[{"data":1,"prerenderedAt":2102},["ShallowReactive",2],{"navigation":3,"\u002Fservices\u002Fteam":927,"mdc--27cy0v-key":2044,"mdc--7sa3b2-key":2060,"mdc--txwjdf-key":2069,"mdc-bprpq4-key":2081,"mdc--22i8xo-key":2093},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":868,"access":12,"apiToc":929,"body":930,"category":2035,"description":2036,"extension":2037,"meta":2038,"navigation":2035,"nest":2039,"path":869,"seo":2040,"sinceVersion":2035,"status":2041,"stem":870,"subtitle":2035,"tier":2042,"tocExternal":2035,"__hash__":2043},"docs\u002Fservices\u002Fteam.md",false,{"type":931,"value":932,"toc":2019},"minimark",[933,936,940,945,958,962,978,982,1021,1025,1200,1235,1239,1244,1430,1434,1508,1517,1535,1558,1565,1569,1587,1591,1695,1699,1704,1827,1832,1881,1885,1970,1974,2015],[934,935,868],"h1",{"id":868},[937,938],"service-meta",{":rows":939},"[{\"label\":\"Subpath\",\"value\":\"`@noy-db\u002Fhub\u002Fteam`\"},{\"label\":\"Factory\",\"value\":\"`withTeam()`\"},{\"label\":\"Layer\",\"value\":\"`with-party`\"},{\"label\":\"Cluster\",\"value\":\"G — Collaboration & Auth\"},{\"label\":\"LOC cost\",\"value\":\"~1,000 (off-bundle when not opted in)\"}]",[941,942,944],"h2",{"id":943},"what-it-does","What it does",[946,947,948,949,953,954,957],"p",{},"Every vault encrypts each collection with its own DEK (data-encryption key) — see\n",[950,951,952],"a",{"href":54},"Permissions & Keyring"," for the full key hierarchy.\nWrapping that DEK for a single owner is the minimum every vault ships with, always on, no\nopt-in required. The ",[955,956,868],"strong",{}," service is what you add when a vault has more than one user:\ngranting a second person a wrapped copy of the DEK, revoking it, rotating it, and everything\nthat follows from more than one keyring existing in the same vault — magic-link viewer\nsessions, sub-permission delegation, and hierarchical permission tiers.",[941,959,961],{"id":960},"when-you-need-it","When you need it",[963,964,965,969,972,975],"ul",{},[966,967,968],"li",{},"Vaults shared between two or more users with role-based access",[966,970,971],{},"Time-boxed read-only viewer sessions (auditors, reviewers)",[966,973,974],{},"Operators with a sub-permission delegated by an admin",[966,976,977],{},"Hierarchical access (tiers 0..N where higher tiers see lower tiers but not vice versa)",[941,979,981],{"id":980},"prerequisites","Prerequisites",[963,983,984,1006],{},[966,985,986,989,990,994,995,998,999,998,1002,1005],{},[955,987,988],{},"None"," — ",[991,992,993],"code",{},"withTeam()"," alone enables ",[991,996,997],{},"grant"," \u002F ",[991,1000,1001],{},"revoke",[991,1003,1004],{},"rotate",".",[966,1007,1008,1012,1013,1016,1017,1020],{},[1009,1010,1011],"em",{},"For tier elevation on a handle:"," the target collection must declare the tier and ",[991,1014,1015],{},"tiersStrategy: withTiers()"," (a separate opt-in from ",[991,1018,1019],{},"@noy-db\u002Fhub\u002Ftiers",") must be passed too.",[941,1022,1024],{"id":1023},"opt-in","Opt in",[1026,1027,1032],"pre",{"className":1028,"code":1029,"language":1030,"meta":1031,"style":1031},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\nimport { toMemory } from '@noy-db\u002Fto-memory'\nimport { withTeam } from '@noy-db\u002Fhub\u002Fteam'\n\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'alice',\n  teamStrategy: withTeam(),\n})\n","ts","",[991,1033,1034,1067,1088,1109,1116,1141,1159,1177,1191],{"__ignoreMap":1031},[1035,1036,1039,1043,1047,1051,1054,1057,1060,1064],"span",{"class":1037,"line":1038},"line",1,[1035,1040,1042],{"class":1041},"s7zQu","import",[1035,1044,1046],{"class":1045},"sMK4o"," {",[1035,1048,1050],{"class":1049},"sTEyZ"," createNoydb",[1035,1052,1053],{"class":1045}," }",[1035,1055,1056],{"class":1041}," from",[1035,1058,1059],{"class":1045}," '",[1035,1061,1063],{"class":1062},"sfazB","@noy-db\u002Fhub",[1035,1065,1066],{"class":1045},"'\n",[1035,1068,1070,1072,1074,1077,1079,1081,1083,1086],{"class":1037,"line":1069},2,[1035,1071,1042],{"class":1041},[1035,1073,1046],{"class":1045},[1035,1075,1076],{"class":1049}," toMemory",[1035,1078,1053],{"class":1045},[1035,1080,1056],{"class":1041},[1035,1082,1059],{"class":1045},[1035,1084,1085],{"class":1062},"@noy-db\u002Fto-memory",[1035,1087,1066],{"class":1045},[1035,1089,1091,1093,1095,1098,1100,1102,1104,1107],{"class":1037,"line":1090},3,[1035,1092,1042],{"class":1041},[1035,1094,1046],{"class":1045},[1035,1096,1097],{"class":1049}," withTeam",[1035,1099,1053],{"class":1045},[1035,1101,1056],{"class":1041},[1035,1103,1059],{"class":1045},[1035,1105,1106],{"class":1062},"@noy-db\u002Fhub\u002Fteam",[1035,1108,1066],{"class":1045},[1035,1110,1112],{"class":1037,"line":1111},4,[1035,1113,1115],{"emptyLinePlaceholder":1114},true,"\n",[1035,1117,1119,1123,1126,1129,1132,1135,1138],{"class":1037,"line":1118},5,[1035,1120,1122],{"class":1121},"spNyl","const",[1035,1124,1125],{"class":1049}," db ",[1035,1127,1128],{"class":1045},"=",[1035,1130,1131],{"class":1041}," await",[1035,1133,1050],{"class":1134},"s2Zo4",[1035,1136,1137],{"class":1049},"(",[1035,1139,1140],{"class":1045},"{\n",[1035,1142,1144,1148,1151,1153,1156],{"class":1037,"line":1143},6,[1035,1145,1147],{"class":1146},"swJcz","  store",[1035,1149,1150],{"class":1045},":",[1035,1152,1076],{"class":1134},[1035,1154,1155],{"class":1049},"()",[1035,1157,1158],{"class":1045},",\n",[1035,1160,1162,1165,1167,1169,1172,1175],{"class":1037,"line":1161},7,[1035,1163,1164],{"class":1146},"  user",[1035,1166,1150],{"class":1045},[1035,1168,1059],{"class":1045},[1035,1170,1171],{"class":1062},"alice",[1035,1173,1174],{"class":1045},"'",[1035,1176,1158],{"class":1045},[1035,1178,1180,1183,1185,1187,1189],{"class":1037,"line":1179},8,[1035,1181,1182],{"class":1146},"  teamStrategy",[1035,1184,1150],{"class":1045},[1035,1186,1097],{"class":1134},[1035,1188,1155],{"class":1049},[1035,1190,1158],{"class":1045},[1035,1192,1194,1197],{"class":1037,"line":1193},9,[1035,1195,1196],{"class":1045},"}",[1035,1198,1199],{"class":1049},")\n",[946,1201,1202,1203,1206,1207,1206,1210,1213,1214,1217,1218,1221,1222,1224,1225,1206,1228,1158,1231,1234],{},"Without ",[991,1204,1205],{},"teamStrategy: withTeam()",", ",[991,1208,1209],{},"db.grant",[991,1211,1212],{},"db.revoke",", and ",[991,1215,1216],{},"db.rotate"," throw\n",[991,1219,1220],{},"TeamNotEnabledError"," — the floor default rejects every call so a single-user vault never\npays the bundle cost of the keyring-grant engine. Single-user primitives stay ungated with or\nwithout ",[991,1223,993],{},": the owner keyring itself, unlock, ",[991,1226,1227],{},"db.listUsers",[991,1229,1230],{},"db.updateUser",[991,1232,1233],{},"db.changeSecret",", and secret rotate\u002Frecover.",[941,1236,1238],{"id":1237},"usage","Usage",[1240,1241,1243],"h3",{"id":1242},"grant-then-revoke","Grant, then revoke",[1026,1245,1247],{"className":1028,"code":1246,"language":1030,"meta":1031,"style":1031},"await db.grant('acme', {\n  userId: 'bob',\n  displayName: 'Bob',\n  role: 'operator',\n  secret: 'glasses cabinet bicycle umbrella thunder velvet',\n  permissions: { invoices: 'rw' },\n})\n\u002F\u002F → resolves once bob's keyring is written with a wrapped DEK for `invoices`\n\nawait db.revoke('acme', { userId: 'bob' })\n\u002F\u002F → resolves once bob's wrapped DEKs are removed. `cascade: 'strict'` (the default) also\n\u002F\u002F   revokes any admins bob had granted; pass `cascade: 'warn'` to log them instead\n",[991,1248,1249,1276,1292,1308,1324,1340,1364,1370,1376,1380,1418,1424],{"__ignoreMap":1031},[1035,1250,1251,1254,1257,1259,1261,1263,1265,1268,1270,1273],{"class":1037,"line":1038},[1035,1252,1253],{"class":1041},"await",[1035,1255,1256],{"class":1049}," db",[1035,1258,1005],{"class":1045},[1035,1260,997],{"class":1134},[1035,1262,1137],{"class":1049},[1035,1264,1174],{"class":1045},[1035,1266,1267],{"class":1062},"acme",[1035,1269,1174],{"class":1045},[1035,1271,1272],{"class":1045},",",[1035,1274,1275],{"class":1045}," {\n",[1035,1277,1278,1281,1283,1285,1288,1290],{"class":1037,"line":1069},[1035,1279,1280],{"class":1146},"  userId",[1035,1282,1150],{"class":1045},[1035,1284,1059],{"class":1045},[1035,1286,1287],{"class":1062},"bob",[1035,1289,1174],{"class":1045},[1035,1291,1158],{"class":1045},[1035,1293,1294,1297,1299,1301,1304,1306],{"class":1037,"line":1090},[1035,1295,1296],{"class":1146},"  displayName",[1035,1298,1150],{"class":1045},[1035,1300,1059],{"class":1045},[1035,1302,1303],{"class":1062},"Bob",[1035,1305,1174],{"class":1045},[1035,1307,1158],{"class":1045},[1035,1309,1310,1313,1315,1317,1320,1322],{"class":1037,"line":1111},[1035,1311,1312],{"class":1146},"  role",[1035,1314,1150],{"class":1045},[1035,1316,1059],{"class":1045},[1035,1318,1319],{"class":1062},"operator",[1035,1321,1174],{"class":1045},[1035,1323,1158],{"class":1045},[1035,1325,1326,1329,1331,1333,1336,1338],{"class":1037,"line":1118},[1035,1327,1328],{"class":1146},"  secret",[1035,1330,1150],{"class":1045},[1035,1332,1059],{"class":1045},[1035,1334,1335],{"class":1062},"glasses cabinet bicycle umbrella thunder velvet",[1035,1337,1174],{"class":1045},[1035,1339,1158],{"class":1045},[1035,1341,1342,1345,1347,1349,1352,1354,1356,1359,1361],{"class":1037,"line":1143},[1035,1343,1344],{"class":1146},"  permissions",[1035,1346,1150],{"class":1045},[1035,1348,1046],{"class":1045},[1035,1350,1351],{"class":1146}," invoices",[1035,1353,1150],{"class":1045},[1035,1355,1059],{"class":1045},[1035,1357,1358],{"class":1062},"rw",[1035,1360,1174],{"class":1045},[1035,1362,1363],{"class":1045}," },\n",[1035,1365,1366,1368],{"class":1037,"line":1161},[1035,1367,1196],{"class":1045},[1035,1369,1199],{"class":1049},[1035,1371,1372],{"class":1037,"line":1179},[1035,1373,1375],{"class":1374},"sHwdD","\u002F\u002F → resolves once bob's keyring is written with a wrapped DEK for `invoices`\n",[1035,1377,1378],{"class":1037,"line":1193},[1035,1379,1115],{"emptyLinePlaceholder":1114},[1035,1381,1383,1385,1387,1389,1391,1393,1395,1397,1399,1401,1403,1406,1408,1410,1412,1414,1416],{"class":1037,"line":1382},10,[1035,1384,1253],{"class":1041},[1035,1386,1256],{"class":1049},[1035,1388,1005],{"class":1045},[1035,1390,1001],{"class":1134},[1035,1392,1137],{"class":1049},[1035,1394,1174],{"class":1045},[1035,1396,1267],{"class":1062},[1035,1398,1174],{"class":1045},[1035,1400,1272],{"class":1045},[1035,1402,1046],{"class":1045},[1035,1404,1405],{"class":1146}," userId",[1035,1407,1150],{"class":1045},[1035,1409,1059],{"class":1045},[1035,1411,1287],{"class":1062},[1035,1413,1174],{"class":1045},[1035,1415,1053],{"class":1045},[1035,1417,1199],{"class":1049},[1035,1419,1421],{"class":1037,"line":1420},11,[1035,1422,1423],{"class":1374},"\u002F\u002F → resolves once bob's wrapped DEKs are removed. `cascade: 'strict'` (the default) also\n",[1035,1425,1427],{"class":1037,"line":1426},12,[1035,1428,1429],{"class":1374},"\u002F\u002F   revokes any admins bob had granted; pass `cascade: 'warn'` to log them instead\n",[1240,1431,1433],{"id":1432},"rotate-keys","Rotate keys",[1026,1435,1437],{"className":1028,"code":1436,"language":1030,"meta":1031,"style":1031},"const { needsRegrant, unverified } = await db.rotate('acme', ['invoices', 'payments'])\n\u002F\u002F → resolves once fresh DEKs are generated for `invoices` and `payments` and every existing\n\u002F\u002F   record in those collections is decrypted under the old DEK and re-encrypted under the new one\n",[991,1438,1439,1498,1503],{"__ignoreMap":1031},[1035,1440,1441,1443,1445,1448,1450,1453,1455,1458,1460,1462,1464,1466,1468,1470,1472,1474,1476,1479,1481,1484,1486,1488,1490,1493,1495],{"class":1037,"line":1038},[1035,1442,1122],{"class":1121},[1035,1444,1046],{"class":1045},[1035,1446,1447],{"class":1049}," needsRegrant",[1035,1449,1272],{"class":1045},[1035,1451,1452],{"class":1049}," unverified ",[1035,1454,1196],{"class":1045},[1035,1456,1457],{"class":1045}," =",[1035,1459,1131],{"class":1041},[1035,1461,1256],{"class":1049},[1035,1463,1005],{"class":1045},[1035,1465,1004],{"class":1134},[1035,1467,1137],{"class":1049},[1035,1469,1174],{"class":1045},[1035,1471,1267],{"class":1062},[1035,1473,1174],{"class":1045},[1035,1475,1272],{"class":1045},[1035,1477,1478],{"class":1049}," [",[1035,1480,1174],{"class":1045},[1035,1482,1483],{"class":1062},"invoices",[1035,1485,1174],{"class":1045},[1035,1487,1272],{"class":1045},[1035,1489,1059],{"class":1045},[1035,1491,1492],{"class":1062},"payments",[1035,1494,1174],{"class":1045},[1035,1496,1497],{"class":1049},"])\n",[1035,1499,1500],{"class":1037,"line":1069},[1035,1501,1502],{"class":1374},"\u002F\u002F → resolves once fresh DEKs are generated for `invoices` and `payments` and every existing\n",[1035,1504,1505],{"class":1037,"line":1090},[1035,1506,1507],{"class":1374},"\u002F\u002F   record in those collections is decrypted under the old DEK and re-encrypted under the new one\n",[946,1509,1510,1512,1513,1516],{},[991,1511,1004],{}," keeps membership unchanged — but ",[955,1514,1515],{},"every other member loses their keys"," for the\nrotated collections. A member's DEKs are wrapped under that member's KEK, and a KEK derives\nonly from that member's secret, so the caller cannot re-wrap a fresh DEK for anyone else.\nRotation therefore drops the rotated collections from every other member's keyring; they keep\ntheir membership and their other collections.",[946,1518,1519,1522,1523,1526,1527,1530,1531,1005],{},[991,1520,1521],{},"needsRegrant"," names each ",[991,1524,1525],{},"(userId, collection)"," pair that was dropped — re-run ",[991,1528,1529],{},"grant()"," for\nthose pairs or they stay locked out. See\n",[950,1532,1534],{"href":1533},"..\u002Fcore\u002F06-permissions-and-keyring#rotation-drops-every-other-members-access","Rotation drops every other member's access",[946,1536,1537,1540,1541,1544,1545,1548,1549,1551,1552,1554,1555,1557],{},[991,1538,1539],{},"unverified"," names members skipped because their ",[991,1542,1543],{},"_keyring"," file failed roster verification.\nSkipping gives them ",[955,1546,1547],{},"less",", never more — the file is left untouched and its wrappings for the\nrotated collections go stale. It is the same locked-out end state as ",[991,1550,1521],{}," but needs a\ndifferent remedy: a ",[991,1553,1521],{}," entry is fixed by ",[991,1556,1529],{},", while an unverified file no longer\nauthenticates and cannot be repaired by granting over it.",[946,1559,1560,1561,1564],{},"To remove a member, use ",[991,1562,1563],{},"db.revoke(vault, { userId })"," — revocation always rotates.",[1240,1566,1568],{"id":1567},"scoped-tier-elevation","Scoped tier elevation",[946,1570,1571,1572,1206,1575,1206,1578,1581,1582,1586],{},"Record-tier elevation — ",[991,1573,1574],{},"vault.elevate()",[991,1576,1577],{},"demote()",[991,1579,1580],{},"delegate()",", tier DEKs — has its own\nservice page: ",[955,1583,1584],{},[950,1585,872],{"href":873},". Grants and tiers compose: the tier DEK a delegate\nreceives is scoped by the same keyring this page describes.",[941,1588,1590],{"id":1589},"api","API",[963,1592,1593,1614,1620,1626,1640,1648,1672],{},[966,1594,1595,1597,1598,1601,1602,1605,1606,1608,1609,1608,1611,1613],{},[991,1596,993],{}," — factory; pass as ",[991,1599,1600],{},"teamStrategy"," to ",[991,1603,1604],{},"createNoydb"," to make ",[991,1607,997],{},"\u002F",[991,1610,1001],{},[991,1612,1004],{}," live.",[966,1615,1616,1619],{},[991,1617,1618],{},"db.grant(vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise\u003Cvoid>"," — wrap a DEK for a new user.",[966,1621,1622,1625],{},[991,1623,1624],{},"db.revoke(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise\u003Cvoid>"," — remove a user's access; cascades to admins they granted by default.",[966,1627,1628,1631,1632,1635,1636,1639],{},[991,1629,1630],{},"db.rotate(vault: string, collections: string[]): Promise\u003Cvoid>"," — regenerate DEKs for the given collections, re-encrypt their records, and re-wrap for remaining members. Throws ",[991,1633,1634],{},"PermissionDeniedError"," for a ",[991,1637,1638],{},"custodian"," caller — rotation is owner\u002Fadmin-only.",[966,1641,1642,1645,1646,1005],{},[991,1643,1644],{},"db.changeSecret(vault: string, newSecret: string, options?): Promise\u003Cvoid>"," — change the caller's own secret; not gated by ",[991,1647,993],{},[966,1649,1650,1651,989,1653,1206,1656,1206,1659,1206,1662,1206,1665,1206,1668,1671],{},"Magic-link grant helpers, imported from ",[991,1652,1106],{},[991,1654,1655],{},"writeMagicLinkGrant",[991,1657,1658],{},"readMagicLinkGrantRecord",[991,1660,1661],{},"listMagicLinkGrants",[991,1663,1664],{},"unwrapMagicLinkGrant",[991,1666,1667],{},"revokeMagicLinkGrant",[991,1669,1670],{},"isMagicLinkGrantExpired"," — one-shot, secret-less read-only viewer sessions bound to a magic-link token.",[966,1673,1674,1675,998,1678,998,1681,998,1684,998,1687,1690,1691,1005],{},"Record-tier elevation and cross-tier delegation (",[991,1676,1677],{},"vault.elevate",[991,1679,1680],{},"demote",[991,1682,1683],{},"delegate",[991,1685,1686],{},"refreshDelegations",[991,1688,1689],{},"revokeDelegation",") moved to ",[955,1692,1693],{},[950,1694,872],{"href":873},[1240,1696,1698],{"id":1697},"options","Options",[946,1700,1701,1150],{},[991,1702,1703],{},"GrantOptions",[1705,1706,1707,1723],"table",{},[1708,1709,1710],"thead",{},[1711,1712,1713,1717,1720],"tr",{},[1714,1715,1716],"th",{},"Field",[1714,1718,1719],{},"Type",[1714,1721,1722],{},"Notes",[1724,1725,1726,1742,1755,1772,1788,1809],"tbody",{},[1711,1727,1728,1734,1739],{},[1729,1730,1731],"td",{},[991,1732,1733],{},"userId",[1729,1735,1736],{},[991,1737,1738],{},"string",[1729,1740,1741],{},"required",[1711,1743,1744,1749,1753],{},[1729,1745,1746],{},[991,1747,1748],{},"displayName",[1729,1750,1751],{},[991,1752,1738],{},[1729,1754,1741],{},[1711,1756,1757,1762,1767],{},[1729,1758,1759],{},[991,1760,1761],{},"role",[1729,1763,1764],{},[991,1765,1766],{},"Role",[1729,1768,1769],{},[991,1770,1771],{},"'owner' | 'admin' | 'operator' | 'viewer' | 'client'",[1711,1773,1774,1779,1783],{},[1729,1775,1776],{},[991,1777,1778],{},"secret",[1729,1780,1781],{},[991,1782,1738],{},[1729,1784,1785,1786],{},"the new user's own secret; not checked against a strength policy by default — validate it yourself before calling ",[991,1787,997],{},[1711,1789,1790,1795,1800],{},[1729,1791,1792],{},[991,1793,1794],{},"permissions",[1729,1796,1797],{},[991,1798,1799],{},"Permissions?",[1729,1801,1802,1805,1806,1808],{},[991,1803,1804],{},"{ collectionName: 'rw' | 'ro' }","; defaults from ",[991,1807,1761],{}," when omitted",[1711,1810,1811,1816,1821],{},[1729,1812,1813],{},[991,1814,1815],{},"allowWeakSecret",[1729,1817,1818],{},[991,1819,1820],{},"boolean?",[1729,1822,1823,1824,1826],{},"reserved for an internal strength check that ",[991,1825,1209],{}," does not currently enable — has no effect through the public API today",[946,1828,1829,1150],{},[991,1830,1831],{},"RevokeOptions",[1705,1833,1834,1844],{},[1708,1835,1836],{},[1711,1837,1838,1840,1842],{},[1714,1839,1716],{},[1714,1841,1719],{},[1714,1843,1722],{},[1724,1845,1846,1858],{},[1711,1847,1848,1852,1856],{},[1729,1849,1850],{},[991,1851,1733],{},[1729,1853,1854],{},[991,1855,1738],{},[1729,1857,1741],{},[1711,1859,1860,1865,1870],{},[1729,1861,1862],{},[991,1863,1864],{},"cascade",[1729,1866,1867],{},[991,1868,1869],{},"'strict' | 'warn'?",[1729,1871,1872,1873,1876,1877,1880],{},"when the revoked user is an admin, ",[991,1874,1875],{},"'strict'"," (default) recursively revokes admins they granted; ",[991,1878,1879],{},"'warn'"," logs them instead",[941,1882,1884],{"id":1883},"limits-gotchas","Limits & gotchas",[963,1886,1887,1904,1909,1919,1930,1944],{},[966,1888,1889,1890,1893,1894,1896,1897,1899,1900,1903],{},"Roles, most to least privileged: ",[991,1891,1892],{},"owner > admin > operator > viewer > client",". Owner and\nadmin can grant\u002Frevoke; viewer and client are read-only. A ",[991,1895,1638],{}," role — normally\nminted via the ",[950,1898,661],{"href":661}," service's ",[991,1901,1902],{},"grantCustodian"," — operates every\ncollection but can never grant, revoke, or rotate, even if held by an admin-equivalent\ncaller.",[966,1905,1906,1908],{},[991,1907,1216],{}," re-encrypts every record in the given collections under a fresh DEK — cost is\nO(records in those collections), not a metadata-only rewrap.",[966,1910,1911,1912,1915,1916,1005],{},"Only one tier elevation can be active per vault at a time; a second ",[991,1913,1914],{},"vault.elevate(...)","\ncall while one is live throws ",[991,1917,1918],{},"AlreadyElevatedError",[966,1920,1921,1922,1925,1926,1929],{},"The export gates (",[991,1923,1924],{},"vault.assertCanExport('plaintext', fmt)"," and\n",[991,1927,1928],{},"vault.assertCanExport('bundle')",") are not bypassed by elevation — it projects a tier,\nnot a privilege escalation.",[966,1931,1932,1933,1936,1937,1940,1941,1005],{},"Owners, admins, and custodians can elevate to any tier (auto-minting the DEK at write\ntime); other roles must already hold a ",[991,1934,1935],{},"*#\u003Ctier>"," DEK on their keyring — via a prior grant\nor an active delegation — otherwise ",[991,1938,1939],{},"elevate"," throws ",[991,1942,1943],{},"TierNotGrantedError",[966,1945,1946,1947,1950,1951,1954,1955,1958,1959,1962,1963,1965,1966,1005],{},"Since ",[991,1948,1949],{},"0.3.0-pre.13",", a record's ",[955,1952,1953],{},"blob attachments follow its tier",": on ",[991,1956,1957],{},"elevate()"," they\nre-home under the tier DEK and become invisible to a tier-0 caller (readable via\n",[991,1960,1961],{},"blob(id).atTier()"," by a cleared caller), and ",[991,1964,1577],{}," restores them. See\n",[950,1967,1969],{"href":1968},"\u002Fservices\u002Fblobs#tiered-blobs-content-follows-the-records-tier","blobs → Tiered blobs",[941,1971,1973],{"id":1972},"see-also","See also",[963,1975,1976,1981,1986,1991,1996,2004],{},[966,1977,1978,1980],{},[950,1979,952],{"href":54}," — the always-on single-owner\nkeyring this service extends",[966,1982,1983,1985],{},[950,1984,864],{"href":864}," — grants flow over sync; rotated DEKs propagate to peers",[966,1987,1988,1990],{},[950,1989,840],{"href":840}," — token-based sessions enforce grant policies",[966,1992,1993,1995],{},[950,1994,697],{"href":697}," — every grant \u002F revoke writes a ledger entry",[966,1997,1998,2000,2001,2003],{},[950,1999,661],{"href":661}," — the owner-only ",[991,2002,1638],{}," role and grant\u002Frevoke-custodian API",[966,2005,2006,2007,1005],{},"Proven by showcase ",[950,2008,2012],{"href":2009,"rel":2010},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Fshowcases\u002Fsrc\u002F06-multi-user.showcase.test.ts",[2011],"nofollow",[991,2013,2014],{},"06-multi-user",[2016,2017,2018],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"title":1031,"searchDepth":1090,"depth":1090,"links":2020},[2021,2022,2023,2024,2025,2030,2033,2034],{"id":943,"depth":1069,"text":944},{"id":960,"depth":1069,"text":961},{"id":980,"depth":1069,"text":981},{"id":1023,"depth":1069,"text":1024},{"id":1237,"depth":1069,"text":1238,"children":2026},[2027,2028,2029],{"id":1242,"depth":1090,"text":1243},{"id":1432,"depth":1090,"text":1433},{"id":1567,"depth":1090,"text":1568},{"id":1589,"depth":1069,"text":1590,"children":2031},[2032],{"id":1697,"depth":1090,"text":1698},{"id":1883,"depth":1069,"text":1884},{"id":1972,"depth":1069,"text":1973},null,"Multi-user collaboration — grant\u002Frevoke\u002Frotate wrapped DEKs via withTeam(), plus magic-link sessions; delegation and tier elevation moved to \u002Fservices\u002Ftiers.","md",{},"service",{"title":868,"description":2036},"stable","important","sJbPu0C1kBdcxl9sl0BkyGCJdvrD5p4BsKkwyCT_Za0",{"data":2045,"body":2046},{},{"type":2047,"children":2048},"root",[2049],{"type":2050,"tag":946,"props":2051,"children":2052},"element",{},[2053],{"type":2050,"tag":991,"props":2054,"children":2056},{"className":2055},[],[2057],{"type":2058,"value":2059},"text","with-party",{"data":2061,"body":2062},{},{"type":2047,"children":2063},[2064],{"type":2050,"tag":946,"props":2065,"children":2066},{},[2067],{"type":2058,"value":2068},"G — Collaboration & Auth",{"data":2070,"body":2071},{},{"type":2047,"children":2072},[2073],{"type":2050,"tag":946,"props":2074,"children":2075},{},[2076],{"type":2050,"tag":991,"props":2077,"children":2079},{"className":2078},[],[2080],{"type":2058,"value":1106},{"data":2082,"body":2083},{},{"type":2047,"children":2084},[2085],{"type":2050,"tag":946,"props":2086,"children":2087},{},[2088],{"type":2050,"tag":991,"props":2089,"children":2091},{"className":2090},[],[2092],{"type":2058,"value":993},{"data":2094,"body":2095},{},{"type":2047,"children":2096},[2097],{"type":2050,"tag":946,"props":2098,"children":2099},{},[2100],{"type":2058,"value":2101},"~1,000 (off-bundle when not opted in)",1791896590874]