[{"data":1,"prerenderedAt":3967},["ShallowReactive",2],{"navigation":3,"\u002Fservices\u002Fauth-landscape":927,"mdc--t4ozlx-key":3888,"mdc-uw1ati-key":3910,"mdc--c18zkg-key":3919,"mdc-g93g6k-key":3954},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":617,"access":12,"apiToc":929,"body":930,"category":3879,"description":3880,"extension":3881,"meta":3882,"navigation":3879,"nest":3883,"path":618,"seo":3884,"sinceVersion":3879,"status":3885,"stem":619,"subtitle":3879,"tier":3886,"tocExternal":3879,"__hash__":3887},"docs\u002Fservices\u002Fauth-landscape.md",false,{"type":931,"value":932,"toc":3852},"minimark",[933,936,946,950,955,976,988,992,1073,1089,1093,1103,1176,1180,1269,1275,1278,1282,1406,1410,1555,1559,1731,1735,1742,1853,1857,1886,1987,1991,2001,2062,2424,2428,2551,2555,2594,2750,2754,2760,2921,2925,2935,3038,3042,3097,3101,3242,3244,3248,3330,3337,3358,3385,3492,3498,3522,3528,3532,3535,3586,3590,3752,3756],[934,935,617],"h1",{"id":617},[937,938,939],"blockquote",{},[940,941,942],"p",{},[943,944,945],"strong",{},"Reference map of authentication, unlock, and sealing-key primitives.",[947,948],"service-meta",{":rows":949},"[{\"label\":\"Status\",\"value\":\"reference — this page documents no API of its own; the packages it names are documented in the [`on-*` family catalog](\u002Ffamilies\u002Fon).\"},{\"label\":\"Cluster\",\"value\":\"collaboration-and-auth\"},{\"label\":\"Cross-cuts\",\"value\":\"every `@noy-db\u002Fon-*` package, `@noy-db\u002Fhub` core (KEK derivation, keyring layout, policy gates), and the [`@noy-db\u002Fat-*` sealing-provider family](\u002Ffamilies\u002Fat).\"},{\"label\":\"Companion\",\"value\":\"[session-tiers](\u002Fservices\u002Fsession-tiers) — how the primitives below compose into a session lifecycle.\"}]",[951,952,954],"h2",{"id":953},"what-this-page-is","What this page is",[940,956,957,958,961,962,965,966,970,971,975],{},"noy-db is a zero-knowledge document store: every record is encrypted on the user's device before it reaches any storage backend. The whole key hierarchy hangs off one root — a ",[943,959,960],{},"key-encryption key (KEK)"," derived from a user credential, which wraps the per-collection ",[943,963,964],{},"data-encryption keys (DEKs)"," (see ",[967,968,969],"a",{"href":66},"Core 02 — Enclave","). \"Login\" therefore always means one concrete thing here: ",[972,973,974],"em",{},"producing the material that unlocks the KEK",".",[940,977,978,979,983,984,987],{},"This page maps the authentication, unlock, and sealing-key methods in common use, scores each on the dimensions that matter for a zero-knowledge offline-first vault, and names the ",[980,981,982],"code",{},"@noy-db\u002F*"," package that covers it — or states plainly that it is deliberately omitted, not covered, or out of scope. The next time someone asks ",[972,985,986],{},"\"can we log in with Cognito \u002F Active Directory \u002F Windows \u002F Touch ID \u002F BankID?\"",", the answer is one table lookup.",[951,989,991],{"id":990},"three-distinct-functions-get-conflated-as-auth","Three distinct functions get conflated as \"auth\"",[993,994,995,1011],"table",{},[996,997,998],"thead",{},[999,1000,1001,1005,1008],"tr",{},[1002,1003,1004],"th",{},"Function",[1002,1006,1007],{},"What it does",[1002,1009,1010],{},"noy-db family",[1012,1013,1014,1031,1047],"tbody",{},[999,1015,1016,1022,1025],{},[1017,1018,1019],"td",{},[943,1020,1021],{},"Authenticator",[1017,1023,1024],{},"Proves the user knows \u002F has \u002F is something. Produces a cryptographic proof or releases a wrap key.",[1017,1026,1027,1030],{},[980,1028,1029],{},"on-*"," (sections 1–5)",[999,1032,1033,1038,1041],{},[1017,1034,1035],{},[943,1036,1037],{},"Identity provider (IdP)",[1017,1039,1040],{},"Federates identity. Issues tokens. Does not by itself produce wrap-key material.",[1017,1042,1043,1046],{},[980,1044,1045],{},"on-oidc"," bridges (section 6)",[999,1048,1049,1054,1057],{},[1017,1050,1051],{},[943,1052,1053],{},"Sealing-key store",[1017,1055,1056],{},"Protects a machine-generated secret under OS-account or KMS guarantees. Does not authenticate the user.",[1017,1058,1059,1064,1065,1068,1069,1072],{},[967,1060,1061],{"href":170},[980,1062,1063],{},"at-*"," — implementations of the ",[980,1066,1067],{},"NoydbSealer"," interface exported by ",[980,1070,1071],{},"@noy-db\u002Fhub"," (sections 8–9)",[940,1074,1075,1076,1079,1080,1083,1084,1086,1087,975],{},"Conflating these is the single most common source of misdesign in this space. A Windows DPAPI sealing provider is ",[943,1077,1078],{},"not"," an authenticator. A hypothetical ",[980,1081,1082],{},"on-google"," would ",[943,1085,1078],{}," be different from ",[980,1088,1045],{},[951,1090,1092],{"id":1091},"session-tiers-briefly","Session tiers, briefly",[940,1094,1095,1096,1099,1100,1102],{},"Several rows below refer to noy-db's ",[943,1097,1098],{},"session tiers"," — the three-rung privilege ladder that structures unlock (defined in full on ",[967,1101,844],{"href":845},"):",[993,1104,1105,1118],{},[996,1106,1107],{},[999,1108,1109,1112,1115],{},[1002,1110,1111],{},"Tier",[1002,1113,1114],{},"Role",[1002,1116,1117],{},"Primitive",[1012,1119,1120,1140,1161],{},[999,1121,1122,1127,1137],{},[1017,1123,1124],{},[943,1125,1126],{},"1",[1017,1128,1129,1130,1132,1133,1136],{},"Master secret — the root secret; derives the KEK. Factory-fixed inside ",[980,1131,1071],{},"; there is no ",[980,1134,1135],{},"on-secret"," package.",[1017,1138,1139],{},"hub core",[999,1141,1142,1147,1150],{},[1017,1143,1144],{},[943,1145,1146],{},"2",[1017,1148,1149],{},"Routine login — multi-slot authenticators, any one of which unlocks the same KEK.",[1017,1151,1152,1155,1156,1155,1158],{},[980,1153,1154],{},"on-webauthn",", ",[980,1157,1045],{},[980,1159,1160],{},"on-password",[999,1162,1163,1168,1171],{},[1017,1164,1165],{},[943,1166,1167],{},"3",[1017,1169,1170],{},"Quick-resume after idle — re-opens an already-unlocked session within a bounded idle window.",[1017,1172,1173],{},[980,1174,1175],{},"on-pin",[951,1177,1179],{"id":1178},"dimensions","Dimensions",[993,1181,1182,1192],{},[996,1183,1184],{},[999,1185,1186,1189],{},[1002,1187,1188],{},"Dimension",[1002,1190,1191],{},"What it tests",[1012,1193,1194,1208,1218,1232,1253],{},[999,1195,1196,1201],{},[1017,1197,1198],{},[943,1199,1200],{},"Online?",[1017,1202,1203,1204,1207],{},"Network required ",[972,1205,1206],{},"at unlock time",". TOTP needs network only at enrollment, so it scores ❌ here.",[999,1209,1210,1215],{},[1017,1211,1212],{},[943,1213,1214],{},"Personal device",[1017,1216,1217],{},"Suits a phone\u002Flaptop bound to one user.",[999,1219,1220,1225],{},[1017,1221,1222],{},[943,1223,1224],{},"Shared device",[1017,1226,1227,1228,1231],{},"Suits a kiosk \u002F clinic terminal \u002F shared family iPad. Implicitly tests ",[972,1229,1230],{},"credential portability"," — methods that work well on shared hardware are ones where the credential travels with the user.",[999,1233,1234,1239],{},[1017,1235,1236],{},[943,1237,1238],{},"Factor",[1017,1240,1241,1244,1245,1248,1249,1252],{},[943,1242,1243],{},"K"," = knowledge · ",[943,1246,1247],{},"D"," = possession\u002Fdevice · ",[943,1250,1251],{},"B"," = biometric\u002Finherence. Multi-factor methods list all that apply.",[999,1254,1255,1260],{},[1017,1256,1257],{},[943,1258,1259],{},"noy-db match",[1017,1261,1262,1263,1265,1266,1268],{},"Existing ",[980,1264,1029],{}," package, ",[980,1267,1063],{}," sealing provider, deliberately omitted (with reason), or not covered.",[940,1270,1271,1274],{},[943,1272,1273],{},"Legend:"," ✅ good fit · ⚠️ works with caveats · ❌ poor fit \u002F breaks model",[1276,1277],"hr",{},[951,1279,1281],{"id":1280},"_1-knowledge-factors","1. Knowledge factors",[993,1283,1284,1304],{},[996,1285,1286],{},[999,1287,1288,1291,1294,1297,1300,1302],{},[1002,1289,1290],{},"Method",[1002,1292,1200],{"align":1293},"center",[1002,1295,1296],{"align":1293},"Personal",[1002,1298,1299],{"align":1293},"Shared",[1002,1301,1238],{"align":1293},[1002,1303,1259],{},[1012,1305,1306,1331,1349,1372,1389],{},[999,1307,1308,1311,1314,1317,1320,1322],{},[1017,1309,1310],{},"Master secret (Diceware)",[1017,1312,1313],{"align":1293},"❌",[1017,1315,1316],{"align":1293},"✅",[1017,1318,1319],{"align":1293},"⚠️ shoulder-surf",[1017,1321,1243],{"align":1293},[1017,1323,1324,1327,1328,1330],{},[943,1325,1326],{},"tier 1, internal to hub"," (no ",[980,1329,1029],{}," package)",[999,1332,1333,1336,1338,1340,1343,1345],{},[1017,1334,1335],{},"Password (tier 2)",[1017,1337,1313],{"align":1293},[1017,1339,1316],{"align":1293},[1017,1341,1342],{"align":1293},"⚠️",[1017,1344,1243],{"align":1293},[1017,1346,1347],{},[980,1348,1160],{},[999,1350,1351,1354,1356,1358,1361,1363],{},[1017,1352,1353],{},"Numeric PIN (4–6 digits)",[1017,1355,1313],{"align":1293},[1017,1357,1316],{"align":1293},[1017,1359,1360],{"align":1293},"❌ low entropy",[1017,1362,1243],{"align":1293},[1017,1364,1365,1367,1368,1371],{},[980,1366,1175],{}," (",[943,1369,1370],{},"tier 3 only",")",[999,1373,1374,1377,1379,1381,1383,1386],{},[1017,1375,1376],{},"Pattern lock (Android-style)",[1017,1378,1313],{"align":1293},[1017,1380,1342],{"align":1293},[1017,1382,1313],{"align":1293},[1017,1384,1385],{"align":1293},"K weak",[1017,1387,1388],{},"❌ deliberately omitted",[999,1390,1391,1394,1397,1399,1401,1403],{},[1017,1392,1393],{},"Security questions",[1017,1395,1396],{"align":1293},"varies",[1017,1398,1342],{"align":1293},[1017,1400,1313],{"align":1293},[1017,1402,1385],{"align":1293},[1017,1404,1405],{},"❌ deliberately omitted (social-engineerable, low entropy)",[951,1407,1409],{"id":1408},"_2-possession-software-otp-link","2. Possession — software OTP \u002F link",[993,1411,1412,1428],{},[996,1413,1414],{},[999,1415,1416,1418,1420,1422,1424,1426],{},[1002,1417,1290],{},[1002,1419,1200],{"align":1293},[1002,1421,1296],{"align":1293},[1002,1423,1299],{"align":1293},[1002,1425,1238],{"align":1293},[1002,1427,1259],{},[1012,1429,1430,1450,1466,1485,1503,1521,1540],{},[999,1431,1432,1435,1438,1440,1443,1445],{},[1017,1433,1434],{},"TOTP (Google Auth, Authy, 1Password)",[1017,1436,1437],{"align":1293},"❌ post-enrol",[1017,1439,1316],{"align":1293},[1017,1441,1442],{"align":1293},"✅ phone-borne",[1017,1444,1247],{"align":1293},[1017,1446,1447],{},[980,1448,1449],{},"on-totp",[999,1451,1452,1455,1457,1459,1461,1463],{},[1017,1453,1454],{},"HOTP (RFC 4226)",[1017,1456,1313],{"align":1293},[1017,1458,1316],{"align":1293},[1017,1460,1316],{"align":1293},[1017,1462,1247],{"align":1293},[1017,1464,1465],{},"❌ (TOTP supersedes)",[999,1467,1468,1471,1473,1475,1477,1480],{},[1017,1469,1470],{},"Email OTP",[1017,1472,1316],{"align":1293},[1017,1474,1316],{"align":1293},[1017,1476,1316],{"align":1293},[1017,1478,1479],{"align":1293},"D (mailbox)",[1017,1481,1482],{},[980,1483,1484],{},"on-email-otp",[999,1486,1487,1490,1492,1494,1497,1500],{},[1017,1488,1489],{},"SMS OTP",[1017,1491,1316],{"align":1293},[1017,1493,1316],{"align":1293},[1017,1495,1496],{"align":1293},"⚠️ SIM-swap",[1017,1498,1499],{"align":1293},"D weakened",[1017,1501,1502],{},"❌ deliberately omitted (NIST SP 800-63B deprecates)",[999,1504,1505,1508,1510,1512,1514,1516],{},[1017,1506,1507],{},"Magic link",[1017,1509,1316],{"align":1293},[1017,1511,1316],{"align":1293},[1017,1513,1342],{"align":1293},[1017,1515,1479],{"align":1293},[1017,1517,1518],{},[980,1519,1520],{},"on-magic-link",[999,1522,1523,1526,1528,1530,1533,1535],{},[1017,1524,1525],{},"Push notification (Duo, Okta Verify, MS Authenticator number-match)",[1017,1527,1316],{"align":1293},[1017,1529,1316],{"align":1293},[1017,1531,1532],{"align":1293},"✅ goes to personal phone",[1017,1534,1247],{"align":1293},[1017,1536,1537,1538,1371],{},"❌ (vendor; reachable via ",[980,1539,1045],{},[999,1541,1542,1545,1547,1549,1551,1553],{},[1017,1543,1544],{},"WhatsApp \u002F Telegram \u002F Signal OTP",[1017,1546,1316],{"align":1293},[1017,1548,1316],{"align":1293},[1017,1550,1342],{"align":1293},[1017,1552,1247],{"align":1293},[1017,1554,1313],{},[951,1556,1558],{"id":1557},"_3-possession-hardware","3. Possession — hardware",[993,1560,1561,1577],{},[996,1562,1563],{},[999,1564,1565,1567,1569,1571,1573,1575],{},[1002,1566,1290],{},[1002,1568,1200],{"align":1293},[1002,1570,1296],{"align":1293},[1002,1572,1299],{"align":1293},[1002,1574,1238],{"align":1293},[1002,1576,1259],{},[1012,1578,1579,1602,1624,1645,1663,1679,1695,1715],{},[999,1580,1581,1588,1590,1592,1595,1598],{},[1017,1582,1583,1584,1587],{},"FIDO2 \u002F WebAuthn — ",[943,1585,1586],{},"roaming"," (YubiKey, SoloKeys, Titan)",[1017,1589,1313],{"align":1293},[1017,1591,1316],{"align":1293},[1017,1593,1594],{"align":1293},"✅ bring the key",[1017,1596,1597],{"align":1293},"D (+ B if biometric key)",[1017,1599,1600],{},[980,1601,1154],{},[999,1603,1604,1610,1612,1614,1617,1620],{},[1017,1605,1583,1606,1609],{},[943,1607,1608],{},"platform"," (Hello, Touch\u002FFace ID, Android)",[1017,1611,1313],{"align":1293},[1017,1613,1316],{"align":1293},[1017,1615,1616],{"align":1293},"❌ device-bound",[1017,1618,1619],{"align":1293},"D + B",[1017,1621,1622],{},[980,1623,1154],{},[999,1625,1626,1629,1632,1634,1637,1640],{},[1017,1627,1628],{},"Passkey — synced (iCloud Keychain, Google Password Manager, 1Password)",[1017,1630,1631],{"align":1293},"✅ at sync",[1017,1633,1316],{"align":1293},[1017,1635,1636],{"align":1293},"⚠️ via QR cross-device",[1017,1638,1639],{"align":1293},"D (synced)",[1017,1641,1642,1644],{},[980,1643,1154],{}," (hybrid transport)",[999,1646,1647,1650,1652,1654,1657,1660],{},[1017,1648,1649],{},"Smart cards — PIV \u002F CAC \u002F e-Residency",[1017,1651,1313],{"align":1293},[1017,1653,1316],{"align":1293},[1017,1655,1656],{"align":1293},"✅ bring the card",[1017,1658,1659],{"align":1293},"D + K (card PIN)",[1017,1661,1662],{},"❌ not covered",[999,1664,1665,1668,1670,1672,1674,1676],{},[1017,1666,1667],{},"Hardware OTP tokens (RSA SecurID, classic Yubikey OTP)",[1017,1669,1313],{"align":1293},[1017,1671,1316],{"align":1293},[1017,1673,1316],{"align":1293},[1017,1675,1247],{"align":1293},[1017,1677,1678],{},"❌ (legacy; FIDO2 covers)",[999,1680,1681,1684,1686,1688,1691,1693],{},[1017,1682,1683],{},"Bluetooth proximity (Apple Watch unlock, Pixel Smart Lock)",[1017,1685,1313],{"align":1293},[1017,1687,1316],{"align":1293},[1017,1689,1690],{"align":1293},"❌ wearable-bound",[1017,1692,1247],{"align":1293},[1017,1694,1313],{},[999,1696,1697,1700,1702,1705,1708,1710],{},[1017,1698,1699],{},"Recovery codes (printable)",[1017,1701,1313],{"align":1293},[1017,1703,1704],{"align":1293},"✅ paper safe",[1017,1706,1707],{"align":1293},"⚠️ emergency only",[1017,1709,1247],{"align":1293},[1017,1711,1712],{},[980,1713,1714],{},"on-recovery",[999,1716,1717,1720,1722,1724,1726,1729],{},[1017,1718,1719],{},"NFC \u002F contactless ID cards (eID, MyKad, Aadhaar w\u002F NFC)",[1017,1721,1313],{"align":1293},[1017,1723,1316],{"align":1293},[1017,1725,1316],{"align":1293},[1017,1727,1728],{"align":1293},"D + K (PIN)",[1017,1730,1313],{},[951,1732,1734],{"id":1733},"_4-inherence-biometrics","4. Inherence — biometrics",[940,1736,1737,1738,1741],{},"Biometrics never ",[972,1739,1740],{},"are"," the secret — they gate access to a local credential. So the noy-db match is always indirect.",[993,1743,1744,1760],{},[996,1745,1746],{},[999,1747,1748,1750,1752,1754,1756,1758],{},[1002,1749,1290],{},[1002,1751,1200],{"align":1293},[1002,1753,1296],{"align":1293},[1002,1755,1299],{"align":1293},[1002,1757,1238],{"align":1293},[1002,1759,1259],{},[1012,1761,1762,1784,1803,1820,1837],{},[999,1763,1764,1767,1769,1771,1773,1776],{},[1017,1765,1766],{},"Touch ID \u002F Face ID (Apple)",[1017,1768,1313],{"align":1293},[1017,1770,1316],{"align":1293},[1017,1772,1313],{"align":1293},[1017,1774,1775],{"align":1293},"B (gates passkey\u002Fkeychain)",[1017,1777,1778,1780,1781],{},[980,1779,1154],{}," (platform); sealing via ",[980,1782,1783],{},"at-macos-keychain",[999,1785,1786,1789,1791,1793,1795,1798],{},[1017,1787,1788],{},"Windows Hello (PIN\u002Ffingerprint\u002Fface\u002Firis)",[1017,1790,1313],{"align":1293},[1017,1792,1316],{"align":1293},[1017,1794,1313],{"align":1293},[1017,1796,1797],{"align":1293},"B + K",[1017,1799,1800,1802],{},[980,1801,1154],{}," (platform)",[999,1804,1805,1808,1810,1812,1814,1816],{},[1017,1806,1807],{},"Android Biometric (BiometricPrompt)",[1017,1809,1313],{"align":1293},[1017,1811,1316],{"align":1293},[1017,1813,1313],{"align":1293},[1017,1815,1251],{"align":1293},[1017,1817,1818,1802],{},[980,1819,1154],{},[999,1821,1822,1825,1827,1829,1832,1835],{},[1017,1823,1824],{},"Voice biometrics (banking IVR)",[1017,1826,1316],{"align":1293},[1017,1828,1316],{"align":1293},[1017,1830,1831],{"align":1293},"⚠️ replay-attackable",[1017,1833,1834],{"align":1293},"B weak",[1017,1836,1313],{},[999,1838,1839,1842,1844,1846,1849,1851],{},[1017,1840,1841],{},"Iris \u002F vein \u002F palm (industrial \u002F clinical)",[1017,1843,1313],{"align":1293},[1017,1845,1316],{"align":1293},[1017,1847,1848],{"align":1293},"✅ if scanner shared",[1017,1850,1251],{"align":1293},[1017,1852,1313],{},[951,1854,1856],{"id":1855},"_5-threshold-split-secrets","5. Threshold \u002F split secrets",[940,1858,1859,1860,1863,1864,1866,1867,1870,1871,1873,1874,1877,1878,1881,1882,1885],{},"A ",[943,1861,1862],{},"recovery profile"," is an enrolled way back into the vault when the secret is lost (full lifecycle on ",[967,1865,844],{"href":845},"). Four profiles exist in the recovery API: ",[943,1868,1869],{},"paper"," (printed single-use codes), ",[943,1872,325],{}," (K-of-N shares held by trustees), ",[943,1875,1876],{},"multi-channel 2-of-3"," (email OTP + device PIN + paper code; any two suffice), and ",[943,1879,1880],{},"admin-mediated"," (an admin issues a magic-link grant and the user adds one factor). Paper and Shamir are available today; multi-channel and admin-mediated declare their API surface and throw ",[980,1883,1884],{},"RecoveryProfileNotImplementedError"," when used.",[993,1887,1888,1904],{},[996,1889,1890],{},[999,1891,1892,1894,1896,1898,1900,1902],{},[1002,1893,1290],{},[1002,1895,1200],{"align":1293},[1002,1897,1296],{"align":1293},[1002,1899,1299],{"align":1293},[1002,1901,1238],{"align":1293},[1002,1903,1259],{},[1012,1905,1906,1926,1952,1971],{},[999,1907,1908,1911,1913,1916,1918,1921],{},[1017,1909,1910],{},"Shamir Secret Sharing (K-of-N)",[1017,1912,1313],{"align":1293},[1017,1914,1915],{"align":1293},"⚠️ coordination",[1017,1917,1342],{"align":1293},[1017,1919,1920],{"align":1293},"D × N",[1017,1922,1923],{},[980,1924,1925],{},"on-shamir",[999,1927,1928,1931,1934,1936,1938,1941],{},[1017,1929,1930],{},"Multi-channel 2-of-3 (the multi-channel recovery profile)",[1017,1932,1933],{"align":1293},"partial",[1017,1935,1316],{"align":1293},[1017,1937,1342],{"align":1293},[1017,1939,1940],{"align":1293},"K + D mix",[1017,1942,1943,1944,1946,1947,1946,1949,1951],{},"composed: ",[980,1945,1714],{}," + ",[980,1948,1484],{},[980,1950,1175],{}," (profile not yet implemented)",[999,1953,1954,1957,1959,1961,1963,1966],{},[1017,1955,1956],{},"Admin-mediated magic-link grant (the admin-mediated recovery profile)",[1017,1958,1316],{"align":1293},[1017,1960,1316],{"align":1293},[1017,1962,1316],{"align":1293},[1017,1964,1965],{"align":1293},"D + admin",[1017,1967,1968,1970],{},[980,1969,1520],{}," + the hub's magic-link grant flow",[999,1972,1973,1976,1978,1980,1982,1985],{},[1017,1974,1975],{},"MPC \u002F threshold signing (Fireblocks, Web3Auth tssLib)",[1017,1977,1316],{"align":1293},[1017,1979,1342],{"align":1293},[1017,1981,1342],{"align":1293},[1017,1983,1984],{"align":1293},"D × parties",[1017,1986,1313],{},[951,1988,1990],{"id":1989},"_6-oidc-federated-identity-providers","6. OIDC \u002F federated identity providers",[940,1992,1993,1994,1997,1998,2000],{},"All require ",[943,1995,1996],{},"online at auth time",". All map to ",[980,1999,1045],{}," with different issuer URLs. Differences are ecosystem fit and built-in 2FA strength, not protocol.",[937,2002,2003],{},[940,2004,2005,2008,2009,2011,2012,2015,2016,2019,2020,2023,2024,2027,2028,2031,2032,2034,2035,2038,2039,1155,2042,2045,2046,2048,2049,2057,2058,2061],{},[943,2006,2007],{},"Server-side dependency"," — OIDC is the only ",[980,2010,1029],{}," family that requires ",[943,2013,2014],{},"consumer-operated infrastructure",". ",[980,2017,2018],{},"@noy-db\u002Fon-oidc"," uses a split-key model: the KEK is XOR-split into a ",[980,2021,2022],{},"deviceHalf"," (a per-device secret that never leaves the device) and a ",[980,2025,2026],{},"serverHalf"," held by a small HTTP service — a ",[972,2029,2030],{},"key connector"," — that verifies ID tokens against the issuer's JWKS and stores each user's ",[980,2033,2026],{}," indexed by the token's ",[980,2036,2037],{},"sub"," claim. The package implements the client side and documents the two-endpoint server contract (",[980,2040,2041],{},"PUT \u002Fkek-fragment",[980,2043,2044],{},"GET \u002Fkek-fragment","); it deliberately does ",[943,2047,1078],{}," ship a reference server, hosted instance, or deploy template. If you have no off-device infrastructure, prefer ",[967,2050,2054],{"href":2051,"rel":2052},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-webauthn",[2053],"nofollow",[980,2055,2056],{},"@noy-db\u002Fon-webauthn"," (platform passkey via Touch ID \u002F Face ID \u002F Windows Hello) — the same \"Login with X\" UX without a server, because the platform passkey ",[972,2059,2060],{},"is"," the device-bound credential.",[993,2063,2064,2083],{},[996,2065,2066],{},[999,2067,2068,2071,2073,2075,2078,2081],{},[1002,2069,2070],{},"Provider",[1002,2072,1296],{"align":1293},[1002,2074,1299],{"align":1293},[1002,2076,2077],{},"Default factors",[1002,2079,2080],{},"Notes \u002F caveat",[1002,2082,1259],{},[1012,2084,2085,2105,2125,2145,2164,2183,2200,2219,2238,2257,2275,2294,2312,2332,2350,2369,2387,2405],{},[999,2086,2087,2090,2092,2095,2098,2101],{},[1017,2088,2089],{},"Google Sign-In",[1017,2091,1316],{"align":1293},[1017,2093,2094],{"align":1293},"⚠️ leaves session",[1017,2096,2097],{},"K + optional D (Google Prompt \u002F TOTP \u002F key)",[1017,2099,2100],{},"Consumer + Workspace",[1017,2102,2103],{},[980,2104,1045],{},[999,2106,2107,2110,2112,2115,2118,2121],{},[1017,2108,2109],{},"Apple Sign-In",[1017,2111,1316],{"align":1293},[1017,2113,2114],{"align":1293},"❌ Apple-bound",[1017,2116,2117],{},"K + B (device) + D",[1017,2119,2120],{},"Anonymizes email",[1017,2122,2123],{},[980,2124,1045],{},[999,2126,2127,2130,2132,2135,2138,2141],{},[1017,2128,2129],{},"Microsoft \u002F Entra ID",[1017,2131,1316],{"align":1293},[1017,2133,2134],{"align":1293},"✅ enterprise",[1017,2136,2137],{},"K + D (Authenticator)",[1017,2139,2140],{},"Conditional Access",[1017,2142,2143],{},[980,2144,1045],{},[999,2146,2147,2150,2152,2154,2157,2160],{},[1017,2148,2149],{},"AD FS (modern)",[1017,2151,1316],{"align":1293},[1017,2153,1316],{"align":1293},[1017,2155,2156],{},"K + D",[1017,2158,2159],{},"OIDC since Server 2016",[1017,2161,2162],{},[980,2163,1045],{},[999,2165,2166,2169,2171,2173,2176,2179],{},[1017,2167,2168],{},"GitHub",[1017,2170,1316],{"align":1293},[1017,2172,1342],{"align":1293},[1017,2174,2175],{},"K + D (TOTP\u002Fpasskey)",[1017,2177,2178],{},"Dev-tooling auth",[1017,2180,2181],{},[980,2182,1045],{},[999,2184,2185,2188,2190,2192,2194,2196],{},[1017,2186,2187],{},"GitLab",[1017,2189,1316],{"align":1293},[1017,2191,1342],{"align":1293},[1017,2193,2156],{},[1017,2195],{},[1017,2197,2198],{},[980,2199,1045],{},[999,2201,2202,2205,2207,2209,2212,2215],{},[1017,2203,2204],{},"Okta",[1017,2206,1316],{"align":1293},[1017,2208,2134],{"align":1293},[1017,2210,2211],{},"K + D (Okta Verify push)",[1017,2213,2214],{},"Workforce IdP",[1017,2216,2217],{},[980,2218,1045],{},[999,2220,2221,2224,2226,2228,2231,2234],{},[1017,2222,2223],{},"Auth0",[1017,2225,1316],{"align":1293},[1017,2227,1316],{"align":1293},[1017,2229,2230],{},"tenant-configurable",[1017,2232,2233],{},"B2C \u002F B2B SaaS IdP",[1017,2235,2236],{},[980,2237,1045],{},[999,2239,2240,2243,2245,2247,2250,2253],{},[1017,2241,2242],{},"AWS Cognito",[1017,2244,1316],{"align":1293},[1017,2246,1342],{"align":1293},[1017,2248,2249],{},"K + optional TOTP\u002FSMS",[1017,2251,2252],{},"State-machine wrapper is real value but the wrap key still needs split-key shape",[1017,2254,2255],{},[980,2256,1045],{},[999,2258,2259,2262,2264,2266,2268,2271],{},[1017,2260,2261],{},"Firebase Auth",[1017,2263,1316],{"align":1293},[1017,2265,1342],{"align":1293},[1017,2267,2156],{},[1017,2269,2270],{},"Mobile-first",[1017,2272,2273],{},[980,2274,1045],{},[999,2276,2277,2280,2282,2284,2287,2290],{},[1017,2278,2279],{},"Keycloak (self-host)",[1017,2281,1316],{"align":1293},[1017,2283,1316],{"align":1293},[1017,2285,2286],{},"configurable",[1017,2288,2289],{},"On-prem IdP",[1017,2291,2292],{},[980,2293,1045],{},[999,2295,2296,2299,2301,2303,2305,2308],{},[1017,2297,2298],{},"ForgeRock \u002F PingOne",[1017,2300,1316],{"align":1293},[1017,2302,2134],{"align":1293},[1017,2304,2286],{},[1017,2306,2307],{},"Legacy enterprise IAM",[1017,2309,2310],{},[980,2311,1045],{},[999,2313,2314,2317,2319,2321,2324,2327],{},[1017,2315,2316],{},"Facebook \u002F Meta",[1017,2318,1316],{"align":1293},[1017,2320,1313],{"align":1293},[1017,2322,2323],{},"K + optional D",[1017,2325,2326],{},"Consumer; not for vault",[1017,2328,2329,2331],{},[980,2330,1045],{}," (not recommended)",[999,2333,2334,2337,2339,2341,2343,2346],{},[1017,2335,2336],{},"LinkedIn \u002F X \u002F Discord \u002F Slack \u002F Notion \u002F Atlassian",[1017,2338,1316],{"align":1293},[1017,2340,1342],{"align":1293},[1017,2342,2156],{},[1017,2344,2345],{},"Work-app + consumer",[1017,2347,2348],{},[980,2349,1045],{},[999,2351,2352,2355,2357,2359,2362,2365],{},[1017,2353,2354],{},"LINE \u002F Kakao \u002F WeChat \u002F Naver",[1017,2356,1316],{"align":1293},[1017,2358,1342],{"align":1293},[1017,2360,2361],{},"K + D (varies)",[1017,2363,2364],{},"Asia-regional",[1017,2366,2367],{},[980,2368,1045],{},[999,2370,2371,2374,2376,2378,2380,2383],{},[1017,2372,2373],{},"Authentik \u002F Zitadel \u002F Logto",[1017,2375,1316],{"align":1293},[1017,2377,1316],{"align":1293},[1017,2379,2286],{},[1017,2381,2382],{},"Open-source Auth0\u002FOkta",[1017,2384,2385],{},[980,2386,1045],{},[999,2388,2389,2392,2394,2396,2398,2401],{},[1017,2390,2391],{},"Clerk \u002F Stytch \u002F WorkOS \u002F Frontegg",[1017,2393,1316],{"align":1293},[1017,2395,1316],{"align":1293},[1017,2397,1396],{},[1017,2399,2400],{},"DevX-IdP-as-SDK",[1017,2402,2403],{},[980,2404,1045],{},[999,2406,2407,2410,2412,2414,2417,2420],{},[1017,2408,2409],{},"ID.me \u002F Login.gov \u002F GOV.UK Verify",[1017,2411,1316],{"align":1293},[1017,2413,1316],{"align":1293},[1017,2415,2416],{},"K + D + identity proofing",[1017,2418,2419],{},"Government IdP",[1017,2421,2422],{},[980,2423,1045],{},[951,2425,2427],{"id":2426},"_7-enterprise-directory-protocols","7. Enterprise \u002F directory protocols",[993,2429,2430,2446],{},[996,2431,2432],{},[999,2433,2434,2436,2438,2440,2442,2444],{},[1002,2435,1290],{},[1002,2437,1200],{"align":1293},[1002,2439,1296],{"align":1293},[1002,2441,1299],{"align":1293},[1002,2443,1238],{"align":1293},[1002,2445,1259],{},[1012,2447,2448,2468,2485,2504,2519,2535],{},[999,2449,2450,2453,2456,2458,2461,2463],{},[1017,2451,2452],{},"LDAP simple\u002FSASL bind (incl AD)",[1017,2454,2455],{"align":1293},"✅ to DC",[1017,2457,1342],{"align":1293},[1017,2459,2460],{"align":1293},"✅ on-prem",[1017,2462,1243],{"align":1293},[1017,2464,2465,2466,1371],{},"❌ not covered (would need the split-key shape, like ",[980,2467,1045],{},[999,2469,2470,2473,2476,2478,2480,2483],{},[1017,2471,2472],{},"Kerberos \u002F IWA \u002F SPNEGO",[1017,2474,2475],{"align":1293},"✅ KDC then cached",[1017,2477,1342],{"align":1293},[1017,2479,1316],{"align":1293},[1017,2481,2482],{"align":1293},"K → D (TGT)",[1017,2484,1313],{},[999,2486,2487,2490,2492,2494,2496,2499],{},[1017,2488,2489],{},"SAML 2.0",[1017,2491,1316],{"align":1293},[1017,2493,1316],{"align":1293},[1017,2495,1316],{"align":1293},[1017,2497,2498],{"align":1293},"varies by IdP",[1017,2500,2501,2502],{},"❌ — bridge the IdP to OIDC and use ",[980,2503,1045],{},[999,2505,2506,2509,2511,2513,2515,2517],{},[1017,2507,2508],{},"RADIUS",[1017,2510,1316],{"align":1293},[1017,2512,1342],{"align":1293},[1017,2514,1316],{"align":1293},[1017,2516,1243],{"align":1293},[1017,2518,1313],{},[999,2520,2521,2524,2526,2528,2531,2533],{},[1017,2522,2523],{},"SSH cert auth (CA-signed)",[1017,2525,1313],{"align":1293},[1017,2527,1316],{"align":1293},[1017,2529,2530],{"align":1293},"✅ bring key",[1017,2532,1247],{"align":1293},[1017,2534,1313],{},[999,2536,2537,2540,2542,2544,2547,2549],{},[1017,2538,2539],{},"mTLS client certs",[1017,2541,1313],{"align":1293},[1017,2543,1316],{"align":1293},[1017,2545,2546],{"align":1293},"⚠️ cert provisioning",[1017,2548,1247],{"align":1293},[1017,2550,1313],{},[951,2552,2554],{"id":2553},"_8-os-keychain-device-local-sealing-not-authenticators","8. OS keychain \u002F device-local sealing — NOT authenticators",[940,2556,2557,2558,2561,2562,2567,2568,2570,2571,2573,2574,2577,2578,2580,2581,2583,2584,2587,2588,2593],{},"These don't authenticate the ",[972,2559,2560],{},"user"," — they protect the vault's root secret under OS-account guarantees. They map to the ",[967,2563,2564,2566],{"href":170},[980,2565,1063],{}," family",": implementations of the ",[980,2569,1067],{}," interface that ",[980,2572,1071],{}," exports for ",[943,2575,2576],{},"managed-secret mode"," — the vault mode where the secret is machine-generated, sealed by the provider, and never shown to the user (see ",[967,2579,844],{"href":845},"). One caveat is structural: unlike every other satellite family, an ",[980,2582,1063],{}," host ",[943,2585,2586],{},"can decrypt the vault it unseals"," — that is the point, and the safeguard is scoping the host to a dedicated vault (the trust boundary is spelled out on the ",[967,2589,2590,2592],{"href":170},[980,2591,1063],{}," overview",").",[993,2595,2596,2613],{},[996,2597,2598],{},[999,2599,2600,2603,2605,2607,2609,2611],{},[1002,2601,2602],{},"Store",[1002,2604,1200],{"align":1293},[1002,2606,1296],{"align":1293},[1002,2608,1299],{"align":1293},[1002,2610,1238],{"align":1293},[1002,2612,1259],{},[1012,2614,2615,2632,2649,2664,2679,2694,2710,2731],{},[999,2616,2617,2620,2622,2624,2627,2630],{},[1017,2618,2619],{},"Windows DPAPI \u002F Credential Manager",[1017,2621,1313],{"align":1293},[1017,2623,1316],{"align":1293},[1017,2625,2626],{"align":1293},"❌ user-bound",[1017,2628,2629],{"align":1293},"D (OS account)",[1017,2631,1662],{},[999,2633,2634,2637,2639,2641,2643,2645],{},[1017,2635,2636],{},"macOS Keychain Services",[1017,2638,1313],{"align":1293},[1017,2640,1316],{"align":1293},[1017,2642,1313],{"align":1293},[1017,2644,1247],{"align":1293},[1017,2646,2647],{},[980,2648,1783],{},[999,2650,2651,2654,2656,2658,2660,2662],{},[1017,2652,2653],{},"iOS Keychain (Secure Enclave)",[1017,2655,1313],{"align":1293},[1017,2657,1316],{"align":1293},[1017,2659,1313],{"align":1293},[1017,2661,1619],{"align":1293},[1017,2663,1662],{},[999,2665,2666,2669,2671,2673,2675,2677],{},[1017,2667,2668],{},"Android Keystore \u002F StrongBox \u002F TEE",[1017,2670,1313],{"align":1293},[1017,2672,1316],{"align":1293},[1017,2674,1313],{"align":1293},[1017,2676,1619],{"align":1293},[1017,2678,1662],{},[999,2680,2681,2684,2686,2688,2690,2692],{},[1017,2682,2683],{},"Linux Secret Service (libsecret, gnome-keyring, KWallet)",[1017,2685,1313],{"align":1293},[1017,2687,1316],{"align":1293},[1017,2689,1313],{"align":1293},[1017,2691,1247],{"align":1293},[1017,2693,1662],{},[999,2695,2696,2699,2701,2703,2706,2708],{},[1017,2697,2698],{},"TPM 2.0 (sealed-to-PCR \u002F no-export)",[1017,2700,1313],{"align":1293},[1017,2702,1316],{"align":1293},[1017,2704,2705],{"align":1293},"✅ server",[1017,2707,1247],{"align":1293},[1017,2709,1662],{},[999,2711,2712,2715,2717,2719,2721,2723],{},[1017,2713,2714],{},"Apple Secure Enclave",[1017,2716,1313],{"align":1293},[1017,2718,1316],{"align":1293},[1017,2720,1313],{"align":1293},[1017,2722,1619],{"align":1293},[1017,2724,2725,2726,2728,2729],{},"indirectly via ",[980,2727,1154],{}," \u002F ",[980,2730,1783],{},[999,2732,2733,2739,2741,2743,2745,2747],{},[1017,2734,2735,2736],{},"Browser CredentialStore \u002F ",[980,2737,2738],{},"navigator.credentials",[1017,2740,1313],{"align":1293},[1017,2742,1316],{"align":1293},[1017,2744,1313],{"align":1293},[1017,2746,1247],{"align":1293},[1017,2748,2749],{},"indirectly via WebAuthn",[951,2751,2753],{"id":2752},"_9-cloud-centralized-kms-hsm-server-context-sealing","9. Cloud \u002F centralized KMS & HSM — server-context sealing",[940,2755,2756,2757,2759],{},"Same family as section 8 (sealing, not auth) but server-side: ",[980,2758,1063],{}," sealing providers for managed-secret mode in server contexts — a host you control opens a scoped vault to compute on a user's behalf.",[993,2761,2762,2779],{},[996,2763,2764],{},[999,2765,2766,2769,2771,2773,2775,2777],{},[1002,2767,2768],{},"Service",[1002,2770,1200],{"align":1293},[1002,2772,1296],{"align":1293},[1002,2774,1299],{"align":1293},[1002,2776,1238],{"align":1293},[1002,2778,1259],{},[1012,2780,2781,2804,2823,2841,2859,2875,2890,2905],{},[999,2782,2783,2790,2792,2794,2796,2799],{},[1017,2784,2785,2786,2789],{},"Host environment variable (base64 256-bit key, ",[980,2787,2788],{},"NOYDB_SEALING_KEY"," by default)",[1017,2791,1313],{"align":1293},[1017,2793,1342],{"align":1293},[1017,2795,2705],{"align":1293},[1017,2797,2798],{"align":1293},"D (host env)",[1017,2800,2801],{},[980,2802,2803],{},"at-env",[999,2805,2806,2809,2811,2813,2815,2818],{},[1017,2807,2808],{},"AWS KMS",[1017,2810,1316],{"align":1293},[1017,2812,1342],{"align":1293},[1017,2814,2705],{"align":1293},[1017,2816,2817],{"align":1293},"D (IAM)",[1017,2819,2820],{},[980,2821,2822],{},"at-aws-kms",[999,2824,2825,2828,2830,2832,2834,2836],{},[1017,2826,2827],{},"GCP Cloud KMS \u002F Cloud HSM",[1017,2829,1316],{"align":1293},[1017,2831,1342],{"align":1293},[1017,2833,1316],{"align":1293},[1017,2835,1247],{"align":1293},[1017,2837,2838],{},[980,2839,2840],{},"at-gcp-kms",[999,2842,2843,2846,2848,2850,2852,2854],{},[1017,2844,2845],{},"Azure Key Vault \u002F Managed HSM",[1017,2847,1316],{"align":1293},[1017,2849,1342],{"align":1293},[1017,2851,1316],{"align":1293},[1017,2853,1247],{"align":1293},[1017,2855,2856],{},[980,2857,2858],{},"at-azure-keyvault",[999,2860,2861,2864,2866,2868,2870,2873],{},[1017,2862,2863],{},"HashiCorp Vault Transit",[1017,2865,1316],{"align":1293},[1017,2867,1342],{"align":1293},[1017,2869,1316],{"align":1293},[1017,2871,2872],{"align":1293},"D (token)",[1017,2874,1662],{},[999,2876,2877,2880,2882,2884,2886,2888],{},[1017,2878,2879],{},"Cloudflare Keyless SSL \u002F Turnstile",[1017,2881,1316],{"align":1293},[1017,2883,1342],{"align":1293},[1017,2885,1316],{"align":1293},[1017,2887,1247],{"align":1293},[1017,2889,1313],{},[999,2891,2892,2895,2897,2899,2901,2903],{},[1017,2893,2894],{},"PKCS 11 HSM (Thales, YubiHSM, SoftHSMv2)",[1017,2896,1313],{"align":1293},[1017,2898,1342],{"align":1293},[1017,2900,1316],{"align":1293},[1017,2902,1247],{"align":1293},[1017,2904,1662],{},[999,2906,2907,2910,2912,2914,2916,2919],{},[1017,2908,2909],{},"AWS Nitro Enclaves \u002F GCP Confidential Space \u002F Azure Confidential",[1017,2911,1316],{"align":1293},[1017,2913,1342],{"align":1293},[1017,2915,1316],{"align":1293},[1017,2917,2918],{"align":1293},"D + attestation",[1017,2920,1313],{},[951,2922,2924],{"id":2923},"_10-password-managers-personal-vaults","10. Password managers \u002F personal vaults",[940,2926,2927,2928,2930,2931,2934],{},"Out of scope for ",[980,2929,1029],{}," — users compose them upstream by ",[972,2932,2933],{},"storing their secret there",". Listed for completeness; not a wrap-key target.",[993,2936,2937,2954],{},[996,2938,2939],{},[999,2940,2941,2944,2946,2948,2950,2952],{},[1002,2942,2943],{},"Tool",[1002,2945,1200],{"align":1293},[1002,2947,1296],{"align":1293},[1002,2949,1299],{"align":1293},[1002,2951,1238],{"align":1293},[1002,2953,1259],{},[1012,2955,2956,2973,2989,3004,3021],{},[999,2957,2958,2961,2964,2966,2968,2971],{},[1017,2959,2960],{},"1Password",[1017,2962,2963],{"align":1293},"⚠️ sync",[1017,2965,1316],{"align":1293},[1017,2967,1313],{"align":1293},[1017,2969,2970],{"align":1293},"K + D + B",[1017,2972,1313],{},[999,2974,2975,2978,2980,2982,2985,2987],{},[1017,2976,2977],{},"Bitwarden \u002F Vaultwarden",[1017,2979,2963],{"align":1293},[1017,2981,1316],{"align":1293},[1017,2983,2984],{"align":1293},"⚠️ self-host kiosk",[1017,2986,2970],{"align":1293},[1017,2988,1313],{},[999,2990,2991,2994,2996,2998,3000,3002],{},[1017,2992,2993],{},"Dashlane \u002F LastPass \u002F NordPass \u002F Proton Pass",[1017,2995,2963],{"align":1293},[1017,2997,1316],{"align":1293},[1017,2999,1313],{"align":1293},[1017,3001,2970],{"align":1293},[1017,3003,1313],{},[999,3005,3006,3009,3011,3013,3015,3018],{},[1017,3007,3008],{},"Apple Passwords \u002F Google Password Manager",[1017,3010,2963],{"align":1293},[1017,3012,1316],{"align":1293},[1017,3014,1313],{"align":1293},[1017,3016,3017],{"align":1293},"K\u002FB (device)",[1017,3019,3020],{},"indirectly via Keychain",[999,3022,3023,3026,3028,3030,3033,3036],{},[1017,3024,3025],{},"KeePass \u002F KeePassXC (offline)",[1017,3027,1313],{"align":1293},[1017,3029,1316],{"align":1293},[1017,3031,3032],{"align":1293},"⚠️ portable",[1017,3034,3035],{"align":1293},"K + D (key file)",[1017,3037,1313],{},[951,3039,3041],{"id":3040},"_11-threat-context-layers-modify-dont-replace-the-above","11. Threat \u002F context layers (modify, don't replace, the above)",[993,3043,3044,3053],{},[996,3045,3046],{},[999,3047,3048,3051],{},[1002,3049,3050],{},"Mechanism",[1002,3052,1259],{},[1012,3054,3055,3065,3075,3082,3089],{},[999,3056,3057,3060],{},[1017,3058,3059],{},"Lockout \u002F duress code \u002F honeypot vault",[1017,3061,3062],{},[980,3063,3064],{},"on-threat",[999,3066,3067,3070],{},[1017,3068,3069],{},"Risk-based \u002F adaptive auth (Okta Risk, Auth0 Anomaly, Cloudflare Turnstile)",[1017,3071,3072,3073,1371],{},"❌ (provider-side; layer above ",[980,3074,1045],{},[999,3076,3077,3080],{},[1017,3078,3079],{},"Device attestation (Play Integrity, App Attest, ASWebAuthSession)",[1017,3081,1313],{},[999,3083,3084,3087],{},[1017,3085,3086],{},"Behavioral biometrics (typing cadence, mouse)",[1017,3088,1313],{},[999,3090,3091,3094],{},[1017,3092,3093],{},"Geofencing \u002F IP allowlists",[1017,3095,3096],{},"❌ (policy-layer, not auth-layer)",[951,3098,3100],{"id":3099},"_12-emerging-specialized","12. Emerging \u002F specialized",[993,3102,3103,3119],{},[996,3104,3105],{},[999,3106,3107,3109,3111,3113,3115,3117],{},[1002,3108,1290],{},[1002,3110,1200],{"align":1293},[1002,3112,1296],{"align":1293},[1002,3114,1299],{"align":1293},[1002,3116,1238],{"align":1293},[1002,3118,1259],{},[1012,3120,3121,3139,3163,3179,3195,3211,3227],{},[999,3122,3123,3126,3128,3130,3133,3135],{},[1017,3124,3125],{},"Passkeys cross-device (BLE hybrid transport, FIDO CTAP 2.2)",[1017,3127,1933],{"align":1293},[1017,3129,1316],{"align":1293},[1017,3131,3132],{"align":1293},"✅ via QR + phone",[1017,3134,1619],{"align":1293},[1017,3136,3137],{},[980,3138,1154],{},[999,3140,3141,3153,3155,3157,3159,3161],{},[1017,3142,3143,3144,1155,3147,1155,3150],{},"Decentralized Identifiers — DID\u002FVC (W3C), ",[980,3145,3146],{},"did:key",[980,3148,3149],{},"did:web",[980,3151,3152],{},"did:ion",[1017,3154,1396],{"align":1293},[1017,3156,1316],{"align":1293},[1017,3158,1316],{"align":1293},[1017,3160,1247],{"align":1293},[1017,3162,1313],{},[999,3164,3165,3168,3171,3173,3175,3177],{},[1017,3166,3167],{},"mDL (ISO\u002FIEC 18013-5 mobile driver license)",[1017,3169,3170],{"align":1293},"❌ BLE",[1017,3172,1316],{"align":1293},[1017,3174,1316],{"align":1293},[1017,3176,1619],{"align":1293},[1017,3178,1313],{},[999,3180,3181,3184,3186,3188,3190,3193],{},[1017,3182,3183],{},"EUDI Wallet (EU Digital Identity, eIDAS 2)",[1017,3185,1396],{"align":1293},[1017,3187,1316],{"align":1293},[1017,3189,1316],{"align":1293},[1017,3191,3192],{"align":1293},"D + B + K",[1017,3194,1313],{},[999,3196,3197,3200,3202,3204,3206,3209],{},[1017,3198,3199],{},"BankID (SE\u002FNO\u002FDK\u002FFI) \u002F ItsMe (BE)",[1017,3201,1316],{"align":1293},[1017,3203,1316],{"align":1293},[1017,3205,1442],{"align":1293},[1017,3207,3208],{"align":1293},"D + K + B",[1017,3210,1662],{},[999,3212,3213,3216,3218,3220,3222,3225],{},[1017,3214,3215],{},"Web3 wallet (SIWE — Sign-In with Ethereum \u002F Solana)",[1017,3217,1316],{"align":1293},[1017,3219,1316],{"align":1293},[1017,3221,1342],{"align":1293},[1017,3223,3224],{"align":1293},"D (priv key) + K (wallet PIN)",[1017,3226,1313],{},[999,3228,3229,3232,3234,3236,3238,3240],{},[1017,3230,3231],{},"WebOTP API (browser-mediated SMS auto-fill)",[1017,3233,1316],{"align":1293},[1017,3235,1316],{"align":1293},[1017,3237,1342],{"align":1293},[1017,3239,1247],{"align":1293},[1017,3241,1313],{},[1276,3243],{},[951,3245,3247],{"id":3246},"whats-covered-today","What's covered today",[3249,3250,3251,3258,3280,3304,3313,3319],"ul",{},[3252,3253,3254,3257],"li",{},[943,3255,3256],{},"Coverage is strong on offline-first primitives"," (TOTP, WebAuthn, recovery codes, Shamir, PIN, password) — the parts where zero-knowledge actually buys you something. That is deliberate.",[3252,3259,3260,3263,3264,3266,3267,1155,3270,3273,3274,3276,3277,3279],{},[943,3261,3262],{},"Coverage is uniform on OIDC."," One ",[980,3265,1045],{}," package handles every provider in section 6, because the protocol — not the brand — is the unit of abstraction. There is no ",[980,3268,3269],{},"on-cognito",[980,3271,3272],{},"on-okta",", or ",[980,3275,1082],{},", and none is needed: they are issuer URLs in an ",[980,3278,1045],{}," config.",[3252,3281,3282,3285,3286,3290,3291,3293,3294,3296,3297,1155,3299,1155,3301,3303],{},[943,3283,3284],{},"Sealing coverage is host-first."," The ",[967,3287,3288,2566],{"href":170},[980,3289,1063],{}," ships providers for the host environment (",[980,3292,2803],{},"), macOS Keychain (",[980,3295,1783],{},"), and the three major cloud KMSes (",[980,3298,2822],{},[980,3300,2840],{},[980,3302,2858],{},"). There is no provider for Windows DPAPI, the iOS\u002FAndroid keystores, Linux Secret Service, or HashiCorp Vault.",[3252,3305,3306,3309,3310,3312],{},[943,3307,3308],{},"Not covered today:"," on-prem directory bind (LDAP \u002F Kerberos), smart cards (roaming WebAuthn covers most of that ground), standalone push-notification factors (reachable via ",[980,3311,1045],{},"), and regional ID schemes (BankID, EUDI Wallet).",[3252,3314,3315,3318],{},[943,3316,3317],{},"Deliberately omitted:"," SMS OTP, security questions, pattern locks — each breaks the security model in a way stated in its table row.",[3252,3320,3321,3326,3327,3329],{},[943,3322,3323,3325],{},[980,3324,3064],{}," is structurally unique."," It is the only ",[980,3328,1029],{}," package that doesn't authenticate; it modifies how the others authenticate (lockout, duress, honeypot).",[951,3331,3333,3334,3336],{"id":3332},"why-the-hub-and-the-on-packages-are-separate","Why the hub and the ",[980,3335,1029],{}," packages are separate",[940,3338,3339,3340,3343,3344,3347,3348,3351,3352],{},"When you enroll recovery codes you install ",[980,3341,3342],{},"@noy-db\u002Fon-recovery"," ",[972,3345,3346],{},"and"," call ",[980,3349,3350],{},"db.team.enrollRecovery(...)"," on the hub — and the same two-package shape recurs for passwords and PINs. The split is deliberate: ",[943,3353,3354,3355,3357],{},"the hub owns the cryptosystem; the ",[980,3356,1029],{}," package owns the user-facing credential format.",[940,3359,3360,3361,2728,3364,3367,3368,3370,3371,3374,3375,3377,3378,3380,3381,3384],{},"The shared \"wrap a DEK set under a credential-derived key\" primitive — ",[980,3362,3363],{},"mintWrappedDeksBlob",[980,3365,3366],{},"unwrapDeksFromBlob",", exported from ",[980,3369,1071],{}," — derives an AES-GCM key from the credential string via PBKDF2-SHA256 (600,000 iterations) and encrypts the serialized DEK set. It is the same primitive whether the credential is a printed recovery code or a typed password. What differs is what counts as a well-formed ",[943,3372,3373],{},"credential",": a Base32-with-checksum string (",[980,3376,1714],{},"), a validated password (",[980,3379,1160],{},"). (",[980,3382,3383],{},"@noy-db\u002Fon-pin"," follows the same pattern but at 100,000 PBKDF2 iterations — a PIN slot's protection window is short and idle-timeout-bounded, and its wire format is deliberately incompatible with the 600K one.)",[993,3386,3387,3400],{},[996,3388,3389],{},[999,3390,3391,3394,3397],{},[1002,3392,3393],{},"Concern",[1002,3395,3396],{},"Lives in",[1002,3398,3399],{},"Why",[1012,3401,3402,3418,3442,3466,3480],{},[999,3403,3404,3407,3415],{},[1017,3405,3406],{},"Cryptosystem (PBKDF2-SHA256 600K → AES-GCM wrap of the DEK set)",[1017,3408,3409,1367,3411,2728,3413,1371],{},[980,3410,1071],{},[980,3412,3363],{},[980,3414,3366],{},[1017,3416,3417],{},"One audited implementation. Every package calls it. A bug-fix or security review touches one place.",[999,3419,3420,3432,3436],{},[1017,3421,3422,3423,1155,3426,1155,3429,1371],{},"On-disk format (",[980,3424,3425],{},"PaperRecoveryEntry",[980,3427,3428],{},"KeyringFile.authenticators[]",[980,3430,3431],{},"_meta\u002Frecovery-paper",[1017,3433,3434],{},[980,3435,1071],{},[1017,3437,3438,3439,3441],{},"The hub knows how to read every keyring it ever wrote; the ",[980,3440,1029],{}," packages can come and go without changing the format.",[999,3443,3444,3459,3463],{},[1017,3445,3446,3447,1155,3450,1155,3453,1155,3456,1371],{},"Orchestration (",[980,3448,3449],{},"db.enrollRecovery",[980,3451,3452],{},"db.recoverSecret",[980,3454,3455],{},"db.enrollAuthenticator",[980,3457,3458],{},"db.unlockViaAuthenticator",[1017,3460,3461],{},[980,3462,1071],{},[1017,3464,3465],{},"These compose multiple primitives and run policy gates. They don't change per credential family.",[999,3467,3468,3471,3477],{},[1017,3469,3470],{},"User-facing string format (Base32 alphabet + checksum, password validation rules, PIN length policy)",[1017,3472,3473,3474,3476],{},"The ",[980,3475,1029],{}," package",[1017,3478,3479],{},"Each consumer can swap. An app that needs BIP-39 word lists instead of Base32 can supply its own format without touching the hub.",[999,3481,3482,3485,3489],{},[1017,3483,3484],{},"Auto-rotation, burn-on-use, atomicity",[1017,3486,3487],{},[980,3488,1071],{},[1017,3490,3491],{},"These are properties of the primitive, not the format.",[940,3493,3494,3495],{},"The classification rule behind the table: ",[943,3496,3497],{},"does the thing produce wrap-key material directly, or does it just shape user input?",[3249,3499,3500,3510],{},[3252,3501,3502,3505,3506,3509],{},[943,3503,3504],{},"Produces wrap-key material directly"," (secret → PBKDF2 → KEK; KEK → AES-KW → DEKs; the wrap-DEKs primitive itself) → ",[943,3507,3508],{},"hub",". There is one cryptosystem, and there is one of it.",[3252,3511,3512,3515,3516,3521],{},[943,3513,3514],{},"Shapes user input"," (Base32 codes with checksums, password length policies, 4-digit PINs, WebAuthn ceremonies, OIDC token flows) → ",[943,3517,3518,3519,3476],{},"an ",[980,3520,1029],{},". There are many possible shapes; each consumer picks one.",[940,3523,3524,3525,3527],{},"This is also why ",[980,3526,3342],{}," stays a separate small package rather than a hub subpath: keeping the format outside the hub is what lets you swap Base32 for another code format without forking the cryptosystem.",[951,3529,3531],{"id":3530},"classifying-a-method-that-isnt-in-the-tables","Classifying a method that isn't in the tables",[940,3533,3534],{},"Evaluating an authentication method this map doesn't list? Walk the same checklist the map itself was built with:",[3536,3537,3538,3544,3556,3573],"ol",{},[3252,3539,3540,3543],{},[943,3541,3542],{},"Is it an authenticator, an IdP, or a sealing-key store?"," Mis-classification means the wrong package family — and the wrong threat model. See \"Three distinct functions\" above.",[3252,3545,3546,3549,3550,3552,3553,3555],{},[943,3547,3548],{},"Does the protocol already have a generic package?"," A vendor-flavored OIDC provider is an ",[980,3551,1045],{}," config, not a missing package. A vendor-flavored OS keychain is a sealing concern (",[980,3554,1063],{},"), not an authenticator.",[3252,3557,3558,3561,3562,3565,3566,3568,3569,3572],{},[943,3559,3560],{},"Can it carry wrap-key material on its own?"," If not (LDAP bind, Kerberos tickets, Cognito tokens), the only honest shape is ",[943,3563,3564],{},"split-key"," — the same pattern as ",[980,3567,1045],{}," — or ",[943,3570,3571],{},"gate-only composition"," with a real authenticator.",[3252,3574,3575,3578,3579,3581,3582,3585],{},[943,3576,3577],{},"Does it work on shared devices?"," If only on personal devices, treat that as a hard constraint in your deployment. Tier 3 (",[980,3580,1175],{},") is ",[972,3583,3584],{},"never"," safe on shared workstations regardless.",[951,3587,3589],{"id":3588},"common-questions-this-map-answers","Common questions this map answers",[993,3591,3592,3605],{},[996,3593,3594],{},[999,3595,3596,3599,3602],{},[1002,3597,3598],{},"Question",[1002,3600,3601],{},"Where to look",[1002,3603,3604],{},"One-line answer",[1012,3606,3607,3620,3632,3644,3656,3670,3690,3703,3716,3732,3743],{},[999,3608,3609,3612,3615],{},[1017,3610,3611],{},"\"Login with Google?\"",[1017,3613,3614],{},"§6",[1017,3616,3617,3619],{},[980,3618,1045],{}," with Google issuer.",[999,3621,3622,3625,3627],{},[1017,3623,3624],{},"\"Login with Apple?\"",[1017,3626,3614],{},[1017,3628,3629,3631],{},[980,3630,1045],{}," with Apple issuer. Apple-ecosystem only on personal device.",[999,3633,3634,3637,3639],{},[1017,3635,3636],{},"\"Login with Microsoft \u002F work account?\"",[1017,3638,3614],{},[1017,3640,3641,3643],{},[980,3642,1045],{}," with Entra ID issuer.",[999,3645,3646,3649,3651],{},[1017,3647,3648],{},"\"Login with AWS Cognito?\"",[1017,3650,3614],{},[1017,3652,3653,3655],{},[980,3654,1045],{}," with the Cognito hosted-UI issuer; state-machine sugar can live as a small helper inside the consumer app.",[999,3657,3658,3661,3664],{},[1017,3659,3660],{},"\"Login with Active Directory?\"",[1017,3662,3663],{},"§6, §7",[1017,3665,3666,3667,3669],{},"Modern AD FS or Entra → ",[980,3668,1045],{},". Raw on-prem AD (LDAP\u002FKerberos) → not covered; it would need the split-key shape.",[999,3671,3672,3675,3678],{},[1017,3673,3674],{},"\"Login with Windows \u002F Windows Hello?\"",[1017,3676,3677],{},"§3, §4, §8",[1017,3679,3680,3681,3683,3684,3686,3687,3689],{},"Windows Hello ",[972,3682,2060],{}," WebAuthn → ",[980,3685,1154],{},". \"Use my Windows account to unlock\" (DPAPI sealing) → not covered; no ",[980,3688,1063],{}," provider for Windows exists.",[999,3691,3692,3695,3698],{},[1017,3693,3694],{},"\"Login with Touch ID \u002F Face ID?\"",[1017,3696,3697],{},"§4",[1017,3699,3700,3701,975],{},"Platform passkey via ",[980,3702,1154],{},[999,3704,3705,3708,3711],{},[1017,3706,3707],{},"\"Login with my YubiKey?\"",[1017,3709,3710],{},"§3",[1017,3712,3713,3714,975],{},"Roaming WebAuthn via ",[980,3715,1154],{},[999,3717,3718,3721,3724],{},[1017,3719,3720],{},"\"SMS as a 2FA factor?\"",[1017,3722,3723],{},"§2",[1017,3725,3726,3727,3729,3730,975],{},"Deliberately omitted. SIM-swap and SS7 attacks make it unfit for vault auth. Use ",[980,3728,1449],{}," or ",[980,3731,1484],{},[999,3733,3734,3737,3740],{},[1017,3735,3736],{},"\"BankID \u002F EUDI Wallet?\"",[1017,3738,3739],{},"§12",[1017,3741,3742],{},"Not covered today.",[999,3744,3745,3748,3750],{},[1017,3746,3747],{},"\"Decentralized identity (DID\u002FVC, SIWE)?\"",[1017,3749,3739],{},[1017,3751,3742],{},[951,3753,3755],{"id":3754},"see-also","See also",[3249,3757,3758,3763,3771,3779,3784,3790],{},[3252,3759,3760,3762],{},[967,3761,844],{"href":845}," — how the primitives compose into the three-tier session lifecycle and policy gates.",[3252,3764,3765,3770],{},[967,3766,3767,3769],{"href":296},[980,3768,1029],{}," family catalog"," — factor table and per-package summaries.",[3252,3772,3773,3778],{},[967,3774,3775,3777],{"href":170},[980,3776,1063],{}," family overview"," — the sealing-provider family: trust boundary, managed-secret mode, per-package summaries.",[3252,3780,3781,3783],{},[967,3782,969],{"href":66}," — the key hierarchy (secret → KEK → DEKs) everything on this page ultimately unlocks.",[3252,3785,3786,3789],{},[967,3787,3788],{"href":54},"Core 06 — Permissions and keyring"," — the keyring: the per-user record of wrapped keys that every method on this page ultimately opens.",[3252,3791,3792,3793,1155,3798,1155,3804,1155,3810,1155,3816,1155,3822,1155,3828,1155,3834,1155,3840,1155,3846],{},"Per-package READMEs: ",[967,3794,3796],{"href":2051,"rel":3795},[2053],[980,3797,1154],{},[967,3799,3802],{"href":3800,"rel":3801},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-oidc",[2053],[980,3803,1045],{},[967,3805,3808],{"href":3806,"rel":3807},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-pin",[2053],[980,3809,1175],{},[967,3811,3814],{"href":3812,"rel":3813},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-totp",[2053],[980,3815,1449],{},[967,3817,3820],{"href":3818,"rel":3819},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-email-otp",[2053],[980,3821,1484],{},[967,3823,3826],{"href":3824,"rel":3825},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-recovery",[2053],[980,3827,1714],{},[967,3829,3832],{"href":3830,"rel":3831},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-shamir",[2053],[980,3833,1925],{},[967,3835,3838],{"href":3836,"rel":3837},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-magic-link",[2053],[980,3839,1520],{},[967,3841,3844],{"href":3842,"rel":3843},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-password",[2053],[980,3845,1160],{},[967,3847,3850],{"href":3848,"rel":3849},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fon\u002Ftree\u002Fmain\u002Fon-threat",[2053],[980,3851,3064],{},{"title":3853,"searchDepth":3854,"depth":3854,"links":3855},"",3,[3856,3858,3859,3860,3861,3862,3863,3864,3865,3866,3867,3868,3869,3870,3871,3872,3873,3874,3876,3877,3878],{"id":953,"depth":3857,"text":954},2,{"id":990,"depth":3857,"text":991},{"id":1091,"depth":3857,"text":1092},{"id":1178,"depth":3857,"text":1179},{"id":1280,"depth":3857,"text":1281},{"id":1408,"depth":3857,"text":1409},{"id":1557,"depth":3857,"text":1558},{"id":1733,"depth":3857,"text":1734},{"id":1855,"depth":3857,"text":1856},{"id":1989,"depth":3857,"text":1990},{"id":2426,"depth":3857,"text":2427},{"id":2553,"depth":3857,"text":2554},{"id":2752,"depth":3857,"text":2753},{"id":2923,"depth":3857,"text":2924},{"id":3040,"depth":3857,"text":3041},{"id":3099,"depth":3857,"text":3100},{"id":3246,"depth":3857,"text":3247},{"id":3332,"depth":3857,"text":3875},"Why the hub and the on-* packages are separate",{"id":3530,"depth":3857,"text":3531},{"id":3588,"depth":3857,"text":3589},{"id":3754,"depth":3857,"text":3755},null,"Reference map of authentication, unlock, and sealing-key methods — every common auth primitive scored and matched to its on-* or at-* package.","md",{},"service",{"title":617,"description":3880},"stable","important","wfqr5o6YwER81CfZ_rcz0aH-pyBrrnuN26hjtbLHoxk",{"data":3889,"body":3890},{},{"type":3891,"children":3892},"root",[3893],{"type":3894,"tag":940,"props":3895,"children":3896},"element",{},[3897,3900,3909],{"type":3898,"value":3899},"text","reference — this page documents no API of its own; the packages it names are documented in the ",{"type":3894,"tag":967,"props":3901,"children":3902},{"href":296},[3903,3908],{"type":3894,"tag":980,"props":3904,"children":3906},{"className":3905},[],[3907],{"type":3898,"value":1029},{"type":3898,"value":3769},{"type":3898,"value":975},{"data":3911,"body":3912},{},{"type":3891,"children":3913},[3914],{"type":3894,"tag":940,"props":3915,"children":3916},{},[3917],{"type":3898,"value":3918},"collaboration-and-auth",{"data":3920,"body":3921},{},{"type":3891,"children":3922},[3923],{"type":3894,"tag":940,"props":3924,"children":3925},{},[3926,3928,3934,3935,3940,3942,3953],{"type":3898,"value":3927},"every ",{"type":3894,"tag":980,"props":3929,"children":3931},{"className":3930},[],[3932],{"type":3898,"value":3933},"@noy-db\u002Fon-*",{"type":3898,"value":1265},{"type":3894,"tag":980,"props":3936,"children":3938},{"className":3937},[],[3939],{"type":3898,"value":1071},{"type":3898,"value":3941}," core (KEK derivation, keyring layout, policy gates), and the ",{"type":3894,"tag":967,"props":3943,"children":3944},{"href":170},[3945,3951],{"type":3894,"tag":980,"props":3946,"children":3948},{"className":3947},[],[3949],{"type":3898,"value":3950},"@noy-db\u002Fat-*",{"type":3898,"value":3952}," sealing-provider family",{"type":3898,"value":975},{"data":3955,"body":3956},{},{"type":3891,"children":3957},[3958],{"type":3894,"tag":940,"props":3959,"children":3960},{},[3961,3965],{"type":3894,"tag":967,"props":3962,"children":3963},{"href":845},[3964],{"type":3898,"value":844},{"type":3898,"value":3966}," — how the primitives below compose into a session lifecycle.",1791896590217]