[API reference](https://evolu.dev/docs/api-reference) › [@evolu/common](https://evolu.dev/docs/api-reference/common) › local‑first/Owner Cryptographic identities that define ownership, encryption, sync, and deletion boundaries for Evolu data. Every database change belongs to an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) and is encrypted with its [OwnerEncryptionKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerEncryptionKey). Owners also make sync selective: only the [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) is synced by default, while other owners can be synced when needed. Individual changes in an append-only local-first history can only be marked as deleted. An entire owner, however, can be removed from devices and relays together with all of its data. The AppOwner must remain because it coordinates the deletion of other owners across devices. Choose an owner by how its data should live and be shared: - [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) coordinates sync and persists for the lifetime of the app identity. - [ShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ShardOwner) partitions application data so it can be synced and deleted independently. - [SharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedOwner) grants collaborative read and write access. - [SharedReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedReadonlyOwner) grants read-only access to shared data. An [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret) deterministically derives three independent values using SLIP-21: - [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId): the public identifier. - [OwnerEncryptionKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerEncryptionKey): the symmetric key that protects the data. - [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey): the rotatable token that authorizes writes. ## Core | Name | Description | | --------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) | An [ReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ReadonlyOwner) with an [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey) for authorizing writes. | | [OwnerError](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/OwnerError) | Common interface implemented by all owner domain errors. | | [OwnerUsage](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/OwnerUsage) | Storage usage and timestamp bounds for an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner). | | [ReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ReadonlyOwner) | [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) without a [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey). | | [OwnerEncryptionKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerEncryptionKey) | Symmetric encryption key for [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) data protection. | | [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerId) | A branded [Id](https://evolu.dev/docs/api-reference/common/Type/variables/Id) that uniquely identifies an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner). | | [OwnerIdBytes](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerIdBytes) | Binary representation of [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId). | | [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerSecret) | 32 bytes of cryptographic entropy used to derive [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) keys. | | [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerWriteKey) | A token that authorizes write operations for an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner). | | [OwnerEncryptionKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerEncryptionKey) | Symmetric encryption key for [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) data protection. | | [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId) | A branded [Id](https://evolu.dev/docs/api-reference/common/Type/variables/Id) that uniquely identifies an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner). | | [OwnerIdBytes](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerIdBytes) | Binary representation of [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId). | | [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret) | 32 bytes of cryptographic entropy used to derive [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) keys. | | [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey) | A token that authorizes write operations for an [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner). | | [ownerWriteKeyLength](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/ownerWriteKeyLength) | Length of an [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey) in bytes. | | [createOwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createOwnerSecret) | Creates a cryptographically random [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret). | | [createOwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createOwnerWriteKey) | Creates a random [OwnerWriteKey](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerWriteKey) for rotating write access. | | [mnemonicToOwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/mnemonicToOwnerSecret) | Converts a [Mnemonic](https://evolu.dev/docs/api-reference/common/Type/variables/Mnemonic) to an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret). | | [ownerIdBytesToOwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/ownerIdBytesToOwnerId) | Converts [OwnerIdBytes](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerIdBytes) to [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId). | | [ownerIdToOwnerIdBytes](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/ownerIdToOwnerIdBytes) | Converts [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId) to [OwnerIdBytes](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerIdBytes). | | [ownerSecretToMnemonic](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/ownerSecretToMnemonic) | Converts an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret) to a [Mnemonic](https://evolu.dev/docs/api-reference/common/Type/variables/Mnemonic). | ## Variants | Name | Description | | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) | The AppOwner represents the application owner. It's created using a cryptographically secure random generator or derived from an external source, e.g., mnemonic stored securely in a hardware device. | | [DeviceAppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/DeviceAppOwner) | An [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) for encrypting device-only data. | | [ShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ShardOwner) | An [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) for sharding data. | | [SharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedOwner) | An [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) for collaborative data with write access. | | [SharedReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedReadonlyOwner) | Read-only version of a [SharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedOwner) for data sharing. Contains only the [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId) and [EncryptionKey](https://evolu.dev/docs/api-reference/common/Crypto/variables/EncryptionKey) needed for others to read the shared data without write access. | | [createAppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createAppOwner) | Creates an [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) from an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret). | | [createShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createShardOwner) | Creates a [ShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ShardOwner) from an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret). | | [createSharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createSharedOwner) | Creates a [SharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedOwner) from an [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret) for collaborative write access. | | [createSharedReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createSharedReadonlyOwner) | Creates a [SharedReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedReadonlyOwner) from a [SharedOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SharedOwner). | | [deriveShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/deriveShardOwner) | Derives a [ShardOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ShardOwner) from an [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) using the specified path. | ## Transport | Name | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [OwnerWebSocketTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/OwnerWebSocketTransport) | WebSocket transport configuration. | | [SyncOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/SyncOwner) | An [ReadonlyOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/ReadonlyOwner) or [Owner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/Owner) with non-empty [OwnerTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerTransport)s so it can be synced. | | [OwnerTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/type-aliases/OwnerTransport) | Transport configuration for connecting to relays. | | [createOwnerWebSocketTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/createOwnerWebSocketTransport) | Creates an [OwnerWebSocketTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/OwnerWebSocketTransport) for the given relay URL and [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId). | | [parseOwnerIdFromOwnerWebSocketTransportUrl](https://evolu.dev/docs/api-reference/common/local-first/Owner/functions/parseOwnerIdFromOwnerWebSocketTransportUrl) | Extracts [OwnerId](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerId) from an [OwnerWebSocketTransport](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/OwnerWebSocketTransport) URL query string. | ## Testing | Variable | Description | | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | [testAppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/testAppOwner) | Deterministic [AppOwner](https://evolu.dev/docs/api-reference/common/local-first/Owner/interfaces/AppOwner) for tests. | | [testOwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/testOwnerSecret) | Deterministic [OwnerSecret](https://evolu.dev/docs/api-reference/common/local-first/Owner/variables/OwnerSecret) for tests. |