[{"data":1,"prerenderedAt":1844},["ShallowReactive",2],{"navigation":3,"\u002Fcore\u002Fnoydb\u002Fkeyring":927},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":69,"access":12,"apiToc":929,"body":930,"category":1835,"description":1836,"extension":1837,"meta":1838,"navigation":1835,"nest":1839,"path":70,"seo":1840,"sinceVersion":1835,"status":1841,"stem":71,"subtitle":1835,"tier":1842,"tocExternal":1835,"__hash__":1843},"docs\u002Fcore\u002F2.noydb\u002F3.keyring.md",true,{"type":931,"value":932,"toc":1821},"minimark",[933,937,946,1003,1020,1052,1087,1091,1098,1105,1194,1197,1241,1247,1290,1297,1339,1345,1393,1413,1453,1459,1480,1487,1494,1498,1519,1525,1545,1548,1555,1561,1601,1636,1688,1703,1713,1727,1774,1797,1817],[934,935,69],"h1",{"id":936},"secret-keyring",[938,939,940,941,945],"p",{},"Every vault is unlocked by one ",[942,943,944],"strong",{},"secret",".",[947,948,951,962,990],"callout",{"color":949,"icon":950},"neutral","i-lucide-key-round",[938,952,953,956,957,961],{},[942,954,955],{},"What counts as a secret."," noy-db never inspects ",[958,959,960],"em",{},"what"," your secret is — only that it can derive\na key from it. It may be a passphrase a person types, a generated code, a certificate, or anything\nelse. Two properties are what matter:",[963,964,965,972],"ul",{},[966,967,968,971],"li",{},[942,969,970],{},"Hard to guess."," The secret is the whole of the vault's security; there is no server-side\naccount to fall back on, and no one to appeal to if it is guessed.",[966,973,974,977,978,985,986,989],{},[942,975,976],{},"Held in the owner's memory where possible"," — the one store nobody else can read, copy, or\nsubpoena. Where memory isn't practical (machine access, long random values), the\n",[979,980,981],"a",{"href":170},[982,983,984],"code",{},"@noy-db\u002Fat-*"," hosts seal the secret to infrastructure you control, and\n",[979,987,321],{"href":988},".\u002Frecovery"," covers the case where it is lost.",[938,991,992,993,995,996,998,999,1002],{},"The docs say ",[958,994,944],{}," throughout because that is the API's name for it (",[982,997,944],{}," on\n",[982,1000,1001],{},"createNoydb()",") and because \"passphrase\" would narrow it to one of the forms it can take.",[938,1004,1005,1006,1008,1009,1011,1012,1015,1016,1019],{},"In standard mode that is the secret you pass as ",[982,1007,944],{}," to ",[982,1010,1001],{},"; the hub derives a key-encryption key (KEK) from it in memory via PBKDF2 and never writes it to disk, so storage backends only ever see ciphertext (see ",[979,1013,21],{"href":1014},".\u002Fenclave","). WebAuthn, OIDC and Shamir supply the unlocked keyring through the ",[982,1017,1018],{},"getKeyring"," option instead, so no secret is derived at all.",[938,1021,1022,1023,1026,1027,1030,1031,1033,1034,1036,1037,1040,1041,1044,1045,1048,1049,945],{},"A vault's minimum is a ",[942,1024,1025],{},"single-owner keyring"," — the ",[982,1028,1029],{},"user"," you name at ",[982,1032,1001],{}," becomes the owner on the first open of a new vault. ",[982,1035,1029],{}," is required configuration, but a personal vault needs nothing more: single-user is the default, and multi-user membership is opt-in team territory. Grant \u002F revoke \u002F rotate route through the team service and throw ",[982,1038,1039],{},"TeamNotEnabledError"," until you pass ",[982,1042,1043],{},"withTeam()"," (see ",[979,1046,85],{"href":1047},".\u002Fstrategies","); every primitive on this page works with ",[942,1050,1051],{},"zero strategies",[938,1053,1054,1055,1058,1059,1062,1063,1066,1067,1066,1070,1066,1073,1066,1076,1066,1079,1082,1083,945],{},"The ",[942,1056,1057],{},"keyring"," is the per-user record at ",[982,1060,1061],{},"_keyring\u002F\u003CuserId>"," that is both the access-control list and the cryptographic gate — what you can read is exactly what your keyring can unwrap. It holds your role (",[982,1064,1065],{},"owner"," \u002F ",[982,1068,1069],{},"admin",[982,1071,1072],{},"custodian",[982,1074,1075],{},"operator",[982,1077,1078],{},"viewer",[982,1080,1081],{},"client","), your per-collection permissions, the wrapped DEKs (one AES-KW-wrapped data-encryption key per collection you can decrypt), and the salt used to derive your KEK from the secret. The full grant\u002Frevoke key ceremony and role model live on ",[979,1084,1086],{"href":1085},"..\u002F06-permissions-and-keyring","Permissions & keyring",[1088,1089,69],"h2",{"id":1090},"secret-keyring-1",[938,1092,1093,1094,1097],{},"Change, rotate, recover, and read the single-user keyring. Each is a single-user primitive — always available, no strategy required; the sensitive ones sit behind a policy gate, not a ",[982,1095,1096],{},"with*()"," opt-in.",[1099,1100,1102],"h3",{"id":1101},"changesecret",[982,1103,1104],{},"changeSecret()",[1106,1107,1112],"pre",{"className":1108,"code":1109,"language":1110,"meta":1111,"style":1111},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","changeSecret(\n  vault: string,\n  newSecret: string,\n  options?: SecretPolicy & {\n    allowWeakSecret?: boolean\n  }\n): Promise\u003Cvoid>\n","ts","",[982,1113,1114,1127,1137,1145,1163,1175,1181],{"__ignoreMap":1111},[1115,1116,1119,1123],"span",{"class":1117,"line":1118},"line",1,[1115,1120,1122],{"class":1121},"s2Zo4","changeSecret",[1115,1124,1126],{"class":1125},"sTEyZ","(\n",[1115,1128,1130,1133],{"class":1117,"line":1129},2,[1115,1131,1132],{"class":1125},"  vault: string",[1115,1134,1136],{"class":1135},"sMK4o",",\n",[1115,1138,1140,1143],{"class":1117,"line":1139},3,[1115,1141,1142],{"class":1125},"  newSecret: string",[1115,1144,1136],{"class":1135},[1115,1146,1148,1151,1154,1157,1160],{"class":1117,"line":1147},4,[1115,1149,1150],{"class":1125},"  options",[1115,1152,1153],{"class":1135},"?:",[1115,1155,1156],{"class":1125}," SecretPolicy ",[1115,1158,1159],{"class":1135},"&",[1115,1161,1162],{"class":1135}," {\n",[1115,1164,1166,1169,1172],{"class":1117,"line":1165},5,[1115,1167,1168],{"class":1125},"    allowWeakSecret?",[1115,1170,1171],{"class":1135},":",[1115,1173,1174],{"class":1125}," boolean\n",[1115,1176,1178],{"class":1117,"line":1177},6,[1115,1179,1180],{"class":1135},"  }\n",[1115,1182,1184,1187,1191],{"class":1117,"line":1183},7,[1115,1185,1186],{"class":1125},"): ",[1115,1188,1190],{"class":1189},"sBMFI","Promise",[1115,1192,1193],{"class":1135},"\u003Cvoid>\n",[938,1195,1196],{},"Change the current user's secret for a vault. The new secret is validated against the strength rules unless you opt out.",[963,1198,1199,1205,1211],{},[966,1200,1201,1204],{},[982,1202,1203],{},"vault"," — the vault whose secret to change.",[966,1206,1207,1210],{},[982,1208,1209],{},"newSecret"," — the replacement secret, validated against the strength rules.",[966,1212,1213,1216,1217,1220,1221,1224,1225],{},[982,1214,1215],{},"options"," — a ",[982,1218,1219],{},"SecretPolicy"," (plus ",[982,1222,1223],{},"allowWeakSecret",") tuning validation:\n",[963,1226,1227,1232],{},[966,1228,1229,1231],{},[982,1230,1223],{}," — skip strength validation entirely (typically only for fixtures and migrations).",[966,1233,1234,1066,1237,1240],{},[982,1235,1236],{},"pattern",[982,1238,1239],{},"customValidator"," — override the default character-class rule, or replace validation wholesale with a custom function.",[1099,1242,1244],{"id":1243},"rotatesecret",[982,1245,1246],{},"rotateSecret()",[1106,1248,1250],{"className":1108,"code":1249,"language":1110,"meta":1111,"style":1111},"rotateSecret(\n  vault: string,\n  input: RotateSecretInput,\n  factors?: FactorProofBundle\n): Promise\u003Cvoid>\n",[982,1251,1252,1259,1265,1272,1282],{"__ignoreMap":1111},[1115,1253,1254,1257],{"class":1117,"line":1118},[1115,1255,1256],{"class":1121},"rotateSecret",[1115,1258,1126],{"class":1125},[1115,1260,1261,1263],{"class":1117,"line":1129},[1115,1262,1132],{"class":1125},[1115,1264,1136],{"class":1135},[1115,1266,1267,1270],{"class":1117,"line":1139},[1115,1268,1269],{"class":1125},"  input: RotateSecretInput",[1115,1271,1136],{"class":1135},[1115,1273,1274,1277,1279],{"class":1117,"line":1147},[1115,1275,1276],{"class":1125},"  factors",[1115,1278,1153],{"class":1135},[1115,1280,1281],{"class":1125}," FactorProofBundle\n",[1115,1283,1284,1286,1288],{"class":1117,"line":1165},[1115,1285,1186],{"class":1125},[1115,1287,1190],{"class":1189},[1115,1289,1193],{"class":1135},[938,1291,1292,1293,1296],{},"Rotate the secret when the user still remembers the old one. A single-user primitive — it stays available with no strategy. Sensitive enough to sit behind the ",[982,1294,1295],{},"rotate-secret"," policy gate, so a tightened policy can demand fresh factor proofs.",[963,1298,1299,1304,1330],{},[966,1300,1301,1303],{},[982,1302,1203],{}," — the vault whose secret to rotate.",[966,1305,1306,1216,1309,1312,1313,1316,1317,1319,1320,1066,1323,1325,1326,1329],{},[982,1307,1308],{},"input",[982,1310,1311],{},"RotateSecretInput"," carrying the ",[982,1314,1315],{},"oldSecret"," and ",[982,1318,1209],{}," (plus optional ",[982,1321,1322],{},"secretPolicy",[982,1324,1223],{}," and per-slot ",[982,1327,1328],{},"slotCeremonies"," to preserve tier-2 authenticators across the rotation).",[966,1331,1332,1335,1336,1338],{},[982,1333,1334],{},"factors"," — factor proofs presented to satisfy the ",[982,1337,1295],{}," gate when a tightened policy demands them.",[1099,1340,1342],{"id":1341},"recoversecret",[982,1343,1344],{},"recoverSecret()",[1106,1346,1348],{"className":1108,"code":1347,"language":1110,"meta":1111,"style":1111},"recoverSecret(\n  vault: string,\n  input: RecoverSecretInput,\n  factors?: FactorProofBundle\n): Promise\u003CRecoverSecretResult>\n",[982,1349,1350,1357,1363,1370,1378],{"__ignoreMap":1111},[1115,1351,1352,1355],{"class":1117,"line":1118},[1115,1353,1354],{"class":1121},"recoverSecret",[1115,1356,1126],{"class":1125},[1115,1358,1359,1361],{"class":1117,"line":1129},[1115,1360,1132],{"class":1125},[1115,1362,1136],{"class":1135},[1115,1364,1365,1368],{"class":1117,"line":1139},[1115,1366,1367],{"class":1125},"  input: RecoverSecretInput",[1115,1369,1136],{"class":1135},[1115,1371,1372,1374,1376],{"class":1117,"line":1147},[1115,1373,1276],{"class":1125},[1115,1375,1153],{"class":1135},[1115,1377,1281],{"class":1125},[1115,1379,1380,1382,1384,1387,1390],{"class":1117,"line":1165},[1115,1381,1186],{"class":1125},[1115,1383,1190],{"class":1189},[1115,1385,1386],{"class":1135},"\u003C",[1115,1388,1389],{"class":1125},"RecoverSecretResult",[1115,1391,1392],{"class":1135},">\n",[938,1394,1395,1396,1399,1400,1403,1404,1406,1407,1410,1411,945],{},"Reset the secret using a recovery proof rather than the old secret. Also a single-user primitive. The ",[982,1397,1398],{},"'paper'"," recovery profile is supported end-to-end; calling it against a profile that only ships its API shape throws ",[982,1401,1402],{},"RecoveryProfileNotImplementedError",". Enrolling recovery profiles is a ",[982,1405,321],{}," config concern (see ",[979,1408,81],{"href":1409},".\u002Fconfiguration","), and the recovery-profile lifecycle and flows are covered on ",[979,1412,77],{"href":988},[963,1414,1415,1420,1445],{},[966,1416,1417,1419],{},[982,1418,1203],{}," — the vault whose secret to reset.",[966,1421,1422,1216,1424,1312,1427,1316,1430,1319,1432,1066,1434,1436,1437,1440,1441,1444],{},[982,1423,1308],{},[982,1425,1426],{},"RecoverSecretInput",[982,1428,1429],{},"recoveryProof",[982,1431,1209],{},[982,1433,1322],{},[982,1435,1223],{},", and ",[982,1438,1439],{},"rotateRemainingCodes"," — default ",[982,1442,1443],{},"true"," — to re-mint the remaining recovery codes after a successful paper recovery).",[966,1446,1447,1335,1449,1452],{},[982,1448,1334],{},[982,1450,1451],{},"recover-secret"," gate when the policy demands them.",[1099,1454,1456],{"id":1455},"getkeyring",[982,1457,1458],{},"getKeyring()",[1106,1460,1462],{"className":1108,"code":1461,"language":1110,"meta":1111,"style":1111},"getKeyring(vault: string): Promise\u003CUnlockedKeyring>\n",[982,1463,1464],{"__ignoreMap":1111},[1115,1465,1466,1468,1471,1473,1475,1478],{"class":1117,"line":1118},[1115,1467,1018],{"class":1121},[1115,1469,1470],{"class":1125},"(vault: string): ",[1115,1472,1190],{"class":1189},[1115,1474,1386],{"class":1135},[1115,1476,1477],{"class":1125},"UnlockedKeyring",[1115,1479,1392],{"class":1135},[938,1481,1482,1483,1486],{},"Return a ",[942,1484,1485],{},"defensive copy"," of the unlocked keyring for a vault (roles, permissions, wrapped DEKs). Reading the owner keyring is a single-user primitive and stays ungated.",[963,1488,1489],{},[966,1490,1491,1493],{},[982,1492,1203],{}," — the vault whose unlocked keyring to copy.",[1088,1495,1497],{"id":1496},"users","Users",[938,1499,1500,1501,1316,1504,1507,1508,1511,1512,1515,1516,1518],{},"The users home for a vault: enumerate members and rewrite a member's post-grant identity fields. ",[982,1502,1503],{},"listUsers",[982,1505,1506],{},"updateUser"," are always-on primitives; the multi-user ",[958,1509,1510],{},"grant \u002F revoke \u002F rotate"," ceremony is the opt-in ",[979,1513,868],{"href":1514},"..\u002F..\u002Fservices\u002Fteam"," service (see ",[979,1517,85],{"href":1047},").",[1099,1520,1522],{"id":1521},"listusers",[982,1523,1524],{},"listUsers()",[1106,1526,1528],{"className":1108,"code":1527,"language":1110,"meta":1111,"style":1111},"listUsers(vault: string): Promise\u003CUserInfo[]>\n",[982,1529,1530],{"__ignoreMap":1111},[1115,1531,1532,1534,1536,1538,1540,1543],{"class":1117,"line":1118},[1115,1533,1503],{"class":1121},[1115,1535,1470],{"class":1125},[1115,1537,1190],{"class":1189},[1115,1539,1386],{"class":1135},[1115,1541,1542],{"class":1125},"UserInfo[]",[1115,1544,1392],{"class":1135},[938,1546,1547],{},"List every user with access to a vault.",[963,1549,1550],{},[966,1551,1552,1554],{},[982,1553,1203],{}," — the vault whose users to list.",[1099,1556,1558],{"id":1557},"updateuser",[982,1559,1560],{},"updateUser()",[1106,1562,1564],{"className":1108,"code":1563,"language":1110,"meta":1111,"style":1111},"updateUser(\n  vault: string,\n  options: UpdateUserOptions,\n  factors?: FactorProofBundle\n): Promise\u003Cvoid>\n",[982,1565,1566,1572,1578,1585,1593],{"__ignoreMap":1111},[1115,1567,1568,1570],{"class":1117,"line":1118},[1115,1569,1506],{"class":1121},[1115,1571,1126],{"class":1125},[1115,1573,1574,1576],{"class":1117,"line":1129},[1115,1575,1132],{"class":1125},[1115,1577,1136],{"class":1135},[1115,1579,1580,1583],{"class":1117,"line":1139},[1115,1581,1582],{"class":1125},"  options: UpdateUserOptions",[1115,1584,1136],{"class":1135},[1115,1586,1587,1589,1591],{"class":1117,"line":1147},[1115,1588,1276],{"class":1125},[1115,1590,1153],{"class":1135},[1115,1592,1281],{"class":1125},[1115,1594,1595,1597,1599],{"class":1117,"line":1165},[1115,1596,1186],{"class":1125},[1115,1598,1190],{"class":1189},[1115,1600,1193],{"class":1135},[938,1602,1603,1604,1607,1608,1611,1612,1615,1616,1619,1620,1623,1624,1627,1628,1631,1632,1635],{},"Mutate post-grant identity fields on an existing keyring. It's a pure plaintext-header rewrite: no DEK re-wrap, no KEK needed, no authenticator or tier-2 slots touched, and — unlike ",[982,1605,1606],{},"db.revoke"," + ",[982,1609,1610],{},"db.grant"," — the same ",[982,1613,1614],{},"userId",", DEK wrappings, and ",[982,1617,1618],{},"granted_by"," survive; only the specified header fields move (last-write-wins). Demoting a role does ",[942,1621,1622],{},"not"," cascade (that's a revoke concern). A role-elevation guard runs regardless of policy: owner can do anything, an admin manages admin\u002Foperator\u002Fviewer\u002Fclient laterally but can neither promote to owner nor demote from owner. Gated by the ",[982,1625,1626],{},"update-user"," policy (a ",[982,1629,1630],{},"STRICT_POLICY"," demands a TOTP \u002F email-OTP proof; ",[982,1633,1634],{},"PERSONAL_POLICY"," accepts a tier-1 unlock).",[963,1637,1638,1643,1681],{},[966,1639,1640,1642],{},[982,1641,1203],{}," — the vault whose keyring to mutate.",[966,1644,1645,1647,1648,1651,1652],{},[982,1646,1215],{}," — an ",[982,1649,1650],{},"UpdateUserOptions"," naming the target and the fields to move:\n",[963,1653,1654,1659,1665,1675],{},[966,1655,1656,1658],{},[982,1657,1614],{}," — the principal whose keyring to update (required).",[966,1660,1661,1664],{},[982,1662,1663],{},"role"," — the new role, subject to the elevation guard above.",[966,1666,1667,1670,1671,1674],{},[982,1668,1669],{},"displayName"," — the new display name; ",[982,1672,1673],{},"null"," clears it.",[966,1676,1677,1680],{},[982,1678,1679],{},"permissions"," — the replacement permission map (full replacement at the map level).",[966,1682,1683,1335,1685,1687],{},[982,1684,1334],{},[982,1686,1626],{}," gate.",[938,1689,1690,1691,1694,1695,1698,1699,1702],{},"Throws ",[982,1692,1693],{},"NoAccessError"," when no keyring exists for the target, ",[982,1696,1697],{},"PermissionDeniedError"," when the hierarchy rejects, and ",[982,1700,1701],{},"ValidationError"," when no field is provided.",[1099,1704,1706,1709,1710],{"id":1705},"getdirectoryenabled-setdirectoryenabled",[982,1707,1708],{},"getDirectoryEnabled()"," · ",[982,1711,1712],{},"setDirectoryEnabled()",[938,1714,1715,1716,1719,1720,1316,1723,1726],{},"The vault-level ",[942,1717,1718],{},"user directory"," toggle decides whether this vault's members show up when you enumerate its team. It sits alongside the per-user hide flag and the user-envelope records those listings read — see ",[979,1721,669],{"href":1722},"..\u002F..\u002Fservices\u002Fdirectory",[979,1724,884],{"href":1725},"..\u002F..\u002Fservices\u002Fuser-envelope"," for the full visibility model.",[1106,1728,1730],{"className":1108,"code":1729,"language":1110,"meta":1111,"style":1111},"getDirectoryEnabled(vault: string): Promise\u003Cboolean>\nsetDirectoryEnabled(\n  vault: string,\n  enabled: boolean\n): Promise\u003Cvoid>\n",[982,1731,1732,1748,1755,1761,1766],{"__ignoreMap":1111},[1115,1733,1734,1737,1739,1741,1743,1746],{"class":1117,"line":1118},[1115,1735,1736],{"class":1121},"getDirectoryEnabled",[1115,1738,1470],{"class":1125},[1115,1740,1190],{"class":1189},[1115,1742,1386],{"class":1135},[1115,1744,1745],{"class":1125},"boolean",[1115,1747,1392],{"class":1135},[1115,1749,1750,1753],{"class":1117,"line":1129},[1115,1751,1752],{"class":1121},"setDirectoryEnabled",[1115,1754,1126],{"class":1125},[1115,1756,1757,1759],{"class":1117,"line":1139},[1115,1758,1132],{"class":1125},[1115,1760,1136],{"class":1135},[1115,1762,1763],{"class":1117,"line":1147},[1115,1764,1765],{"class":1125},"  enabled: boolean\n",[1115,1767,1768,1770,1772],{"class":1117,"line":1165},[1115,1769,1186],{"class":1125},[1115,1771,1190],{"class":1189},[1115,1773,1193],{"class":1135},[938,1775,1776,1778,1779,1781,1782,1785,1786,1788,1789,1792,1793,1796],{},[982,1777,1736],{}," reads the vault-level user-directory listing toggle, defaulting to on (",[982,1780,1443],{},") when no ",[982,1783,1784],{},"_meta\u002Fdirectory"," document exists yet — no role gate, anyone who can open the vault may read it. ",[982,1787,1752],{}," flips it and is owner-only; when disabled, the hub-level user enumeration throws ",[982,1790,1791],{},"DirectoryDisabledError"," for callers who are neither owner nor admin. Honest caveat: this is a UX flag, ",[942,1794,1795],{},"not a privacy guarantee"," — the keyring and user-envelope records stay observable to anyone with direct store read access; only the hub-level enumeration is gated.",[963,1798,1799,1809],{},[966,1800,1801,1803,1804,1806,1807,1518],{},[982,1802,1203],{}," — the vault whose directory toggle to read (",[982,1805,1736],{},") or flip (",[982,1808,1752],{},[966,1810,1811,1814,1815,945],{},[982,1812,1813],{},"enabled"," — the new toggle value for ",[982,1816,1752],{},[1818,1819,1820],"style",{},"html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":1111,"searchDepth":1139,"depth":1139,"links":1822},[1823,1829],{"id":1090,"depth":1129,"text":69,"children":1824},[1825,1826,1827,1828],{"id":1101,"depth":1139,"text":1104},{"id":1243,"depth":1139,"text":1246},{"id":1341,"depth":1139,"text":1344},{"id":1455,"depth":1139,"text":1458},{"id":1496,"depth":1129,"text":1497,"children":1830},[1831,1832,1833],{"id":1521,"depth":1139,"text":1524},{"id":1557,"depth":1139,"text":1560},{"id":1705,"depth":1139,"text":1834},"getDirectoryEnabled() · setDirectoryEnabled()",null,"The vault secret and single-user keyring: change \u002F rotate \u002F recover the secret, read the keyring, and the users home — list, update, directory toggle.","md",{},"kernel",{"title":69,"description":1836},"stable","essential","hSBKE4ZEGwVfr31YRPLSxo1CM7nfdiuahjoqpa8rSoo",1791896579872]