[{"data":1,"prerenderedAt":2839},["ShallowReactive",2],{"navigation":3,"\u002Fcore\u002F06-permissions-and-keyring":927},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":929,"access":12,"apiToc":930,"body":931,"category":2829,"description":2830,"extension":2831,"meta":2832,"navigation":2833,"nest":2834,"path":54,"seo":2835,"sinceVersion":2829,"status":2836,"stem":55,"subtitle":2829,"tier":2837,"tocExternal":2829,"__hash__":2838},"docs\u002Fcore\u002F06-permissions-and-keyring.md","Permissions & Keyring",false,{"type":932,"value":933,"toc":2814},"minimark",[934,938,953,958,988,995,1049,1064,1068,1173,1243,1247,1254,1459,1470,1474,1517,1880,1885,1888,1915,1921,1923,1941,1964,1971,1984,1988,2014,2017,2027,2037,2191,2201,2205,2216,2234,2239,2313,2398,2482,2501,2530,2547,2565,2569,2670,2674,2710,2714,2781,2785,2810],[935,936,929],"h1",{"id":937},"permissions-keyring",[939,940,941],"blockquote",{},[942,943,944,948,949],"p",{},[945,946,947],"strong",{},"Always-on. Every vault has a keyring — a single-owner keyring is the minimum.","\nSource of truth: ",[950,951,952],"code",{},"packages\u002Fhub\u002Fsrc\u002Fwith-party\u002Fteam\u002Fkeyring.ts",[954,955,957],"h2",{"id":956},"what-it-is","What it is",[942,959,960,961,964,965,968,969,972,973,977,978,981,982,987],{},"noy-db encrypts each collection with its own ",[945,962,963],{},"DEK"," (data-encryption key). Your copy of\nthose DEKs lives in your ",[945,966,967],{},"keyring",": a per-user record stored at ",[950,970,971],{},"_keyring\u002F\u003CuserId>","\ninside the vault. The DEKs in the keyring are ",[974,975,976],"em",{},"wrapped"," — encrypted with AES-KW — under\nyour ",[945,979,980],{},"KEK"," (key-encryption key), which is derived from your secret and never written\nto disk. The full key hierarchy is covered in ",[983,984,986],"a",{"href":985},".\u002Fnoydb\u002Fenclave","Core 02 — Enclave",";\nthis page assumes it.",[942,989,990,991,994],{},"That design makes the keyring both the access-control list and the cryptographic gate:\n",[945,992,993],{},"what you can read is exactly what your keyring can unwrap",". The keyring record holds:",[996,997,998,1022,1029,1032,1035,1042],"ul",{},[999,1000,1001,1002,1005,1006,1005,1009,1005,1012,1005,1015,1005,1018,1021],"li",{},"Your role (",[950,1003,1004],{},"owner"," \u002F ",[950,1007,1008],{},"admin",[950,1010,1011],{},"custodian",[950,1013,1014],{},"operator",[950,1016,1017],{},"viewer",[950,1019,1020],{},"client",")",[999,1023,1024,1025,1028],{},"Per-collection permissions (",[950,1026,1027],{},"{ collectionName: 'rw' | 'ro' }",") for the explicit-grant roles",[999,1030,1031],{},"Wrapped DEKs — one per collection you can decrypt",[999,1033,1034],{},"The salt used to derive your KEK from your secret",[999,1036,1037,1038,1041],{},"A ",[974,1039,1040],{},"canary"," — a fixed value wrapped under your KEK, so the hub can tell a wrong\nsecret apart from on-disk corruption",[999,1043,1044,1045,1048],{},"Optional export\u002Fimport capability grants for the ",[950,1046,1047],{},"@noy-db\u002Fas-*"," packages",[942,1050,1051,1052,1055,1056,1059,1060,1063],{},"A vault opens only for a user whose keyring unwraps. Secret unlock is the default;\npasskey, OIDC, magic-link, and other unlock methods come from the ",[950,1053,1054],{},"@noy-db\u002Fon-*"," packages\n(see ",[983,1057,617],{"href":1058},"..\u002Fservices\u002Fauth-landscape",") via the ",[950,1061,1062],{},"getKeyring"," option.",[954,1065,1067],{"id":1066},"roles","Roles",[1069,1070,1071,1087],"table",{},[1072,1073,1074],"thead",{},[1075,1076,1077,1081,1084],"tr",{},[1078,1079,1080],"th",{},"Role",[1078,1082,1083],{},"Collection access",[1078,1085,1086],{},"Can grant \u002F revoke",[1088,1089,1090,1103,1121,1132,1151,1162],"tbody",{},[1075,1091,1092,1097,1100],{},[1093,1094,1095],"td",{},[950,1096,1004],{},[1093,1098,1099],{},"all, read-write",[1093,1101,1102],{},"Yes — any role",[1075,1104,1105,1109,1111],{},[1093,1106,1107],{},[950,1108,1008],{},[1093,1110,1099],{},[1093,1112,1113,1005,1115,1005,1117,1005,1119],{},[950,1114,1008],{},[950,1116,1014],{},[950,1118,1017],{},[950,1120,1020],{},[1075,1122,1123,1127,1129],{},[1093,1124,1125],{},[950,1126,1011],{},[1093,1128,1099],{},[1093,1130,1131],{},"No",[1075,1133,1134,1138,1149],{},[1093,1135,1136],{},[950,1137,1014],{},[1093,1139,1140,1141,1144,1145,1148],{},"explicit list (",[950,1142,1143],{},"rw"," or ",[950,1146,1147],{},"ro"," per collection)",[1093,1150,1131],{},[1075,1152,1153,1157,1160],{},[1093,1154,1155],{},[950,1156,1017],{},[1093,1158,1159],{},"all, read-only",[1093,1161,1131],{},[1075,1163,1164,1168,1171],{},[1093,1165,1166],{},[950,1167,1020],{},[1093,1169,1170],{},"explicit list, read-only",[1093,1172,1131],{},[996,1174,1175,1183,1196,1219],{},[999,1176,1177,1182],{},[945,1178,1179,1181],{},[950,1180,1004],{}," cannot be revoked"," — by anyone, ever.",[999,1184,1185,1190,1191,1195],{},[945,1186,1187,1189],{},[950,1188,1008],{},"s delegate laterally",": an admin can grant another admin, but never an owner or\na custodian. When an admin is revoked, the admins they granted are revoked too (see\n",[983,1192,1194],{"href":1193},"#revoke","Revoke"," below).",[999,1197,1198,1202,1203,1206,1207,1210,1211,1214,1215,1218],{},[945,1199,1200],{},[950,1201,1011],{}," is the sovereign-custody role: operationally admin-rank (reads and\nwrites every collection) but provably non-owning — it can never grant, revoke, or\nrotate keys. Only the owner can mint or remove one, via ",[950,1204,1205],{},"db.grantCustodian()"," \u002F\n",[950,1208,1209],{},"db.revokeCustodian()"," (opt-in: ",[950,1212,1213],{},"custodyStrategy: withCustody()"," — see the\n",[983,1216,661],{"href":1217},"..\u002Fservices\u002Fcustody"," service).",[999,1220,1221,1224,1225,1228,1229,1232,1233,1236,1237,1239,1240,1242],{},[945,1222,1223],{},"Privilege rank"," (used by ",[950,1226,1227],{},"db.listAccessibleVaults({ minRole })","):\n",[950,1230,1231],{},"client (1) \u003C viewer (2) \u003C operator (3) \u003C custodian = admin (4) \u003C owner (5)",". The order\nreflects ",[974,1234,1235],{},"how much a principal can see",", not how much it can modify — which is why\n",[950,1238,1017],{}," (read-all) outranks ",[950,1241,1020],{}," (explicit-read).",[954,1244,1246],{"id":1245},"single-owner-flow","Single-owner flow",[942,1248,1249,1250,1253],{},"Single-user vaults need nothing beyond the core. The first ",[950,1251,1252],{},"openVault()"," for a brand-new\nvault creates the owner keyring automatically:",[1255,1256,1261],"pre",{"className":1257,"code":1258,"language":1259,"meta":1260,"style":1260},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\n\n\u002F\u002F No store → the kernel's built-in in-memory store. Add `store: …` to persist.\nconst db = await createNoydb({ user: 'me', secret: 'correct-horse-battery-staple' })\n\n\u002F\u002F First open of a new vault: a random salt is generated, the KEK is derived\n\u002F\u002F from the secret, and an owner keyring is persisted to _keyring\u002Fme.\nconst vault = await db.openVault('personal')\n\nawait db.listUsers('personal')\n\u002F\u002F → [{ userId: 'me', displayName: 'me', role: 'owner', permissions: {},\n\u002F\u002F      createdAt: '2026-07-08T10:00:00.000Z', grantedBy: 'me' }]\n","ts","",[950,1262,1263,1296,1303,1310,1370,1375,1381,1387,1419,1424,1447,1453],{"__ignoreMap":1260},[1264,1265,1268,1272,1276,1280,1283,1286,1289,1293],"span",{"class":1266,"line":1267},"line",1,[1264,1269,1271],{"class":1270},"s7zQu","import",[1264,1273,1275],{"class":1274},"sMK4o"," {",[1264,1277,1279],{"class":1278},"sTEyZ"," createNoydb",[1264,1281,1282],{"class":1274}," }",[1264,1284,1285],{"class":1270}," from",[1264,1287,1288],{"class":1274}," '",[1264,1290,1292],{"class":1291},"sfazB","@noy-db\u002Fhub",[1264,1294,1295],{"class":1274},"'\n",[1264,1297,1299],{"class":1266,"line":1298},2,[1264,1300,1302],{"emptyLinePlaceholder":1301},true,"\n",[1264,1304,1306],{"class":1266,"line":1305},3,[1264,1307,1309],{"class":1308},"sHwdD","\u002F\u002F No store → the kernel's built-in in-memory store. Add `store: …` to persist.\n",[1264,1311,1313,1317,1320,1323,1326,1329,1332,1335,1339,1342,1344,1347,1350,1353,1356,1358,1360,1363,1365,1367],{"class":1266,"line":1312},4,[1264,1314,1316],{"class":1315},"spNyl","const",[1264,1318,1319],{"class":1278}," db ",[1264,1321,1322],{"class":1274},"=",[1264,1324,1325],{"class":1270}," await",[1264,1327,1279],{"class":1328},"s2Zo4",[1264,1330,1331],{"class":1278},"(",[1264,1333,1334],{"class":1274},"{",[1264,1336,1338],{"class":1337},"swJcz"," user",[1264,1340,1341],{"class":1274},":",[1264,1343,1288],{"class":1274},[1264,1345,1346],{"class":1291},"me",[1264,1348,1349],{"class":1274},"'",[1264,1351,1352],{"class":1274},",",[1264,1354,1355],{"class":1337}," secret",[1264,1357,1341],{"class":1274},[1264,1359,1288],{"class":1274},[1264,1361,1362],{"class":1291},"correct-horse-battery-staple",[1264,1364,1349],{"class":1274},[1264,1366,1282],{"class":1274},[1264,1368,1369],{"class":1278},")\n",[1264,1371,1373],{"class":1266,"line":1372},5,[1264,1374,1302],{"emptyLinePlaceholder":1301},[1264,1376,1378],{"class":1266,"line":1377},6,[1264,1379,1380],{"class":1308},"\u002F\u002F First open of a new vault: a random salt is generated, the KEK is derived\n",[1264,1382,1384],{"class":1266,"line":1383},7,[1264,1385,1386],{"class":1308},"\u002F\u002F from the secret, and an owner keyring is persisted to _keyring\u002Fme.\n",[1264,1388,1390,1392,1395,1397,1399,1402,1405,1408,1410,1412,1415,1417],{"class":1266,"line":1389},8,[1264,1391,1316],{"class":1315},[1264,1393,1394],{"class":1278}," vault ",[1264,1396,1322],{"class":1274},[1264,1398,1325],{"class":1270},[1264,1400,1401],{"class":1278}," db",[1264,1403,1404],{"class":1274},".",[1264,1406,1407],{"class":1328},"openVault",[1264,1409,1331],{"class":1278},[1264,1411,1349],{"class":1274},[1264,1413,1414],{"class":1291},"personal",[1264,1416,1349],{"class":1274},[1264,1418,1369],{"class":1278},[1264,1420,1422],{"class":1266,"line":1421},9,[1264,1423,1302],{"emptyLinePlaceholder":1301},[1264,1425,1427,1430,1432,1434,1437,1439,1441,1443,1445],{"class":1266,"line":1426},10,[1264,1428,1429],{"class":1270},"await",[1264,1431,1401],{"class":1278},[1264,1433,1404],{"class":1274},[1264,1435,1436],{"class":1328},"listUsers",[1264,1438,1331],{"class":1278},[1264,1440,1349],{"class":1274},[1264,1442,1414],{"class":1291},[1264,1444,1349],{"class":1274},[1264,1446,1369],{"class":1278},[1264,1448,1450],{"class":1266,"line":1449},11,[1264,1451,1452],{"class":1308},"\u002F\u002F → [{ userId: 'me', displayName: 'me', role: 'owner', permissions: {},\n",[1264,1454,1456],{"class":1266,"line":1455},12,[1264,1457,1458],{"class":1308},"\u002F\u002F      createdAt: '2026-07-08T10:00:00.000Z', grantedBy: 'me' }]\n",[942,1460,1461,1462,1465,1466,1469],{},"Collection DEKs are minted lazily: the first time a collection is touched, the hub\ngenerates a fresh DEK, wraps it under your KEK, and re-persists the keyring. On every\nlater open, the hub re-derives the KEK from your secret plus the stored salt and\nunwraps the DEKs — a wrong secret throws ",[950,1463,1464],{},"InvalidKeyError","; a keyring whose bytes\nwere damaged throws ",[950,1467,1468],{},"KeyringCorruptError"," (the canary is what distinguishes the two).",[954,1471,1473],{"id":1472},"multi-user-grant-and-revoke","Multi-user: grant and revoke",[942,1475,1476,1477,1479,1480,1483,1484,1487,1488,1491,1492,1005,1495,1206,1498,1501,1502,1505,1506,1509,1510,1513,1514,1404],{},"Multi-user membership is the ",[945,1478,868],{}," capability, opt-in since ",[950,1481,1482],{},"0.3",": pass\n",[950,1485,1486],{},"teamStrategy: withTeam()"," to ",[950,1489,1490],{},"createNoydb()",", otherwise ",[950,1493,1494],{},"db.grant",[950,1496,1497],{},"db.revoke",[950,1499,1500],{},"db.rotate"," throw ",[950,1503,1504],{},"TeamNotEnabledError",". Magic-link invites live with the\n",[983,1507,868],{"href":1508},"..\u002Fservices\u002Fteam"," service; cross-tier delegation moved to\n",[983,1511,872],{"href":1512},"..\u002Fservices\u002Ftiers",", and the session-authentication ladder has its own page at\n",[983,1515,844],{"href":1516},"..\u002Fservices\u002Fsession-tiers",[1255,1518,1520],{"className":1257,"code":1519,"language":1259,"meta":1260,"style":1260},"import { createNoydb } from '@noy-db\u002Fhub'\nimport { withTeam } from '@noy-db\u002Fhub\u002Fteam'\n\nconst db = await createNoydb({\n  user: 'owner@example.com',\n  secret: 'owner-secret-goes-here',\n  teamStrategy: withTeam(),\n})\nawait db.openVault('acme')\n\n\u002F\u002F Owner grants Alice read-write on invoices\nawait db.grant('acme', {\n  userId: 'alice@example.com',\n  displayName: 'Alice',\n  role: 'operator',\n  secret: 'alice-initial-secret',\n  permissions: { invoices: 'rw' },\n})\n\nawait db.listUsers('acme')\n\u002F\u002F → [ { userId: 'owner@example.com', role: 'owner',    … },\n\u002F\u002F     { userId: 'alice@example.com', role: 'operator', permissions: { invoices: 'rw' },\n\u002F\u002F       grantedBy: 'owner@example.com', … } ]\n\n\u002F\u002F Owner revokes Alice; the DEKs of her collections are rotated\nawait db.revoke('acme', { userId: 'alice@example.com' })\n",[950,1521,1522,1540,1560,1564,1581,1598,1614,1628,1635,1656,1660,1665,1689,1706,1723,1739,1755,1779,1786,1791,1812,1818,1824,1830,1835,1841],{"__ignoreMap":1260},[1264,1523,1524,1526,1528,1530,1532,1534,1536,1538],{"class":1266,"line":1267},[1264,1525,1271],{"class":1270},[1264,1527,1275],{"class":1274},[1264,1529,1279],{"class":1278},[1264,1531,1282],{"class":1274},[1264,1533,1285],{"class":1270},[1264,1535,1288],{"class":1274},[1264,1537,1292],{"class":1291},[1264,1539,1295],{"class":1274},[1264,1541,1542,1544,1546,1549,1551,1553,1555,1558],{"class":1266,"line":1298},[1264,1543,1271],{"class":1270},[1264,1545,1275],{"class":1274},[1264,1547,1548],{"class":1278}," withTeam",[1264,1550,1282],{"class":1274},[1264,1552,1285],{"class":1270},[1264,1554,1288],{"class":1274},[1264,1556,1557],{"class":1291},"@noy-db\u002Fhub\u002Fteam",[1264,1559,1295],{"class":1274},[1264,1561,1562],{"class":1266,"line":1305},[1264,1563,1302],{"emptyLinePlaceholder":1301},[1264,1565,1566,1568,1570,1572,1574,1576,1578],{"class":1266,"line":1312},[1264,1567,1316],{"class":1315},[1264,1569,1319],{"class":1278},[1264,1571,1322],{"class":1274},[1264,1573,1325],{"class":1270},[1264,1575,1279],{"class":1328},[1264,1577,1331],{"class":1278},[1264,1579,1580],{"class":1274},"{\n",[1264,1582,1583,1586,1588,1590,1593,1595],{"class":1266,"line":1372},[1264,1584,1585],{"class":1337},"  user",[1264,1587,1341],{"class":1274},[1264,1589,1288],{"class":1274},[1264,1591,1592],{"class":1291},"owner@example.com",[1264,1594,1349],{"class":1274},[1264,1596,1597],{"class":1274},",\n",[1264,1599,1600,1603,1605,1607,1610,1612],{"class":1266,"line":1377},[1264,1601,1602],{"class":1337},"  secret",[1264,1604,1341],{"class":1274},[1264,1606,1288],{"class":1274},[1264,1608,1609],{"class":1291},"owner-secret-goes-here",[1264,1611,1349],{"class":1274},[1264,1613,1597],{"class":1274},[1264,1615,1616,1619,1621,1623,1626],{"class":1266,"line":1383},[1264,1617,1618],{"class":1337},"  teamStrategy",[1264,1620,1341],{"class":1274},[1264,1622,1548],{"class":1328},[1264,1624,1625],{"class":1278},"()",[1264,1627,1597],{"class":1274},[1264,1629,1630,1633],{"class":1266,"line":1389},[1264,1631,1632],{"class":1274},"}",[1264,1634,1369],{"class":1278},[1264,1636,1637,1639,1641,1643,1645,1647,1649,1652,1654],{"class":1266,"line":1421},[1264,1638,1429],{"class":1270},[1264,1640,1401],{"class":1278},[1264,1642,1404],{"class":1274},[1264,1644,1407],{"class":1328},[1264,1646,1331],{"class":1278},[1264,1648,1349],{"class":1274},[1264,1650,1651],{"class":1291},"acme",[1264,1653,1349],{"class":1274},[1264,1655,1369],{"class":1278},[1264,1657,1658],{"class":1266,"line":1426},[1264,1659,1302],{"emptyLinePlaceholder":1301},[1264,1661,1662],{"class":1266,"line":1449},[1264,1663,1664],{"class":1308},"\u002F\u002F Owner grants Alice read-write on invoices\n",[1264,1666,1667,1669,1671,1673,1676,1678,1680,1682,1684,1686],{"class":1266,"line":1455},[1264,1668,1429],{"class":1270},[1264,1670,1401],{"class":1278},[1264,1672,1404],{"class":1274},[1264,1674,1675],{"class":1328},"grant",[1264,1677,1331],{"class":1278},[1264,1679,1349],{"class":1274},[1264,1681,1651],{"class":1291},[1264,1683,1349],{"class":1274},[1264,1685,1352],{"class":1274},[1264,1687,1688],{"class":1274}," {\n",[1264,1690,1692,1695,1697,1699,1702,1704],{"class":1266,"line":1691},13,[1264,1693,1694],{"class":1337},"  userId",[1264,1696,1341],{"class":1274},[1264,1698,1288],{"class":1274},[1264,1700,1701],{"class":1291},"alice@example.com",[1264,1703,1349],{"class":1274},[1264,1705,1597],{"class":1274},[1264,1707,1709,1712,1714,1716,1719,1721],{"class":1266,"line":1708},14,[1264,1710,1711],{"class":1337},"  displayName",[1264,1713,1341],{"class":1274},[1264,1715,1288],{"class":1274},[1264,1717,1718],{"class":1291},"Alice",[1264,1720,1349],{"class":1274},[1264,1722,1597],{"class":1274},[1264,1724,1726,1729,1731,1733,1735,1737],{"class":1266,"line":1725},15,[1264,1727,1728],{"class":1337},"  role",[1264,1730,1341],{"class":1274},[1264,1732,1288],{"class":1274},[1264,1734,1014],{"class":1291},[1264,1736,1349],{"class":1274},[1264,1738,1597],{"class":1274},[1264,1740,1742,1744,1746,1748,1751,1753],{"class":1266,"line":1741},16,[1264,1743,1602],{"class":1337},[1264,1745,1341],{"class":1274},[1264,1747,1288],{"class":1274},[1264,1749,1750],{"class":1291},"alice-initial-secret",[1264,1752,1349],{"class":1274},[1264,1754,1597],{"class":1274},[1264,1756,1758,1761,1763,1765,1768,1770,1772,1774,1776],{"class":1266,"line":1757},17,[1264,1759,1760],{"class":1337},"  permissions",[1264,1762,1341],{"class":1274},[1264,1764,1275],{"class":1274},[1264,1766,1767],{"class":1337}," invoices",[1264,1769,1341],{"class":1274},[1264,1771,1288],{"class":1274},[1264,1773,1143],{"class":1291},[1264,1775,1349],{"class":1274},[1264,1777,1778],{"class":1274}," },\n",[1264,1780,1782,1784],{"class":1266,"line":1781},18,[1264,1783,1632],{"class":1274},[1264,1785,1369],{"class":1278},[1264,1787,1789],{"class":1266,"line":1788},19,[1264,1790,1302],{"emptyLinePlaceholder":1301},[1264,1792,1794,1796,1798,1800,1802,1804,1806,1808,1810],{"class":1266,"line":1793},20,[1264,1795,1429],{"class":1270},[1264,1797,1401],{"class":1278},[1264,1799,1404],{"class":1274},[1264,1801,1436],{"class":1328},[1264,1803,1331],{"class":1278},[1264,1805,1349],{"class":1274},[1264,1807,1651],{"class":1291},[1264,1809,1349],{"class":1274},[1264,1811,1369],{"class":1278},[1264,1813,1815],{"class":1266,"line":1814},21,[1264,1816,1817],{"class":1308},"\u002F\u002F → [ { userId: 'owner@example.com', role: 'owner',    … },\n",[1264,1819,1821],{"class":1266,"line":1820},22,[1264,1822,1823],{"class":1308},"\u002F\u002F     { userId: 'alice@example.com', role: 'operator', permissions: { invoices: 'rw' },\n",[1264,1825,1827],{"class":1266,"line":1826},23,[1264,1828,1829],{"class":1308},"\u002F\u002F       grantedBy: 'owner@example.com', … } ]\n",[1264,1831,1833],{"class":1266,"line":1832},24,[1264,1834,1302],{"emptyLinePlaceholder":1301},[1264,1836,1838],{"class":1266,"line":1837},25,[1264,1839,1840],{"class":1308},"\u002F\u002F Owner revokes Alice; the DEKs of her collections are rotated\n",[1264,1842,1844,1846,1848,1850,1853,1855,1857,1859,1861,1863,1865,1868,1870,1872,1874,1876,1878],{"class":1266,"line":1843},26,[1264,1845,1429],{"class":1270},[1264,1847,1401],{"class":1278},[1264,1849,1404],{"class":1274},[1264,1851,1852],{"class":1328},"revoke",[1264,1854,1331],{"class":1278},[1264,1856,1349],{"class":1274},[1264,1858,1651],{"class":1291},[1264,1860,1349],{"class":1274},[1264,1862,1352],{"class":1274},[1264,1864,1275],{"class":1274},[1264,1866,1867],{"class":1337}," userId",[1264,1869,1341],{"class":1274},[1264,1871,1288],{"class":1274},[1264,1873,1701],{"class":1291},[1264,1875,1349],{"class":1274},[1264,1877,1282],{"class":1274},[1264,1879,1369],{"class":1278},[1881,1882,1884],"h3",{"id":1883},"what-a-grant-does","What a grant does",[942,1886,1887],{},"A grant is a key ceremony, not a row in an ACL table:",[1889,1890,1891,1898,1905],"ol",{},[999,1892,1893,1894,1897],{},"A fresh salt is generated for the grantee, and their KEK is derived from the\n",[950,1895,1896],{},"secret"," in the grant options.",[999,1899,1900,1901,1904],{},"The DEKs of the granted collections — which the ",[974,1902,1903],{},"grantor's"," unlocked keyring already\nholds in memory — are wrapped under the grantee's new KEK.",[999,1906,1907,1908,1910,1911,1914],{},"A keyring record for the grantee is written to ",[950,1909,971],{},", stamped with\n",[950,1912,1913],{},"grantedBy"," for the delegation trail.",[942,1916,1917,1918,1404],{},"The records themselves are never re-encrypted, and no plaintext is touched. A grantor can\nonly hand out DEKs it holds itself — a grant that would widen access beyond the grantor's\nown keyring throws ",[950,1919,1920],{},"PrivilegeEscalationError",[1881,1922,1194],{"id":1852},[942,1924,1925,1928,1929,1932,1933,1936,1937,1940],{},[950,1926,1927],{},"db.revoke(vault, { userId })"," deletes the target's keyring and ",[945,1930,1931],{},"rotates the DEKs"," of\nevery collection that keyring could decrypt — each affected record is re-encrypted under a\nfresh DEK. That rotation is the same operation as ",[950,1934,1935],{},"db.rotate()"," below, so it has the same\nconsequence: ",[945,1938,1939],{},"the remaining members also lose their keys"," for those collections and must\nbe re-granted.",[942,1942,1943,1944,1947,1948,1951,1952,1955,1956,1959,1960,1963],{},"Rotation is unconditional — there is no option to skip it. ",[950,1945,1946],{},"RevokeOptions"," carries ",[950,1949,1950],{},"userId","\nand ",[950,1953,1954],{},"cascade",", and nothing else. An earlier ",[950,1957,1958],{},"rotateKeys: false"," escape hatch was removed\nbecause it made revocation a no-op: leaving the DEKs in place means the revoked member's\ncopied key material keeps opening the collection, including records written ",[974,1961,1962],{},"after"," the\nrevocation. Losing the other members' keys is the cost of revocation actually revoking.",[942,1965,1966,1967,1970],{},"When the revoked user is an admin, the revoke\ncascades through every admin they (transitively) granted; pass ",[950,1968,1969],{},"cascade: 'warn'"," to leave\nthose descendants in place and get a console warning instead.",[942,1972,1973,1974,1977,1978,1981,1982,1404],{},"To rotate without removing anyone (e.g. after a suspected key leak), use\n",[950,1975,1976],{},"db.rotate(vault, ['invoices', …])"," — but read the next section first: \"without removing\nanyone\" does not mean \"without taking anything away.\" To change a role, display name, or permission map\nwithout touching any keys, use ",[950,1979,1980],{},"db.updateUser(vault, { userId, role?, displayName?, permissions? })"," — a header-only rewrite that leaves DEK wrappings and enrolled\nauthenticators intact, guarded by the same role hierarchy as ",[950,1983,1675],{},[1881,1985,1987],{"id":1986},"rotation-drops-every-other-members-access","Rotation drops every other member's access",[1989,1990,1993],"callout",{"color":1991,"icon":1992},"warning","i-lucide-shield-alert",[942,1994,1995,1998,1999,2002,2003,2006,2007,2009,2010,2013],{},[950,1996,1997],{},"db.rotate(vault, collections)"," keeps everyone's ",[945,2000,2001],{},"membership"," but removes their ",[945,2004,2005],{},"keys"," for the\nrotated collections. Every other member is locked out of those collections until you re-grant them.\n",[950,2008,1927],{}," runs the same rotation by default, so ",[945,2011,2012],{},"revoking one member locks\nout the rest"," of the team on that member's collections.",[942,2015,2016],{},"This is the zero-knowledge property working as designed rather than a gap. A member's DEKs are\nwrapped under that member's KEK, and a KEK derives only from that member's secret — so the caller\ncannot derive anyone else's KEK, and therefore cannot re-wrap a fresh DEK for them. There is no\nkey material in the caller's hands that would let rotation preserve someone else's access.",[942,2018,2019,2020,2023,2024,2026],{},"What rotation does ",[974,2021,2022],{},"not"," do is remove anyone from the vault: members keep their membership, their\nrole, and their keys for every collection you did not rotate. That is the only sense in which this\nis the \"just rotate\" path — \"revoke and rotate\" is ",[950,2025,1927],{},", which\nalways rotates.",[942,2028,2029,2030],{},"So the recovery step is always the same: ",[945,2031,2032,2033,2036],{},"re-run ",[950,2034,2035],{},"grant()"," for each (member, collection) pair you\nrotated.",[1255,2038,2040],{"className":1257,"code":2039,"language":1259,"meta":1260,"style":1260},"const { needsRegrant } = await db.rotate('acme', ['invoices'])\n\u002F\u002F → [{ userId: 'bob', collection: 'invoices' }]\n\nfor (const { userId, collection } of needsRegrant) {\n  await db.grant('acme', { userId, permissions: { [collection]: 'rw' }, \u002F* … *\u002F })\n}\n",[950,2041,2042,2088,2093,2097,2126,2186],{"__ignoreMap":1260},[1264,2043,2044,2046,2048,2051,2053,2056,2058,2060,2062,2065,2067,2069,2071,2073,2075,2078,2080,2083,2085],{"class":1266,"line":1267},[1264,2045,1316],{"class":1315},[1264,2047,1275],{"class":1274},[1264,2049,2050],{"class":1278}," needsRegrant ",[1264,2052,1632],{"class":1274},[1264,2054,2055],{"class":1274}," =",[1264,2057,1325],{"class":1270},[1264,2059,1401],{"class":1278},[1264,2061,1404],{"class":1274},[1264,2063,2064],{"class":1328},"rotate",[1264,2066,1331],{"class":1278},[1264,2068,1349],{"class":1274},[1264,2070,1651],{"class":1291},[1264,2072,1349],{"class":1274},[1264,2074,1352],{"class":1274},[1264,2076,2077],{"class":1278}," [",[1264,2079,1349],{"class":1274},[1264,2081,2082],{"class":1291},"invoices",[1264,2084,1349],{"class":1274},[1264,2086,2087],{"class":1278},"])\n",[1264,2089,2090],{"class":1266,"line":1298},[1264,2091,2092],{"class":1308},"\u002F\u002F → [{ userId: 'bob', collection: 'invoices' }]\n",[1264,2094,2095],{"class":1266,"line":1305},[1264,2096,1302],{"emptyLinePlaceholder":1301},[1264,2098,2099,2102,2105,2107,2109,2111,2113,2116,2118,2121,2124],{"class":1266,"line":1312},[1264,2100,2101],{"class":1270},"for",[1264,2103,2104],{"class":1278}," (",[1264,2106,1316],{"class":1315},[1264,2108,1275],{"class":1274},[1264,2110,1867],{"class":1278},[1264,2112,1352],{"class":1274},[1264,2114,2115],{"class":1278}," collection ",[1264,2117,1632],{"class":1274},[1264,2119,2120],{"class":1274}," of",[1264,2122,2123],{"class":1278}," needsRegrant) ",[1264,2125,1580],{"class":1274},[1264,2127,2128,2131,2133,2135,2137,2139,2141,2143,2145,2147,2149,2151,2153,2156,2158,2160,2162,2165,2168,2170,2172,2174,2176,2179,2182,2184],{"class":1266,"line":1372},[1264,2129,2130],{"class":1270},"  await",[1264,2132,1401],{"class":1278},[1264,2134,1404],{"class":1274},[1264,2136,1675],{"class":1328},[1264,2138,1331],{"class":1337},[1264,2140,1349],{"class":1274},[1264,2142,1651],{"class":1291},[1264,2144,1349],{"class":1274},[1264,2146,1352],{"class":1274},[1264,2148,1275],{"class":1274},[1264,2150,1867],{"class":1278},[1264,2152,1352],{"class":1274},[1264,2154,2155],{"class":1337}," permissions",[1264,2157,1341],{"class":1274},[1264,2159,1275],{"class":1274},[1264,2161,2077],{"class":1337},[1264,2163,2164],{"class":1278},"collection",[1264,2166,2167],{"class":1337},"]",[1264,2169,1341],{"class":1274},[1264,2171,1288],{"class":1274},[1264,2173,1143],{"class":1291},[1264,2175,1349],{"class":1274},[1264,2177,2178],{"class":1274}," },",[1264,2180,2181],{"class":1308}," \u002F* … *\u002F",[1264,2183,1282],{"class":1274},[1264,2185,1369],{"class":1337},[1264,2187,2188],{"class":1266,"line":1377},[1264,2189,2190],{"class":1274},"}\n",[942,2192,2193,2196,2197,2200],{},[950,2194,2195],{},"rotate()"," returns that list as ",[950,2198,2199],{},"needsRegrant"," (noy-db#854), so you do not have to track the\naffected pairs yourself before rotating.",[1881,2202,2204],{"id":2203},"the-roster-epoch-refusing-a-replayed-roster","The roster epoch — refusing a replayed roster",[942,2206,2207,2208,2211,2212,2215],{},"Since ",[950,2209,2210],{},"0.7.0-pre.9"," a keyring carries ",[950,2213,2214],{},"roster_epoch",", bumped on every roster write and bound into\nthe roster's canonical form so a store can neither edit it nor strip it (noy-db#1097).",[942,2217,2218,2219,2222,2223,2226,2227,2229,2230,2233],{},"It exists because a roster tag authenticates the roster's ",[945,2220,2221],{},"contents"," and says nothing about it\nbeing ",[945,2224,2225],{},"current"," — and the gap is reachable without forging anything. There is no role-change API,\nso narrowing someone's standing means calling ",[950,2228,1675],{}," again with a lower role, which overwrites in\nplace. The previous, broader file was legitimately minted by the vault, so a store that kept a copy\ncan re-serve it: the KEK unwraps, the canary checks out, the tag verifies, and the replay ",[945,2231,2232],{},"restores\nthe higher role",", usably. Rotation does not close this — it converts live access into stale access,\nand role gates capabilities rather than keys.",[942,2235,2236,2237,1341],{},"What ships in ",[950,2238,2210],{},[996,2240,2241,2253,2280,2306],{},[999,2242,2243,2248,2249,2252],{},[945,2244,2245],{},[950,2246,2247],{},"KeyringFile.roster_epoch?: number"," — bumped on every roster write and bound into\n",[950,2250,2251],{},"rosterCanonical",", so a store can neither edit nor strip it.",[999,2254,2255,2262,2263,2266,2267,2270,2271,2276,2277,1404],{},[945,2256,2257,2258,2261],{},"Two ",[950,2259,2260],{},"KeyringTamperedError"," reasons"," — ",[950,2264,2265],{},"roster-epoch-rewound"," (the file is older than the floor\nyou supplied) and ",[950,2268,2269],{},"roster-epoch-absent"," (it carries no epoch at all). Both arrive at\n",[945,2272,2273],{},[950,2274,2275],{},"err.details.reason",", not ",[950,2278,2279],{},"err.reason",[999,2281,2282,2287,2288,2293,2294,2297,2298,2301,2302,2305],{},[945,2283,2284],{},[950,2285,2286],{},"assertRosterEpochCurrent(found, expected, userId)"," and ",[945,2289,2290],{},[950,2291,2292],{},"nextRosterEpoch(current)",", on the\nroot barrel since ",[950,2295,2296],{},"0.7.0-pre.10",". (They shipped in ",[950,2299,2300],{},"pre.9"," reachable from no entry point at all;\n",[950,2303,2304],{},"pre.10"," exports them.)",[999,2307,2308,2309,2312],{},"All thirteen roster-mint sites stamp the epoch before the tag is minted, and ",[950,2310,2311],{},"writeKeyringFile","\nrefuses to write a keyring without one — an output-domain guard, so a future mint site cannot ship\nthe field empty.",[1255,2314,2316],{"className":1257,"code":2315,"language":1259,"meta":1260,"style":1260},"import { assertRosterEpochCurrent } from '@noy-db\u002Fhub'\n\n\u002F\u002F `expected` is your floor, and it must reach you by a channel the store does not carry.\ntry {\n  assertRosterEpochCurrent(keyring.roster_epoch, expected, userId)\n} catch (err) {\n  \u002F\u002F err.details.reason === 'roster-epoch-rewound' | 'roster-epoch-absent'\n}\n",[950,2317,2318,2337,2341,2346,2353,2377,2389,2394],{"__ignoreMap":1260},[1264,2319,2320,2322,2324,2327,2329,2331,2333,2335],{"class":1266,"line":1267},[1264,2321,1271],{"class":1270},[1264,2323,1275],{"class":1274},[1264,2325,2326],{"class":1278}," assertRosterEpochCurrent",[1264,2328,1282],{"class":1274},[1264,2330,1285],{"class":1270},[1264,2332,1288],{"class":1274},[1264,2334,1292],{"class":1291},[1264,2336,1295],{"class":1274},[1264,2338,2339],{"class":1266,"line":1298},[1264,2340,1302],{"emptyLinePlaceholder":1301},[1264,2342,2343],{"class":1266,"line":1305},[1264,2344,2345],{"class":1308},"\u002F\u002F `expected` is your floor, and it must reach you by a channel the store does not carry.\n",[1264,2347,2348,2351],{"class":1266,"line":1312},[1264,2349,2350],{"class":1270},"try",[1264,2352,1688],{"class":1274},[1264,2354,2355,2358,2360,2362,2364,2366,2368,2371,2373,2375],{"class":1266,"line":1372},[1264,2356,2357],{"class":1328},"  assertRosterEpochCurrent",[1264,2359,1331],{"class":1337},[1264,2361,967],{"class":1278},[1264,2363,1404],{"class":1274},[1264,2365,2214],{"class":1278},[1264,2367,1352],{"class":1274},[1264,2369,2370],{"class":1278}," expected",[1264,2372,1352],{"class":1274},[1264,2374,1867],{"class":1278},[1264,2376,1369],{"class":1337},[1264,2378,2379,2381,2384,2387],{"class":1266,"line":1377},[1264,2380,1632],{"class":1274},[1264,2382,2383],{"class":1270}," catch",[1264,2385,2386],{"class":1278}," (err) ",[1264,2388,1580],{"class":1274},[1264,2390,2391],{"class":1266,"line":1383},[1264,2392,2393],{"class":1308},"  \u002F\u002F err.details.reason === 'roster-epoch-rewound' | 'roster-epoch-absent'\n",[1264,2395,2396],{"class":1266,"line":1389},[1264,2397,2190],{"class":1274},[1069,2399,2400,2416],{},[1072,2401,2402],{},[1075,2403,2404,2413],{},[1078,2405,2406,2409,2410],{},[950,2407,2408],{},"found"," vs ",[950,2411,2412],{},"expected",[1078,2414,2415],{},"result",[1088,2417,2418,2426,2439,2456,2472],{},[1075,2419,2420,2423],{},[1093,2421,2422],{},"equal",[1093,2424,2425],{},"accepted",[1075,2427,2428,2437],{},[1093,2429,2430,2432,2433,2436],{},[950,2431,2408],{}," ",[945,2434,2435],{},"greater"," — the roster moved on since your floor was minted",[1093,2438,2425],{},[1075,2440,2441,2449],{},[1093,2442,2443,2432,2445,2448],{},[950,2444,2408],{},[945,2446,2447],{},"lower"," — a rewind",[1093,2450,2451,2453,2454],{},[950,2452,2260],{},", ",[950,2455,2265],{},[1075,2457,2458,2466],{},[1093,2459,2460,2462,2463,2465],{},[950,2461,2408],{}," absent, ",[950,2464,2412],{}," supplied",[1093,2467,2468,2453,2470],{},[950,2469,2260],{},[950,2471,2269],{},[1075,2473,2474,2479],{},[1093,2475,2476,2478],{},[950,2477,2412],{}," absent — you supplied no floor",[1093,2480,2481],{},"accepted; the check is opt-in",[942,2483,2484,2487,2488,2276,2493,2496,2497,2500],{},[950,2485,2486],{},"nextRosterEpoch(undefined)"," returns ",[945,2489,2490],{},[950,2491,2492],{},"1",[950,2494,2495],{},"0",", so ",[974,2498,2499],{},"\"has an epoch\""," is never confusable with\nfalsy. It is the only sanctioned way to produce the next value: a write that reused or lowered an\nepoch would mint a file the comparison above cannot tell from a replay.",[1989,2502,2505,2515],{"color":2503,"icon":2504},"info","i-lucide-radio",[942,2506,2507,2510,2511,2514],{},[945,2508,2509],{},"The anchor has to arrive out of band, and that part is yours."," An epoch stored beside the roster\nis not an anchor — a store that rewinds the roster rewinds the epoch with it. It becomes one only\nwhen compared against a value that reached the reader by a channel the store does not carry. The hub\nowns the epoch and the comparison; ",[945,2512,2513],{},"which channel a deployment trusts is deliberately the\nconsumer's problem",", because the hub cannot know.",[942,2516,2517,2518,2521,2522,2525,2526,2529],{},"Two alternatives were considered and rejected, recorded here so they are not re-derived: ",[945,2519,2520],{},"time","\n(defeats long rewinds, useless against fresh ones — and a narrowing replay is entirely the fresh\ncase) and ",[945,2523,2524],{},"the vault head"," (circular — head buckets are read with a keyring-issued DEK, and a\nrewound roster renders as the benign ",[974,2527,2528],{},"no-expectations"," verdict).",[942,2531,2532,2535,2536,2539,2540,2542,2543,2546],{},[945,2533,2534],{},"Opt-in, and absence is never zero."," With no expected epoch, nothing changes for a caller. When\none is supplied, a file carrying ",[945,2537,2538],{},"no"," epoch is refused as ",[950,2541,2269],{}," rather than read as\nepoch 0 — treating absence as zero would accept every pre-epoch file, which is exactly the replay\nthe mechanism refuses. ",[950,2544,2545],{},"found > expected"," is accepted: the anchor is a floor, not an equality, since\na roster may legitimately have moved on since the floor was issued.",[1989,2548,2551],{"color":2549,"icon":2550},"neutral","i-lucide-check-circle-2",[942,2552,2553,2556,2557,2560,2561,2564],{},[945,2554,2555],{},"Not a format break — no migration, no re-seed."," The epoch is bound ",[945,2558,2559],{},"conditionally",", so a\nkeyring written before it existed canonicalises byte-identically and its existing tag still\nverifies. (Binding it the way every other optional field is bound would have failed every\npre-existing tag and rendered every existing vault unopenable.) This is unrelated to the\n",[950,2562,2563],{},"0.6.0"," on-disk format breaks — nothing stored needs to change.",[954,2566,2568],{"id":2567},"permission-checks-on-every-operation","Permission checks on every operation",[996,2570,2571,2610,2616,2625],{},[999,2572,2573,2576,2577,1005,2580,2583,2584,2587,2588,2591,2592,1005,2594,1005,2596,2598,2599,1005,2601,2603,2604,2606,2607,1404],{},[945,2574,2575],{},"Writes"," — every ",[950,2578,2579],{},"put",[950,2581,2582],{},"delete"," checks write permission ",[974,2585,2586],{},"before"," any encryption or\nstore I\u002FO; a denied write throws ",[950,2589,2590],{},"ReadOnlyError"," and the store never sees the request.\nThe rule: ",[950,2593,1004],{},[950,2595,1008],{},[950,2597,1011],{}," always write; ",[950,2600,1017],{},[950,2602,1020],{}," never do;\n",[950,2605,1014],{}," writes where its permission entry is ",[950,2608,2609],{},"'rw'",[999,2611,2612,2615],{},[945,2613,2614],{},"Reads"," — vault-wide enumeration silently skips collections the keyring has no access\nto. The floor is cryptographic, not advisory: without the wrapped DEK for a collection,\nthere is nothing to decrypt.",[999,2617,2618,2621,2622,1404],{},[945,2619,2620],{},"Grant \u002F revoke \u002F role changes"," — an operation the caller's role does not permit\nthrows ",[950,2623,2624],{},"PermissionDeniedError",[999,2626,2627,2630,2631,2633,2634,2637,2638,2641,2642,2645,2646,2649,2650,2653,2654,2657,2658,1005,2660,2662,2663,2666,2667,1404],{},[945,2628,2629],{},"Exports"," — the ",[950,2632,1047],{}," packages authorize through\n",[950,2635,2636],{},"vault.assertCanExport(tier, format?)",", backed by the public\n",[950,2639,2640],{},"hasExportCapability(keyring, tier, format?)"," check. Two tiers:\n",[950,2643,2644],{},"assertCanExport('plaintext', 'xlsx')"," for plaintext formats — the default is ",[945,2647,2648],{},"empty\nfor every role",", so plaintext export must be positively granted via the\n",[950,2651,2652],{},"exportCapability"," grant option — and ",[950,2655,2656],{},"assertCanExport('bundle')"," for encrypted\nbundles, which defaults on for ",[950,2659,1004],{},[950,2661,1008],{}," and off for everyone else. Imports are\ndefault-closed for ",[974,2664,2665],{},"every"," role, including owner, until granted via ",[950,2668,2669],{},"importCapability",[954,2671,2673],{"id":2672},"critical-invariants","Critical invariants",[996,2675,2676,2686,2695,2701],{},[999,2677,2678,2681,2682,2685],{},[945,2679,2680],{},"No vault without a keyring."," Even ",[950,2683,2684],{},"encrypt: false"," mode synthesizes an in-memory\nowner keyring, so the permission code path is uniform.",[999,2687,2688,2691,2692,2694],{},[945,2689,2690],{},"Wrapped DEKs are persisted; raw DEKs and the KEK never are."," The keyring record's\nmetadata (role, permissions, salt) is readable on the store, but an attacker reading\n",[950,2693,971],{}," cannot decrypt anything without the user's secret.",[999,2696,2697,2700],{},[945,2698,2699],{},"Owner is irrevocable",", and no role below owner can create or destroy an\nowner-shaped keyring.",[999,2702,2703,2706,2707,2709],{},[945,2704,2705],{},"A grant can never widen access",": every DEK wrapped into a new keyring must come from\nthe grantor's own unlocked DEK set (",[950,2708,1920],{}," otherwise).",[954,2711,2713],{"id":2712},"public-surface","Public surface",[996,2715,2716,2725,2734,2743,2749,2755,2770],{},[999,2717,2718,2721,2722,1021],{},[950,2719,2720],{},"db.team.getKeyring(vault)"," — defensive copy of the unlocked keyring (",[950,2723,2724],{},"UnlockedKeyring",[999,2726,2727,2730,2731],{},[950,2728,2729],{},"db.listUsers(vault)"," — every member's ",[950,2732,2733],{},"{ userId, displayName, role, permissions, createdAt, grantedBy }",[999,2735,2736,2262,2739,2742],{},[950,2737,2738],{},"db.listAccessibleVaults({ minRole? })",[950,2740,2741],{},"{ id, role }"," per vault the current user can unwrap",[999,2744,2745,2748],{},[950,2746,2747],{},"db.changeSecret(vault, newSecret, opts?)"," — re-wrap your own keyring under a new secret",[999,2750,2751,2754],{},[950,2752,2753],{},"db.updateUser(vault, opts)"," — header-only role \u002F name \u002F permissions change",[999,2756,2757,2758,2761,2762,2453,2765,2453,2768],{},"With ",[950,2759,2760],{},"withTeam()",": ",[950,2763,2764],{},"db.grant(vault, opts)",[950,2766,2767],{},"db.revoke(vault, opts)",[950,2769,1997],{},[999,2771,2757,2772,2761,2775,2453,2778],{},[950,2773,2774],{},"withCustody()",[950,2776,2777],{},"db.grantCustodian(vault, opts)",[950,2779,2780],{},"db.revokeCustodian(vault, opts)",[954,2782,2784],{"id":2783},"see-also","See also",[996,2786,2787,2792,2798,2805],{},[999,2788,2789,2791],{},[983,2790,868],{"href":1508}," — multi-user grant\u002Frevoke\u002Frotate, magic-link, delegation",[999,2793,2794,2797],{},[983,2795,840],{"href":2796},"..\u002Fservices\u002Fsession"," — token sessions on top of keyrings",[999,2799,2800,2630,2802,2804],{},[983,2801,617],{"href":1058},[950,2803,1054],{}," unlock methods (secret, WebAuthn, OIDC, magic-link, …)",[999,2806,2807,2809],{},[983,2808,986],{"href":985}," — the key hierarchy this page builds on",[2811,2812,2813],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":1260,"searchDepth":1305,"depth":1305,"links":2815},[2816,2817,2818,2819,2825,2826,2827,2828],{"id":956,"depth":1298,"text":957},{"id":1066,"depth":1298,"text":1067},{"id":1245,"depth":1298,"text":1246},{"id":1472,"depth":1298,"text":1473,"children":2820},[2821,2822,2823,2824],{"id":1883,"depth":1305,"text":1884},{"id":1852,"depth":1305,"text":1194},{"id":1986,"depth":1305,"text":1987},{"id":2203,"depth":1305,"text":2204},{"id":2567,"depth":1298,"text":2568},{"id":2672,"depth":1298,"text":2673},{"id":2712,"depth":1298,"text":2713},{"id":2783,"depth":1298,"text":2784},null,"How a vault admits users: the per-user keyring file, roles, and per-collection rw\u002Fro\u002Fnone permissions.","md",{},{"title":10},"kernel",{"title":929,"description":2830},"stable","essential","7XpIhN7wqk8y0q4zo8JanK6PKs6mm7x5adjBAHkLBlI",1791896581849]