[{"data":1,"prerenderedAt":3183},["ShallowReactive",2],{"navigation":3,"\u002Fservices\u002Fpolicy":927,"mdc-8bt02u-key":3144,"mdc-3a7z3d-key":3161},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":796,"access":12,"apiToc":929,"body":930,"category":3135,"description":3136,"extension":3137,"meta":3138,"navigation":3135,"nest":3139,"path":797,"seo":3140,"sinceVersion":3135,"status":3141,"stem":798,"subtitle":3135,"tier":3142,"tocExternal":3135,"__hash__":3143},"docs\u002Fservices\u002Fpolicy.md",false,{"type":931,"value":932,"toc":3110},"minimark",[933,936,940,945,967,1006,1013,1017,1033,1279,1298,1302,1307,1317,1552,1578,1667,1671,1807,1819,1823,1832,1940,1944,1949,2016,2025,2030,2115,2202,2218,2223,2287,2292,2416,2419,2428,2531,2567,2575,2647,2654,2872,2880,2884,2921,2925,2959,2963,3061,3065,3106],[934,935,796],"h1",{"id":796},[937,938],"service-meta",{":rows":939},"[{\"label\":\"Subpath\",\"value\":\"`@noy-db\u002Fhub` (root export)\"},{\"label\":\"Type\",\"value\":\"Core feature — every vault has a policy from creation; configured via the `policy` option on `createNoydb()`.\"}]",[941,942,944],"h2",{"id":943},"what-it-does","What it does",[946,947,948,949,952,953,957,958,962,963,966],"p",{},"Some operations on a vault are more dangerous than others — rotating the secret, exporting\nplaintext, enrolling a new authenticator, granting or revoking a user. ",[950,951,796],"code",{}," lets you declare,\nper operation, the minimum authentication strength required before that operation is allowed to\nrun: a minimum ",[954,955,956],"strong",{},"session tier"," (how the caller unlocked the vault — secret, routine\nlogin, or quick-resume PIN; see ",[959,960,844],"a",{"href":961},".\u002Fsession-tiers",") and, optionally, extra\n",[954,964,965],{},"factor proofs"," (a fresh TOTP code, an emailed one-time code, a recovery code, …) presented at\nthe moment of the call.",[946,968,969,970,973,974,977,978,981,982,985,986,989,990,993,994,997,998,981,1000,1002,1003,1005],{},"Each guarded operation is called a ",[954,971,972],{},"gate",". A gate has a name (",[950,975,976],{},"'rotate-secret'",",\n",[950,979,980],{},"'export-plaintext'",", ",[950,983,984],{},"'enroll-user'",", …) and a ",[950,987,988],{},"GatePolicy"," — the rule that decides whether a\ngiven call is allowed. The full set of gates for a vault is a ",[950,991,992],{},"VaultPolicy",", persisted once at\n",[950,995,996],{},"_meta\u002Fpolicy"," on first vault creation. ",[950,999,840],{},[950,1001,872],{},", and ",[950,1004,868],{}," build their\nre-authentication prompts and permission checks on top of this same gate-check enforcement.",[946,1007,1008,1009,1012],{},"There is nothing to opt into — every vault has a policy from the moment it's created. If you pass\nnone, noy-db uses a sensible default (",[950,1010,1011],{},"PERSONAL_POLICY","); you only need to reach for the API below\nwhen you want to change the defaults or check a gate yourself.",[941,1014,1016],{"id":1015},"setup","Setup",[946,1018,1019,1021,1022,1025,1026,1028,1029,1032],{},[950,1020,796],{}," has no ",[950,1023,1024],{},"with*()"," strategy — pass a ",[950,1027,992],{}," directly to ",[950,1030,1031],{},"createNoydb()",". Start from\none of the two built-in presets and override only the gates you need to change:",[1034,1035,1040],"pre",{"className":1036,"code":1037,"language":1038,"meta":1039,"style":1039},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb, STRICT_POLICY, mergePolicy } from '@noy-db\u002Fhub'\n\nconst db = await createNoydb({\n  store,\n  user: 'u1',\n  \u002F\u002F STRICT_POLICY, with one extra app-defined gate layered on top.\n  policy: mergePolicy(STRICT_POLICY, {\n    gates: {\n      'app:approve-large-payment': {\n        minTier: 2,\n        factors: [{ anyOf: ['totp'] }],\n      },\n    },\n  }),\n})\n","ts","",[950,1041,1042,1086,1093,1118,1126,1146,1153,1171,1181,1196,1210,1248,1254,1260,1271],{"__ignoreMap":1039},[1043,1044,1047,1051,1055,1059,1062,1065,1067,1070,1073,1076,1079,1083],"span",{"class":1045,"line":1046},"line",1,[1043,1048,1050],{"class":1049},"s7zQu","import",[1043,1052,1054],{"class":1053},"sMK4o"," {",[1043,1056,1058],{"class":1057},"sTEyZ"," createNoydb",[1043,1060,1061],{"class":1053},",",[1043,1063,1064],{"class":1057}," STRICT_POLICY",[1043,1066,1061],{"class":1053},[1043,1068,1069],{"class":1057}," mergePolicy",[1043,1071,1072],{"class":1053}," }",[1043,1074,1075],{"class":1049}," from",[1043,1077,1078],{"class":1053}," '",[1043,1080,1082],{"class":1081},"sfazB","@noy-db\u002Fhub",[1043,1084,1085],{"class":1053},"'\n",[1043,1087,1089],{"class":1045,"line":1088},2,[1043,1090,1092],{"emptyLinePlaceholder":1091},true,"\n",[1043,1094,1096,1100,1103,1106,1109,1112,1115],{"class":1045,"line":1095},3,[1043,1097,1099],{"class":1098},"spNyl","const",[1043,1101,1102],{"class":1057}," db ",[1043,1104,1105],{"class":1053},"=",[1043,1107,1108],{"class":1049}," await",[1043,1110,1058],{"class":1111},"s2Zo4",[1043,1113,1114],{"class":1057},"(",[1043,1116,1117],{"class":1053},"{\n",[1043,1119,1121,1124],{"class":1045,"line":1120},4,[1043,1122,1123],{"class":1057},"  store",[1043,1125,977],{"class":1053},[1043,1127,1129,1133,1136,1138,1141,1144],{"class":1045,"line":1128},5,[1043,1130,1132],{"class":1131},"swJcz","  user",[1043,1134,1135],{"class":1053},":",[1043,1137,1078],{"class":1053},[1043,1139,1140],{"class":1081},"u1",[1043,1142,1143],{"class":1053},"'",[1043,1145,977],{"class":1053},[1043,1147,1149],{"class":1045,"line":1148},6,[1043,1150,1152],{"class":1151},"sHwdD","  \u002F\u002F STRICT_POLICY, with one extra app-defined gate layered on top.\n",[1043,1154,1156,1159,1161,1163,1166,1168],{"class":1045,"line":1155},7,[1043,1157,1158],{"class":1131},"  policy",[1043,1160,1135],{"class":1053},[1043,1162,1069],{"class":1111},[1043,1164,1165],{"class":1057},"(STRICT_POLICY",[1043,1167,1061],{"class":1053},[1043,1169,1170],{"class":1053}," {\n",[1043,1172,1174,1177,1179],{"class":1045,"line":1173},8,[1043,1175,1176],{"class":1131},"    gates",[1043,1178,1135],{"class":1053},[1043,1180,1170],{"class":1053},[1043,1182,1184,1187,1190,1192,1194],{"class":1045,"line":1183},9,[1043,1185,1186],{"class":1053},"      '",[1043,1188,1189],{"class":1131},"app:approve-large-payment",[1043,1191,1143],{"class":1053},[1043,1193,1135],{"class":1053},[1043,1195,1170],{"class":1053},[1043,1197,1199,1202,1204,1208],{"class":1045,"line":1198},10,[1043,1200,1201],{"class":1131},"        minTier",[1043,1203,1135],{"class":1053},[1043,1205,1207],{"class":1206},"sbssI"," 2",[1043,1209,977],{"class":1053},[1043,1211,1213,1216,1218,1221,1224,1227,1229,1231,1233,1235,1237,1240,1243,1246],{"class":1045,"line":1212},11,[1043,1214,1215],{"class":1131},"        factors",[1043,1217,1135],{"class":1053},[1043,1219,1220],{"class":1057}," [",[1043,1222,1223],{"class":1053},"{",[1043,1225,1226],{"class":1131}," anyOf",[1043,1228,1135],{"class":1053},[1043,1230,1220],{"class":1057},[1043,1232,1143],{"class":1053},[1043,1234,333],{"class":1081},[1043,1236,1143],{"class":1053},[1043,1238,1239],{"class":1057},"] ",[1043,1241,1242],{"class":1053},"}",[1043,1244,1245],{"class":1057},"]",[1043,1247,977],{"class":1053},[1043,1249,1251],{"class":1045,"line":1250},12,[1043,1252,1253],{"class":1053},"      },\n",[1043,1255,1257],{"class":1045,"line":1256},13,[1043,1258,1259],{"class":1053},"    },\n",[1043,1261,1263,1266,1269],{"class":1045,"line":1262},14,[1043,1264,1265],{"class":1053},"  }",[1043,1267,1268],{"class":1057},")",[1043,1270,977],{"class":1053},[1043,1272,1274,1276],{"class":1045,"line":1273},15,[1043,1275,1242],{"class":1053},[1043,1277,1278],{"class":1057},")\n",[946,1280,1281,1282,1284,1285,1287,1288,1290,1291,1293,1294,1297],{},"If you omit ",[950,1283,796],{}," entirely, noy-db persists ",[950,1286,1011],{}," on first vault creation. The\non-disk document is the source of truth after that: the ",[950,1289,796],{}," option only takes effect the\nfirst time a vault is created, not on every ",[950,1292,1031],{}," call. Change it later with\n",[950,1295,1296],{},"db.updatePolicy()",".",[941,1299,1301],{"id":1300},"usage","Usage",[1303,1304,1306],"h3",{"id":1305},"_1-check-a-gate-before-calling-a-guarded-method","1. Check a gate before calling a guarded method",[946,1308,1309,1312,1313,1316],{},[950,1310,1311],{},"db.checkGate(vault, gate, factors?)"," evaluates a gate against the vault's current session tier\nand the factor proofs you present, without performing any other action. Use it to pre-flight a UI\n(\"do I need to ask for a TOTP code before showing the export button?\") or to guard your own\n",[950,1314,1315],{},"app:*"," actions.",[1034,1318,1320],{"className":1036,"code":1319,"language":1038,"meta":1039,"style":1039},"import { PolicyDeniedError } from '@noy-db\u002Fhub'\n\ntry {\n  await db.checkGate('books', 'export-plaintext', {\n    factors: [{ kind: 'totp', mintedAt: new Date().toISOString() }],\n  })\n  \u002F\u002F → resolves with undefined: allowed\n} catch (err) {\n  if (err instanceof PolicyDeniedError) {\n    \u002F\u002F → err.reason: 'insufficient-tier' | 'missing-factor' | 'stale-proof'\n    \u002F\u002F               | 'disabled' | 'shared-device-blocked'\n    \u002F\u002F → err.required: the GatePolicy the caller failed to satisfy\n    console.log(`denied: ${err.reason}`, err.required)\n  }\n}\n",[950,1321,1322,1341,1345,1352,1387,1439,1445,1450,1462,1484,1489,1494,1499,1542,1547],{"__ignoreMap":1039},[1043,1323,1324,1326,1328,1331,1333,1335,1337,1339],{"class":1045,"line":1046},[1043,1325,1050],{"class":1049},[1043,1327,1054],{"class":1053},[1043,1329,1330],{"class":1057}," PolicyDeniedError",[1043,1332,1072],{"class":1053},[1043,1334,1075],{"class":1049},[1043,1336,1078],{"class":1053},[1043,1338,1082],{"class":1081},[1043,1340,1085],{"class":1053},[1043,1342,1343],{"class":1045,"line":1088},[1043,1344,1092],{"emptyLinePlaceholder":1091},[1043,1346,1347,1350],{"class":1045,"line":1095},[1043,1348,1349],{"class":1049},"try",[1043,1351,1170],{"class":1053},[1043,1353,1354,1357,1360,1362,1365,1367,1369,1372,1374,1376,1378,1381,1383,1385],{"class":1045,"line":1120},[1043,1355,1356],{"class":1049},"  await",[1043,1358,1359],{"class":1057}," db",[1043,1361,1297],{"class":1053},[1043,1363,1364],{"class":1111},"checkGate",[1043,1366,1114],{"class":1131},[1043,1368,1143],{"class":1053},[1043,1370,1371],{"class":1081},"books",[1043,1373,1143],{"class":1053},[1043,1375,1061],{"class":1053},[1043,1377,1078],{"class":1053},[1043,1379,1380],{"class":1081},"export-plaintext",[1043,1382,1143],{"class":1053},[1043,1384,1061],{"class":1053},[1043,1386,1170],{"class":1053},[1043,1388,1389,1392,1394,1396,1398,1401,1403,1405,1407,1409,1411,1414,1416,1419,1422,1425,1427,1430,1433,1435,1437],{"class":1045,"line":1128},[1043,1390,1391],{"class":1131},"    factors",[1043,1393,1135],{"class":1053},[1043,1395,1220],{"class":1131},[1043,1397,1223],{"class":1053},[1043,1399,1400],{"class":1131}," kind",[1043,1402,1135],{"class":1053},[1043,1404,1078],{"class":1053},[1043,1406,333],{"class":1081},[1043,1408,1143],{"class":1053},[1043,1410,1061],{"class":1053},[1043,1412,1413],{"class":1131}," mintedAt",[1043,1415,1135],{"class":1053},[1043,1417,1418],{"class":1053}," new",[1043,1420,1421],{"class":1111}," Date",[1043,1423,1424],{"class":1131},"()",[1043,1426,1297],{"class":1053},[1043,1428,1429],{"class":1111},"toISOString",[1043,1431,1432],{"class":1131},"() ",[1043,1434,1242],{"class":1053},[1043,1436,1245],{"class":1131},[1043,1438,977],{"class":1053},[1043,1440,1441,1443],{"class":1045,"line":1148},[1043,1442,1265],{"class":1053},[1043,1444,1278],{"class":1131},[1043,1446,1447],{"class":1045,"line":1155},[1043,1448,1449],{"class":1151},"  \u002F\u002F → resolves with undefined: allowed\n",[1043,1451,1452,1454,1457,1460],{"class":1045,"line":1173},[1043,1453,1242],{"class":1053},[1043,1455,1456],{"class":1049}," catch",[1043,1458,1459],{"class":1057}," (err) ",[1043,1461,1117],{"class":1053},[1043,1463,1464,1467,1470,1473,1476,1479,1482],{"class":1045,"line":1183},[1043,1465,1466],{"class":1049},"  if",[1043,1468,1469],{"class":1131}," (",[1043,1471,1472],{"class":1057},"err",[1043,1474,1475],{"class":1053}," instanceof",[1043,1477,1330],{"class":1478},"sBMFI",[1043,1480,1481],{"class":1131},") ",[1043,1483,1117],{"class":1053},[1043,1485,1486],{"class":1045,"line":1198},[1043,1487,1488],{"class":1151},"    \u002F\u002F → err.reason: 'insufficient-tier' | 'missing-factor' | 'stale-proof'\n",[1043,1490,1491],{"class":1045,"line":1212},[1043,1492,1493],{"class":1151},"    \u002F\u002F               | 'disabled' | 'shared-device-blocked'\n",[1043,1495,1496],{"class":1045,"line":1250},[1043,1497,1498],{"class":1151},"    \u002F\u002F → err.required: the GatePolicy the caller failed to satisfy\n",[1043,1500,1501,1504,1506,1509,1511,1514,1517,1520,1522,1524,1527,1530,1532,1535,1537,1540],{"class":1045,"line":1256},[1043,1502,1503],{"class":1057},"    console",[1043,1505,1297],{"class":1053},[1043,1507,1508],{"class":1111},"log",[1043,1510,1114],{"class":1131},[1043,1512,1513],{"class":1053},"`",[1043,1515,1516],{"class":1081},"denied: ",[1043,1518,1519],{"class":1053},"${",[1043,1521,1472],{"class":1057},[1043,1523,1297],{"class":1053},[1043,1525,1526],{"class":1057},"reason",[1043,1528,1529],{"class":1053},"}`",[1043,1531,1061],{"class":1053},[1043,1533,1534],{"class":1057}," err",[1043,1536,1297],{"class":1053},[1043,1538,1539],{"class":1057},"required",[1043,1541,1278],{"class":1131},[1043,1543,1544],{"class":1045,"line":1262},[1043,1545,1546],{"class":1053},"  }\n",[1043,1548,1549],{"class":1045,"line":1273},[1043,1550,1551],{"class":1053},"}\n",[946,1553,1554,1555,981,1558,981,1561,1564,1565,1568,1569,1571,1572,1574,1575,1135],{},"Built-in gated methods (",[950,1556,1557],{},"db.rotateSecret",[950,1559,1560],{},"db.enrollAuthenticator",[950,1562,1563],{},"db.updateUser",", …) take\nthe same ",[950,1566,1567],{},"FactorProofBundle"," as their last argument and run through ",[950,1570,1364],{}," internally, so you\nusually don't call ",[950,1573,1364],{}," directly for those — just pass ",[950,1576,1577],{},"factors",[1034,1579,1581],{"className":1036,"code":1580,"language":1038,"meta":1039,"style":1039},"await db.team.rotateSecret(\n  'books',\n  { newSecret: 'glasses cabinet bicycle umbrella thunder velvet' },\n  { factors: [{ kind: 'totp' }] },\n)\n",[950,1582,1583,1602,1613,1633,1663],{"__ignoreMap":1039},[1043,1584,1585,1588,1590,1592,1594,1596,1599],{"class":1045,"line":1046},[1043,1586,1587],{"class":1049},"await",[1043,1589,1359],{"class":1057},[1043,1591,1297],{"class":1053},[1043,1593,868],{"class":1057},[1043,1595,1297],{"class":1053},[1043,1597,1598],{"class":1111},"rotateSecret",[1043,1600,1601],{"class":1057},"(\n",[1043,1603,1604,1607,1609,1611],{"class":1045,"line":1088},[1043,1605,1606],{"class":1053},"  '",[1043,1608,1371],{"class":1081},[1043,1610,1143],{"class":1053},[1043,1612,977],{"class":1053},[1043,1614,1615,1618,1621,1623,1625,1628,1630],{"class":1045,"line":1095},[1043,1616,1617],{"class":1053},"  {",[1043,1619,1620],{"class":1131}," newSecret",[1043,1622,1135],{"class":1053},[1043,1624,1078],{"class":1053},[1043,1626,1627],{"class":1081},"glasses cabinet bicycle umbrella thunder velvet",[1043,1629,1143],{"class":1053},[1043,1631,1632],{"class":1053}," },\n",[1043,1634,1635,1637,1640,1642,1644,1646,1648,1650,1652,1654,1656,1658,1660],{"class":1045,"line":1120},[1043,1636,1617],{"class":1053},[1043,1638,1639],{"class":1131}," factors",[1043,1641,1135],{"class":1053},[1043,1643,1220],{"class":1057},[1043,1645,1223],{"class":1053},[1043,1647,1400],{"class":1131},[1043,1649,1135],{"class":1053},[1043,1651,1078],{"class":1053},[1043,1653,333],{"class":1081},[1043,1655,1143],{"class":1053},[1043,1657,1072],{"class":1053},[1043,1659,1239],{"class":1057},[1043,1661,1662],{"class":1053},"},\n",[1043,1664,1665],{"class":1045,"line":1128},[1043,1666,1278],{"class":1057},[1303,1668,1670],{"id":1669},"_2-read-and-update-the-vaults-policy","2. Read and update the vault's policy",[1034,1672,1674],{"className":1036,"code":1673,"language":1038,"meta":1039,"style":1039},"const current = await db.getPolicy('books')\n\u002F\u002F → { secret: { minWords: 6, ... }, gates: { 'rotate-secret': { minTier: 1, ... }, ... } }\n\nconst updated = await db.updatePolicy('books', {\n  gates: {\n    'view-team-profiles': { minTier: 1, enabled: false }, \u002F\u002F privacy-strict opt-out\n  },\n})\n\u002F\u002F → merged VaultPolicy: every other gate untouched, 'view-team-profiles' replaced\n",[950,1675,1676,1704,1709,1713,1743,1752,1791,1796,1802],{"__ignoreMap":1039},[1043,1677,1678,1680,1683,1685,1687,1689,1691,1694,1696,1698,1700,1702],{"class":1045,"line":1046},[1043,1679,1099],{"class":1098},[1043,1681,1682],{"class":1057}," current ",[1043,1684,1105],{"class":1053},[1043,1686,1108],{"class":1049},[1043,1688,1359],{"class":1057},[1043,1690,1297],{"class":1053},[1043,1692,1693],{"class":1111},"getPolicy",[1043,1695,1114],{"class":1057},[1043,1697,1143],{"class":1053},[1043,1699,1371],{"class":1081},[1043,1701,1143],{"class":1053},[1043,1703,1278],{"class":1057},[1043,1705,1706],{"class":1045,"line":1088},[1043,1707,1708],{"class":1151},"\u002F\u002F → { secret: { minWords: 6, ... }, gates: { 'rotate-secret': { minTier: 1, ... }, ... } }\n",[1043,1710,1711],{"class":1045,"line":1095},[1043,1712,1092],{"emptyLinePlaceholder":1091},[1043,1714,1715,1717,1720,1722,1724,1726,1728,1731,1733,1735,1737,1739,1741],{"class":1045,"line":1120},[1043,1716,1099],{"class":1098},[1043,1718,1719],{"class":1057}," updated ",[1043,1721,1105],{"class":1053},[1043,1723,1108],{"class":1049},[1043,1725,1359],{"class":1057},[1043,1727,1297],{"class":1053},[1043,1729,1730],{"class":1111},"updatePolicy",[1043,1732,1114],{"class":1057},[1043,1734,1143],{"class":1053},[1043,1736,1371],{"class":1081},[1043,1738,1143],{"class":1053},[1043,1740,1061],{"class":1053},[1043,1742,1170],{"class":1053},[1043,1744,1745,1748,1750],{"class":1045,"line":1128},[1043,1746,1747],{"class":1131},"  gates",[1043,1749,1135],{"class":1053},[1043,1751,1170],{"class":1053},[1043,1753,1754,1757,1760,1762,1764,1766,1769,1771,1774,1776,1779,1781,1785,1788],{"class":1045,"line":1148},[1043,1755,1756],{"class":1053},"    '",[1043,1758,1759],{"class":1131},"view-team-profiles",[1043,1761,1143],{"class":1053},[1043,1763,1135],{"class":1053},[1043,1765,1054],{"class":1053},[1043,1767,1768],{"class":1131}," minTier",[1043,1770,1135],{"class":1053},[1043,1772,1773],{"class":1206}," 1",[1043,1775,1061],{"class":1053},[1043,1777,1778],{"class":1131}," enabled",[1043,1780,1135],{"class":1053},[1043,1782,1784],{"class":1783},"sfNiH"," false",[1043,1786,1787],{"class":1053}," },",[1043,1789,1790],{"class":1151}," \u002F\u002F privacy-strict opt-out\n",[1043,1792,1793],{"class":1045,"line":1155},[1043,1794,1795],{"class":1053},"  },\n",[1043,1797,1798,1800],{"class":1045,"line":1173},[1043,1799,1242],{"class":1053},[1043,1801,1278],{"class":1057},[1043,1803,1804],{"class":1045,"line":1183},[1043,1805,1806],{"class":1151},"\u002F\u002F → merged VaultPolicy: every other gate untouched, 'view-team-profiles' replaced\n",[946,1808,1809,1811,1812,1815,1816,1818],{},[950,1810,1730],{}," fully ",[954,1813,1814],{},"replaces"," the entry for any gate you specify (it does not deep-merge a\nsingle gate's fields) and leaves every other gate as-is. It is itself gated by ",[950,1817,984],{}," —\nchanging the policy is a privilege-management action.",[1303,1820,1822],{"id":1821},"_3-preview-a-verdict-without-throwing","3. Preview a verdict without throwing",[946,1824,1825,1828,1829,1831],{},[950,1826,1827],{},"describeGate"," runs the same check as ",[950,1830,1364],{}," but returns a structured result instead of\nthrowing — useful for building an error UI (\"you'll need a TOTP code plus a recovery code to do\nthat\") ahead of the user attempting the action:",[1034,1833,1835],{"className":1036,"code":1834,"language":1038,"meta":1039,"style":1039},"import { describeGate } from '@noy-db\u002Fhub'\n\nconst verdict = await describeGate(await db.getPolicy('books'), 'rotate-secret', {\n  activeTier: 1,\n  factors: [],\n})\n\u002F\u002F → { ok: false, reason: 'missing-factor', required: { minTier: 1, factors: [...] } }\n",[950,1836,1837,1856,1860,1906,1917,1929,1935],{"__ignoreMap":1039},[1043,1838,1839,1841,1843,1846,1848,1850,1852,1854],{"class":1045,"line":1046},[1043,1840,1050],{"class":1049},[1043,1842,1054],{"class":1053},[1043,1844,1845],{"class":1057}," describeGate",[1043,1847,1072],{"class":1053},[1043,1849,1075],{"class":1049},[1043,1851,1078],{"class":1053},[1043,1853,1082],{"class":1081},[1043,1855,1085],{"class":1053},[1043,1857,1858],{"class":1045,"line":1088},[1043,1859,1092],{"emptyLinePlaceholder":1091},[1043,1861,1862,1864,1867,1869,1871,1873,1875,1877,1879,1881,1883,1885,1887,1889,1891,1893,1895,1897,1900,1902,1904],{"class":1045,"line":1095},[1043,1863,1099],{"class":1098},[1043,1865,1866],{"class":1057}," verdict ",[1043,1868,1105],{"class":1053},[1043,1870,1108],{"class":1049},[1043,1872,1845],{"class":1111},[1043,1874,1114],{"class":1057},[1043,1876,1587],{"class":1049},[1043,1878,1359],{"class":1057},[1043,1880,1297],{"class":1053},[1043,1882,1693],{"class":1111},[1043,1884,1114],{"class":1057},[1043,1886,1143],{"class":1053},[1043,1888,1371],{"class":1081},[1043,1890,1143],{"class":1053},[1043,1892,1268],{"class":1057},[1043,1894,1061],{"class":1053},[1043,1896,1078],{"class":1053},[1043,1898,1899],{"class":1081},"rotate-secret",[1043,1901,1143],{"class":1053},[1043,1903,1061],{"class":1053},[1043,1905,1170],{"class":1053},[1043,1907,1908,1911,1913,1915],{"class":1045,"line":1120},[1043,1909,1910],{"class":1131},"  activeTier",[1043,1912,1135],{"class":1053},[1043,1914,1773],{"class":1206},[1043,1916,977],{"class":1053},[1043,1918,1919,1922,1924,1927],{"class":1045,"line":1128},[1043,1920,1921],{"class":1131},"  factors",[1043,1923,1135],{"class":1053},[1043,1925,1926],{"class":1057}," []",[1043,1928,977],{"class":1053},[1043,1930,1931,1933],{"class":1045,"line":1148},[1043,1932,1242],{"class":1053},[1043,1934,1278],{"class":1057},[1043,1936,1937],{"class":1045,"line":1155},[1043,1938,1939],{"class":1151},"\u002F\u002F → { ok: false, reason: 'missing-factor', required: { minTier: 1, factors: [...] } }\n",[941,1941,1943],{"id":1942},"api-reference","API reference",[1303,1945,1947],{"id":1946},"vaultpolicy",[950,1948,992],{},[1034,1950,1952],{"className":1036,"code":1951,"language":1038,"meta":1039,"style":1039},"interface VaultPolicy {\n  readonly secret?: SecretPolicy   \u002F\u002F strength rules applied at secret ingress\n  readonly gates: Partial\u003CRecord\u003CGateName, GatePolicy>>\n}\n",[950,1953,1954,1964,1981,2012],{"__ignoreMap":1039},[1043,1955,1956,1959,1962],{"class":1045,"line":1046},[1043,1957,1958],{"class":1098},"interface",[1043,1960,1961],{"class":1478}," VaultPolicy",[1043,1963,1170],{"class":1053},[1043,1965,1966,1969,1972,1975,1978],{"class":1045,"line":1088},[1043,1967,1968],{"class":1098},"  readonly",[1043,1970,1971],{"class":1131}," secret",[1043,1973,1974],{"class":1053},"?:",[1043,1976,1977],{"class":1478}," SecretPolicy",[1043,1979,1980],{"class":1151},"   \u002F\u002F strength rules applied at secret ingress\n",[1043,1982,1983,1985,1988,1990,1993,1996,1999,2001,2004,2006,2009],{"class":1045,"line":1095},[1043,1984,1968],{"class":1098},[1043,1986,1987],{"class":1131}," gates",[1043,1989,1135],{"class":1053},[1043,1991,1992],{"class":1478}," Partial",[1043,1994,1995],{"class":1053},"\u003C",[1043,1997,1998],{"class":1478},"Record",[1043,2000,1995],{"class":1053},[1043,2002,2003],{"class":1478},"GateName",[1043,2005,1061],{"class":1053},[1043,2007,2008],{"class":1478}," GatePolicy",[1043,2010,2011],{"class":1053},">>\n",[1043,2013,2014],{"class":1045,"line":1120},[1043,2015,1551],{"class":1053},[946,2017,2018,2019,2021,2022,2024],{},"Persisted once at ",[950,2020,996],{}," when a vault is first created; ",[950,2023,1296],{}," is the only\nsupported way to change it afterward.",[1303,2026,2028],{"id":2027},"gatepolicy",[950,2029,988],{},[1034,2031,2033],{"className":1036,"code":2032,"language":1038,"meta":1039,"style":1039},"interface GatePolicy {\n  readonly minTier: 1 | 2 | 3          \u002F\u002F minimum session tier the caller must hold\n  readonly factors?: ReadonlyArray\u003CFactorRequirement>\n  readonly warn?: WarningRules\n  readonly enabled?: boolean            \u002F\u002F false disables the action entirely\n}\n",[950,2034,2035,2043,2066,2085,2097,2111],{"__ignoreMap":1039},[1043,2036,2037,2039,2041],{"class":1045,"line":1046},[1043,2038,1958],{"class":1098},[1043,2040,2008],{"class":1478},[1043,2042,1170],{"class":1053},[1043,2044,2045,2047,2049,2051,2053,2056,2058,2060,2063],{"class":1045,"line":1088},[1043,2046,1968],{"class":1098},[1043,2048,1768],{"class":1131},[1043,2050,1135],{"class":1053},[1043,2052,1773],{"class":1206},[1043,2054,2055],{"class":1053}," |",[1043,2057,1207],{"class":1206},[1043,2059,2055],{"class":1053},[1043,2061,2062],{"class":1206}," 3",[1043,2064,2065],{"class":1151},"          \u002F\u002F minimum session tier the caller must hold\n",[1043,2067,2068,2070,2072,2074,2077,2079,2082],{"class":1045,"line":1095},[1043,2069,1968],{"class":1098},[1043,2071,1639],{"class":1131},[1043,2073,1974],{"class":1053},[1043,2075,2076],{"class":1478}," ReadonlyArray",[1043,2078,1995],{"class":1053},[1043,2080,2081],{"class":1478},"FactorRequirement",[1043,2083,2084],{"class":1053},">\n",[1043,2086,2087,2089,2092,2094],{"class":1045,"line":1120},[1043,2088,1968],{"class":1098},[1043,2090,2091],{"class":1131}," warn",[1043,2093,1974],{"class":1053},[1043,2095,2096],{"class":1478}," WarningRules\n",[1043,2098,2099,2101,2103,2105,2108],{"class":1045,"line":1128},[1043,2100,1968],{"class":1098},[1043,2102,1778],{"class":1131},[1043,2104,1974],{"class":1053},[1043,2106,2107],{"class":1478}," boolean",[1043,2109,2110],{"class":1151},"            \u002F\u002F false disables the action entirely\n",[1043,2112,2113],{"class":1045,"line":1148},[1043,2114,1551],{"class":1053},[2116,2117,2118,2131],"table",{},[2119,2120,2121],"thead",{},[2122,2123,2124,2128],"tr",{},[2125,2126,2127],"th",{},"Field",[2125,2129,2130],{},"Purpose",[2132,2133,2134,2152,2163,2185],"tbody",{},[2122,2135,2136,2142],{},[2137,2138,2139],"td",{},[950,2140,2141],{},"minTier",[2137,2143,2144,2145,2148,2149,1297],{},"Lower number is more privileged (",[950,2146,2147],{},"1"," = secret unlock). The caller's active tier must be ",[950,2150,2151],{},"\u003C= minTier",[2122,2153,2154,2158],{},[2137,2155,2156],{},[950,2157,1577],{},[2137,2159,2160,2161,1297],{},"Extra freshness-bound proofs required on top of the tier check — see ",[950,2162,2081],{},[2122,2164,2165,2170],{},[2137,2166,2167],{},[950,2168,2169],{},"warn",[2137,2171,2172,2173,2176,2177,2180,2181,2184],{},"Soft signals layered on the verdict. Today only ",[950,2174,2175],{},"warn.sharedDevice: 'block'"," is enforced — it turns a shared-device call into a denial. ",[950,2178,2179],{},"warn.weakAuthenticator"," is declared on the ",[950,2182,2183],{},"WarningRules"," type but not yet read or enforced by the engine.",[2122,2186,2187,2192],{},[2137,2188,2189],{},[950,2190,2191],{},"enabled",[2137,2193,2194,2195,2198,2199,2201],{},"Set ",[950,2196,2197],{},"false"," to disable the action outright (e.g. ",[950,2200,1899],{}," is impossible by construction in managed-secret mode).",[946,2203,2204,2207,2208,2211,2212,1469,2215,2217],{},[954,2205,2206],{},"Built-in gates without a configured policy fail closed"," (treated as ",[950,2209,2210],{},"{ minTier: 1, enabled: false }","). ",[954,2213,2214],{},"App-defined gates",[950,2216,1315],{},") without a configured policy are no-ops — the engine\nonly enforces gates you've explicitly registered.",[1303,2219,2221],{"id":2220},"factorrequirement",[950,2222,2081],{},[1034,2224,2226],{"className":1036,"code":2225,"language":1038,"meta":1039,"style":1039},"interface FactorRequirement {\n  readonly anyOf: ReadonlyArray\u003CFactorKind>\n  readonly count?: number        \u002F\u002F distinct fresh proofs required, default 1\n  readonly freshnessMs?: number  \u002F\u002F acceptance window per proof, default 5 minutes\n}\n",[950,2227,2228,2237,2254,2269,2283],{"__ignoreMap":1039},[1043,2229,2230,2232,2235],{"class":1045,"line":1046},[1043,2231,1958],{"class":1098},[1043,2233,2234],{"class":1478}," FactorRequirement",[1043,2236,1170],{"class":1053},[1043,2238,2239,2241,2243,2245,2247,2249,2252],{"class":1045,"line":1088},[1043,2240,1968],{"class":1098},[1043,2242,1226],{"class":1131},[1043,2244,1135],{"class":1053},[1043,2246,2076],{"class":1478},[1043,2248,1995],{"class":1053},[1043,2250,2251],{"class":1478},"FactorKind",[1043,2253,2084],{"class":1053},[1043,2255,2256,2258,2261,2263,2266],{"class":1045,"line":1095},[1043,2257,1968],{"class":1098},[1043,2259,2260],{"class":1131}," count",[1043,2262,1974],{"class":1053},[1043,2264,2265],{"class":1478}," number",[1043,2267,2268],{"class":1151},"        \u002F\u002F distinct fresh proofs required, default 1\n",[1043,2270,2271,2273,2276,2278,2280],{"class":1045,"line":1120},[1043,2272,1968],{"class":1098},[1043,2274,2275],{"class":1131}," freshnessMs",[1043,2277,1974],{"class":1053},[1043,2279,2265],{"class":1478},[1043,2281,2282],{"class":1151},"  \u002F\u002F acceptance window per proof, default 5 minutes\n",[1043,2284,2285],{"class":1045,"line":1128},[1043,2286,1551],{"class":1053},[1303,2288,2290],{"id":2289},"factorkind",[950,2291,2251],{},[2116,2293,2294,2307],{},[2119,2295,2296],{},[2122,2297,2298,2301,2304],{},[2125,2299,2300],{},"Kind",[2125,2302,2303],{},"Source",[2125,2305,2306],{},"Off-device?",[2132,2308,2309,2321,2332,2347,2361,2374,2387,2402],{},[2122,2310,2311,2315,2318],{},[2137,2312,2313],{},[950,2314,333],{},[2137,2316,2317],{},"RFC 6238 authenticator app (Google Authenticator, 1Password)",[2137,2319,2320],{},"yes",[2122,2322,2323,2327,2330],{},[2137,2324,2325],{},[950,2326,301],{},[2137,2328,2329],{},"one-time code mailed to the user",[2137,2331,2320],{},[2122,2333,2334,2338,2344],{},[2137,2335,2336],{},[950,2337,321],{},[2137,2339,2340,2341,1268],{},"printable recovery code (",[950,2342,2343],{},"@noy-db\u002Fon-recovery",[2137,2345,2346],{},"yes (paper)",[2122,2348,2349,2353,2359],{},[2137,2350,2351],{},[950,2352,325],{},[2137,2354,2355,2356,1268],{},"k-of-n threshold share (",[950,2357,2358],{},"@noy-db\u002Fon-shamir",[2137,2360,2320],{},[2122,2362,2363,2368,2371],{},[2137,2364,2365],{},[950,2366,2367],{},"webauthn-roaming",[2137,2369,2370],{},"hardware key (YubiKey, SoloKey, Titan)",[2137,2372,2373],{},"yes (key is portable)",[2122,2375,2376,2381,2384],{},[2137,2377,2378],{},[950,2379,2380],{},"webauthn-platform",[2137,2382,2383],{},"platform passkey (Touch ID, Face ID, Windows Hello)",[2137,2385,2386],{},"no (device-bound)",[2122,2388,2389,2393,2399],{},[2137,2390,2391],{},[950,2392,313],{},[2137,2394,2395,2396,1268],{},"tier-2 password (",[950,2397,2398],{},"@noy-db\u002Fon-password",[2137,2400,2401],{},"no",[2122,2403,2404,2408,2414],{},[2137,2405,2406],{},[950,2407,317],{},[2137,2409,2410,2411,1268],{},"tier-3 quick-resume PIN (",[950,2412,2413],{},"@noy-db\u002Fon-pin",[2137,2415,2401],{},[946,2417,2418],{},"Off-device kinds are the strongest proofs because they require something separate from the device\nthe user just unlocked; platform\u002Fpassword\u002FPIN prove \"this is still the same user\" without binding\nacross devices.",[1303,2420,2422,2425,2426],{"id":2421},"factorproof-factorproofbundle",[950,2423,2424],{},"FactorProof"," \u002F ",[950,2427,1567],{},[1034,2429,2431],{"className":1036,"code":2430,"language":1038,"meta":1039,"style":1039},"interface FactorProof {\n  readonly kind: FactorKind\n  readonly mintedAt?: string   \u002F\u002F ISO-8601 timestamp, compared against freshnessMs\n  readonly payload?: unknown   \u002F\u002F method-specific, opaque to the engine\n}\n\ninterface FactorProofBundle {\n  readonly factors?: ReadonlyArray\u003CFactorProof>\n  readonly sharedDevice?: boolean\n}\n",[950,2432,2433,2442,2453,2467,2482,2486,2490,2499,2515,2527],{"__ignoreMap":1039},[1043,2434,2435,2437,2440],{"class":1045,"line":1046},[1043,2436,1958],{"class":1098},[1043,2438,2439],{"class":1478}," FactorProof",[1043,2441,1170],{"class":1053},[1043,2443,2444,2446,2448,2450],{"class":1045,"line":1088},[1043,2445,1968],{"class":1098},[1043,2447,1400],{"class":1131},[1043,2449,1135],{"class":1053},[1043,2451,2452],{"class":1478}," FactorKind\n",[1043,2454,2455,2457,2459,2461,2464],{"class":1045,"line":1095},[1043,2456,1968],{"class":1098},[1043,2458,1413],{"class":1131},[1043,2460,1974],{"class":1053},[1043,2462,2463],{"class":1478}," string",[1043,2465,2466],{"class":1151},"   \u002F\u002F ISO-8601 timestamp, compared against freshnessMs\n",[1043,2468,2469,2471,2474,2476,2479],{"class":1045,"line":1120},[1043,2470,1968],{"class":1098},[1043,2472,2473],{"class":1131}," payload",[1043,2475,1974],{"class":1053},[1043,2477,2478],{"class":1478}," unknown",[1043,2480,2481],{"class":1151},"   \u002F\u002F method-specific, opaque to the engine\n",[1043,2483,2484],{"class":1045,"line":1128},[1043,2485,1551],{"class":1053},[1043,2487,2488],{"class":1045,"line":1148},[1043,2489,1092],{"emptyLinePlaceholder":1091},[1043,2491,2492,2494,2497],{"class":1045,"line":1155},[1043,2493,1958],{"class":1098},[1043,2495,2496],{"class":1478}," FactorProofBundle",[1043,2498,1170],{"class":1053},[1043,2500,2501,2503,2505,2507,2509,2511,2513],{"class":1045,"line":1173},[1043,2502,1968],{"class":1098},[1043,2504,1639],{"class":1131},[1043,2506,1974],{"class":1053},[1043,2508,2076],{"class":1478},[1043,2510,1995],{"class":1053},[1043,2512,2424],{"class":1478},[1043,2514,2084],{"class":1053},[1043,2516,2517,2519,2522,2524],{"class":1045,"line":1183},[1043,2518,1968],{"class":1098},[1043,2520,2521],{"class":1131}," sharedDevice",[1043,2523,1974],{"class":1053},[1043,2525,2526],{"class":1478}," boolean\n",[1043,2528,2529],{"class":1045,"line":1198},[1043,2530,1551],{"class":1053},[946,2532,2533,2535,2536,2538,2539,977,2542,981,2545,981,2547,981,2549,977,2552,981,2555,981,2557,981,2560,977,2563,2566],{},[950,2534,1567],{}," is the optional last argument of every gated ",[950,2537,62],{}," method (",[950,2540,2541],{},"db.grant",[950,2543,2544],{},"db.revoke",[950,2546,1563],{},[950,2548,1560],{},[950,2550,2551],{},"db.removeAuthenticator",[950,2553,2554],{},"db.updateAuthenticator",[950,2556,1557],{},[950,2558,2559],{},"db.recoverSecret",[950,2561,2562],{},"db.recoverUser",[950,2564,2565],{},"db.enrollUnlock",", …).",[1303,2568,2570,2425,2572],{"id":2569},"gatename-builtingatename",[950,2571,2003],{},[950,2573,2574],{},"BuiltInGateName",[946,2576,2577,2579,2580,2582,2583,2586,2587,981,2589,981,2592,977,2595,981,2598,981,2601,981,2604,981,2607,977,2610,981,2613,981,2616,981,2619,981,2622,977,2624,981,2627,981,2630,981,2632,977,2635,981,2638,981,2641,981,2644,1297],{},[950,2578,2003],{}," is either a ",[950,2581,2574],{}," or an app-defined name of the form ",[950,2584,2585],{},"`app:${string}`",".\nBuilt-in gates: ",[950,2588,1899],{},[950,2590,2591],{},"recover-secret",[950,2593,2594],{},"enroll-authenticator",[950,2596,2597],{},"remove-authenticator",[950,2599,2600],{},"update-authenticator",[950,2602,2603],{},"rotate-recovery",[950,2605,2606],{},"rotate-unlock",[950,2608,2609],{},"enroll-user",[950,2611,2612],{},"revoke-user",[950,2614,2615],{},"peer-recover-user",[950,2617,2618],{},"update-user",[950,2620,2621],{},"export-bundle",[950,2623,1380],{},[950,2625,2626],{},"view-user-auth",[950,2628,2629],{},"edit-own-profile",[950,2631,1759],{},[950,2633,2634],{},"client-unilateral-withdraw",[950,2636,2637],{},"user-request-withdrawal",[950,2639,2640],{},"approve-user-withdrawal",[950,2642,2643],{},"grant-custodian",[950,2645,2646],{},"liberate-vault",[1303,2648,2650,2425,2652],{"id":2649},"checkgate-describegate",[950,2651,1364],{},[950,2653,1827],{},[1034,2655,2657],{"className":1036,"code":2656,"language":1038,"meta":1039,"style":1039},"function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise\u003Cvoid>\nfunction describeGate(\n  policy: VaultPolicy,\n  gate: GateName,\n  context: CheckGateContext,\n): Promise\u003C{ ok: true } | { ok: false; reason: PolicyDenyReason; required: GatePolicy }>\n\ninterface CheckGateContext {\n  readonly activeTier: ActiveTier         \u002F\u002F 1 | 2 | 3\n  readonly factors?: ReadonlyArray\u003CFactorProof>\n  readonly sharedDevice?: boolean\n  readonly now?: number                    \u002F\u002F override Date.now() for tests\n}\n",[950,2658,2659,2709,2717,2727,2738,2749,2801,2805,2813,2828,2844,2854,2868],{"__ignoreMap":1039},[1043,2660,2661,2664,2667,2669,2672,2674,2676,2678,2681,2683,2686,2688,2691,2693,2696,2699,2702,2704,2707],{"class":1045,"line":1046},[1043,2662,2663],{"class":1098},"function",[1043,2665,2666],{"class":1111}," checkGate",[1043,2668,1114],{"class":1053},[1043,2670,796],{"class":2671},"sHdIc",[1043,2673,1135],{"class":1053},[1043,2675,1961],{"class":1478},[1043,2677,1061],{"class":1053},[1043,2679,2680],{"class":2671}," gate",[1043,2682,1135],{"class":1053},[1043,2684,2685],{"class":1478}," GateName",[1043,2687,1061],{"class":1053},[1043,2689,2690],{"class":2671}," context",[1043,2692,1135],{"class":1053},[1043,2694,2695],{"class":1478}," CheckGateContext",[1043,2697,2698],{"class":1053},"):",[1043,2700,2701],{"class":1478}," Promise",[1043,2703,1995],{"class":1053},[1043,2705,2706],{"class":1478},"void",[1043,2708,2084],{"class":1053},[1043,2710,2711,2713,2715],{"class":1045,"line":1088},[1043,2712,2663],{"class":1098},[1043,2714,1845],{"class":1111},[1043,2716,1601],{"class":1053},[1043,2718,2719,2721,2723,2725],{"class":1045,"line":1095},[1043,2720,1158],{"class":2671},[1043,2722,1135],{"class":1053},[1043,2724,1961],{"class":1478},[1043,2726,977],{"class":1053},[1043,2728,2729,2732,2734,2736],{"class":1045,"line":1120},[1043,2730,2731],{"class":2671},"  gate",[1043,2733,1135],{"class":1053},[1043,2735,2685],{"class":1478},[1043,2737,977],{"class":1053},[1043,2739,2740,2743,2745,2747],{"class":1045,"line":1128},[1043,2741,2742],{"class":2671},"  context",[1043,2744,1135],{"class":1053},[1043,2746,2695],{"class":1478},[1043,2748,977],{"class":1053},[1043,2750,2751,2753,2755,2758,2761,2763,2766,2768,2770,2772,2774,2776,2778,2781,2784,2786,2789,2791,2794,2796,2798],{"class":1045,"line":1148},[1043,2752,2698],{"class":1053},[1043,2754,2701],{"class":1478},[1043,2756,2757],{"class":1053},"\u003C{",[1043,2759,2760],{"class":1131}," ok",[1043,2762,1135],{"class":1053},[1043,2764,2765],{"class":1478}," true",[1043,2767,1072],{"class":1053},[1043,2769,2055],{"class":1053},[1043,2771,1054],{"class":1053},[1043,2773,2760],{"class":1131},[1043,2775,1135],{"class":1053},[1043,2777,1784],{"class":1478},[1043,2779,2780],{"class":1053},";",[1043,2782,2783],{"class":1131}," reason",[1043,2785,1135],{"class":1053},[1043,2787,2788],{"class":1478}," PolicyDenyReason",[1043,2790,2780],{"class":1053},[1043,2792,2793],{"class":1131}," required",[1043,2795,1135],{"class":1053},[1043,2797,2008],{"class":1478},[1043,2799,2800],{"class":1053}," }>\n",[1043,2802,2803],{"class":1045,"line":1155},[1043,2804,1092],{"emptyLinePlaceholder":1091},[1043,2806,2807,2809,2811],{"class":1045,"line":1173},[1043,2808,1958],{"class":1098},[1043,2810,2695],{"class":1478},[1043,2812,1170],{"class":1053},[1043,2814,2815,2817,2820,2822,2825],{"class":1045,"line":1183},[1043,2816,1968],{"class":1098},[1043,2818,2819],{"class":1131}," activeTier",[1043,2821,1135],{"class":1053},[1043,2823,2824],{"class":1478}," ActiveTier",[1043,2826,2827],{"class":1151},"         \u002F\u002F 1 | 2 | 3\n",[1043,2829,2830,2832,2834,2836,2838,2840,2842],{"class":1045,"line":1198},[1043,2831,1968],{"class":1098},[1043,2833,1639],{"class":1131},[1043,2835,1974],{"class":1053},[1043,2837,2076],{"class":1478},[1043,2839,1995],{"class":1053},[1043,2841,2424],{"class":1478},[1043,2843,2084],{"class":1053},[1043,2845,2846,2848,2850,2852],{"class":1045,"line":1212},[1043,2847,1968],{"class":1098},[1043,2849,2521],{"class":1131},[1043,2851,1974],{"class":1053},[1043,2853,2526],{"class":1478},[1043,2855,2856,2858,2861,2863,2865],{"class":1045,"line":1250},[1043,2857,1968],{"class":1098},[1043,2859,2860],{"class":1131}," now",[1043,2862,1974],{"class":1053},[1043,2864,2265],{"class":1478},[1043,2866,2867],{"class":1151},"                    \u002F\u002F override Date.now() for tests\n",[1043,2869,2870],{"class":1045,"line":1256},[1043,2871,1551],{"class":1053},[946,2873,2874,2876,2877,2879],{},[950,2875,1311],{}," is the convenience wrapper — it loads the vault's policy and\nactive tier for you and calls ",[950,2878,1364],{}," underneath.",[1303,2881,2883],{"id":2882},"presets-and-merging","Presets and merging",[2885,2886,2887,2898,2907],"ul",{},[2888,2889,2890,2892,2893,977,2895,2897],"li",{},[950,2891,1011],{}," — the default for personal vaults and small deployments. Off-device factors\n(TOTP \u002F email-OTP \u002F recovery) are required only where they matter most (",[950,2894,1899],{},[950,2896,1380],{},"); most gates are satisfied by a plain tier-1 unlock.",[2888,2899,2900,2903,2904,1297],{},[950,2901,2902],{},"STRICT_POLICY"," — for regulated deployments and shared workstations. Raises the secret floor\nto 8 words, requires two distinct off-device factors for sensitive exports, and blocks exports\non a device flagged ",[950,2905,2906],{},"sharedDevice",[2888,2908,2909,2912,2913,2916,2917,2920],{},[950,2910,2911],{},"mergePolicy(base, override?)"," — merges a partial override onto a preset. Unspecified gates\ninherit from ",[950,2914,2915],{},"base","; gates present in ",[950,2918,2919],{},"override"," fully replace the base entry for that gate.",[1303,2922,2924],{"id":2923},"errors","Errors",[2885,2926,2927,2951],{},[2888,2928,2929,2932,2933,2935,2936,981,2938,2940,2941,2944,2945,2947,2948,2950],{},[950,2930,2931],{},"PolicyDeniedError"," — thrown by ",[950,2934,1364],{}," (and any gated method) on denial. Carries\n",[950,2937,972],{},[950,2939,1526],{}," (a ",[950,2942,2943],{},"PolicyDenyReason","), and ",[950,2946,1539],{}," (the ",[950,2949,988],{}," that was not met).",[2888,2952,2953,2955,2956,1297],{},[950,2954,2943],{}," — ",[950,2957,2958],{},"'insufficient-tier' | 'missing-factor' | 'stale-proof' | 'disabled' | 'shared-device-blocked'",[941,2960,2962],{"id":2961},"limits-gotchas","Limits & gotchas",[2885,2964,2965,2986,2999,3011,3033,3044],{},[2888,2966,2967,2970,2971,2973,2974,2976,2977,2979,2980,2982,2983,2985],{},[954,2968,2969],{},"The on-disk policy wins."," ",[950,2972,796],{}," on ",[950,2975,1031],{}," is only honored the first time a vault\nis created; every later ",[950,2978,1031],{}," call for the same vault reads the persisted document\nfrom ",[950,2981,996],{},". Use ",[950,2984,1296],{}," to change it deliberately — a developer override\ncan never silently weaken what the vault already committed to.",[2888,2987,2988,2991,2992,2995,2996,2998],{},[954,2989,2990],{},"Built-in gates fail closed."," A built-in gate with no entry in ",[950,2993,2994],{},"gates"," behaves as\n",[950,2997,2210],{}," — it denies every call until you configure it.",[2888,3000,3001,3004,3005,3007,3008,3010],{},[954,3002,3003],{},"App gates fail open."," An ",[950,3006,1315],{}," gate with no entry is a no-op (always allowed) — register a\n",[950,3009,988],{}," for it if you want enforcement.",[2888,3012,3013,3018,3019,3021,3022,3025,3026,3029,3030,1297],{},[954,3014,3015,3017],{},[950,3016,2141],{}," is \"at least as privileged\", not \"exactly\"."," Tier ",[950,3020,2147],{}," (secret) satisfies a gate\nrequiring ",[950,3023,3024],{},"minTier: 3","; a session at tier ",[950,3027,3028],{},"3"," (PIN-unlocked) does not satisfy a gate requiring\n",[950,3031,3032],{},"minTier: 1",[2888,3034,3035,3040,3041,3043],{},[954,3036,3037,3039],{},[950,3038,1730],{}," replaces a gate wholesale."," Overriding one field of a preset's gate means\nre-specifying the whole ",[950,3042,988],{}," for that gate, not patching a single field.",[2888,3045,3046,3051,3052,2955,3055,3058,3059,1297],{},[954,3047,3048,3050],{},[950,3049,2169],{}," never blocks by itself"," unless explicitly set to ",[950,3053,3054],{},"'block'",[950,3056,3057],{},"sharedDevice: 'warn'"," is\npurely informational and never raises ",[950,3060,2931],{},[941,3062,3064],{"id":3063},"see-also","See also",[2885,3066,3067,3084,3090,3096],{},[2888,3068,3069,3071,3072,3074,3075,3074,3078,3080,3081,3083],{},[959,3070,844],{"href":961}," — the tier model (",[950,3073,2147],{},"\u002F",[950,3076,3077],{},"2",[950,3079,3028],{},") that ",[950,3082,2141],{}," checks against.",[2888,3085,3086,3089],{},[959,3087,840],{"href":3088},".\u002Fsession"," — session lifecycle and re-authentication built on top of gate checks.",[2888,3091,3092,3095],{},[959,3093,868],{"href":3094},".\u002Fteam"," — grant\u002Frevoke\u002Fupdate-user flows gated by this policy DSL.",[2888,3097,3098,3101,3102],{},[959,3099,3100],{"href":598},"Services overview"," · ",[959,3103,3105],{"href":3104},"\u002Forientation","Orientation map",[3107,3108,3109],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}",{"title":1039,"searchDepth":1095,"depth":1095,"links":3111},[3112,3113,3114,3119,3133,3134],{"id":943,"depth":1088,"text":944},{"id":1015,"depth":1088,"text":1016},{"id":1300,"depth":1088,"text":1301,"children":3115},[3116,3117,3118],{"id":1305,"depth":1095,"text":1306},{"id":1669,"depth":1095,"text":1670},{"id":1821,"depth":1095,"text":1822},{"id":1942,"depth":1088,"text":1943,"children":3120},[3121,3122,3123,3124,3125,3127,3129,3131,3132],{"id":1946,"depth":1095,"text":992},{"id":2027,"depth":1095,"text":988},{"id":2220,"depth":1095,"text":2081},{"id":2289,"depth":1095,"text":2251},{"id":2421,"depth":1095,"text":3126},"FactorProof \u002F FactorProofBundle",{"id":2569,"depth":1095,"text":3128},"GateName \u002F BuiltInGateName",{"id":2649,"depth":1095,"text":3130},"checkGate \u002F describeGate",{"id":2882,"depth":1095,"text":2883},{"id":2923,"depth":1095,"text":2924},{"id":2961,"depth":1088,"text":2962},{"id":3063,"depth":1088,"text":3064},null,"Gate sensitive vault operations behind a minimum session tier and optional extra-factor proofs, via the VaultPolicy \u002F GatePolicy config types.","md",{},"service",{"title":796,"description":3136},"stable","important","_NXcpkJ61NbiAT0bqjVuf1Q_hFC8egpWKJP2NbiJMr4",{"data":3145,"body":3146},{},{"type":3147,"children":3148},"root",[3149],{"type":3150,"tag":946,"props":3151,"children":3152},"element",{},[3153,3159],{"type":3150,"tag":950,"props":3154,"children":3156},{"className":3155},[],[3157],{"type":3158,"value":1082},"text",{"type":3158,"value":3160}," (root export)",{"data":3162,"body":3163},{},{"type":3147,"children":3164},[3165],{"type":3150,"tag":946,"props":3166,"children":3167},{},[3168,3170,3175,3177,3182],{"type":3158,"value":3169},"Core feature — every vault has a policy from creation; configured via the ",{"type":3150,"tag":950,"props":3171,"children":3173},{"className":3172},[],[3174],{"type":3158,"value":796},{"type":3158,"value":3176}," option on ",{"type":3150,"tag":950,"props":3178,"children":3180},{"className":3179},[],[3181],{"type":3158,"value":1031},{"type":3158,"value":1297},1791896581967]