Querying

Query groups wrap common node APIs:

• client.chain: chain head, blocks, headers, protocol, verification.
• client.mempool: local mempool reads.
• client.consensus: consensus status.
• client.observability: operator observability endpoints.
• client.governance: validators, active validators, chain access rules.
• client.buckets: bucket observability, access rules, and actor-authenticated public-index record search.
• client.identities: organizations and users.

Operator-only queries require operatorToken in the client config.

For bucket concepts, index schemas, encryption modes, and permission behavior, see Data Buckets and Permission Model.

Searching Bucket Records

Record search uses the node's actor-authenticated bucket API. Pass the actor public key through the SDK options; the SDK sends it in x-noos-public-key-base64.

const result = await client.buckets.searchRecords("bucket-project-data", {
  actorPublicKey: process.env.NOOS_SIGNER_PUBLIC_KEY!,
  indexes: {
    reviewed: true,
    projectId: "project-a",
  },
  limit: 100,
});

The API validates each indexes value against the bucket index schema and uses typed record_indexes predicates. It never decrypts payloads.

Preparing Encrypted Record Writes

client.buckets.prepareEncryptedRecord(bucketId, { actorPublicKey }) wraps the legacy GET /buckets/:id/records/encrypted-prepare metadata helper. The default client.transactions.addEncryptedRecordFromPlaintext(...) path now uses POST /buckets/:id/records/prepare-add-encrypted-record, which receives plaintext, generates a raw UUID record id, prepares the exact transaction ADD_ENCRYPTED_RECORD envelope, and requires submission with a preparedTransactionId.

The endpoint returns only safe public material:

• bucket id and encryption mode;
• creator user and organization ids resolved from the authenticated actor;
• recipient count derived from bucket access rules and implicit bucket ownership;
• active bucket-key metadata, without bucket-key envelopes for write preparation.

It does not return plaintext, raw DEKs, private keys, decrypted payloads, or bucket-key envelopes for per-bucket write preparation. Bucket-key envelope recipients are controlled by bucket replication strategy and access rules at bucket-key creation/rotation time.

client.buckets.wrapEncryptedRecordDek(bucketId, dekBase64, { actorPublicKey }) wraps POST /buckets/:id/records/encrypted-wrap-dek. It lets the backend derive the required encrypted-read recipients and return key envelopes without exposing the recipient list to the browser. It is retained as a lower-level legacy helper; the high-level plaintext transaction helper no longer calls it automatically.