[{"data":1,"prerenderedAt":4567},["ShallowReactive",2],{"navigation":3,"\u002Fservices\u002Fbroker":927,"mdc--27cy0v-key":4508,"mdc--7sa3b2-key":4524,"mdc--2m6uwf-key":4533,"mdc--7pkmam-key":4545,"mdc-nus9ms-key":4558},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":625,"access":12,"apiToc":929,"body":930,"category":4497,"description":4498,"extension":4499,"meta":4500,"navigation":4497,"nest":4501,"path":626,"seo":4502,"sinceVersion":4503,"status":4504,"stem":627,"subtitle":4505,"tier":4506,"tocExternal":4497,"__hash__":4507},"docs\u002Fservices\u002Fbroker.md",false,{"type":931,"value":932,"toc":4481},"minimark",[933,936,940,945,967,986,990,1026,1030,1037,1204,1207,1211,1233,1334,1338,1341,1388,1392,1714,1718,1733,2105,2126,2136,2140,2352,2370,2505,2509,2531,2627,2631,2657,2661,2682,2731,2738,4302,4306,4347,4351,4439,4443,4477],[934,935,625],"h1",{"id":625},[937,938],"service-meta",{":rows":939},"[{\"label\":\"Subpath\",\"value\":\"`@noy-db\u002Fhub\u002Fbroker`\"},{\"label\":\"Factory\",\"value\":\"`withBroker(config)`\"},{\"label\":\"Layer\",\"value\":\"`with-party`\"},{\"label\":\"Cluster\",\"value\":\"G — Collaboration & Auth\"},{\"label\":\"LOC cost\",\"value\":\"~500 (off-bundle when not opted in)\"}]",[941,942,944],"h2",{"id":943},"what-it-does","What it does",[946,947,948,949,953,954,957,958,962,963,966],"p",{},"The credential broker lets a client ",[950,951,952],"strong",{},"secret-bound to a vault"," obtain short-lived, rolling\ncloud-storage credentials (AWS access keys today; a vendor-neutral token shape is reserved for a\nlater slice) ",[950,955,956],{},"without ever putting a long-lived secret in the client",". A 32-byte seed is\ngenerated once, encrypted under the vault's own ",[959,960,961],"code",{},"_broker"," collection DEK (data-encryption key),\nand never leaves the device. A ",[950,964,965],{},"derived proof key"," — never the seed itself — is registered with\na broker host at enrolment; from then on the client re-derives the same key, signs a challenge the\nhost just issued, and the host mints scoped, minutes-to-an-hour credentials on a verified proof.",[946,968,969,970,974,975,978,979,985],{},"Nothing here weakens the zero-knowledge guarantee over document ",[971,972,973],"em",{},"contents"," — this broker only gates\n",[950,976,977],{},"storage-backend access"," (can this client currently read\u002Fwrite ciphertext at all), not the\nconfidentiality of what's inside it. It is the same trust class as the ",[980,981,982],"a",{"href":170},[959,983,984],{},"at-*","\nsealing-key family: a host you run participates, but it never sees a secret, KEK, DEK, or\nplaintext.",[941,987,989],{"id":988},"when-you-need-it","When you need it",[991,992,993,1008,1011],"ul",{},[994,995,996,997,1000,1001,1000,1004,1007],"li",{},"An app backed by a cloud store (",[959,998,999],{},"@noy-db\u002Fto-aws-dynamo",", ",[959,1002,1003],{},"@noy-db\u002Fto-aws-s3",[959,1005,1006],{},"@noy-db\u002Fas-aws-s3",")\nthat wants per-vault-scoped, auto-rotating credentials instead of one static IAM key baked into\nevery client.",[994,1009,1010],{},"Revocation without a client-side ceremony: stop re-issuing at the broker and every client's\ncredential goes dead within its TTL.",[994,1012,1013,1014,1017,1018,1021,1022,1025],{},"Per-role access tiers (",[959,1015,1016],{},"profile",", e.g. ",[959,1019,1020],{},"'read'"," vs ",[959,1023,1024],{},"'admin'",") mapped to distinct STS session\npolicies, enforced by the same proof.",[941,1027,1029],{"id":1028},"threat-model-what-it-defeats-and-what-it-honestly-does-not","Threat model — what it defeats, and what it honestly does not",[946,1031,1032,1033,1036],{},"Store-access credentials gate ",[950,1034,1035],{},"availability \u002F tamper \u002F deletion"," of ciphertext, never its\nconfidentiality — that rests on the enclave, unchanged. The secret and every key\u002FDEK never\nleave the client; the broker sees only a challenge proof. The stolen-ciphertext story is unchanged\nby any of this.",[1038,1039,1040,1060],"table",{},[1041,1042,1043],"thead",{},[1044,1045,1046,1050,1053],"tr",{},[1047,1048,1049],"th",{},"Property",[1047,1051,1052],{},"Defeats",[1047,1054,1055,1056,1059],{},"Does ",[950,1057,1058],{},"not"," defeat",[1061,1062,1063,1082,1130,1158,1190],"tbody",{},[1044,1064,1065,1072,1075],{},[1066,1067,1068,1071],"td",{},[950,1069,1070],{},"Rolling"," (short-lived, rotating)",[1066,1073,1074],{},"A credential lifted from a memory dump, crash log, or devtools session is dead within its TTL (minutes–1 h). Revocation = the broker stops re-issuing; no client-side rotation ceremony.",[1066,1076,1077,1078,1081],{},"Live abuse ",[950,1079,1080],{},"within"," the TTL.",[1044,1083,1084,1089,1108],{},[1066,1085,1086],{},[950,1087,1088],{},"Non-extractable",[1066,1090,1091,1092,1095,1096,1099,1100,1103,1104,1107],{},"An attacker who copies the app bundle, ",[959,1093,1094],{},"localStorage",", or IndexedDB ",[950,1097,1098],{},"at rest"," gets nothing replayable: the steady-state proof key is a WebCrypto ",[959,1101,1102],{},"extractable: false"," ",[959,1105,1106],{},"['sign']"," HMAC key.",[1066,1109,1110,1113,1114,1117,1118,1121,1122,1125,1126,1129],{},[950,1111,1112],{},"A resident XSS attacker while the vault is unlocked"," — they can drive the whole proof flow with the live key, ",[971,1115,1116],{},"and"," re-run the key derivation from the decrypted seed, whose bytes are re-derivable while unlocked. Non-extractability denies ",[950,1119,1120],{},"capability-cloning"," (reuse of a ",[971,1123,1124],{},"handle"," offline\u002Flater\u002Felsewhere), not live in-page use. It is defense-in-depth against a ",[971,1127,1128],{},"leaked handle only",".",[1044,1131,1132,1142,1148],{},[1066,1133,1134,1137,1138,1141],{},[950,1135,1136],{},"User-bound"," (",[959,1139,1140],{},"access = f(app config, unlocked keyring)",")",[1066,1143,1144,1145,1147],{},"App config alone (bundle constants, endpoint URLs) grants zero cloud access — the broker refuses without a proof derivable only from a decrypted ",[959,1146,961],{}," seed. Per-user STS session tags + a scoped session policy let the cloud side enforce per-vault scoping, so user A's credentials cannot read user B's rows.",[1066,1149,1150,1153,1154,1157],{},[950,1151,1152],{},"A compromised broker host."," It is the credential authority; its compromise mints credentials for anyone. This is outside the zero-knowledge boundary ",[950,1155,1156],{},"by design"," — the broker still never sees secret, KEK, DEK, or plaintext.",[1044,1159,1160,1166,1177],{},[1066,1161,1162,1165],{},[950,1163,1164],{},"Symmetric-verifiable"," (the broker holds the same key it verifies)",[1066,1167,1168,1169,1172,1173,1176],{},"A forged ",[971,1170,1171],{},"client"," proof grants nothing the broker cannot already grant itself — it ",[950,1174,1175],{},"is"," the credential mint.",[1066,1178,1179,1182,1183,1185,1186,1189],{},[950,1180,1181],{},"A read-only leak of the broker's registered-key store."," Because verification is symmetric HMAC, a registered proof key ",[950,1184,1175],{}," a forgeable credential — ",[971,1187,1188],{},"unless the host wraps registered keys at rest under a broker-side KMS key"," (mandated below): with KMS-wrap, a read-only DB leak yields only ciphertext the attacker cannot unwrap.",[1044,1191,1192,1198,1201],{},[1066,1193,1194,1197],{},[950,1195,1196],{},"Transparent"," (dev wires the cloud store at setup; the end user never sees it)",[1066,1199,1200],{},"Nothing — this is UX, not security. Listed so nobody mistakes it for a security property.",[1066,1202,1203],{},"—",[946,1205,1206],{},"An asymmetric enrolment (register only a public verifier) would remove the at-rest forgeability\nstructurally, but WebCrypto cannot portably derive a deterministic keypair from the key-derivation\noutput. KMS-wrap is the accepted mitigation for the symmetric-HMAC at-rest exposure — see the\nreference host below.",[941,1208,1210],{"id":1209},"protocol-enrol-challenge-mint-refresh-rotate","Protocol: enrol → challenge → mint → refresh → rotate",[946,1212,1213,1103,1216,1000,1219,1222,1223,1225,1226,1229,1230,1232],{},[950,1214,1215],{},"What the broker learns:",[959,1217,1218],{},"vaultId",[959,1220,1221],{},"brokerId",", a one-way 32-byte derivation output (registered\nonce, inverts to nothing), the requested ",[959,1224,1016],{},", request timing\u002FIP, and the dev-backend\nattestation identity at enrol.\n",[950,1227,1228],{},"What it never learns:"," the secret, any KEK\u002FDEK, collection names, record contents, or the\n",[959,1231,961],{}," seed itself.",[1234,1235,1236,1268,1278,1304,1317],"ol",{},[994,1237,1238,1137,1241,1244,1245,1247,1248,1251,1252,1255,1256,1259,1260,1263,1264,1267],{},[950,1239,1240],{},"Enrol",[959,1242,1243],{},"vault.broker().enroll()",", idempotent). Creates the ",[959,1246,961],{}," seed if absent (a\ncreate-if-absent compare-and-set — two concurrent enrols converge on one seed, never two),\nderives the proof bits, and ",[959,1249,1250],{},"POST \u002Fenroll","s them plus a dev-backend attestation token. Only after\na 2xx does the local record flip ",[959,1253,1254],{},"registered: true"," — a seed whose ",[959,1257,1258],{},"\u002Fenroll"," POST failed stays\nunregistered, so a later mint fails fast instead of degrading into an opaque proof error.\nRequires owner\u002Fadmin role, and — ",[950,1261,1262],{},"for first-ever seed creation only"," — the vault's KEK. A\nkeyring holding only a DEK (e.g. a PIN quick-resume) can still ",[971,1265,1266],{},"use"," an already-enrolled seed,\njust not create the first one.",[994,1269,1270,1273,1274,1277],{},[950,1271,1272],{},"Challenge."," The client ",[959,1275,1276],{},"POST \u002Fchallenge","s; the host mints a random, single-use challenge with\na short (≤ 60 s) TTL and returns it.",[994,1279,1280,1283,1284,1286,1287,1000,1289,1291,1292,1295,1296,1299,1300,1303],{},[950,1281,1282],{},"Mint."," The client re-derives the proof key from the seed, signs a canonical string binding\n",[959,1285,1218],{},", the broker endpoint's origin, ",[959,1288,1221],{},[959,1290,1016],{},", the challenge, and its\n",[959,1293,1294],{},"expiresAt",", then ",[959,1297,1298],{},"POST \u002Fcredentials","s the proof. The host ",[950,1301,1302],{},"burns the challenge before doing any\nHMAC work"," (a replay of an already-used challenge is rejected before the MAC is even checked),\nverifies the signature against the unwrapped registered key, and — only then — mints scoped,\nshort-lived cloud credentials.",[994,1305,1306,1103,1309,1312,1313,1316],{},[950,1307,1308],{},"Refresh \u002F cache.",[959,1310,1311],{},"credentialSource(profile)"," (what a store's credential hook calls) holds a\nsingle-flight, per-profile cache: concurrent callers near expiry await one round-trip; cached\ncredentials are valid until ",[959,1314,1315],{},"max(expiresAt − skewMs, now + minCacheMs)",". Nothing is ever written\nto disk — credentials live only in memory and die with the tab.",[994,1318,1319,1137,1322,1325,1326,1329,1330,1333],{},[950,1320,1321],{},"Rotate",[959,1323,1324],{},"vault.broker().rotate()","). Quiesces the cache (awaits any in-flight round-trip),\nmints a fresh seed, registers it ",[950,1327,1328],{},"before"," overwriting the local record, and overwrites last.\nThe host must accept ",[950,1331,1332],{},"both"," the old and new registration for a short grace window so an\nin-flight proof computed under the pre-rotation seed still verifies.",[941,1335,1337],{"id":1336},"prerequisites","Prerequisites",[946,1339,1340],{},"Four parts must exist together before a brokered credential reaches a store — each is detailed below, all four up front:",[1234,1342,1343,1355,1361,1382],{},[994,1344,1345,1350,1351,1354],{},[950,1346,1347],{},[959,1348,1349],{},"brokerStrategy: withBroker(config)"," on ",[959,1352,1353],{},"createNoydb"," (this page's opt-in).",[994,1356,1357,1360],{},[950,1358,1359],{},"A running broker host"," implementing the four obligations listed under \"The reference broker host\" below — the hub ships the protocol, you run the host.",[994,1362,1363,1374,1375,1377,1378,1381],{},[950,1364,1365,1366,1369,1370,1373],{},"The ",[959,1367,1368],{},"credentialSource"," wired into a cloud store's ",[959,1371,1372],{},"credentials"," option"," (e.g. ",[959,1376,1003],{}," \u002F ",[959,1379,1380],{},"to-aws-dynamo",") so the short-lived credentials actually reach the SDK.",[994,1383,1384,1387],{},[950,1385,1386],{},"Owner\u002Fadmin role"," for registration — and, for first-ever seed creation only, the vault's KEK.",[941,1389,1391],{"id":1390},"opt-in","Opt in",[1393,1394,1399],"pre",{"className":1395,"code":1396,"language":1397,"meta":1398,"style":1398},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\nimport { withBroker } from '@noy-db\u002Fhub\u002Fbroker'\nimport { toBrowserIdb } from '@noy-db\u002Fto-browser-idb'\n\nconst db = await createNoydb({\n  store: toBrowserIdb(),\n  user: 'me',\n  secret: 'correct horse battery staple',\n  brokerStrategy: withBroker({\n    brokerId: 'broker-1',\n    endpoint: 'https:\u002F\u002Fbroker.example.com',\n    \u002F\u002F Your app's proof to the host that this enrollment call is\n    \u002F\u002F legitimate — e.g. the session token your backend already issued.\n    attestation: () => mySessionToken,\n  }),\n})\nconst vault = await db.openVault('acme')\nawait vault.broker().enroll()\n","ts","",[959,1400,1401,1434,1455,1476,1483,1508,1526,1544,1561,1575,1592,1609,1616,1622,1641,1651,1660,1691],{"__ignoreMap":1398},[1402,1403,1406,1410,1414,1418,1421,1424,1427,1431],"span",{"class":1404,"line":1405},"line",1,[1402,1407,1409],{"class":1408},"s7zQu","import",[1402,1411,1413],{"class":1412},"sMK4o"," {",[1402,1415,1417],{"class":1416},"sTEyZ"," createNoydb",[1402,1419,1420],{"class":1412}," }",[1402,1422,1423],{"class":1408}," from",[1402,1425,1426],{"class":1412}," '",[1402,1428,1430],{"class":1429},"sfazB","@noy-db\u002Fhub",[1402,1432,1433],{"class":1412},"'\n",[1402,1435,1437,1439,1441,1444,1446,1448,1450,1453],{"class":1404,"line":1436},2,[1402,1438,1409],{"class":1408},[1402,1440,1413],{"class":1412},[1402,1442,1443],{"class":1416}," withBroker",[1402,1445,1420],{"class":1412},[1402,1447,1423],{"class":1408},[1402,1449,1426],{"class":1412},[1402,1451,1452],{"class":1429},"@noy-db\u002Fhub\u002Fbroker",[1402,1454,1433],{"class":1412},[1402,1456,1458,1460,1462,1465,1467,1469,1471,1474],{"class":1404,"line":1457},3,[1402,1459,1409],{"class":1408},[1402,1461,1413],{"class":1412},[1402,1463,1464],{"class":1416}," toBrowserIdb",[1402,1466,1420],{"class":1412},[1402,1468,1423],{"class":1408},[1402,1470,1426],{"class":1412},[1402,1472,1473],{"class":1429},"@noy-db\u002Fto-browser-idb",[1402,1475,1433],{"class":1412},[1402,1477,1479],{"class":1404,"line":1478},4,[1402,1480,1482],{"emptyLinePlaceholder":1481},true,"\n",[1402,1484,1486,1490,1493,1496,1499,1502,1505],{"class":1404,"line":1485},5,[1402,1487,1489],{"class":1488},"spNyl","const",[1402,1491,1492],{"class":1416}," db ",[1402,1494,1495],{"class":1412},"=",[1402,1497,1498],{"class":1408}," await",[1402,1500,1417],{"class":1501},"s2Zo4",[1402,1503,1504],{"class":1416},"(",[1402,1506,1507],{"class":1412},"{\n",[1402,1509,1511,1515,1518,1520,1523],{"class":1404,"line":1510},6,[1402,1512,1514],{"class":1513},"swJcz","  store",[1402,1516,1517],{"class":1412},":",[1402,1519,1464],{"class":1501},[1402,1521,1522],{"class":1416},"()",[1402,1524,1525],{"class":1412},",\n",[1402,1527,1529,1532,1534,1536,1539,1542],{"class":1404,"line":1528},7,[1402,1530,1531],{"class":1513},"  user",[1402,1533,1517],{"class":1412},[1402,1535,1426],{"class":1412},[1402,1537,1538],{"class":1429},"me",[1402,1540,1541],{"class":1412},"'",[1402,1543,1525],{"class":1412},[1402,1545,1547,1550,1552,1554,1557,1559],{"class":1404,"line":1546},8,[1402,1548,1549],{"class":1513},"  secret",[1402,1551,1517],{"class":1412},[1402,1553,1426],{"class":1412},[1402,1555,1556],{"class":1429},"correct horse battery staple",[1402,1558,1541],{"class":1412},[1402,1560,1525],{"class":1412},[1402,1562,1564,1567,1569,1571,1573],{"class":1404,"line":1563},9,[1402,1565,1566],{"class":1513},"  brokerStrategy",[1402,1568,1517],{"class":1412},[1402,1570,1443],{"class":1501},[1402,1572,1504],{"class":1416},[1402,1574,1507],{"class":1412},[1402,1576,1578,1581,1583,1585,1588,1590],{"class":1404,"line":1577},10,[1402,1579,1580],{"class":1513},"    brokerId",[1402,1582,1517],{"class":1412},[1402,1584,1426],{"class":1412},[1402,1586,1587],{"class":1429},"broker-1",[1402,1589,1541],{"class":1412},[1402,1591,1525],{"class":1412},[1402,1593,1595,1598,1600,1602,1605,1607],{"class":1404,"line":1594},11,[1402,1596,1597],{"class":1513},"    endpoint",[1402,1599,1517],{"class":1412},[1402,1601,1426],{"class":1412},[1402,1603,1604],{"class":1429},"https:\u002F\u002Fbroker.example.com",[1402,1606,1541],{"class":1412},[1402,1608,1525],{"class":1412},[1402,1610,1612],{"class":1404,"line":1611},12,[1402,1613,1615],{"class":1614},"sHwdD","    \u002F\u002F Your app's proof to the host that this enrollment call is\n",[1402,1617,1619],{"class":1404,"line":1618},13,[1402,1620,1621],{"class":1614},"    \u002F\u002F legitimate — e.g. the session token your backend already issued.\n",[1402,1623,1625,1628,1630,1633,1636,1639],{"class":1404,"line":1624},14,[1402,1626,1627],{"class":1501},"    attestation",[1402,1629,1517],{"class":1412},[1402,1631,1632],{"class":1412}," ()",[1402,1634,1635],{"class":1488}," =>",[1402,1637,1638],{"class":1416}," mySessionToken",[1402,1640,1525],{"class":1412},[1402,1642,1644,1647,1649],{"class":1404,"line":1643},15,[1402,1645,1646],{"class":1412},"  }",[1402,1648,1141],{"class":1416},[1402,1650,1525],{"class":1412},[1402,1652,1654,1657],{"class":1404,"line":1653},16,[1402,1655,1656],{"class":1412},"}",[1402,1658,1659],{"class":1416},")\n",[1402,1661,1663,1665,1668,1670,1672,1675,1677,1680,1682,1684,1687,1689],{"class":1404,"line":1662},17,[1402,1664,1489],{"class":1488},[1402,1666,1667],{"class":1416}," vault ",[1402,1669,1495],{"class":1412},[1402,1671,1498],{"class":1408},[1402,1673,1674],{"class":1416}," db",[1402,1676,1129],{"class":1412},[1402,1678,1679],{"class":1501},"openVault",[1402,1681,1504],{"class":1416},[1402,1683,1541],{"class":1412},[1402,1685,1686],{"class":1429},"acme",[1402,1688,1541],{"class":1412},[1402,1690,1659],{"class":1416},[1402,1692,1694,1697,1700,1702,1704,1706,1708,1711],{"class":1404,"line":1693},18,[1402,1695,1696],{"class":1408},"await",[1402,1698,1699],{"class":1416}," vault",[1402,1701,1129],{"class":1412},[1402,1703,625],{"class":1501},[1402,1705,1522],{"class":1416},[1402,1707,1129],{"class":1412},[1402,1709,1710],{"class":1501},"enroll",[1402,1712,1713],{"class":1416},"()\n",[941,1715,1717],{"id":1716},"the-whole-flow-end-to-end","The whole flow, end to end",[946,1719,1720,1721,1724,1725,1728,1729,1732],{},"The four parts above, assembled — this is the shape the showcase suite runs in CI (",[959,1722,1723],{},"97-broker-aws",", Tier 1: an in-process reference host built from the published ",[959,1726,1727],{},"issueChallenge()","\u002F",[959,1730,1731],{},"verifyBrokerProof()"," primitives, real proof crypto, no network):",[1393,1734,1736],{"className":1395,"code":1735,"language":1397,"meta":1398,"style":1398},"import { createNoydb } from '@noy-db\u002Fhub'\nimport { withBroker } from '@noy-db\u002Fhub\u002Fbroker'\nimport { toMemory } from '@noy-db\u002Fto-memory'\nimport { toAwsDynamo } from '@noy-db\u002Fto-aws-dynamo'\n\n\u002F\u002F Part 1 + 4 — opt in, with your attestation:\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'alice',\n  secret: 'broker-secret-2026',\n  brokerStrategy: withBroker({\n    brokerId: 'broker-1',\n    endpoint: 'https:\u002F\u002Fbroker.example.com', \u002F\u002F Part 2 — your running host\n    attestation: () => mySessionToken,\n  }),\n})\nconst vault = await db.openVault('acme')\n\n\u002F\u002F One-time per device: register this client's proof key with the host.\nawait vault.broker().enroll()\n\n\u002F\u002F Part 3 — the rolling credential source, wired into a cloud store's\n\u002F\u002F `credentials` refresh hook. The SDK re-invokes it near expiry; each\n\u002F\u002F invocation runs the challenge → proof → mint round trip.\nconst source = vault.broker().credentialSource('read')\nconst cloudStore = toAwsDynamo({ table: 'acme-vault-table', credentials: source })\n",[959,1737,1738,1756,1774,1794,1813,1817,1822,1838,1850,1865,1880,1892,1906,1924,1938,1946,1952,1978,1982,1988,2007,2012,2018,2024,2030,2063],{"__ignoreMap":1398},[1402,1739,1740,1742,1744,1746,1748,1750,1752,1754],{"class":1404,"line":1405},[1402,1741,1409],{"class":1408},[1402,1743,1413],{"class":1412},[1402,1745,1417],{"class":1416},[1402,1747,1420],{"class":1412},[1402,1749,1423],{"class":1408},[1402,1751,1426],{"class":1412},[1402,1753,1430],{"class":1429},[1402,1755,1433],{"class":1412},[1402,1757,1758,1760,1762,1764,1766,1768,1770,1772],{"class":1404,"line":1436},[1402,1759,1409],{"class":1408},[1402,1761,1413],{"class":1412},[1402,1763,1443],{"class":1416},[1402,1765,1420],{"class":1412},[1402,1767,1423],{"class":1408},[1402,1769,1426],{"class":1412},[1402,1771,1452],{"class":1429},[1402,1773,1433],{"class":1412},[1402,1775,1776,1778,1780,1783,1785,1787,1789,1792],{"class":1404,"line":1457},[1402,1777,1409],{"class":1408},[1402,1779,1413],{"class":1412},[1402,1781,1782],{"class":1416}," toMemory",[1402,1784,1420],{"class":1412},[1402,1786,1423],{"class":1408},[1402,1788,1426],{"class":1412},[1402,1790,1791],{"class":1429},"@noy-db\u002Fto-memory",[1402,1793,1433],{"class":1412},[1402,1795,1796,1798,1800,1803,1805,1807,1809,1811],{"class":1404,"line":1478},[1402,1797,1409],{"class":1408},[1402,1799,1413],{"class":1412},[1402,1801,1802],{"class":1416}," toAwsDynamo",[1402,1804,1420],{"class":1412},[1402,1806,1423],{"class":1408},[1402,1808,1426],{"class":1412},[1402,1810,999],{"class":1429},[1402,1812,1433],{"class":1412},[1402,1814,1815],{"class":1404,"line":1485},[1402,1816,1482],{"emptyLinePlaceholder":1481},[1402,1818,1819],{"class":1404,"line":1510},[1402,1820,1821],{"class":1614},"\u002F\u002F Part 1 + 4 — opt in, with your attestation:\n",[1402,1823,1824,1826,1828,1830,1832,1834,1836],{"class":1404,"line":1528},[1402,1825,1489],{"class":1488},[1402,1827,1492],{"class":1416},[1402,1829,1495],{"class":1412},[1402,1831,1498],{"class":1408},[1402,1833,1417],{"class":1501},[1402,1835,1504],{"class":1416},[1402,1837,1507],{"class":1412},[1402,1839,1840,1842,1844,1846,1848],{"class":1404,"line":1546},[1402,1841,1514],{"class":1513},[1402,1843,1517],{"class":1412},[1402,1845,1782],{"class":1501},[1402,1847,1522],{"class":1416},[1402,1849,1525],{"class":1412},[1402,1851,1852,1854,1856,1858,1861,1863],{"class":1404,"line":1563},[1402,1853,1531],{"class":1513},[1402,1855,1517],{"class":1412},[1402,1857,1426],{"class":1412},[1402,1859,1860],{"class":1429},"alice",[1402,1862,1541],{"class":1412},[1402,1864,1525],{"class":1412},[1402,1866,1867,1869,1871,1873,1876,1878],{"class":1404,"line":1577},[1402,1868,1549],{"class":1513},[1402,1870,1517],{"class":1412},[1402,1872,1426],{"class":1412},[1402,1874,1875],{"class":1429},"broker-secret-2026",[1402,1877,1541],{"class":1412},[1402,1879,1525],{"class":1412},[1402,1881,1882,1884,1886,1888,1890],{"class":1404,"line":1594},[1402,1883,1566],{"class":1513},[1402,1885,1517],{"class":1412},[1402,1887,1443],{"class":1501},[1402,1889,1504],{"class":1416},[1402,1891,1507],{"class":1412},[1402,1893,1894,1896,1898,1900,1902,1904],{"class":1404,"line":1611},[1402,1895,1580],{"class":1513},[1402,1897,1517],{"class":1412},[1402,1899,1426],{"class":1412},[1402,1901,1587],{"class":1429},[1402,1903,1541],{"class":1412},[1402,1905,1525],{"class":1412},[1402,1907,1908,1910,1912,1914,1916,1918,1921],{"class":1404,"line":1618},[1402,1909,1597],{"class":1513},[1402,1911,1517],{"class":1412},[1402,1913,1426],{"class":1412},[1402,1915,1604],{"class":1429},[1402,1917,1541],{"class":1412},[1402,1919,1920],{"class":1412},",",[1402,1922,1923],{"class":1614}," \u002F\u002F Part 2 — your running host\n",[1402,1925,1926,1928,1930,1932,1934,1936],{"class":1404,"line":1624},[1402,1927,1627],{"class":1501},[1402,1929,1517],{"class":1412},[1402,1931,1632],{"class":1412},[1402,1933,1635],{"class":1488},[1402,1935,1638],{"class":1416},[1402,1937,1525],{"class":1412},[1402,1939,1940,1942,1944],{"class":1404,"line":1643},[1402,1941,1646],{"class":1412},[1402,1943,1141],{"class":1416},[1402,1945,1525],{"class":1412},[1402,1947,1948,1950],{"class":1404,"line":1653},[1402,1949,1656],{"class":1412},[1402,1951,1659],{"class":1416},[1402,1953,1954,1956,1958,1960,1962,1964,1966,1968,1970,1972,1974,1976],{"class":1404,"line":1662},[1402,1955,1489],{"class":1488},[1402,1957,1667],{"class":1416},[1402,1959,1495],{"class":1412},[1402,1961,1498],{"class":1408},[1402,1963,1674],{"class":1416},[1402,1965,1129],{"class":1412},[1402,1967,1679],{"class":1501},[1402,1969,1504],{"class":1416},[1402,1971,1541],{"class":1412},[1402,1973,1686],{"class":1429},[1402,1975,1541],{"class":1412},[1402,1977,1659],{"class":1416},[1402,1979,1980],{"class":1404,"line":1693},[1402,1981,1482],{"emptyLinePlaceholder":1481},[1402,1983,1985],{"class":1404,"line":1984},19,[1402,1986,1987],{"class":1614},"\u002F\u002F One-time per device: register this client's proof key with the host.\n",[1402,1989,1991,1993,1995,1997,1999,2001,2003,2005],{"class":1404,"line":1990},20,[1402,1992,1696],{"class":1408},[1402,1994,1699],{"class":1416},[1402,1996,1129],{"class":1412},[1402,1998,625],{"class":1501},[1402,2000,1522],{"class":1416},[1402,2002,1129],{"class":1412},[1402,2004,1710],{"class":1501},[1402,2006,1713],{"class":1416},[1402,2008,2010],{"class":1404,"line":2009},21,[1402,2011,1482],{"emptyLinePlaceholder":1481},[1402,2013,2015],{"class":1404,"line":2014},22,[1402,2016,2017],{"class":1614},"\u002F\u002F Part 3 — the rolling credential source, wired into a cloud store's\n",[1402,2019,2021],{"class":1404,"line":2020},23,[1402,2022,2023],{"class":1614},"\u002F\u002F `credentials` refresh hook. The SDK re-invokes it near expiry; each\n",[1402,2025,2027],{"class":1404,"line":2026},24,[1402,2028,2029],{"class":1614},"\u002F\u002F invocation runs the challenge → proof → mint round trip.\n",[1402,2031,2033,2035,2038,2040,2042,2044,2046,2048,2050,2052,2054,2056,2059,2061],{"class":1404,"line":2032},25,[1402,2034,1489],{"class":1488},[1402,2036,2037],{"class":1416}," source ",[1402,2039,1495],{"class":1412},[1402,2041,1699],{"class":1416},[1402,2043,1129],{"class":1412},[1402,2045,625],{"class":1501},[1402,2047,1522],{"class":1416},[1402,2049,1129],{"class":1412},[1402,2051,1368],{"class":1501},[1402,2053,1504],{"class":1416},[1402,2055,1541],{"class":1412},[1402,2057,2058],{"class":1429},"read",[1402,2060,1541],{"class":1412},[1402,2062,1659],{"class":1416},[1402,2064,2066,2068,2071,2073,2075,2077,2080,2083,2085,2087,2090,2092,2094,2097,2099,2101,2103],{"class":1404,"line":2065},26,[1402,2067,1489],{"class":1488},[1402,2069,2070],{"class":1416}," cloudStore ",[1402,2072,1495],{"class":1412},[1402,2074,1802],{"class":1501},[1402,2076,1504],{"class":1416},[1402,2078,2079],{"class":1412},"{",[1402,2081,2082],{"class":1513}," table",[1402,2084,1517],{"class":1412},[1402,2086,1426],{"class":1412},[1402,2088,2089],{"class":1429},"acme-vault-table",[1402,2091,1541],{"class":1412},[1402,2093,1920],{"class":1412},[1402,2095,2096],{"class":1513}," credentials",[1402,2098,1517],{"class":1412},[1402,2100,2037],{"class":1416},[1402,2102,1656],{"class":1412},[1402,2104,1659],{"class":1416},[946,2106,2107,2108,2111,2112,2115,2116,2118,2119,2122,2123,2125],{},"What the showcase asserts about this exact flow: the first ",[959,2109,2110],{},"source()"," call performs one challenge and one mint through the real HKDF\u002FHMAC proof chain; the minted credentials carry ",[959,2113,2114],{},"kind: 'aws'"," and an expiry; the store's SDK client receives ",[959,2117,1372],{}," as a ",[971,2120,2121],{},"function"," (rolling, not baked); and a replayed challenge is rejected with 401 ",[950,2124,1328],{}," any proof verification runs (burn-then-verify). Vault records written meanwhile are ordinary encrypted envelopes — the broker changes how the store authenticates, never what it can read.",[946,2127,2128,2129,2131,2132,2135],{},"To run it yourself: ",[980,2130,576],{"href":577},", file ",[959,2133,2134],{},"97-broker-aws.showcase.test.ts"," — Tier 2 of the same file drives real STS against a deployable CloudFormation stack when you set the gate variables.",[941,2137,2139],{"id":2138},"client-surface","Client surface",[1393,2141,2143],{"className":1395,"code":2142,"language":1397,"meta":1398,"style":1398},"export interface BrokerConfig {\n  readonly brokerId: string        \u002F\u002F stable id; part of the derivation info tag AND the proof MAC.\n                                    \u002F\u002F MUST be globally-unique \u002F endpoint-derived — reusing one\n                                    \u002F\u002F brokerId across two endpoints enables a cross-endpoint relay.\n  readonly endpoint: string        \u002F\u002F https broker base URL; its origin is bound into the proof MAC\n  readonly attestation?: () => string | Promise\u003Cstring>  \u002F\u002F dev-backend session token for \u002Fenroll\n  readonly fetch?: typeof fetch    \u002F\u002F DI for tests \u002F non-window runtimes\n  readonly skewMs?: number         \u002F\u002F refresh margin, default 60_000\n}\n\nexport interface CredentialBrokerHandle {\n  enroll(): Promise\u003Cvoid>                                     \u002F\u002F generate + persist seed, register\n  rotate(): Promise\u003Cvoid>                                     \u002F\u002F rotate seed + re-register\n  credentialSource(profile?: string): StoreCredentialSource   \u002F\u002F single-flight, cached\n}\n",[959,2144,2145,2160,2176,2181,2186,2200,2234,2252,2267,2272,2276,2287,2307,2325,2348],{"__ignoreMap":1398},[1402,2146,2147,2150,2153,2157],{"class":1404,"line":1405},[1402,2148,2149],{"class":1408},"export",[1402,2151,2152],{"class":1488}," interface",[1402,2154,2156],{"class":2155},"sBMFI"," BrokerConfig",[1402,2158,2159],{"class":1412}," {\n",[1402,2161,2162,2165,2168,2170,2173],{"class":1404,"line":1436},[1402,2163,2164],{"class":1488},"  readonly",[1402,2166,2167],{"class":1513}," brokerId",[1402,2169,1517],{"class":1412},[1402,2171,2172],{"class":2155}," string",[1402,2174,2175],{"class":1614},"        \u002F\u002F stable id; part of the derivation info tag AND the proof MAC.\n",[1402,2177,2178],{"class":1404,"line":1457},[1402,2179,2180],{"class":1614},"                                    \u002F\u002F MUST be globally-unique \u002F endpoint-derived — reusing one\n",[1402,2182,2183],{"class":1404,"line":1478},[1402,2184,2185],{"class":1614},"                                    \u002F\u002F brokerId across two endpoints enables a cross-endpoint relay.\n",[1402,2187,2188,2190,2193,2195,2197],{"class":1404,"line":1485},[1402,2189,2164],{"class":1488},[1402,2191,2192],{"class":1513}," endpoint",[1402,2194,1517],{"class":1412},[1402,2196,2172],{"class":2155},[1402,2198,2199],{"class":1614},"        \u002F\u002F https broker base URL; its origin is bound into the proof MAC\n",[1402,2201,2202,2204,2207,2210,2212,2214,2216,2219,2222,2225,2228,2231],{"class":1404,"line":1510},[1402,2203,2164],{"class":1488},[1402,2205,2206],{"class":1513}," attestation",[1402,2208,2209],{"class":1412},"?:",[1402,2211,1632],{"class":1412},[1402,2213,1635],{"class":1488},[1402,2215,2172],{"class":2155},[1402,2217,2218],{"class":1412}," |",[1402,2220,2221],{"class":2155}," Promise",[1402,2223,2224],{"class":1412},"\u003C",[1402,2226,2227],{"class":2155},"string",[1402,2229,2230],{"class":1412},">",[1402,2232,2233],{"class":1614},"  \u002F\u002F dev-backend session token for \u002Fenroll\n",[1402,2235,2236,2238,2241,2243,2246,2249],{"class":1404,"line":1528},[1402,2237,2164],{"class":1488},[1402,2239,2240],{"class":1513}," fetch",[1402,2242,2209],{"class":1412},[1402,2244,2245],{"class":1412}," typeof",[1402,2247,2248],{"class":1416}," fetch    ",[1402,2250,2251],{"class":1614},"\u002F\u002F DI for tests \u002F non-window runtimes\n",[1402,2253,2254,2256,2259,2261,2264],{"class":1404,"line":1546},[1402,2255,2164],{"class":1488},[1402,2257,2258],{"class":1513}," skewMs",[1402,2260,2209],{"class":1412},[1402,2262,2263],{"class":2155}," number",[1402,2265,2266],{"class":1614},"         \u002F\u002F refresh margin, default 60_000\n",[1402,2268,2269],{"class":1404,"line":1563},[1402,2270,2271],{"class":1412},"}\n",[1402,2273,2274],{"class":1404,"line":1577},[1402,2275,1482],{"emptyLinePlaceholder":1481},[1402,2277,2278,2280,2282,2285],{"class":1404,"line":1594},[1402,2279,2149],{"class":1408},[1402,2281,2152],{"class":1488},[1402,2283,2284],{"class":2155}," CredentialBrokerHandle",[1402,2286,2159],{"class":1412},[1402,2288,2289,2292,2295,2297,2299,2302,2304],{"class":1404,"line":1611},[1402,2290,2291],{"class":1513},"  enroll",[1402,2293,2294],{"class":1412},"():",[1402,2296,2221],{"class":2155},[1402,2298,2224],{"class":1412},[1402,2300,2301],{"class":2155},"void",[1402,2303,2230],{"class":1412},[1402,2305,2306],{"class":1614},"                                     \u002F\u002F generate + persist seed, register\n",[1402,2308,2309,2312,2314,2316,2318,2320,2322],{"class":1404,"line":1618},[1402,2310,2311],{"class":1513},"  rotate",[1402,2313,2294],{"class":1412},[1402,2315,2221],{"class":2155},[1402,2317,2224],{"class":1412},[1402,2319,2301],{"class":2155},[1402,2321,2230],{"class":1412},[1402,2323,2324],{"class":1614},"                                     \u002F\u002F rotate seed + re-register\n",[1402,2326,2327,2330,2332,2335,2337,2339,2342,2345],{"class":1404,"line":1624},[1402,2328,2329],{"class":1513},"  credentialSource",[1402,2331,1504],{"class":1412},[1402,2333,1016],{"class":2334},"sHdIc",[1402,2336,2209],{"class":1412},[1402,2338,2172],{"class":2155},[1402,2340,2341],{"class":1412},"):",[1402,2343,2344],{"class":2155}," StoreCredentialSource",[1402,2346,2347],{"class":1614},"   \u002F\u002F single-flight, cached\n",[1402,2349,2350],{"class":1404,"line":1643},[1402,2351,2271],{"class":1412},[946,2353,2354,2357,2358,2361,2362,2365,2366,2369],{},[959,2355,2356],{},"vault.broker()"," returns the ",[959,2359,2360],{},"CredentialBrokerHandle",". Every ",[959,2363,2364],{},"StoreCredentialSource"," produces the\nvendor-neutral ",[959,2367,2368],{},"StoreCredentials"," type:",[1393,2371,2373],{"className":1395,"code":2372,"language":1397,"meta":1398,"style":1398},"export type StoreCredentials =\n  | { readonly kind: 'aws'; readonly accessKeyId: string; readonly secretAccessKey: string\n      readonly sessionToken?: string; readonly expiresAt?: string }\n  | { readonly kind: 'token'; readonly token: string; readonly expiresAt?: string } \u002F\u002F a later slice\n",[959,2374,2375,2388,2434,2460],{"__ignoreMap":1398},[1402,2376,2377,2379,2382,2385],{"class":1404,"line":1405},[1402,2378,2149],{"class":1408},[1402,2380,2381],{"class":1488}," type",[1402,2383,2384],{"class":2155}," StoreCredentials",[1402,2386,2387],{"class":1412}," =\n",[1402,2389,2390,2393,2395,2398,2401,2403,2405,2408,2410,2413,2415,2418,2420,2422,2424,2426,2429,2431],{"class":1404,"line":1436},[1402,2391,2392],{"class":1412},"  |",[1402,2394,1413],{"class":1412},[1402,2396,2397],{"class":1488}," readonly",[1402,2399,2400],{"class":1513}," kind",[1402,2402,1517],{"class":1412},[1402,2404,1426],{"class":1412},[1402,2406,2407],{"class":1429},"aws",[1402,2409,1541],{"class":1412},[1402,2411,2412],{"class":1412},";",[1402,2414,2397],{"class":1488},[1402,2416,2417],{"class":1513}," accessKeyId",[1402,2419,1517],{"class":1412},[1402,2421,2172],{"class":2155},[1402,2423,2412],{"class":1412},[1402,2425,2397],{"class":1488},[1402,2427,2428],{"class":1513}," secretAccessKey",[1402,2430,1517],{"class":1412},[1402,2432,2433],{"class":2155}," string\n",[1402,2435,2436,2439,2442,2444,2446,2448,2450,2453,2455,2457],{"class":1404,"line":1457},[1402,2437,2438],{"class":1488},"      readonly",[1402,2440,2441],{"class":1513}," sessionToken",[1402,2443,2209],{"class":1412},[1402,2445,2172],{"class":2155},[1402,2447,2412],{"class":1412},[1402,2449,2397],{"class":1488},[1402,2451,2452],{"class":1513}," expiresAt",[1402,2454,2209],{"class":1412},[1402,2456,2172],{"class":2155},[1402,2458,2459],{"class":1412}," }\n",[1402,2461,2462,2464,2466,2468,2470,2472,2474,2477,2479,2481,2483,2486,2488,2490,2492,2494,2496,2498,2500,2502],{"class":1404,"line":1478},[1402,2463,2392],{"class":1412},[1402,2465,1413],{"class":1412},[1402,2467,2397],{"class":1488},[1402,2469,2400],{"class":1513},[1402,2471,1517],{"class":1412},[1402,2473,1426],{"class":1412},[1402,2475,2476],{"class":1429},"token",[1402,2478,1541],{"class":1412},[1402,2480,2412],{"class":1412},[1402,2482,2397],{"class":1488},[1402,2484,2485],{"class":1513}," token",[1402,2487,1517],{"class":1412},[1402,2489,2172],{"class":2155},[1402,2491,2412],{"class":1412},[1402,2493,2397],{"class":1488},[1402,2495,2452],{"class":1513},[1402,2497,2209],{"class":1412},[1402,2499,2172],{"class":2155},[1402,2501,1420],{"class":1412},[1402,2503,2504],{"class":1614}," \u002F\u002F a later slice\n",[941,2506,2508],{"id":2507},"wiring-into-a-stores-credential-hook","Wiring into a store's credential hook",[946,2510,2511,2512,2514,2515,2517,2518,2520,2521,2524,2525,2527,2528,2341],{},"Wire the resulting ",[959,2513,1368],{}," into a store's rolling-credential hook — e.g.\n",[959,2516,1006],{},"'s ",[959,2519,1372],{}," option, which feeds the AWS SDK's own ",[959,2522,2523],{},"memoizeIdentityProvider","\n(the SDK owns refresh on the ",[959,2526,2114],{}," arm, re-invoking the provider whenever the returned\nidentity carries an ",[959,2529,2530],{},"expiration: Date",[1393,2532,2534],{"className":1395,"code":2533,"language":1397,"meta":1398,"style":1398},"import { asAwsS3 } from '@noy-db\u002Fas-aws-s3'\n\nconst objects = asAwsS3({\n  bucket: 'acme-assets',\n  credentials: vault.broker().credentialSource('read'),\n})\n",[959,2535,2536,2555,2559,2574,2590,2621],{"__ignoreMap":1398},[1402,2537,2538,2540,2542,2545,2547,2549,2551,2553],{"class":1404,"line":1405},[1402,2539,1409],{"class":1408},[1402,2541,1413],{"class":1412},[1402,2543,2544],{"class":1416}," asAwsS3",[1402,2546,1420],{"class":1412},[1402,2548,1423],{"class":1408},[1402,2550,1426],{"class":1412},[1402,2552,1006],{"class":1429},[1402,2554,1433],{"class":1412},[1402,2556,2557],{"class":1404,"line":1436},[1402,2558,1482],{"emptyLinePlaceholder":1481},[1402,2560,2561,2563,2566,2568,2570,2572],{"class":1404,"line":1457},[1402,2562,1489],{"class":1488},[1402,2564,2565],{"class":1416}," objects ",[1402,2567,1495],{"class":1412},[1402,2569,2544],{"class":1501},[1402,2571,1504],{"class":1416},[1402,2573,1507],{"class":1412},[1402,2575,2576,2579,2581,2583,2586,2588],{"class":1404,"line":1478},[1402,2577,2578],{"class":1513},"  bucket",[1402,2580,1517],{"class":1412},[1402,2582,1426],{"class":1412},[1402,2584,2585],{"class":1429},"acme-assets",[1402,2587,1541],{"class":1412},[1402,2589,1525],{"class":1412},[1402,2591,2592,2595,2597,2599,2601,2603,2605,2607,2609,2611,2613,2615,2617,2619],{"class":1404,"line":1485},[1402,2593,2594],{"class":1513},"  credentials",[1402,2596,1517],{"class":1412},[1402,2598,1699],{"class":1416},[1402,2600,1129],{"class":1412},[1402,2602,625],{"class":1501},[1402,2604,1522],{"class":1416},[1402,2606,1129],{"class":1412},[1402,2608,1368],{"class":1501},[1402,2610,1504],{"class":1416},[1402,2612,1541],{"class":1412},[1402,2614,2058],{"class":1429},[1402,2616,1541],{"class":1412},[1402,2618,1141],{"class":1416},[1402,2620,1525],{"class":1412},[1402,2622,2623,2625],{"class":1404,"line":1510},[1402,2624,1656],{"class":1412},[1402,2626,1659],{"class":1416},[941,2628,2630],{"id":2629},"behavior-when-not-opted-in","Behavior when NOT opted in",[946,2632,2633,2634,2637,2638,2641,2642,2644,2645,1000,2647,2650,2651,2654,2655,1129],{},"Every broker method on the default floor throws ",[959,2635,2636],{},"BrokerNotEnabledError"," (its message points at\n",[959,2639,2640],{},"withBroker()"," from ",[959,2643,1452],{},"). ",[959,2646,1243],{},[959,2648,2649],{},".rotate()",", and\n",[959,2652,2653],{},".credentialSource()"," all throw\u002Freject the same way. Zero bytes enter a bundle that never imports\n",[959,2656,1452],{},[941,2658,2660],{"id":2659},"the-reference-broker-host-four-obligations","The reference broker host — four obligations",[946,2662,2663,2664,2666,2667,2669,2670,2673,2674,2677,2678,2681],{},"A conforming broker host embeds two host-side helpers re-exported from ",[959,2665,1452],{}," —\n",[959,2668,1727],{}," (nonce mint, TTL-clamped to ",[959,2671,2672],{},"[10 s, 60 s]",") and ",[959,2675,2676],{},"verifyBrokerProof(args)","\n(burn-then-verify). Around them, ",[950,2679,2680],{},"every"," conforming host must implement four obligations. Skipping\n(a) or (b) breaks the threat-model candor above; skipping (c) or (d) degrades availability, not\nconfidentiality.",[991,2683,2684,2694,2708,2722],{},[994,2685,2686,2689,2690,2693],{},[950,2687,2688],{},"(a) KMS-wrap registered proof keys at rest — mandated, not optional."," The host must store each\nregistered proof key wrapped under a broker-side KMS key and unwrap only in-memory at verify time.\nSymmetric HMAC verification means a read-only leak of an ",[971,2691,2692],{},"unwrapped"," key store is\ncredential-equivalent — this is the one control that prevents that.",[994,2695,2696,2699,2700,2703,2704,2707],{},[950,2697,2698],{},"(b) Atomic single-use challenge burn, before any MAC work."," The ",[959,2701,2702],{},"consumeChallenge"," callback\npassed to ",[959,2705,2706],{},"verifyBrokerProof"," must atomically test-and-delete the challenge; a second presentation\nof the same challenge must fail even with a byte-identical, unexpired, otherwise-valid proof.",[994,2709,2710,2721],{},[950,2711,2712,2713,2716,2717,2720],{},"(c) Rate-limit ",[959,2714,2715],{},"\u002Fcredentials"," per ",[959,2718,2719],{},"(vaultId, brokerId)"," (recommended)."," Bounds the multi-tab\ncredential-amplification surface. App-side hooks + consent audit remain the primary controls; this\nis a defense-in-depth backstop, not a substitute.",[994,2723,2724,2730],{},[950,2725,2726,2727,2729],{},"(d) Accept old ",[950,2728,1116],{}," new registrations for a short grace window on rotate."," An in-flight proof\ncomputed under the pre-rotation seed (e.g. mid-sync-flush) must still verify; never drop the old\nregistration the instant a new one lands.",[946,2732,2733,2734,2737],{},"The illustrative host below is Lambda\u002FSTS-shaped — swap the KMS\u002FDynamoDB\u002FSTS clients for whatever\nyour infra uses. It issues a challenge, burns it ",[950,2735,2736],{},"once"," before any candidate-key loop, verifies\nagainst a KMS-unwrapped key, and mints via STS, hardened with obligations (a) and (c):",[1393,2739,2741],{"className":1395,"code":2740,"language":1397,"meta":1398,"style":1398},"import { issueChallenge, verifyBrokerProof } from '@noy-db\u002Fhub\u002Fbroker'\nimport { KMSClient, EncryptCommand, DecryptCommand } from '@aws-sdk\u002Fclient-kms'\nimport { STSClient, AssumeRoleCommand } from '@aws-sdk\u002Fclient-sts'\n\u002F\u002F registeredKeys \u002F challenges \u002F rateLimiter: any durable KV with an atomic\n\u002F\u002F delete-if-present (DynamoDB conditional delete, Redis DEL, etc.) works.\n\nconst kms = new KMSClient({})\nconst sts = new STSClient({})\nconst KMS_KEY_ID = process.env.BROKER_KMS_KEY_ID!            \u002F\u002F (a)\nconst keyOf = (vaultId: string, brokerId: string) => `${vaultId}:${brokerId}`\n\n\u002F\u002F ─── POST \u002Fenroll ──────────────────────────────────────────────\nexport async function handleEnroll(req: { vaultId: string; brokerId: string; proofKey: string }, attestation?: string) {\n  if (!attestation || !(await verifyDevBackendSession(attestation))) return { statusCode: 401 }\n  \u002F\u002F (a) Wrap BEFORE it ever touches durable storage. A read-only table leak is\n  \u002F\u002F otherwise credential-equivalent under symmetric HMAC.\n  const { CiphertextBlob } = await kms.send(new EncryptCommand({\n    KeyId: KMS_KEY_ID, Plaintext: Buffer.from(req.proofKey, 'base64'),\n  }))\n  \u002F\u002F (d) APPEND, never overwrite: rotate() registers new before local overwrite,\n  \u002F\u002F so this key must coexist with any prior one for a grace window.\n  await registeredKeys.append(keyOf(req.vaultId, req.brokerId), Buffer.from(CiphertextBlob!).toString('base64'))\n  return { statusCode: 200 }\n}\n\n\u002F\u002F ─── POST \u002Fchallenge ───────────────────────────────────────────\nexport async function handleChallenge() {\n  const { challenge, expiresAt } = issueChallenge()\n  await challenges.put(challenge, { expiresAt })            \u002F\u002F immutable once written\n  return { statusCode: 200, body: { challenge, expiresAt } }\n}\n\n\u002F\u002F ─── POST \u002Fcredentials ─────────────────────────────────────────\nexport async function handleCredentials(req: { vaultId: string; brokerId: string; challenge: string; proof: string; profile?: string }) {\n  if (!(await rateLimiter.allow(keyOf(req.vaultId, req.brokerId)))) return { statusCode: 429 } \u002F\u002F (c)\n\n  \u002F\u002F expiresAt is immutable per challenge once written, so reading it is safe\n  \u002F\u002F without coordination; only the delete below needs to be atomic.\n  const expiresAt = await challenges.peekExpiresAt(req.challenge)\n  const burnedFresh = await challenges.deleteIfPresent(req.challenge)  \u002F\u002F (b) burn ONCE, before any candidate loop\n  if (!burnedFresh || expiresAt === undefined) return { statusCode: 401 }\n\n  const wrappedCandidates = await registeredKeys.allFor(keyOf(req.vaultId, req.brokerId)) \u002F\u002F may hold old+new (d)\n  let ok = false\n  for (const wrapped of wrappedCandidates) {\n    const { Plaintext } = await kms.send(new DecryptCommand({ CiphertextBlob: Buffer.from(wrapped, 'base64') }))\n    ok = await verifyBrokerProof({\n      consumeChallenge: async () => true,                  \u002F\u002F already burned above — trivially fresh\n      registeredProofKey: new Uint8Array(Plaintext!),\n      vaultId: req.vaultId, endpointOrigin: 'https:\u002F\u002Fbroker.example.com', brokerId: req.brokerId,\n      profile: req.profile, challenge: req.challenge, expiresAt, proof: req.proof,\n    })\n    if (ok) break\n  }\n  if (!ok) return { statusCode: 401 }\n\n  const { Credentials } = await sts.send(new AssumeRoleCommand({\n    RoleArn: roleForProfile(req.profile),\n    RoleSessionName: `broker-${req.vaultId}`.slice(0, 64),\n    Tags: [{ Key: 'noydbVault', Value: req.vaultId }],\n    Policy: scopedSessionPolicy(req.vaultId),              \u002F\u002F dynamodb:LeadingKeys \u002F S3 prefix on the vault id\n    DurationSeconds: 3600,\n  }))\n  return {\n    statusCode: 200,\n    body: {\n      kind: 'aws', accessKeyId: Credentials!.AccessKeyId, secretAccessKey: Credentials!.SecretAccessKey,\n      sessionToken: Credentials!.SessionToken, expiresAt: Credentials!.Expiration!.toISOString(),\n    },\n  }\n}\n",[959,2742,2743,2767,2797,2822,2827,2832,2836,2857,2876,2903,2949,2953,2958,3017,3064,3069,3074,3110,3157,3164,3169,3174,3243,3259,3263,3267,3272,3288,3310,3342,3374,3379,3384,3390,3455,3515,3520,3526,3532,3560,3593,3630,3635,3680,3695,3717,3778,3794,3816,3840,3881,3926,3934,3950,3956,3981,3986,4019,4042,4086,4131,4157,4170,4177,4184,4196,4206,4249,4286,4292,4297],{"__ignoreMap":1398},[1402,2744,2745,2747,2749,2752,2754,2757,2759,2761,2763,2765],{"class":1404,"line":1405},[1402,2746,1409],{"class":1408},[1402,2748,1413],{"class":1412},[1402,2750,2751],{"class":1416}," issueChallenge",[1402,2753,1920],{"class":1412},[1402,2755,2756],{"class":1416}," verifyBrokerProof",[1402,2758,1420],{"class":1412},[1402,2760,1423],{"class":1408},[1402,2762,1426],{"class":1412},[1402,2764,1452],{"class":1429},[1402,2766,1433],{"class":1412},[1402,2768,2769,2771,2773,2776,2778,2781,2783,2786,2788,2790,2792,2795],{"class":1404,"line":1436},[1402,2770,1409],{"class":1408},[1402,2772,1413],{"class":1412},[1402,2774,2775],{"class":1416}," KMSClient",[1402,2777,1920],{"class":1412},[1402,2779,2780],{"class":1416}," EncryptCommand",[1402,2782,1920],{"class":1412},[1402,2784,2785],{"class":1416}," DecryptCommand",[1402,2787,1420],{"class":1412},[1402,2789,1423],{"class":1408},[1402,2791,1426],{"class":1412},[1402,2793,2794],{"class":1429},"@aws-sdk\u002Fclient-kms",[1402,2796,1433],{"class":1412},[1402,2798,2799,2801,2803,2806,2808,2811,2813,2815,2817,2820],{"class":1404,"line":1457},[1402,2800,1409],{"class":1408},[1402,2802,1413],{"class":1412},[1402,2804,2805],{"class":1416}," STSClient",[1402,2807,1920],{"class":1412},[1402,2809,2810],{"class":1416}," AssumeRoleCommand",[1402,2812,1420],{"class":1412},[1402,2814,1423],{"class":1408},[1402,2816,1426],{"class":1412},[1402,2818,2819],{"class":1429},"@aws-sdk\u002Fclient-sts",[1402,2821,1433],{"class":1412},[1402,2823,2824],{"class":1404,"line":1478},[1402,2825,2826],{"class":1614},"\u002F\u002F registeredKeys \u002F challenges \u002F rateLimiter: any durable KV with an atomic\n",[1402,2828,2829],{"class":1404,"line":1485},[1402,2830,2831],{"class":1614},"\u002F\u002F delete-if-present (DynamoDB conditional delete, Redis DEL, etc.) works.\n",[1402,2833,2834],{"class":1404,"line":1510},[1402,2835,1482],{"emptyLinePlaceholder":1481},[1402,2837,2838,2840,2843,2845,2848,2850,2852,2855],{"class":1404,"line":1528},[1402,2839,1489],{"class":1488},[1402,2841,2842],{"class":1416}," kms ",[1402,2844,1495],{"class":1412},[1402,2846,2847],{"class":1412}," new",[1402,2849,2775],{"class":1501},[1402,2851,1504],{"class":1416},[1402,2853,2854],{"class":1412},"{}",[1402,2856,1659],{"class":1416},[1402,2858,2859,2861,2864,2866,2868,2870,2872,2874],{"class":1404,"line":1546},[1402,2860,1489],{"class":1488},[1402,2862,2863],{"class":1416}," sts ",[1402,2865,1495],{"class":1412},[1402,2867,2847],{"class":1412},[1402,2869,2805],{"class":1501},[1402,2871,1504],{"class":1416},[1402,2873,2854],{"class":1412},[1402,2875,1659],{"class":1416},[1402,2877,2878,2880,2883,2885,2888,2890,2892,2894,2897,2900],{"class":1404,"line":1563},[1402,2879,1489],{"class":1488},[1402,2881,2882],{"class":1416}," KMS_KEY_ID ",[1402,2884,1495],{"class":1412},[1402,2886,2887],{"class":1416}," process",[1402,2889,1129],{"class":1412},[1402,2891,183],{"class":1416},[1402,2893,1129],{"class":1412},[1402,2895,2896],{"class":1416},"BROKER_KMS_KEY_ID",[1402,2898,2899],{"class":1412},"!",[1402,2901,2902],{"class":1614},"            \u002F\u002F (a)\n",[1402,2904,2905,2907,2910,2912,2914,2916,2918,2920,2922,2924,2926,2928,2930,2932,2935,2937,2939,2941,2944,2946],{"class":1404,"line":1577},[1402,2906,1489],{"class":1488},[1402,2908,2909],{"class":1416}," keyOf ",[1402,2911,1495],{"class":1412},[1402,2913,1137],{"class":1412},[1402,2915,1218],{"class":2334},[1402,2917,1517],{"class":1412},[1402,2919,2172],{"class":2155},[1402,2921,1920],{"class":1412},[1402,2923,2167],{"class":2334},[1402,2925,1517],{"class":1412},[1402,2927,2172],{"class":2155},[1402,2929,1141],{"class":1412},[1402,2931,1635],{"class":1488},[1402,2933,2934],{"class":1412}," `${",[1402,2936,1218],{"class":1416},[1402,2938,1656],{"class":1412},[1402,2940,1517],{"class":1429},[1402,2942,2943],{"class":1412},"${",[1402,2945,1221],{"class":1416},[1402,2947,2948],{"class":1412},"}`\n",[1402,2950,2951],{"class":1404,"line":1594},[1402,2952,1482],{"emptyLinePlaceholder":1481},[1402,2954,2955],{"class":1404,"line":1611},[1402,2956,2957],{"class":1614},"\u002F\u002F ─── POST \u002Fenroll ──────────────────────────────────────────────\n",[1402,2959,2960,2962,2965,2968,2971,2973,2976,2978,2980,2983,2985,2987,2989,2991,2993,2995,2997,3000,3002,3004,3007,3009,3011,3013,3015],{"class":1404,"line":1618},[1402,2961,2149],{"class":1408},[1402,2963,2964],{"class":1488}," async",[1402,2966,2967],{"class":1488}," function",[1402,2969,2970],{"class":1501}," handleEnroll",[1402,2972,1504],{"class":1412},[1402,2974,2975],{"class":2334},"req",[1402,2977,1517],{"class":1412},[1402,2979,1413],{"class":1412},[1402,2981,2982],{"class":1513}," vaultId",[1402,2984,1517],{"class":1412},[1402,2986,2172],{"class":2155},[1402,2988,2412],{"class":1412},[1402,2990,2167],{"class":1513},[1402,2992,1517],{"class":1412},[1402,2994,2172],{"class":2155},[1402,2996,2412],{"class":1412},[1402,2998,2999],{"class":1513}," proofKey",[1402,3001,1517],{"class":1412},[1402,3003,2172],{"class":2155},[1402,3005,3006],{"class":1412}," },",[1402,3008,2206],{"class":2334},[1402,3010,2209],{"class":1412},[1402,3012,2172],{"class":2155},[1402,3014,1141],{"class":1412},[1402,3016,2159],{"class":1412},[1402,3018,3019,3022,3024,3026,3028,3031,3034,3036,3038,3041,3043,3045,3048,3051,3053,3056,3058,3062],{"class":1404,"line":1624},[1402,3020,3021],{"class":1408},"  if",[1402,3023,1137],{"class":1513},[1402,3025,2899],{"class":1412},[1402,3027,609],{"class":1416},[1402,3029,3030],{"class":1412}," ||",[1402,3032,3033],{"class":1412}," !",[1402,3035,1504],{"class":1513},[1402,3037,1696],{"class":1408},[1402,3039,3040],{"class":1501}," verifyDevBackendSession",[1402,3042,1504],{"class":1513},[1402,3044,609],{"class":1416},[1402,3046,3047],{"class":1513},"))) ",[1402,3049,3050],{"class":1408},"return",[1402,3052,1413],{"class":1412},[1402,3054,3055],{"class":1513}," statusCode",[1402,3057,1517],{"class":1412},[1402,3059,3061],{"class":3060},"sbssI"," 401",[1402,3063,2459],{"class":1412},[1402,3065,3066],{"class":1404,"line":1643},[1402,3067,3068],{"class":1614},"  \u002F\u002F (a) Wrap BEFORE it ever touches durable storage. A read-only table leak is\n",[1402,3070,3071],{"class":1404,"line":1653},[1402,3072,3073],{"class":1614},"  \u002F\u002F otherwise credential-equivalent under symmetric HMAC.\n",[1402,3075,3076,3079,3081,3084,3086,3089,3091,3094,3096,3099,3101,3104,3106,3108],{"class":1404,"line":1662},[1402,3077,3078],{"class":1488},"  const",[1402,3080,1413],{"class":1412},[1402,3082,3083],{"class":1416}," CiphertextBlob",[1402,3085,1420],{"class":1412},[1402,3087,3088],{"class":1412}," =",[1402,3090,1498],{"class":1408},[1402,3092,3093],{"class":1416}," kms",[1402,3095,1129],{"class":1412},[1402,3097,3098],{"class":1501},"send",[1402,3100,1504],{"class":1513},[1402,3102,3103],{"class":1412},"new",[1402,3105,2780],{"class":1501},[1402,3107,1504],{"class":1513},[1402,3109,1507],{"class":1412},[1402,3111,3112,3115,3117,3120,3122,3125,3127,3130,3132,3135,3137,3139,3141,3144,3146,3148,3151,3153,3155],{"class":1404,"line":1693},[1402,3113,3114],{"class":1513},"    KeyId",[1402,3116,1517],{"class":1412},[1402,3118,3119],{"class":1416}," KMS_KEY_ID",[1402,3121,1920],{"class":1412},[1402,3123,3124],{"class":1513}," Plaintext",[1402,3126,1517],{"class":1412},[1402,3128,3129],{"class":1416}," Buffer",[1402,3131,1129],{"class":1412},[1402,3133,3134],{"class":1501},"from",[1402,3136,1504],{"class":1513},[1402,3138,2975],{"class":1416},[1402,3140,1129],{"class":1412},[1402,3142,3143],{"class":1416},"proofKey",[1402,3145,1920],{"class":1412},[1402,3147,1426],{"class":1412},[1402,3149,3150],{"class":1429},"base64",[1402,3152,1541],{"class":1412},[1402,3154,1141],{"class":1513},[1402,3156,1525],{"class":1412},[1402,3158,3159,3161],{"class":1404,"line":1984},[1402,3160,1646],{"class":1412},[1402,3162,3163],{"class":1513},"))\n",[1402,3165,3166],{"class":1404,"line":1990},[1402,3167,3168],{"class":1614},"  \u002F\u002F (d) APPEND, never overwrite: rotate() registers new before local overwrite,\n",[1402,3170,3171],{"class":1404,"line":2009},[1402,3172,3173],{"class":1614},"  \u002F\u002F so this key must coexist with any prior one for a grace window.\n",[1402,3175,3176,3179,3182,3184,3187,3189,3192,3194,3196,3198,3200,3202,3205,3207,3209,3211,3213,3215,3217,3219,3221,3224,3226,3228,3230,3233,3235,3237,3239,3241],{"class":1404,"line":2014},[1402,3177,3178],{"class":1408},"  await",[1402,3180,3181],{"class":1416}," registeredKeys",[1402,3183,1129],{"class":1412},[1402,3185,3186],{"class":1501},"append",[1402,3188,1504],{"class":1513},[1402,3190,3191],{"class":1501},"keyOf",[1402,3193,1504],{"class":1513},[1402,3195,2975],{"class":1416},[1402,3197,1129],{"class":1412},[1402,3199,1218],{"class":1416},[1402,3201,1920],{"class":1412},[1402,3203,3204],{"class":1416}," req",[1402,3206,1129],{"class":1412},[1402,3208,1221],{"class":1416},[1402,3210,1141],{"class":1513},[1402,3212,1920],{"class":1412},[1402,3214,3129],{"class":1416},[1402,3216,1129],{"class":1412},[1402,3218,3134],{"class":1501},[1402,3220,1504],{"class":1513},[1402,3222,3223],{"class":1416},"CiphertextBlob",[1402,3225,2899],{"class":1412},[1402,3227,1141],{"class":1513},[1402,3229,1129],{"class":1412},[1402,3231,3232],{"class":1501},"toString",[1402,3234,1504],{"class":1513},[1402,3236,1541],{"class":1412},[1402,3238,3150],{"class":1429},[1402,3240,1541],{"class":1412},[1402,3242,3163],{"class":1513},[1402,3244,3245,3248,3250,3252,3254,3257],{"class":1404,"line":2020},[1402,3246,3247],{"class":1408},"  return",[1402,3249,1413],{"class":1412},[1402,3251,3055],{"class":1513},[1402,3253,1517],{"class":1412},[1402,3255,3256],{"class":3060}," 200",[1402,3258,2459],{"class":1412},[1402,3260,3261],{"class":1404,"line":2026},[1402,3262,2271],{"class":1412},[1402,3264,3265],{"class":1404,"line":2032},[1402,3266,1482],{"emptyLinePlaceholder":1481},[1402,3268,3269],{"class":1404,"line":2065},[1402,3270,3271],{"class":1614},"\u002F\u002F ─── POST \u002Fchallenge ───────────────────────────────────────────\n",[1402,3273,3275,3277,3279,3281,3284,3286],{"class":1404,"line":3274},27,[1402,3276,2149],{"class":1408},[1402,3278,2964],{"class":1488},[1402,3280,2967],{"class":1488},[1402,3282,3283],{"class":1501}," handleChallenge",[1402,3285,1522],{"class":1412},[1402,3287,2159],{"class":1412},[1402,3289,3291,3293,3295,3298,3300,3302,3304,3306,3308],{"class":1404,"line":3290},28,[1402,3292,3078],{"class":1488},[1402,3294,1413],{"class":1412},[1402,3296,3297],{"class":1416}," challenge",[1402,3299,1920],{"class":1412},[1402,3301,2452],{"class":1416},[1402,3303,1420],{"class":1412},[1402,3305,3088],{"class":1412},[1402,3307,2751],{"class":1501},[1402,3309,1713],{"class":1513},[1402,3311,3313,3315,3318,3320,3323,3325,3328,3330,3332,3334,3336,3339],{"class":1404,"line":3312},29,[1402,3314,3178],{"class":1408},[1402,3316,3317],{"class":1416}," challenges",[1402,3319,1129],{"class":1412},[1402,3321,3322],{"class":1501},"put",[1402,3324,1504],{"class":1513},[1402,3326,3327],{"class":1416},"challenge",[1402,3329,1920],{"class":1412},[1402,3331,1413],{"class":1412},[1402,3333,2452],{"class":1416},[1402,3335,1420],{"class":1412},[1402,3337,3338],{"class":1513},")            ",[1402,3340,3341],{"class":1614},"\u002F\u002F immutable once written\n",[1402,3343,3345,3347,3349,3351,3353,3355,3357,3360,3362,3364,3366,3368,3370,3372],{"class":1404,"line":3344},30,[1402,3346,3247],{"class":1408},[1402,3348,1413],{"class":1412},[1402,3350,3055],{"class":1513},[1402,3352,1517],{"class":1412},[1402,3354,3256],{"class":3060},[1402,3356,1920],{"class":1412},[1402,3358,3359],{"class":1513}," body",[1402,3361,1517],{"class":1412},[1402,3363,1413],{"class":1412},[1402,3365,3297],{"class":1416},[1402,3367,1920],{"class":1412},[1402,3369,2452],{"class":1416},[1402,3371,1420],{"class":1412},[1402,3373,2459],{"class":1412},[1402,3375,3377],{"class":1404,"line":3376},31,[1402,3378,2271],{"class":1412},[1402,3380,3382],{"class":1404,"line":3381},32,[1402,3383,1482],{"emptyLinePlaceholder":1481},[1402,3385,3387],{"class":1404,"line":3386},33,[1402,3388,3389],{"class":1614},"\u002F\u002F ─── POST \u002Fcredentials ─────────────────────────────────────────\n",[1402,3391,3393,3395,3397,3399,3402,3404,3406,3408,3410,3412,3414,3416,3418,3420,3422,3424,3426,3428,3430,3432,3434,3437,3439,3441,3443,3446,3448,3450,3453],{"class":1404,"line":3392},34,[1402,3394,2149],{"class":1408},[1402,3396,2964],{"class":1488},[1402,3398,2967],{"class":1488},[1402,3400,3401],{"class":1501}," handleCredentials",[1402,3403,1504],{"class":1412},[1402,3405,2975],{"class":2334},[1402,3407,1517],{"class":1412},[1402,3409,1413],{"class":1412},[1402,3411,2982],{"class":1513},[1402,3413,1517],{"class":1412},[1402,3415,2172],{"class":2155},[1402,3417,2412],{"class":1412},[1402,3419,2167],{"class":1513},[1402,3421,1517],{"class":1412},[1402,3423,2172],{"class":2155},[1402,3425,2412],{"class":1412},[1402,3427,3297],{"class":1513},[1402,3429,1517],{"class":1412},[1402,3431,2172],{"class":2155},[1402,3433,2412],{"class":1412},[1402,3435,3436],{"class":1513}," proof",[1402,3438,1517],{"class":1412},[1402,3440,2172],{"class":2155},[1402,3442,2412],{"class":1412},[1402,3444,3445],{"class":1513}," profile",[1402,3447,2209],{"class":1412},[1402,3449,2172],{"class":2155},[1402,3451,3452],{"class":1412}," })",[1402,3454,2159],{"class":1412},[1402,3456,3458,3460,3462,3464,3466,3468,3471,3473,3476,3478,3480,3482,3484,3486,3488,3490,3492,3494,3496,3499,3501,3503,3505,3507,3510,3512],{"class":1404,"line":3457},35,[1402,3459,3021],{"class":1408},[1402,3461,1137],{"class":1513},[1402,3463,2899],{"class":1412},[1402,3465,1504],{"class":1513},[1402,3467,1696],{"class":1408},[1402,3469,3470],{"class":1416}," rateLimiter",[1402,3472,1129],{"class":1412},[1402,3474,3475],{"class":1501},"allow",[1402,3477,1504],{"class":1513},[1402,3479,3191],{"class":1501},[1402,3481,1504],{"class":1513},[1402,3483,2975],{"class":1416},[1402,3485,1129],{"class":1412},[1402,3487,1218],{"class":1416},[1402,3489,1920],{"class":1412},[1402,3491,3204],{"class":1416},[1402,3493,1129],{"class":1412},[1402,3495,1221],{"class":1416},[1402,3497,3498],{"class":1513},")))) ",[1402,3500,3050],{"class":1408},[1402,3502,1413],{"class":1412},[1402,3504,3055],{"class":1513},[1402,3506,1517],{"class":1412},[1402,3508,3509],{"class":3060}," 429",[1402,3511,1420],{"class":1412},[1402,3513,3514],{"class":1614}," \u002F\u002F (c)\n",[1402,3516,3518],{"class":1404,"line":3517},36,[1402,3519,1482],{"emptyLinePlaceholder":1481},[1402,3521,3523],{"class":1404,"line":3522},37,[1402,3524,3525],{"class":1614},"  \u002F\u002F expiresAt is immutable per challenge once written, so reading it is safe\n",[1402,3527,3529],{"class":1404,"line":3528},38,[1402,3530,3531],{"class":1614},"  \u002F\u002F without coordination; only the delete below needs to be atomic.\n",[1402,3533,3535,3537,3539,3541,3543,3545,3547,3550,3552,3554,3556,3558],{"class":1404,"line":3534},39,[1402,3536,3078],{"class":1488},[1402,3538,2452],{"class":1416},[1402,3540,3088],{"class":1412},[1402,3542,1498],{"class":1408},[1402,3544,3317],{"class":1416},[1402,3546,1129],{"class":1412},[1402,3548,3549],{"class":1501},"peekExpiresAt",[1402,3551,1504],{"class":1513},[1402,3553,2975],{"class":1416},[1402,3555,1129],{"class":1412},[1402,3557,3327],{"class":1416},[1402,3559,1659],{"class":1513},[1402,3561,3563,3565,3568,3570,3572,3574,3576,3579,3581,3583,3585,3587,3590],{"class":1404,"line":3562},40,[1402,3564,3078],{"class":1488},[1402,3566,3567],{"class":1416}," burnedFresh",[1402,3569,3088],{"class":1412},[1402,3571,1498],{"class":1408},[1402,3573,3317],{"class":1416},[1402,3575,1129],{"class":1412},[1402,3577,3578],{"class":1501},"deleteIfPresent",[1402,3580,1504],{"class":1513},[1402,3582,2975],{"class":1416},[1402,3584,1129],{"class":1412},[1402,3586,3327],{"class":1416},[1402,3588,3589],{"class":1513},")  ",[1402,3591,3592],{"class":1614},"\u002F\u002F (b) burn ONCE, before any candidate loop\n",[1402,3594,3596,3598,3600,3602,3605,3607,3609,3612,3615,3618,3620,3622,3624,3626,3628],{"class":1404,"line":3595},41,[1402,3597,3021],{"class":1408},[1402,3599,1137],{"class":1513},[1402,3601,2899],{"class":1412},[1402,3603,3604],{"class":1416},"burnedFresh",[1402,3606,3030],{"class":1412},[1402,3608,2452],{"class":1416},[1402,3610,3611],{"class":1412}," ===",[1402,3613,3614],{"class":1412}," undefined",[1402,3616,3617],{"class":1513},") ",[1402,3619,3050],{"class":1408},[1402,3621,1413],{"class":1412},[1402,3623,3055],{"class":1513},[1402,3625,1517],{"class":1412},[1402,3627,3061],{"class":3060},[1402,3629,2459],{"class":1412},[1402,3631,3633],{"class":1404,"line":3632},42,[1402,3634,1482],{"emptyLinePlaceholder":1481},[1402,3636,3638,3640,3643,3645,3647,3649,3651,3654,3656,3658,3660,3662,3664,3666,3668,3670,3672,3674,3677],{"class":1404,"line":3637},43,[1402,3639,3078],{"class":1488},[1402,3641,3642],{"class":1416}," wrappedCandidates",[1402,3644,3088],{"class":1412},[1402,3646,1498],{"class":1408},[1402,3648,3181],{"class":1416},[1402,3650,1129],{"class":1412},[1402,3652,3653],{"class":1501},"allFor",[1402,3655,1504],{"class":1513},[1402,3657,3191],{"class":1501},[1402,3659,1504],{"class":1513},[1402,3661,2975],{"class":1416},[1402,3663,1129],{"class":1412},[1402,3665,1218],{"class":1416},[1402,3667,1920],{"class":1412},[1402,3669,3204],{"class":1416},[1402,3671,1129],{"class":1412},[1402,3673,1221],{"class":1416},[1402,3675,3676],{"class":1513},")) ",[1402,3678,3679],{"class":1614},"\u002F\u002F may hold old+new (d)\n",[1402,3681,3683,3686,3689,3691],{"class":1404,"line":3682},44,[1402,3684,3685],{"class":1488},"  let",[1402,3687,3688],{"class":1416}," ok",[1402,3690,3088],{"class":1412},[1402,3692,3694],{"class":3693},"sfNiH"," false\n",[1402,3696,3698,3701,3703,3705,3708,3711,3713,3715],{"class":1404,"line":3697},45,[1402,3699,3700],{"class":1408},"  for",[1402,3702,1137],{"class":1513},[1402,3704,1489],{"class":1488},[1402,3706,3707],{"class":1416}," wrapped",[1402,3709,3710],{"class":1412}," of",[1402,3712,3642],{"class":1416},[1402,3714,3617],{"class":1513},[1402,3716,1507],{"class":1412},[1402,3718,3720,3723,3725,3727,3729,3731,3733,3735,3737,3739,3741,3743,3745,3747,3749,3751,3753,3755,3757,3759,3761,3764,3766,3768,3770,3772,3774,3776],{"class":1404,"line":3719},46,[1402,3721,3722],{"class":1488},"    const",[1402,3724,1413],{"class":1412},[1402,3726,3124],{"class":1416},[1402,3728,1420],{"class":1412},[1402,3730,3088],{"class":1412},[1402,3732,1498],{"class":1408},[1402,3734,3093],{"class":1416},[1402,3736,1129],{"class":1412},[1402,3738,3098],{"class":1501},[1402,3740,1504],{"class":1513},[1402,3742,3103],{"class":1412},[1402,3744,2785],{"class":1501},[1402,3746,1504],{"class":1513},[1402,3748,2079],{"class":1412},[1402,3750,3083],{"class":1513},[1402,3752,1517],{"class":1412},[1402,3754,3129],{"class":1416},[1402,3756,1129],{"class":1412},[1402,3758,3134],{"class":1501},[1402,3760,1504],{"class":1513},[1402,3762,3763],{"class":1416},"wrapped",[1402,3765,1920],{"class":1412},[1402,3767,1426],{"class":1412},[1402,3769,3150],{"class":1429},[1402,3771,1541],{"class":1412},[1402,3773,3617],{"class":1513},[1402,3775,1656],{"class":1412},[1402,3777,3163],{"class":1513},[1402,3779,3781,3784,3786,3788,3790,3792],{"class":1404,"line":3780},47,[1402,3782,3783],{"class":1416},"    ok",[1402,3785,3088],{"class":1412},[1402,3787,1498],{"class":1408},[1402,3789,2756],{"class":1501},[1402,3791,1504],{"class":1513},[1402,3793,1507],{"class":1412},[1402,3795,3797,3800,3802,3804,3806,3808,3811,3813],{"class":1404,"line":3796},48,[1402,3798,3799],{"class":1501},"      consumeChallenge",[1402,3801,1517],{"class":1412},[1402,3803,2964],{"class":1488},[1402,3805,1632],{"class":1412},[1402,3807,1635],{"class":1488},[1402,3809,3810],{"class":3693}," true",[1402,3812,1920],{"class":1412},[1402,3814,3815],{"class":1614},"                  \u002F\u002F already burned above — trivially fresh\n",[1402,3817,3819,3822,3824,3826,3829,3831,3834,3836,3838],{"class":1404,"line":3818},49,[1402,3820,3821],{"class":1513},"      registeredProofKey",[1402,3823,1517],{"class":1412},[1402,3825,2847],{"class":1412},[1402,3827,3828],{"class":1501}," Uint8Array",[1402,3830,1504],{"class":1513},[1402,3832,3833],{"class":1416},"Plaintext",[1402,3835,2899],{"class":1412},[1402,3837,1141],{"class":1513},[1402,3839,1525],{"class":1412},[1402,3841,3843,3846,3848,3850,3852,3854,3856,3859,3861,3863,3865,3867,3869,3871,3873,3875,3877,3879],{"class":1404,"line":3842},50,[1402,3844,3845],{"class":1513},"      vaultId",[1402,3847,1517],{"class":1412},[1402,3849,3204],{"class":1416},[1402,3851,1129],{"class":1412},[1402,3853,1218],{"class":1416},[1402,3855,1920],{"class":1412},[1402,3857,3858],{"class":1513}," endpointOrigin",[1402,3860,1517],{"class":1412},[1402,3862,1426],{"class":1412},[1402,3864,1604],{"class":1429},[1402,3866,1541],{"class":1412},[1402,3868,1920],{"class":1412},[1402,3870,2167],{"class":1513},[1402,3872,1517],{"class":1412},[1402,3874,3204],{"class":1416},[1402,3876,1129],{"class":1412},[1402,3878,1221],{"class":1416},[1402,3880,1525],{"class":1412},[1402,3882,3884,3887,3889,3891,3893,3895,3897,3899,3901,3903,3905,3907,3909,3911,3913,3915,3917,3919,3921,3924],{"class":1404,"line":3883},51,[1402,3885,3886],{"class":1513},"      profile",[1402,3888,1517],{"class":1412},[1402,3890,3204],{"class":1416},[1402,3892,1129],{"class":1412},[1402,3894,1016],{"class":1416},[1402,3896,1920],{"class":1412},[1402,3898,3297],{"class":1513},[1402,3900,1517],{"class":1412},[1402,3902,3204],{"class":1416},[1402,3904,1129],{"class":1412},[1402,3906,3327],{"class":1416},[1402,3908,1920],{"class":1412},[1402,3910,2452],{"class":1416},[1402,3912,1920],{"class":1412},[1402,3914,3436],{"class":1513},[1402,3916,1517],{"class":1412},[1402,3918,3204],{"class":1416},[1402,3920,1129],{"class":1412},[1402,3922,3923],{"class":1416},"proof",[1402,3925,1525],{"class":1412},[1402,3927,3929,3932],{"class":1404,"line":3928},52,[1402,3930,3931],{"class":1412},"    }",[1402,3933,1659],{"class":1513},[1402,3935,3937,3940,3942,3945,3947],{"class":1404,"line":3936},53,[1402,3938,3939],{"class":1408},"    if",[1402,3941,1137],{"class":1513},[1402,3943,3944],{"class":1416},"ok",[1402,3946,3617],{"class":1513},[1402,3948,3949],{"class":1408},"break\n",[1402,3951,3953],{"class":1404,"line":3952},54,[1402,3954,3955],{"class":1412},"  }\n",[1402,3957,3959,3961,3963,3965,3967,3969,3971,3973,3975,3977,3979],{"class":1404,"line":3958},55,[1402,3960,3021],{"class":1408},[1402,3962,1137],{"class":1513},[1402,3964,2899],{"class":1412},[1402,3966,3944],{"class":1416},[1402,3968,3617],{"class":1513},[1402,3970,3050],{"class":1408},[1402,3972,1413],{"class":1412},[1402,3974,3055],{"class":1513},[1402,3976,1517],{"class":1412},[1402,3978,3061],{"class":3060},[1402,3980,2459],{"class":1412},[1402,3982,3984],{"class":1404,"line":3983},56,[1402,3985,1482],{"emptyLinePlaceholder":1481},[1402,3987,3989,3991,3993,3996,3998,4000,4002,4005,4007,4009,4011,4013,4015,4017],{"class":1404,"line":3988},57,[1402,3990,3078],{"class":1488},[1402,3992,1413],{"class":1412},[1402,3994,3995],{"class":1416}," Credentials",[1402,3997,1420],{"class":1412},[1402,3999,3088],{"class":1412},[1402,4001,1498],{"class":1408},[1402,4003,4004],{"class":1416}," sts",[1402,4006,1129],{"class":1412},[1402,4008,3098],{"class":1501},[1402,4010,1504],{"class":1513},[1402,4012,3103],{"class":1412},[1402,4014,2810],{"class":1501},[1402,4016,1504],{"class":1513},[1402,4018,1507],{"class":1412},[1402,4020,4022,4025,4027,4030,4032,4034,4036,4038,4040],{"class":1404,"line":4021},58,[1402,4023,4024],{"class":1513},"    RoleArn",[1402,4026,1517],{"class":1412},[1402,4028,4029],{"class":1501}," roleForProfile",[1402,4031,1504],{"class":1513},[1402,4033,2975],{"class":1416},[1402,4035,1129],{"class":1412},[1402,4037,1016],{"class":1416},[1402,4039,1141],{"class":1513},[1402,4041,1525],{"class":1412},[1402,4043,4045,4048,4050,4053,4056,4058,4060,4062,4064,4067,4069,4072,4074,4077,4079,4082,4084],{"class":1404,"line":4044},59,[1402,4046,4047],{"class":1513},"    RoleSessionName",[1402,4049,1517],{"class":1412},[1402,4051,4052],{"class":1412}," `",[1402,4054,4055],{"class":1429},"broker-",[1402,4057,2943],{"class":1412},[1402,4059,2975],{"class":1416},[1402,4061,1129],{"class":1412},[1402,4063,1218],{"class":1416},[1402,4065,4066],{"class":1412},"}`",[1402,4068,1129],{"class":1412},[1402,4070,4071],{"class":1501},"slice",[1402,4073,1504],{"class":1513},[1402,4075,4076],{"class":3060},"0",[1402,4078,1920],{"class":1412},[1402,4080,4081],{"class":3060}," 64",[1402,4083,1141],{"class":1513},[1402,4085,1525],{"class":1412},[1402,4087,4089,4092,4094,4097,4099,4102,4104,4106,4109,4111,4113,4116,4118,4120,4122,4124,4126,4129],{"class":1404,"line":4088},60,[1402,4090,4091],{"class":1513},"    Tags",[1402,4093,1517],{"class":1412},[1402,4095,4096],{"class":1513}," [",[1402,4098,2079],{"class":1412},[1402,4100,4101],{"class":1513}," Key",[1402,4103,1517],{"class":1412},[1402,4105,1426],{"class":1412},[1402,4107,4108],{"class":1429},"noydbVault",[1402,4110,1541],{"class":1412},[1402,4112,1920],{"class":1412},[1402,4114,4115],{"class":1513}," Value",[1402,4117,1517],{"class":1412},[1402,4119,3204],{"class":1416},[1402,4121,1129],{"class":1412},[1402,4123,1218],{"class":1416},[1402,4125,1420],{"class":1412},[1402,4127,4128],{"class":1513},"]",[1402,4130,1525],{"class":1412},[1402,4132,4134,4137,4139,4142,4144,4146,4148,4150,4152,4154],{"class":1404,"line":4133},61,[1402,4135,4136],{"class":1513},"    Policy",[1402,4138,1517],{"class":1412},[1402,4140,4141],{"class":1501}," scopedSessionPolicy",[1402,4143,1504],{"class":1513},[1402,4145,2975],{"class":1416},[1402,4147,1129],{"class":1412},[1402,4149,1218],{"class":1416},[1402,4151,1141],{"class":1513},[1402,4153,1920],{"class":1412},[1402,4155,4156],{"class":1614},"              \u002F\u002F dynamodb:LeadingKeys \u002F S3 prefix on the vault id\n",[1402,4158,4160,4163,4165,4168],{"class":1404,"line":4159},62,[1402,4161,4162],{"class":1513},"    DurationSeconds",[1402,4164,1517],{"class":1412},[1402,4166,4167],{"class":3060}," 3600",[1402,4169,1525],{"class":1412},[1402,4171,4173,4175],{"class":1404,"line":4172},63,[1402,4174,1646],{"class":1412},[1402,4176,3163],{"class":1513},[1402,4178,4180,4182],{"class":1404,"line":4179},64,[1402,4181,3247],{"class":1408},[1402,4183,2159],{"class":1412},[1402,4185,4187,4190,4192,4194],{"class":1404,"line":4186},65,[1402,4188,4189],{"class":1513},"    statusCode",[1402,4191,1517],{"class":1412},[1402,4193,3256],{"class":3060},[1402,4195,1525],{"class":1412},[1402,4197,4199,4202,4204],{"class":1404,"line":4198},66,[1402,4200,4201],{"class":1513},"    body",[1402,4203,1517],{"class":1412},[1402,4205,2159],{"class":1412},[1402,4207,4209,4212,4214,4216,4218,4220,4222,4224,4226,4228,4231,4234,4236,4238,4240,4242,4244,4247],{"class":1404,"line":4208},67,[1402,4210,4211],{"class":1513},"      kind",[1402,4213,1517],{"class":1412},[1402,4215,1426],{"class":1412},[1402,4217,2407],{"class":1429},[1402,4219,1541],{"class":1412},[1402,4221,1920],{"class":1412},[1402,4223,2417],{"class":1513},[1402,4225,1517],{"class":1412},[1402,4227,3995],{"class":1416},[1402,4229,4230],{"class":1412},"!.",[1402,4232,4233],{"class":1416},"AccessKeyId",[1402,4235,1920],{"class":1412},[1402,4237,2428],{"class":1513},[1402,4239,1517],{"class":1412},[1402,4241,3995],{"class":1416},[1402,4243,4230],{"class":1412},[1402,4245,4246],{"class":1416},"SecretAccessKey",[1402,4248,1525],{"class":1412},[1402,4250,4252,4255,4257,4259,4261,4264,4266,4268,4270,4272,4274,4277,4279,4282,4284],{"class":1404,"line":4251},68,[1402,4253,4254],{"class":1513},"      sessionToken",[1402,4256,1517],{"class":1412},[1402,4258,3995],{"class":1416},[1402,4260,4230],{"class":1412},[1402,4262,4263],{"class":1416},"SessionToken",[1402,4265,1920],{"class":1412},[1402,4267,2452],{"class":1513},[1402,4269,1517],{"class":1412},[1402,4271,3995],{"class":1416},[1402,4273,4230],{"class":1412},[1402,4275,4276],{"class":1416},"Expiration",[1402,4278,4230],{"class":1412},[1402,4280,4281],{"class":1501},"toISOString",[1402,4283,1522],{"class":1513},[1402,4285,1525],{"class":1412},[1402,4287,4289],{"class":1404,"line":4288},69,[1402,4290,4291],{"class":1412},"    },\n",[1402,4293,4295],{"class":1404,"line":4294},70,[1402,4296,3955],{"class":1412},[1402,4298,4300],{"class":1404,"line":4299},71,[1402,4301,2271],{"class":1412},[941,4303,4305],{"id":4304},"pairs-well-with","Pairs well with",[991,4307,4308,4332],{},[994,4309,4310,4314,4315,1728,4318,4321,4322,1728,4324,4327,4328,4331],{},[980,4311,4312],{"href":869},[959,4313,868],{}," — role gating (",[959,4316,4317],{},"owner",[959,4319,4320],{},"admin"," only for ",[959,4323,1710],{},[959,4325,4326],{},"rotate",") reuses the\nsame keyring roles ",[959,4329,4330],{},"withTeam()"," grants.",[994,4333,4334,4338,4339,4342,4343,4346],{},[980,4335,4336],{"href":841},[959,4337,840],{}," — a broker-fronted app typically also gates ",[971,4340,4341],{},"app"," sessions with\n",[959,4344,4345],{},"withSession()","; the two are independent (broker gates cloud-store access, session gates\napp-level tokens).",[941,4348,4350],{"id":4349},"edge-cases-limits","Edge cases & limits",[991,4352,4353,4370,4380,4398,4421,4433],{},[994,4354,4355,1103,4360,4363,4364,4366,4367,4369],{},[950,4356,4357,4359],{},[959,4358,961],{}," is not a normal collection.",[959,4361,4362],{},"vault.collection('_broker')"," throws a\nreserved-collection error — the seed is reachable only through ",[959,4365,2356],{},". A granted\nsub-admin keyring (operator, viewer, client) never receives the ",[959,4368,961],{}," DEK, so it cannot\ndecrypt the seed even with API access to everything else; only owner\u002Fadmin grantees do.",[994,4371,4372,4375,4376,4379],{},[950,4373,4374],{},"Enrol vs. use."," First-ever seed creation needs the vault's KEK (throws ",[959,4377,4378],{},"BrokerEnrolmentError"," —\n\"re-authenticate\" — on a DEK-only keyring, e.g. mid PIN quick-resume). Using an already-enrolled\nseed to mint credentials needs only the DEK.",[994,4381,4382,4385,4386,4389,4390,4393,4394,4397],{},[950,4383,4384],{},"Offline \u002F broker-down."," A network failure or an unreachable host surfaces ",[959,4387,4388],{},"NetworkError"," from\n",[959,4391,4392],{},"credentialSource()","; a rejected proof surfaces ",[959,4395,4396],{},"BrokerProofError",". Both are treated as\noffline-degradable by a syncing store — local writes queue, nothing is lost.",[994,4399,4400,4409,4410,4412,4413,4415,4416,4418,4419,1129],{},[950,4401,4402,4404,4405,4408],{},[959,4403,1016],{}," and ",[959,4406,4407],{},"endpointOrigin"," are bound into the MAC."," A proof captured at one ",[959,4411,1016],{}," (e.g.\n",[959,4414,1020],{},") cannot be replayed at another (",[959,4417,1024],{},"); a proof cannot be relayed to a different\nbroker endpoint reusing the same ",[959,4420,1221],{},[994,4422,4423,4429,4430,4432],{},[950,4424,4425,4428],{},[959,4426,4427],{},"kind: 'token'"," stores"," (postgres\u002Fturso\u002Fsupabase\u002Fwebdav) are not wired yet — the\n",[959,4431,2368],{}," type reserves the shape, but no store owns its refresh loop for it today.",[994,4434,4435,4438],{},[950,4436,4437],{},"Sealed-to-instance delivery"," (encrypting the credential response to a specific device's\nkeypair) is a deferred future slice.",[941,4440,4442],{"id":4441},"see-also","See also",[991,4444,4445,4456,4467],{},[994,4446,4447,4404,4451,4455],{},[980,4448,4449],{"href":686},[959,4450,685],{},[980,4452,4453],{"href":865},[959,4454,864],{}," — how offline-degradable writes queue\nwhen the broker or store is unreachable.",[994,4457,4458,4462,4463,1728,4465,1129],{},[980,4459,4460],{"href":869},[959,4461,868],{}," — the keyring roles that gate ",[959,4464,1710],{},[959,4466,4326],{},[994,4468,4469,4470,1129],{},"Proven by showcase ",[980,4471,4475],{"href":4472,"rel":4473},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Fshowcases\u002Fsrc\u002F97-broker-aws.showcase.test.ts",[4474],"nofollow",[959,4476,1723],{},[4478,4479,4480],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":1398,"searchDepth":1457,"depth":1457,"links":4482},[4483,4484,4485,4486,4487,4488,4489,4490,4491,4492,4493,4494,4495,4496],{"id":943,"depth":1436,"text":944},{"id":988,"depth":1436,"text":989},{"id":1028,"depth":1436,"text":1029},{"id":1209,"depth":1436,"text":1210},{"id":1336,"depth":1436,"text":1337},{"id":1390,"depth":1436,"text":1391},{"id":1716,"depth":1436,"text":1717},{"id":2138,"depth":1436,"text":2139},{"id":2507,"depth":1436,"text":2508},{"id":2629,"depth":1436,"text":2630},{"id":2659,"depth":1436,"text":2660},{"id":4304,"depth":1436,"text":4305},{"id":4349,"depth":1436,"text":4350},{"id":4441,"depth":1436,"text":4442},null,"The credential broker: a secret-bound client obtains short-lived, auto-rotating cloud-storage credentials without ever holding a long-lived secret.","md",{},"service",{"title":625,"description":4498},"0.3.0-pre.11","stable","Secret-bound rolling store credentials — short-lived cloud access with no long-lived secret in the client","advanced","Wi7FMH4sOeomfDv2MhIjTdaLgUqcYvBVycQqaHDHDVs",{"data":4509,"body":4510},{},{"type":4511,"children":4512},"root",[4513],{"type":4514,"tag":946,"props":4515,"children":4516},"element",{},[4517],{"type":4514,"tag":959,"props":4518,"children":4520},{"className":4519},[],[4521],{"type":4522,"value":4523},"text","with-party",{"data":4525,"body":4526},{},{"type":4511,"children":4527},[4528],{"type":4514,"tag":946,"props":4529,"children":4530},{},[4531],{"type":4522,"value":4532},"G — Collaboration & Auth",{"data":4534,"body":4535},{},{"type":4511,"children":4536},[4537],{"type":4514,"tag":946,"props":4538,"children":4539},{},[4540],{"type":4514,"tag":959,"props":4541,"children":4543},{"className":4542},[],[4544],{"type":4522,"value":1452},{"data":4546,"body":4547},{},{"type":4511,"children":4548},[4549],{"type":4514,"tag":946,"props":4550,"children":4551},{},[4552],{"type":4514,"tag":959,"props":4553,"children":4555},{"className":4554},[],[4556],{"type":4522,"value":4557},"withBroker(config)",{"data":4559,"body":4560},{},{"type":4511,"children":4561},[4562],{"type":4514,"tag":946,"props":4563,"children":4564},{},[4565],{"type":4522,"value":4566},"~500 (off-bundle when not opted in)",1791896591004]