone can never decrypt anything. This is the cheapest, least-operations way to get federated passwordless unlock — but be clear with yourself up front: ",[944,1009,1010],{},"it is not zero-server.",[1012,1013,1015],"h2",{"id":1014},"the-three-pieces-and-the-honest-part","The three pieces (and the honest part)",[941,1017,1018,1021,1022,1025,1026,1029,1030,1033],{},[957,1019,1020],{},"on-oidc"," is a Bitwarden-style ",[944,1023,1024],{},"split-key key-connector"," design: ",[957,1027,1028],{},"KEK = serverHalf ⊕ deviceHalf",". That means passwordless-federated unlock needs ",[944,1031,1032],{},"three"," cooperating pieces, and exactly one of them is a server you must run:",[1035,1036,1038],"div",{"style":1037},"border:1px solid var(--ui-border); border-radius:0.75rem; background:var(--ui-bg-elevated); padding:1.25rem 1rem; margin:1.5rem 0; overflow-x:auto;",[1035,1039,1041,1070,1082,1107,1110],{"style":1040},"display:flex; flex-direction:column; gap:0.6rem; min-width:22rem; line-height:1.4;",[1035,1042,1044,1053],{"style":1043},"border:1px solid var(--ui-border); border-radius:0.5rem; background:var(--ui-bg); padding:0.6rem 1rem;",[1035,1045,1047,1048],{"style":1046},"font-weight:600; color:var(--ui-text-highlighted);","1 · AWS Cognito ",[1049,1050,1052],"span",{"style":1051},"font-weight:400; color:var(--ui-text-muted);","— the OIDC provider (managed)",[1035,1054,1056,1057,1061,1062,1065,1066,1069],{"style":1055},"font-size:0.8rem; color:var(--ui-text-muted);","Runs the passwordless ceremony (email OTP, or a passkey) and issues an OIDC ",[1049,1058,1060],{"style":1059},"font-family:ui-monospace,monospace;","ID token",". noy-db never sees the ceremony — only the resulting token. Proves ",[966,1063,1064],{},"who",", carries ",[966,1067,1068],{},"no"," wrap-key.",[1035,1071,1073,1074,1077,1078,1081],{"style":1072},"text-align:center; color:var(--ui-text-muted); font-size:0.7rem;","▼  ID token (RS256, ",[1049,1075,1076],{"style":1059},"sub"," + ",[1049,1079,1080],{"style":1059},"aud",")",[1035,1083,1085,1091],{"style":1084},"border:1px solid var(--ui-primary); border-radius:0.5rem; background:var(--ui-bg); padding:0.6rem 1rem;",[1035,1086,1087,1088],{"style":1046},"2 · The key-connector ",[1049,1089,1090],{"style":1051},"— a tiny server YOU host",[1035,1092,1093,1096,1097,1100,1101,1103,1104,1106],{"style":1055},[1049,1094,1095],{"style":1059},"PUT\u002FGET \u002Fkek-fragment",". Verifies the Cognito ID token against the pool's JWKS, then stores\u002Freturns the encrypted ",[1049,1098,1099],{"style":1059},"serverHalf"," keyed by ",[1049,1102,1076],{"style":1059},". This is the one piece that is not zero-infra. It holds only ",[1049,1105,1099],{"style":1059}," — useless without the device half.",[1035,1108,1109],{"style":1072},"▼  encrypted serverHalf",[1035,1111,1112,1118],{"style":1043},[1035,1113,1114,1115],{"style":1046},"3 · The noy-db client ",[1049,1116,1117],{"style":1051},"— on-oidc",[1035,1119,1120,1122,1123,1125,1126,1129,1130,1132,1133,1135,1136,1139],{"style":1055},[1049,1121,988],{"style":1059}," \u002F ",[1049,1124,992],{"style":1059}," derive the ",[1049,1127,1128],{"style":1059},"deviceHalf"," from a per-device secret (never transmitted) and XOR it with the ",[1049,1131,1099],{"style":1059}," → the KEK → a ",[944,1134,1006],{}," unlock (",[1049,1137,1138],{"style":1059},"kek: null",").",[941,1141,1142,1143,1148,1149,1152],{},"Neither Cognito nor the key-connector ever holds both halves, so a compromise of either — stolen tokens, or a breached connector — still cannot read the vault. Note that ",[944,1144,1145,1147],{},[957,1146,1020],{}," itself does not verify the ID token signature"," — that is the key-connector's job. The client only reads claims for a fast ",[957,1150,1151],{},"exp"," pre-flight.",[1012,1154,1156],{"id":1155},"prerequisites","Prerequisites",[1158,1159,1160,1174,1180,1205,1215],"ul",{},[1161,1162,1163,1166,1167,1170,1171,1139],"li",{},[944,1164,1165],{},"Packages:"," ",[957,1168,1169],{},"pnpm add @noy-db\u002Fhub @noy-db\u002Fon-oidc"," (+ a store, e.g. ",[957,1172,1173],{},"@noy-db\u002Fto-browser-idb",[1161,1175,1176,1179],{},[944,1177,1178],{},"An AWS Cognito user pool"," with passwordless sign-in and an app client (below). Cognito's free tier covers a generous monthly active-user allowance, and beyond it the per-MAU cost is low — this is the \"cheap managed provider\" choice.",[1161,1181,1182,1185,1186,1188,1189,1192,1193,1195,1196,1200,1201,1204],{},[944,1183,1184],{},"A key-connector server you host"," speaking ",[957,1187,1095],{},". It's small (below), but it ",[966,1190,1191],{},"is"," a server — if you'd rather run ",[944,1194,1068],{}," server at all, jump to ",[973,1197,1199],{"href":1198},"#limits-alternative","Limits & alternative"," for ",[957,1202,1203],{},"on-webauthn",".",[1161,1206,1207,1210,1211,1214],{},[944,1208,1209],{},"A one-time tier-1 bootstrap"," per user (secret, recovery code, or a custodian invite). The OIDC unlock is enrolled ",[966,1212,1213],{},"from"," an already-unlocked keyring — it adds a passwordless way in, it does not create the vault.",[1161,1216,1217,1224,1225,1228],{},[944,1218,1219,1220,1223],{},"Somewhere to persist the ",[957,1221,1222],{},"OidcEnrollment"," record"," — it is opaque metadata (no key material), so any store or ",[957,1226,1227],{},"localStorage"," works.",[1012,1230,1232],{"id":1231},"what-this-gets-you","What this gets you",[1234,1235,1236,1249],"table",{},[1237,1238,1239],"thead",{},[1240,1241,1242,1246],"tr",{},[1243,1244,1245],"th",{},"Capability",[1243,1247,1248],{},"Which piece provides it",[1250,1251,1252,1261,1269,1279,1293,1304],"tbody",{},[1240,1253,1254,1258],{},[1255,1256,1257],"td",{},"Passwordless sign-in (email OTP \u002F passkey)",[1255,1259,1260],{},"AWS Cognito's hosted ceremony",[1240,1262,1263,1266],{},[1255,1264,1265],{},"Federated identity, no password directory of your own",[1255,1267,1268],{},"Cognito user pool + app client",[1240,1270,1271,1274],{},[1255,1272,1273],{},"Vault unlock from that identity, zero-knowledge",[1255,1275,1276,1278],{},[957,1277,1020],{}," split-key + your key-connector",[1240,1280,1281,1284],{},[1255,1282,1283],{},"Read \u002F write the vault after unlock",[1255,1285,1286,1287,1290,1291,1081],{},"the returned tier-2 ",[957,1288,1289],{},"UnlockedKeyring"," (",[957,1292,1138],{},[1240,1294,1295,1298],{},[1255,1296,1297],{},"grant \u002F rotate \u002F enroll-another \u002F open a second vault",[1255,1299,1300,1303],{},[944,1301,1302],{},"Not"," this session — needs a tier-1 unlock",[1240,1305,1306,1309],{},[1255,1307,1308],{},"Recover a lost device",[1255,1310,1311],{},"a recovery profile or a fresh tier-1 re-enrollment — see below",[1012,1313,1315],{"id":1314},"setup","Setup",[941,1317,1318,1319,1322,1323,1326],{},"The tier-1 bootstrap is an ordinary ",[957,1320,1321],{},"createNoydb({...})",". Later sessions swap the secret for the OIDC unlock via the ",[957,1324,1325],{},"getKeyring"," seam (last block):",[1328,1329,1334],"pre",{"className":1330,"code":1331,"language":1332,"meta":1333,"style":1333},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\nimport { toMemory } from '@noy-db\u002Fto-memory' \u002F\u002F swap for toBrowserIdb() in a browser\n\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'alice',\n  secret: 'correct horse battery staple', \u002F\u002F tier-1 bootstrap, once\n})\nconst vault = await db.openVault('books')\n","ts","",[957,1335,1336,1368,1394,1401,1426,1444,1461,1482,1491],{"__ignoreMap":1333},[1049,1337,1340,1344,1348,1352,1355,1358,1361,1365],{"class":1338,"line":1339},"line",1,[1049,1341,1343],{"class":1342},"s7zQu","import",[1049,1345,1347],{"class":1346},"sMK4o"," {",[1049,1349,1351],{"class":1350},"sTEyZ"," createNoydb",[1049,1353,1354],{"class":1346}," }",[1049,1356,1357],{"class":1342}," from",[1049,1359,1360],{"class":1346}," '",[1049,1362,1364],{"class":1363},"sfazB","@noy-db\u002Fhub",[1049,1366,1367],{"class":1346},"'\n",[1049,1369,1371,1373,1375,1378,1380,1382,1384,1387,1390],{"class":1338,"line":1370},2,[1049,1372,1343],{"class":1342},[1049,1374,1347],{"class":1346},[1049,1376,1377],{"class":1350}," toMemory",[1049,1379,1354],{"class":1346},[1049,1381,1357],{"class":1342},[1049,1383,1360],{"class":1346},[1049,1385,1386],{"class":1363},"@noy-db\u002Fto-memory",[1049,1388,1389],{"class":1346},"'",[1049,1391,1393],{"class":1392},"sHwdD"," \u002F\u002F swap for toBrowserIdb() in a browser\n",[1049,1395,1397],{"class":1338,"line":1396},3,[1049,1398,1400],{"emptyLinePlaceholder":1399},true,"\n",[1049,1402,1404,1408,1411,1414,1417,1420,1423],{"class":1338,"line":1403},4,[1049,1405,1407],{"class":1406},"spNyl","const",[1049,1409,1410],{"class":1350}," db ",[1049,1412,1413],{"class":1346},"=",[1049,1415,1416],{"class":1342}," await",[1049,1418,1351],{"class":1419},"s2Zo4",[1049,1421,1422],{"class":1350},"(",[1049,1424,1425],{"class":1346},"{\n",[1049,1427,1429,1433,1436,1438,1441],{"class":1338,"line":1428},5,[1049,1430,1432],{"class":1431},"swJcz","  store",[1049,1434,1435],{"class":1346},":",[1049,1437,1377],{"class":1419},[1049,1439,1440],{"class":1350},"()",[1049,1442,1443],{"class":1346},",\n",[1049,1445,1447,1450,1452,1454,1457,1459],{"class":1338,"line":1446},6,[1049,1448,1449],{"class":1431},"  user",[1049,1451,1435],{"class":1346},[1049,1453,1360],{"class":1346},[1049,1455,1456],{"class":1363},"alice",[1049,1458,1389],{"class":1346},[1049,1460,1443],{"class":1346},[1049,1462,1464,1467,1469,1471,1474,1476,1479],{"class":1338,"line":1463},7,[1049,1465,1466],{"class":1431},"  secret",[1049,1468,1435],{"class":1346},[1049,1470,1360],{"class":1346},[1049,1472,1473],{"class":1363},"correct horse battery staple",[1049,1475,1389],{"class":1346},[1049,1477,1478],{"class":1346},",",[1049,1480,1481],{"class":1392}," \u002F\u002F tier-1 bootstrap, once\n",[1049,1483,1485,1488],{"class":1338,"line":1484},8,[1049,1486,1487],{"class":1346},"}",[1049,1489,1490],{"class":1350},")\n",[1049,1492,1494,1496,1499,1501,1503,1506,1508,1511,1513,1515,1518,1520],{"class":1338,"line":1493},9,[1049,1495,1407],{"class":1406},[1049,1497,1498],{"class":1350}," vault ",[1049,1500,1413],{"class":1346},[1049,1502,1416],{"class":1342},[1049,1504,1505],{"class":1350}," db",[1049,1507,1204],{"class":1346},[1049,1509,1510],{"class":1419},"openVault",[1049,1512,1422],{"class":1350},[1049,1514,1389],{"class":1346},[1049,1516,1517],{"class":1363},"books",[1049,1519,1389],{"class":1346},[1049,1521,1490],{"class":1350},[1012,1523,1525],{"id":1524},"cognito-setup-documented-not-ci-tested","Cognito setup (documented, not CI-tested)",[938,1527,1528],{},[941,1529,1530,1531,1534,1535,1538,1539,1544],{},"These are AWS console\u002FAPI steps, so the showcase does ",[944,1532,1533],{},"not"," execute them — it stands in a Cognito-shaped token. The setting ",[966,1536,1537],{},"names"," below are accurate; consult the ",[973,1540,1543],{"href":1541,"rel":1542},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcognito\u002Flatest\u002Fdeveloperguide\u002Fcognito-user-identity-pools.html",[977],"Amazon Cognito user-pool docs"," for the current console click-path, which AWS revises often.",[1546,1547,1548,1562,1579],"ol",{},[1161,1549,1550,1553,1554,1557,1558,1561],{},[944,1551,1552],{},"Create a user pool."," Choose passwordless sign-in: enable ",[944,1555,1556],{},"email one-time code"," (and, optionally, ",[944,1559,1560],{},"passkey \u002F WebAuthn",") as the sign-in method. This is the ceremony noy-db never sees.",[1161,1563,1564,1567,1568,1571,1572,1574,1575,1578],{},[944,1565,1566],{},"Add an app client."," Its ",[944,1569,1570],{},"client ID"," becomes the ID token's ",[957,1573,1080],{}," claim and your ",[957,1576,1577],{},"config.clientId",". For a public SPA\u002Fnative client, use a client without a secret and the authorization-code + PKCE flow.",[1161,1580,1581,1584,1585,1588,1589,1592,1593,1596],{},[944,1582,1583],{},"Note the issuer."," A pool's OIDC issuer is ",[957,1586,1587],{},"https:\u002F\u002Fcognito-idp.\u003Cregion>.amazonaws.com\u002F\u003CuserPoolId>"," and its JWKS is published at ",[957,1590,1591],{},"${issuer}\u002F.well-known\u002Fjwks.json",". Cognito signs ID tokens with ",[944,1594,1595],{},"RS256",". Your key-connector verifies against that JWKS.",[941,1598,1599],{},"That's the whole managed surface — no password reset flows, no email templates, no account tables to own.",[1012,1601,1603],{"id":1602},"the-key-connector-the-one-server-you-run","The key-connector (the one server you run)",[941,1605,1606,1607,1609,1610,1613,1614,1616,1617,1619,1620,1622,1623,1626,1627,1630],{},"A minimal handler for the two endpoints ",[957,1608,1020],{}," speaks. It ",[944,1611,1612],{},"verifies the Cognito ID token against the pool's JWKS",", then stores\u002Freturns the encrypted ",[957,1615,1099],{}," indexed by the verified ",[957,1618,1076],{}," — never trusting a ",[957,1621,1076],{}," from the request body. This mirrors the real, dependency-free connector fixture the showcase runs (",[957,1624,1625],{},"showcases\u002Fsrc\u002F_oidc.ts"," → ",[957,1628,1629],{},"createInMemoryKeyConnector","); the fixture is the same protocol, only in-process.",[1328,1632,1634],{"className":1330,"code":1633,"language":1332,"meta":1333,"style":1333},"\u002F\u002F key-connector — sketch of the one server piece you host.\n\u002F\u002F `verifyCognitoIdToken` fetches the pool's JWKS once, caches it, and checks\n\u002F\u002F signature + iss + aud + exp (RS256). See _oidc.ts::verifyIdToken for the\n\u002F\u002F exact Web-Crypto verification this stands in for.\nimport { verifyCognitoIdToken } from '.\u002Fcognito-verify.js'\n\nconst JWKS_URI = `https:\u002F\u002Fcognito-idp.${REGION}.amazonaws.com\u002F${POOL_ID}\u002F.well-known\u002Fjwks.json`\nconst store = new Map\u003Cstring, { encryptedServerHalf: string; iv: string }>()\n\nasync function handle(req: Request): Promise\u003CResponse> {\n  const idToken = (req.headers.get('authorization') ?? '').replace(\u002F^Bearer\\s+\u002Fi, '')\n  let sub: string\n  try {\n    ;({ sub } = await verifyCognitoIdToken(idToken, { jwksUri: JWKS_URI, issuer: ISSUER, audience: APP_CLIENT_ID }))\n  } catch {\n    return new Response(JSON.stringify({ error: 'invalid_token' }), { status: 401 })\n  }\n\n  if (req.method === 'PUT') {\n    const { encryptedServerHalf, iv } = await req.json()\n    store.set(sub, { encryptedServerHalf, iv }) \u002F\u002F sub from the VERIFIED token, never the body\n    return new Response(JSON.stringify({ ok: true }))\n  }\n  \u002F\u002F GET\n  const frag = store.get(sub)\n  return frag\n    ? new Response(JSON.stringify(frag))\n    : new Response(JSON.stringify({ error: 'not_found' }), { status: 404 })\n}\n",[957,1635,1636,1641,1646,1651,1656,1676,1680,1719,1769,1773,1813,1887,1901,1909,1972,1983,2040,2046,2051,2080,2109,2141,2175,2180,2186,2209,2218,2243,2295],{"__ignoreMap":1333},[1049,1637,1638],{"class":1338,"line":1339},[1049,1639,1640],{"class":1392},"\u002F\u002F key-connector — sketch of the one server piece you host.\n",[1049,1642,1643],{"class":1338,"line":1370},[1049,1644,1645],{"class":1392},"\u002F\u002F `verifyCognitoIdToken` fetches the pool's JWKS once, caches it, and checks\n",[1049,1647,1648],{"class":1338,"line":1396},[1049,1649,1650],{"class":1392},"\u002F\u002F signature + iss + aud + exp (RS256). See _oidc.ts::verifyIdToken for the\n",[1049,1652,1653],{"class":1338,"line":1403},[1049,1654,1655],{"class":1392},"\u002F\u002F exact Web-Crypto verification this stands in for.\n",[1049,1657,1658,1660,1662,1665,1667,1669,1671,1674],{"class":1338,"line":1428},[1049,1659,1343],{"class":1342},[1049,1661,1347],{"class":1346},[1049,1663,1664],{"class":1350}," verifyCognitoIdToken",[1049,1666,1354],{"class":1346},[1049,1668,1357],{"class":1342},[1049,1670,1360],{"class":1346},[1049,1672,1673],{"class":1363},".\u002Fcognito-verify.js",[1049,1675,1367],{"class":1346},[1049,1677,1678],{"class":1338,"line":1446},[1049,1679,1400],{"emptyLinePlaceholder":1399},[1049,1681,1682,1684,1687,1689,1692,1695,1698,1701,1703,1706,1708,1711,1713,1716],{"class":1338,"line":1463},[1049,1683,1407],{"class":1406},[1049,1685,1686],{"class":1350}," JWKS_URI ",[1049,1688,1413],{"class":1346},[1049,1690,1691],{"class":1346}," `",[1049,1693,1694],{"class":1363},"https:\u002F\u002Fcognito-idp.",[1049,1696,1697],{"class":1346},"${",[1049,1699,1700],{"class":1350},"REGION",[1049,1702,1487],{"class":1346},[1049,1704,1705],{"class":1363},".amazonaws.com\u002F",[1049,1707,1697],{"class":1346},[1049,1709,1710],{"class":1350},"POOL_ID",[1049,1712,1487],{"class":1346},[1049,1714,1715],{"class":1363},"\u002F.well-known\u002Fjwks.json",[1049,1717,1718],{"class":1346},"`\n",[1049,1720,1721,1723,1726,1728,1731,1734,1737,1741,1743,1745,1748,1750,1753,1756,1759,1761,1763,1766],{"class":1338,"line":1484},[1049,1722,1407],{"class":1406},[1049,1724,1725],{"class":1350}," store ",[1049,1727,1413],{"class":1346},[1049,1729,1730],{"class":1346}," new",[1049,1732,1733],{"class":1419}," Map",[1049,1735,1736],{"class":1346},"\u003C",[1049,1738,1740],{"class":1739},"sBMFI","string",[1049,1742,1478],{"class":1346},[1049,1744,1347],{"class":1346},[1049,1746,1747],{"class":1431}," encryptedServerHalf",[1049,1749,1435],{"class":1346},[1049,1751,1752],{"class":1739}," string",[1049,1754,1755],{"class":1346},";",[1049,1757,1758],{"class":1431}," iv",[1049,1760,1435],{"class":1346},[1049,1762,1752],{"class":1739},[1049,1764,1765],{"class":1346}," }>",[1049,1767,1768],{"class":1350},"()\n",[1049,1770,1771],{"class":1338,"line":1493},[1049,1772,1400],{"emptyLinePlaceholder":1399},[1049,1774,1776,1779,1782,1785,1787,1791,1793,1796,1799,1802,1804,1807,1810],{"class":1338,"line":1775},10,[1049,1777,1778],{"class":1406},"async",[1049,1780,1781],{"class":1406}," function",[1049,1783,1784],{"class":1419}," handle",[1049,1786,1422],{"class":1346},[1049,1788,1790],{"class":1789},"sHdIc","req",[1049,1792,1435],{"class":1346},[1049,1794,1795],{"class":1739}," Request",[1049,1797,1798],{"class":1346},"):",[1049,1800,1801],{"class":1739}," Promise",[1049,1803,1736],{"class":1346},[1049,1805,1806],{"class":1739},"Response",[1049,1808,1809],{"class":1346},">",[1049,1811,1812],{"class":1346}," {\n",[1049,1814,1816,1819,1822,1825,1827,1829,1831,1834,1836,1839,1841,1843,1846,1848,1851,1854,1857,1859,1861,1864,1866,1868,1871,1874,1877,1881,1883,1885],{"class":1338,"line":1815},11,[1049,1817,1818],{"class":1406},"  const",[1049,1820,1821],{"class":1350}," idToken",[1049,1823,1824],{"class":1346}," =",[1049,1826,1290],{"class":1431},[1049,1828,1790],{"class":1350},[1049,1830,1204],{"class":1346},[1049,1832,1833],{"class":1350},"headers",[1049,1835,1204],{"class":1346},[1049,1837,1838],{"class":1419},"get",[1049,1840,1422],{"class":1431},[1049,1842,1389],{"class":1346},[1049,1844,1845],{"class":1363},"authorization",[1049,1847,1389],{"class":1346},[1049,1849,1850],{"class":1431},") ",[1049,1852,1853],{"class":1346},"??",[1049,1855,1856],{"class":1346}," ''",[1049,1858,1081],{"class":1431},[1049,1860,1204],{"class":1346},[1049,1862,1863],{"class":1419},"replace",[1049,1865,1422],{"class":1431},[1049,1867,989],{"class":1346},[1049,1869,1870],{"class":1342},"^",[1049,1872,1873],{"class":1363},"Bearer\\s",[1049,1875,1876],{"class":1346},"+\u002F",[1049,1878,1880],{"class":1879},"sbssI","i",[1049,1882,1478],{"class":1346},[1049,1884,1856],{"class":1346},[1049,1886,1490],{"class":1431},[1049,1888,1890,1893,1896,1898],{"class":1338,"line":1889},12,[1049,1891,1892],{"class":1406},"  let",[1049,1894,1895],{"class":1350}," sub",[1049,1897,1435],{"class":1346},[1049,1899,1900],{"class":1739}," string\n",[1049,1902,1904,1907],{"class":1338,"line":1903},13,[1049,1905,1906],{"class":1342},"  try",[1049,1908,1812],{"class":1346},[1049,1910,1912,1915,1917,1920,1922,1924,1926,1928,1930,1932,1935,1937,1939,1942,1944,1947,1949,1952,1954,1957,1959,1962,1964,1967,1969],{"class":1338,"line":1911},14,[1049,1913,1914],{"class":1346},"    ;",[1049,1916,1422],{"class":1431},[1049,1918,1919],{"class":1346},"{",[1049,1921,1895],{"class":1350},[1049,1923,1354],{"class":1346},[1049,1925,1824],{"class":1346},[1049,1927,1416],{"class":1342},[1049,1929,1664],{"class":1419},[1049,1931,1422],{"class":1431},[1049,1933,1934],{"class":1350},"idToken",[1049,1936,1478],{"class":1346},[1049,1938,1347],{"class":1346},[1049,1940,1941],{"class":1431}," jwksUri",[1049,1943,1435],{"class":1346},[1049,1945,1946],{"class":1350}," JWKS_URI",[1049,1948,1478],{"class":1346},[1049,1950,1951],{"class":1431}," issuer",[1049,1953,1435],{"class":1346},[1049,1955,1956],{"class":1350}," ISSUER",[1049,1958,1478],{"class":1346},[1049,1960,1961],{"class":1431}," audience",[1049,1963,1435],{"class":1346},[1049,1965,1966],{"class":1350}," APP_CLIENT_ID",[1049,1968,1354],{"class":1346},[1049,1970,1971],{"class":1431},"))\n",[1049,1973,1975,1978,1981],{"class":1338,"line":1974},15,[1049,1976,1977],{"class":1346},"  }",[1049,1979,1980],{"class":1342}," catch",[1049,1982,1812],{"class":1346},[1049,1984,1986,1989,1991,1994,1996,1999,2001,2004,2006,2008,2011,2013,2015,2018,2020,2022,2024,2026,2028,2031,2033,2036,2038],{"class":1338,"line":1985},16,[1049,1987,1988],{"class":1342},"    return",[1049,1990,1730],{"class":1346},[1049,1992,1993],{"class":1419}," Response",[1049,1995,1422],{"class":1431},[1049,1997,1998],{"class":1350},"JSON",[1049,2000,1204],{"class":1346},[1049,2002,2003],{"class":1419},"stringify",[1049,2005,1422],{"class":1431},[1049,2007,1919],{"class":1346},[1049,2009,2010],{"class":1431}," error",[1049,2012,1435],{"class":1346},[1049,2014,1360],{"class":1346},[1049,2016,2017],{"class":1363},"invalid_token",[1049,2019,1389],{"class":1346},[1049,2021,1354],{"class":1346},[1049,2023,1081],{"class":1431},[1049,2025,1478],{"class":1346},[1049,2027,1347],{"class":1346},[1049,2029,2030],{"class":1431}," status",[1049,2032,1435],{"class":1346},[1049,2034,2035],{"class":1879}," 401",[1049,2037,1354],{"class":1346},[1049,2039,1490],{"class":1431},[1049,2041,2043],{"class":1338,"line":2042},17,[1049,2044,2045],{"class":1346},"  }\n",[1049,2047,2049],{"class":1338,"line":2048},18,[1049,2050,1400],{"emptyLinePlaceholder":1399},[1049,2052,2054,2057,2059,2061,2063,2066,2069,2071,2074,2076,2078],{"class":1338,"line":2053},19,[1049,2055,2056],{"class":1342},"  if",[1049,2058,1290],{"class":1431},[1049,2060,1790],{"class":1350},[1049,2062,1204],{"class":1346},[1049,2064,2065],{"class":1350},"method",[1049,2067,2068],{"class":1346}," ===",[1049,2070,1360],{"class":1346},[1049,2072,2073],{"class":1363},"PUT",[1049,2075,1389],{"class":1346},[1049,2077,1850],{"class":1431},[1049,2079,1425],{"class":1346},[1049,2081,2083,2086,2088,2090,2092,2094,2096,2098,2100,2103,2105,2107],{"class":1338,"line":2082},20,[1049,2084,2085],{"class":1406},"    const",[1049,2087,1347],{"class":1346},[1049,2089,1747],{"class":1350},[1049,2091,1478],{"class":1346},[1049,2093,1758],{"class":1350},[1049,2095,1354],{"class":1346},[1049,2097,1824],{"class":1346},[1049,2099,1416],{"class":1342},[1049,2101,2102],{"class":1350}," req",[1049,2104,1204],{"class":1346},[1049,2106,141],{"class":1419},[1049,2108,1768],{"class":1431},[1049,2110,2112,2115,2117,2120,2122,2124,2126,2128,2130,2132,2134,2136,2138],{"class":1338,"line":2111},21,[1049,2113,2114],{"class":1350},"    store",[1049,2116,1204],{"class":1346},[1049,2118,2119],{"class":1419},"set",[1049,2121,1422],{"class":1431},[1049,2123,1076],{"class":1350},[1049,2125,1478],{"class":1346},[1049,2127,1347],{"class":1346},[1049,2129,1747],{"class":1350},[1049,2131,1478],{"class":1346},[1049,2133,1758],{"class":1350},[1049,2135,1354],{"class":1346},[1049,2137,1850],{"class":1431},[1049,2139,2140],{"class":1392},"\u002F\u002F sub from the VERIFIED token, never the body\n",[1049,2142,2144,2146,2148,2150,2152,2154,2156,2158,2160,2162,2165,2167,2171,2173],{"class":1338,"line":2143},22,[1049,2145,1988],{"class":1342},[1049,2147,1730],{"class":1346},[1049,2149,1993],{"class":1419},[1049,2151,1422],{"class":1431},[1049,2153,1998],{"class":1350},[1049,2155,1204],{"class":1346},[1049,2157,2003],{"class":1419},[1049,2159,1422],{"class":1431},[1049,2161,1919],{"class":1346},[1049,2163,2164],{"class":1431}," ok",[1049,2166,1435],{"class":1346},[1049,2168,2170],{"class":2169},"sfNiH"," true",[1049,2172,1354],{"class":1346},[1049,2174,1971],{"class":1431},[1049,2176,2178],{"class":1338,"line":2177},23,[1049,2179,2045],{"class":1346},[1049,2181,2183],{"class":1338,"line":2182},24,[1049,2184,2185],{"class":1392},"  \u002F\u002F GET\n",[1049,2187,2189,2191,2194,2196,2199,2201,2203,2205,2207],{"class":1338,"line":2188},25,[1049,2190,1818],{"class":1406},[1049,2192,2193],{"class":1350}," frag",[1049,2195,1824],{"class":1346},[1049,2197,2198],{"class":1350}," store",[1049,2200,1204],{"class":1346},[1049,2202,1838],{"class":1419},[1049,2204,1422],{"class":1431},[1049,2206,1076],{"class":1350},[1049,2208,1490],{"class":1431},[1049,2210,2212,2215],{"class":1338,"line":2211},26,[1049,2213,2214],{"class":1342},"  return",[1049,2216,2217],{"class":1350}," frag\n",[1049,2219,2221,2224,2226,2228,2230,2232,2234,2236,2238,2241],{"class":1338,"line":2220},27,[1049,2222,2223],{"class":1346},"    ?",[1049,2225,1730],{"class":1346},[1049,2227,1993],{"class":1419},[1049,2229,1422],{"class":1431},[1049,2231,1998],{"class":1350},[1049,2233,1204],{"class":1346},[1049,2235,2003],{"class":1419},[1049,2237,1422],{"class":1431},[1049,2239,2240],{"class":1350},"frag",[1049,2242,1971],{"class":1431},[1049,2244,2246,2249,2251,2253,2255,2257,2259,2261,2263,2265,2267,2269,2271,2274,2276,2278,2280,2282,2284,2286,2288,2291,2293],{"class":1338,"line":2245},28,[1049,2247,2248],{"class":1346},"    :",[1049,2250,1730],{"class":1346},[1049,2252,1993],{"class":1419},[1049,2254,1422],{"class":1431},[1049,2256,1998],{"class":1350},[1049,2258,1204],{"class":1346},[1049,2260,2003],{"class":1419},[1049,2262,1422],{"class":1431},[1049,2264,1919],{"class":1346},[1049,2266,2010],{"class":1431},[1049,2268,1435],{"class":1346},[1049,2270,1360],{"class":1346},[1049,2272,2273],{"class":1363},"not_found",[1049,2275,1389],{"class":1346},[1049,2277,1354],{"class":1346},[1049,2279,1081],{"class":1431},[1049,2281,1478],{"class":1346},[1049,2283,1347],{"class":1346},[1049,2285,2030],{"class":1431},[1049,2287,1435],{"class":1346},[1049,2289,2290],{"class":1879}," 404",[1049,2292,1354],{"class":1346},[1049,2294,1490],{"class":1431},[1049,2296,2298],{"class":1338,"line":2297},29,[1049,2299,2300],{"class":1346},"}\n",[941,2302,2303,2304,2306,2307,2309],{},"The connector holds only ",[957,2305,1099],{},", which is worthless without the device-bound ",[957,2308,1128],{}," — that is why a connector breach does not read the vault.",[1012,2311,2313],{"id":2312},"the-noy-db-client","The noy-db client",[941,2315,2316,2317,2323,2324,2327],{},"Build the Cognito config as a ",[944,2318,2319,2320],{},"plain ",[957,2321,2322],{},"OidcProviderConfig",". ",[957,2325,2326],{},"knownProviders"," ships shortcuts for google \u002F apple \u002F line only; every other issuer — Cognito included — is this same public object shape, so nothing here is a workaround:",[1328,2329,2331],{"className":1330,"code":2330,"language":1332,"meta":1333,"style":1333},"import { enrollOidc, unlockOidc, type OidcProviderConfig } from '@noy-db\u002Fon-oidc'\n\nconst config: OidcProviderConfig = {\n  name: 'AWS Cognito',\n  issuer: `https:\u002F\u002Fcognito-idp.${REGION}.amazonaws.com\u002F${POOL_ID}`,\n  clientId: APP_CLIENT_ID, \u002F\u002F the app-client id == the ID token's `aud`\n  scopes: ['openid', 'email'],\n  keyConnectorUrl: 'https:\u002F\u002Fkey-connector.example.com',\n}\n",[957,2332,2333,2365,2369,2384,2400,2428,2442,2473,2489],{"__ignoreMap":1333},[1049,2334,2335,2337,2339,2342,2344,2347,2349,2352,2355,2357,2359,2361,2363],{"class":1338,"line":1339},[1049,2336,1343],{"class":1342},[1049,2338,1347],{"class":1346},[1049,2340,2341],{"class":1350}," enrollOidc",[1049,2343,1478],{"class":1346},[1049,2345,2346],{"class":1350}," unlockOidc",[1049,2348,1478],{"class":1346},[1049,2350,2351],{"class":1342}," type",[1049,2353,2354],{"class":1350}," OidcProviderConfig",[1049,2356,1354],{"class":1346},[1049,2358,1357],{"class":1342},[1049,2360,1360],{"class":1346},[1049,2362,959],{"class":1363},[1049,2364,1367],{"class":1346},[1049,2366,2367],{"class":1338,"line":1370},[1049,2368,1400],{"emptyLinePlaceholder":1399},[1049,2370,2371,2373,2376,2378,2380,2382],{"class":1338,"line":1396},[1049,2372,1407],{"class":1406},[1049,2374,2375],{"class":1350}," config",[1049,2377,1435],{"class":1346},[1049,2379,2354],{"class":1739},[1049,2381,1824],{"class":1346},[1049,2383,1812],{"class":1346},[1049,2385,2386,2389,2391,2393,2396,2398],{"class":1338,"line":1403},[1049,2387,2388],{"class":1431},"  name",[1049,2390,1435],{"class":1346},[1049,2392,1360],{"class":1346},[1049,2394,2395],{"class":1363},"AWS Cognito",[1049,2397,1389],{"class":1346},[1049,2399,1443],{"class":1346},[1049,2401,2402,2405,2407,2409,2411,2413,2415,2417,2419,2421,2423,2426],{"class":1338,"line":1428},[1049,2403,2404],{"class":1431},"  issuer",[1049,2406,1435],{"class":1346},[1049,2408,1691],{"class":1346},[1049,2410,1694],{"class":1363},[1049,2412,1697],{"class":1346},[1049,2414,1700],{"class":1350},[1049,2416,1487],{"class":1346},[1049,2418,1705],{"class":1363},[1049,2420,1697],{"class":1346},[1049,2422,1710],{"class":1350},[1049,2424,2425],{"class":1346},"}`",[1049,2427,1443],{"class":1346},[1049,2429,2430,2433,2435,2437,2439],{"class":1338,"line":1446},[1049,2431,2432],{"class":1431},"  clientId",[1049,2434,1435],{"class":1346},[1049,2436,1966],{"class":1350},[1049,2438,1478],{"class":1346},[1049,2440,2441],{"class":1392}," \u002F\u002F the app-client id == the ID token's `aud`\n",[1049,2443,2444,2447,2449,2452,2454,2457,2459,2461,2463,2466,2468,2471],{"class":1338,"line":1463},[1049,2445,2446],{"class":1431},"  scopes",[1049,2448,1435],{"class":1346},[1049,2450,2451],{"class":1350}," [",[1049,2453,1389],{"class":1346},[1049,2455,2456],{"class":1363},"openid",[1049,2458,1389],{"class":1346},[1049,2460,1478],{"class":1346},[1049,2462,1360],{"class":1346},[1049,2464,2465],{"class":1363},"email",[1049,2467,1389],{"class":1346},[1049,2469,2470],{"class":1350},"]",[1049,2472,1443],{"class":1346},[1049,2474,2475,2478,2480,2482,2485,2487],{"class":1338,"line":1484},[1049,2476,2477],{"class":1431},"  keyConnectorUrl",[1049,2479,1435],{"class":1346},[1049,2481,1360],{"class":1346},[1049,2483,2484],{"class":1363},"https:\u002F\u002Fkey-connector.example.com",[1049,2486,1389],{"class":1346},[1049,2488,1443],{"class":1346},[1049,2490,2491],{"class":1338,"line":1493},[1049,2492,2300],{"class":1346},[941,2494,2495,2498,2499,2501],{},[944,2496,2497],{},"Enroll once",", from the tier-1-unlocked keyring, with a fresh Cognito ID token. This derives the device secret, XOR-splits the keyring payload, and PUTs the encrypted ",[957,2500,1099],{}," to your connector:",[1328,2503,2505],{"className":1330,"code":2504,"language":1332,"meta":1333,"style":1333},"\u002F\u002F `idToken` came from the completed Cognito passwordless sign-in.\nconst enrollment = await enrollOidc(await db.team.getKeyring('books'), 'books', config, idToken)\n\u002F\u002F Persist `enrollment` (it's opaque metadata) so later sessions can find the `sub`.\n",[957,2506,2507,2512,2567],{"__ignoreMap":1333},[1049,2508,2509],{"class":1338,"line":1339},[1049,2510,2511],{"class":1392},"\u002F\u002F `idToken` came from the completed Cognito passwordless sign-in.\n",[1049,2513,2514,2516,2519,2521,2523,2525,2527,2530,2532,2534,2536,2538,2540,2542,2544,2546,2548,2550,2552,2554,2556,2558,2560,2562,2564],{"class":1338,"line":1370},[1049,2515,1407],{"class":1406},[1049,2517,2518],{"class":1350}," enrollment ",[1049,2520,1413],{"class":1346},[1049,2522,1416],{"class":1342},[1049,2524,2341],{"class":1419},[1049,2526,1422],{"class":1350},[1049,2528,2529],{"class":1342},"await",[1049,2531,1505],{"class":1350},[1049,2533,1204],{"class":1346},[1049,2535,868],{"class":1350},[1049,2537,1204],{"class":1346},[1049,2539,1325],{"class":1419},[1049,2541,1422],{"class":1350},[1049,2543,1389],{"class":1346},[1049,2545,1517],{"class":1363},[1049,2547,1389],{"class":1346},[1049,2549,1081],{"class":1350},[1049,2551,1478],{"class":1346},[1049,2553,1360],{"class":1346},[1049,2555,1517],{"class":1363},[1049,2557,1389],{"class":1346},[1049,2559,1478],{"class":1346},[1049,2561,2375],{"class":1350},[1049,2563,1478],{"class":1346},[1049,2565,2566],{"class":1350}," idToken)\n",[1049,2568,2569],{"class":1338,"line":1396},[1049,2570,2571],{"class":1392},"\u002F\u002F Persist `enrollment` (it's opaque metadata) so later sessions can find the `sub`.\n",[941,2573,2574,2577,2578,2581,2582,2585,2586,2588,2589,2592],{},[944,2575,2576],{},"Unlock on every later session"," with a ",[966,2579,2580],{},"new"," Cognito login — no secret typed. Feed the returned keyring straight into ",[957,2583,2584],{},"createNoydb"," via ",[957,2587,1325],{},", the cold-start seam every ",[957,2590,2591],{},"on-*"," method satisfies:",[1328,2594,2596],{"className":1330,"code":2595,"language":1332,"meta":1333,"style":1333},"const unlocked = await unlockOidc(enrollment, config, freshIdToken)\n\nconst db = await createNoydb({\n  store: toMemory(), \u002F\u002F the same store that holds the vault\n  user: 'alice',\n  getKeyring: async () => unlocked, \u002F\u002F no `secret` — passwordless from here on\n})\nconst books = await db.openVault('books')\n\u002F\u002F books.collection(...).get(...) \u002F .put(...) all work — this is a real session.\n",[957,2597,2598,2623,2627,2643,2658,2672,2696,2702,2729],{"__ignoreMap":1333},[1049,2599,2600,2602,2605,2607,2609,2611,2614,2616,2618,2620],{"class":1338,"line":1339},[1049,2601,1407],{"class":1406},[1049,2603,2604],{"class":1350}," unlocked ",[1049,2606,1413],{"class":1346},[1049,2608,1416],{"class":1342},[1049,2610,2346],{"class":1419},[1049,2612,2613],{"class":1350},"(enrollment",[1049,2615,1478],{"class":1346},[1049,2617,2375],{"class":1350},[1049,2619,1478],{"class":1346},[1049,2621,2622],{"class":1350}," freshIdToken)\n",[1049,2624,2625],{"class":1338,"line":1370},[1049,2626,1400],{"emptyLinePlaceholder":1399},[1049,2628,2629,2631,2633,2635,2637,2639,2641],{"class":1338,"line":1396},[1049,2630,1407],{"class":1406},[1049,2632,1410],{"class":1350},[1049,2634,1413],{"class":1346},[1049,2636,1416],{"class":1342},[1049,2638,1351],{"class":1419},[1049,2640,1422],{"class":1350},[1049,2642,1425],{"class":1346},[1049,2644,2645,2647,2649,2651,2653,2655],{"class":1338,"line":1403},[1049,2646,1432],{"class":1431},[1049,2648,1435],{"class":1346},[1049,2650,1377],{"class":1419},[1049,2652,1440],{"class":1350},[1049,2654,1478],{"class":1346},[1049,2656,2657],{"class":1392}," \u002F\u002F the same store that holds the vault\n",[1049,2659,2660,2662,2664,2666,2668,2670],{"class":1338,"line":1428},[1049,2661,1449],{"class":1431},[1049,2663,1435],{"class":1346},[1049,2665,1360],{"class":1346},[1049,2667,1456],{"class":1363},[1049,2669,1389],{"class":1346},[1049,2671,1443],{"class":1346},[1049,2673,2674,2677,2679,2682,2685,2688,2691,2693],{"class":1338,"line":1446},[1049,2675,2676],{"class":1419},"  getKeyring",[1049,2678,1435],{"class":1346},[1049,2680,2681],{"class":1406}," async",[1049,2683,2684],{"class":1346}," ()",[1049,2686,2687],{"class":1406}," =>",[1049,2689,2690],{"class":1350}," unlocked",[1049,2692,1478],{"class":1346},[1049,2694,2695],{"class":1392}," \u002F\u002F no `secret` — passwordless from here on\n",[1049,2697,2698,2700],{"class":1338,"line":1463},[1049,2699,1487],{"class":1346},[1049,2701,1490],{"class":1350},[1049,2703,2704,2706,2709,2711,2713,2715,2717,2719,2721,2723,2725,2727],{"class":1338,"line":1484},[1049,2705,1407],{"class":1406},[1049,2707,2708],{"class":1350}," books ",[1049,2710,1413],{"class":1346},[1049,2712,1416],{"class":1342},[1049,2714,1505],{"class":1350},[1049,2716,1204],{"class":1346},[1049,2718,1510],{"class":1419},[1049,2720,1422],{"class":1350},[1049,2722,1389],{"class":1346},[1049,2724,1517],{"class":1363},[1049,2726,1389],{"class":1346},[1049,2728,1490],{"class":1350},[1049,2730,2731],{"class":1338,"line":1493},[1049,2732,2733],{"class":1392},"\u002F\u002F books.collection(...).get(...) \u002F .put(...) all work — this is a real session.\n",[1012,2735,2737],{"id":2736},"verify","Verify",[941,2739,2740,2741,2743,2744,2747,2748,2753,2754,2756,2757,2759],{},"The showcase proves the property, not just the happy path: after ",[957,2742,992],{},", ",[957,2745,2746],{},"unlocked.kek"," is ",[944,2749,2750],{},[957,2751,2752],{},"null"," — the tier-2 signature — yet the session reads a record written under tier 1 and writes a new one. It also asserts the connector received only opaque ciphertext, and that a wrong-issuer, wrong-",[957,2755,1080],{},", expired, or wrong-",[957,2758,1076],{}," token is rejected:",[1328,2761,2763],{"className":1330,"code":2762,"language":1332,"meta":1333,"style":1333},"const unlocked = await unlockOidc(enrollment, config, unlockToken)\nexpect(unlocked.kek).toBeNull()          \u002F\u002F tier-2: no KEK, ever\nexpect(await invoices.get('inv-1')).toBeTruthy() \u002F\u002F …but reads\u002Fwrites work\n",[957,2764,2765,2788,2812],{"__ignoreMap":1333},[1049,2766,2767,2769,2771,2773,2775,2777,2779,2781,2783,2785],{"class":1338,"line":1339},[1049,2768,1407],{"class":1406},[1049,2770,2604],{"class":1350},[1049,2772,1413],{"class":1346},[1049,2774,1416],{"class":1342},[1049,2776,2346],{"class":1419},[1049,2778,2613],{"class":1350},[1049,2780,1478],{"class":1346},[1049,2782,2375],{"class":1350},[1049,2784,1478],{"class":1346},[1049,2786,2787],{"class":1350}," unlockToken)\n",[1049,2789,2790,2793,2796,2798,2801,2803,2806,2809],{"class":1338,"line":1370},[1049,2791,2792],{"class":1419},"expect",[1049,2794,2795],{"class":1350},"(unlocked",[1049,2797,1204],{"class":1346},[1049,2799,2800],{"class":1350},"kek)",[1049,2802,1204],{"class":1346},[1049,2804,2805],{"class":1419},"toBeNull",[1049,2807,2808],{"class":1350},"()          ",[1049,2810,2811],{"class":1392},"\u002F\u002F tier-2: no KEK, ever\n",[1049,2813,2814,2816,2818,2820,2823,2825,2827,2829,2831,2834,2836,2839,2841,2844,2847],{"class":1338,"line":1396},[1049,2815,2792],{"class":1419},[1049,2817,1422],{"class":1350},[1049,2819,2529],{"class":1342},[1049,2821,2822],{"class":1350}," invoices",[1049,2824,1204],{"class":1346},[1049,2826,1838],{"class":1419},[1049,2828,1422],{"class":1350},[1049,2830,1389],{"class":1346},[1049,2832,2833],{"class":1363},"inv-1",[1049,2835,1389],{"class":1346},[1049,2837,2838],{"class":1350},"))",[1049,2840,1204],{"class":1346},[1049,2842,2843],{"class":1419},"toBeTruthy",[1049,2845,2846],{"class":1350},"() ",[1049,2848,2849],{"class":1392},"\u002F\u002F …but reads\u002Fwrites work\n",[1012,2851,1199],{"id":2852},"limits-alternative",[1158,2854,2855,2872,2902],{},[1161,2856,2857,2860,2861,2863,2864,2867,2868,1204],{},[944,2858,2859],{},"It's a tier-2 unlock, with tier-2 limits."," The OIDC session yields DEKs with ",[957,2862,1138],{},": it can read and write, but cannot ",[957,2865,2866],{},"grant",", rotate the secret, enroll another authenticator, or open a second vault — those need a real tier-1 unlock. See ",[973,2869,2871],{"href":2870},"\u002Fcore\u002Fnoydb\u002Fauthentication#can-a-method-serve-a-different-tier","Authentication → Can a method serve a different tier?",[1161,2873,2874,2877,2878,2880,2881,2883,2884,2887,2888,2743,2891,2894,2895,2897,2898,2901],{},[944,2875,2876],{},"Lose the device half and Cognito alone can't get you back in."," The ",[957,2879,1128],{}," never leaves the device; a wiped browser \u002F new device makes ",[957,2882,992],{}," fail with ",[957,2885,2886],{},"OidcDeviceSecretNotFoundError"," (or a 404 from the connector). Recovery is a fresh tier-1 re-enrollment — a ",[973,2889,2890],{"href":322},"paper recovery code",[973,2892,2893],{"href":326},"Shamir"," share, or a custodian invite — then a new ",[957,2896,988],{},". Cognito re-proves ",[966,2899,2900],{},"identity",", not your device secret.",[1161,2903,2904,2907,2908,2912,2913,2915,2916,2918,2919,2922],{},[944,2905,2906],{},"Want NO server at all?"," If running even a tiny key-connector is unwelcome, ",[973,2909,2910],{"href":338},[957,2911,1203],{}," gives a similar login-with-your-device UX using a platform passkey (Touch ID \u002F Windows Hello) with ",[944,2914,1068],{}," key-connector and ",[944,2917,1068],{}," OIDC provider — the wrapping key is derived from the authenticator's PRF output on-device. Choose OIDC when you specifically want ",[966,2920,2921],{},"federated"," identity (a shared corporate\u002Fsocial login) or central account management; choose WebAuthn when you want the least infrastructure.",[1012,2924,2926],{"id":2925},"see-also","See also",[1158,2928,2929,2936,2943,2948],{},[1161,2930,2931,2935],{},[973,2932,2933],{"href":310},[957,2934,1020],{}," — the split-key model and the shipped provider configs, in depth.",[1161,2937,2938,2942],{},[973,2939,2940],{"href":338},[957,2941,1203],{}," — the no-server passwordless alternative.",[1161,2944,2945,2947],{},[973,2946,589],{"href":590}," — how OIDC stacks with secret, passkey, session policy, and recovery.",[1161,2949,2950,2952],{},[973,2951,844],{"href":845}," — the three-tier ladder and what each tier may do.",[2954,2955,2956],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":1333,"searchDepth":1396,"depth":1396,"links":2958},[2959,2960,2961,2962,2963,2964,2965,2966,2967,2968],{"id":1014,"depth":1370,"text":1015},{"id":1155,"depth":1370,"text":1156},{"id":1231,"depth":1370,"text":1232},{"id":1314,"depth":1370,"text":1315},{"id":1524,"depth":1370,"text":1525},{"id":1602,"depth":1370,"text":1603},{"id":2312,"depth":1370,"text":2313},{"id":2736,"depth":1370,"text":2737},{"id":2852,"depth":1370,"text":1199},{"id":2925,"depth":1370,"text":2926},null,"Passwordless federated tier-2 unlock with the least infrastructure — AWS Cognito, one tiny key-connector, and the on-oidc split-key client.","md",{},{"title":555,"description":2970},"stable","important","x5LNGZ7QOMkFGucjn36Qj1gNXNa6U9LrBH40OdTCZag",1791896576268]