stable
Services
The opt-in with*() catalog, grouped by service layer.
The opt-in with*() catalog — capabilities you compose on top of the core. Each capability is its own tree-shakeable service behind a with<Service>() strategy seam: when you don't import the factory, none of that service's code reaches your bundle. You always opt in per service (someStrategy: withSomething()).
The service layers — with-lookup, with-commit, with-formula, with-shape, with-audit, with-party, with-sync, with-fork, with-store, plus the single-purpose with-pod and with-cargo — are simply how the service source is grouped into folders. They're a way to browse the catalog by intent, not something you import or configure: there is no layer factory or layer export, only per-service ones. The via/ field features are a separate declaration surface (per field, not per vault).
Browse the pages in the sidebar, or jump into the Orientation map to pick capabilities and land on the exact pages you need.
The catalog
Every service page, grouped by its with-* source layer (and the Via field features) — generated live from the pages that exist.
Read & query with-lookup
| foreign-refs | Foreign-key references between collections: |
| joins | Eager foreign-key joins in the query DSL: |
| cross-join | Cartesian and lateral cross-joins in the query DSL, with a 50,000-row cost ceiling enforced before allocation. |
| indexing | Opt-in secondary indexing: |
| search | Keyword lookup via `withSearch()`: |
| embeddings | Semantic and hybrid retrieval via `withSearch()`: |
| live | Reactive subscriptions: |
| partitioning | Scoping query execution to a subset of a collection by time range, region, or tenant — planned, not yet implemented. |
| reduce | Opt-in record reduction for the query DSL: |
Write & mutate with-commit
| transactions | Multi-record atomic writes: |
| sequence | `vault.sequence(name).next()` hands out gap-free, duplicate-free serial numbers — 1, 2, 3, … — even when multiple callers on one store… |
| numbering | Deferred numbering: |
| history | Per-record version snapshots, a hash-chained tamper-evident ledger, JSON Patch deltas, point-in-time reads via `vault.at()`, and backup verification. |
| crdt | Conflict-free replicated types: |
| vault-head | An authenticated {id → version} manifest that detects a store withholding or rewinding records — the one attack per-envelope authentication… |
Derived data with-formula
| derivations | Deterministic derived data: |
| materialized-views | withMaterializedView() persists a query's result — filter, groupBy, aggregate, join — as a live collection with eager, lazy, or manual refresh. |
| overlay-views | withOverlayedView() merges a computed base collection with a user-writable overlay, so an operator can correct one row without touching the… |
Data shape with-shape
| schema-identifiers | Opaque permanent field ids that survive a rename, plus a generation↔content-hash binding that makes 'which schema is generation N' answerable. |
| manifest | The pod-wide schema manifest — an encrypted index of every collection's schema generation, content hash and field ids, plus the open() read path. |
| metadata-ladder | The collection and vault rungs above field-level metadata — collectionMeta and vaultMeta identity layers that describe() and dumpSchema()… |
| metadata-riders | Three riders on the describe() contract — toJSONSchema() x- extension keys, dictKey inline labels, and devtools PII masking. |
| blobs | Encrypted binary attachments — chunked AES-256-GCM storage with content-addressed dedup, MIME sniffing, retention compaction, and bulk export. |
| links | Managed many-to-many link sets between two collections — an encrypted junction queryable from either side, with per-link metadata and delete policy. |
| satellites | Split a record's hot, small fields from its heavy, cold ones into two paired collections, with a joined handle that merges the full record. |
| validation | Richer runtime validators (Zod-style, JSON-schema). |
| migrations | Schema migrations between hub versions / collection renames / field rename + backfill. |
Time & audit with-audit
| transferable-partitions | Extract a referentially-complete, re-keyed slice of a vault into a standalone bundle and hand it to a new owner — a cryptographic ownership transfer. |
| plaintext-bypass | The fixed set of internal collections that store plain JSON instead of ciphertext, why each needs to, and what a store-only attacker learns from them. |
| governance | Reference map for personal-data governance under GDPR and PDPA — crypto-shred as the erasure mechanism, and where each data-subject right… |
| guards | Per-record locks, per-field freezes, and an audited amendment override for business rules stricter than a plain write permission. |
| tiers | Record tiers — scoped elevation with TTL + reason, per-tier DEKs, tier-gated reads, and how blobs, search, and forget behave across tiers. |
| consent | Consent-audit logging for GDPR/PIPL-style compliance: |
| forget | GDPR-style right-to-erasure: |
| portability | Export half of `withPortability()`: |
| withdrawal | Removal half of `withPortability()`: |
| periods | Accounting-style period closes with a write-guard: |
| sealed-record | Seal a single record's decryption key to an external host (e.g. |
| attestation | Issue signed, per-field commitments for vault records as QR credentials anyone can verify fully offline — plus revocation with a signed,… |
| metrics | Hub-level observability (timings, cache stats, sync stats). |
| coverage | Sketch-based read accounting: |
Snapshot & fork with-fork
| snapshots | Point-in-time backup and restore: |
| shadow | Read-only views of a live vault: |
| archive | Cold-storage archival: |
Party & auth with-party
| auth-landscape | Reference map of authentication, unlock, and sealing-key methods — every common auth primitive scored and matched to its on-* or at-* package. |
| session | Serializable session tokens that skip re-running the unlock ceremony, plus a SessionPolicy for idle/absolute timeouts and re-auth gates. |
| session-tiers | The three-tier session-authentication ladder — secret, multi-slot, quick-resume — and the policy-gate DSL guarding sensitive vault operations. |
| team | Multi-user collaboration — grant/revoke/rotate wrapped DEKs via withTeam(), plus magic-link sessions; delegation and tier elevation moved… |
| broker | The credential broker: |
| custody | Sovereign custody: |
| sync | Replication engine — dirty tracking, push/pull between a local store and remote targets, conflict resolution — plus live presence over an… |
| sealing-pid-stability | Reference rule: |
Store ops with-store
| lazy | Bounded-memory reads for collections too large for RAM: |
| storage-capability-matrix | Which essential or extended to-* store exposes which shape, its per-record CAS atomicity, and whether db.transaction() can commit atomically. |
Pod · .noydb with-pod
| bundle | Write and read .noydb files — a portable single-file vault container with a minimum-disclosure header and optional re-keyed export to recipients. |
| pod-signature | Ed25519 authentication of a .noydb pod's plaintext header, verifiable by a static page with no store, no vault and no key material beyond WebCrypto. |
| pod-redirect | One signed 'this moved, go there' record for pods, store tombstones and manifest re-points — followable pre-auth, verified before every hop. |
Via · field features via
| money | The `money()` field descriptor: |
| i18n | Multi-locale records via a shared label dictionary (dictKey) or per-record translated text (i18nText), resolved to the caller's locale at read time. |
| lookup | The lookup()/enumOf()/dict() field feature: |
| computed | Computed scalar fields: |
| classified | Classified fields: |