@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.3

package/dist/{chunk-PSHOXR6C.js → chunk-ADBMJDBW.js}

@@ -1,22 +1,22 @@
 import {
   loadVaultPolicy
-} from "./chunk-SM3AVUHC.js";
+} from "./chunk-LES2Z7B4.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-GYGWYIOZ.js";
+} from "./chunk-6I2YPLAG.js";
 import {
   loadFence
-} from "./chunk-IAGBDSCS.js";
+} from "./chunk-4NZCZUGL.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-TEILUWOI.js";
+} from "./chunk-UP6EMMDI.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -24,57 +24,62 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-5R3ERCDH.js";
+} from "./chunk-YN66UOXT.js";
 import {
   NO_ATTESTATION
-} from "./chunk-WYSO2NIH.js";
+} from "./chunk-ZRDYQZYH.js";
+import {
+  NO_CLASSIFIED,
+  enforceClassifiedWrite,
+  resolveClassifiedFields
+} from "./chunk-MIOLJG2R.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-IPB7FTQX.js";
+} from "./chunk-4DZGZ7II.js";
 import {
   NO_PORTABILITY
-} from "./chunk-KVOXU4T5.js";
+} from "./chunk-HGQG3VIP.js";
 import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-TJYQIGAP.js";
+} from "./chunk-Z44OY24N.js";
 import {
   runDrainBarrier
-} from "./chunk-QHJW5EXU.js";
+} from "./chunk-JFYIHLU3.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-SKF73JOP.js";
+} from "./chunk-4NMFWOS2.js";
 import {
   OverlayedCollection
-} from "./chunk-CMGR4ZEW.js";
+} from "./chunk-NMRKAGHE.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-Y22T3KQE.js";
+} from "./chunk-2KSPDSWI.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-V7RWQRG7.js";
+} from "./chunk-LKBLAUOB.js";
 import {
   loadPersistedSchema,
   savePersistedSchema
-} from "./chunk-26LGBE4T.js";
+} from "./chunk-U6OM4E67.js";
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-ZCGAHGUS.js";
+} from "./chunk-AY4P6PHN.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-IELYAOGG.js";
+} from "./chunk-YTIAXSUE.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-LFLXAY2W.js";
+} from "./chunk-PYWW4KLO.js";
 import {
   enrollAuthenticator,
   findAuthenticator,
@@ -84,7 +89,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-UPJNJGGA.js";
+} from "./chunk-OVIVYAQL.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -94,7 +99,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-IGUYVGGI.js";
+} from "./chunk-IJW6K6UX.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -112,17 +117,17 @@ import {
   revoke,
   rotateKeys,
   updateKeyringIdentity
-} from "./chunk-WWGT2MDV.js";
+} from "./chunk-5A6TC3RQ.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-ITNUCOXM.js";
+} from "./chunk-2N4MUSF3.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex as sha256Hex2
-} from "./chunk-AIWULCUO.js";
+} from "./chunk-6EVZXETK.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -131,27 +136,31 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-SRB2XEWB.js";
+} from "./chunk-6OQ7NKMZ.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-UV5MFVO3.js";
+} from "./chunk-FELHYKIO.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
-  buildTombstone,
-  encrypt,
   findByDet,
   hasPerRecordKey,
-  isTombstone,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
-  sha256Hex,
   validateSchemaInput
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-5EZAJEES.js";
+import {
+  buildTombstone,
+  isTombstone
+} from "./chunk-6RASM2J4.js";
+import {
+  encrypt,
+  sha256Hex
+} from "./chunk-L4IRFTIF.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-OCDUQUAP.js";
 import {
   NO_AGGREGATE,
   Query,
@@ -161,22 +170,25 @@ import {
   decodeMoneyFields,
   quantizeMoneyFields,
   validateMoneyFieldPaths
-} from "./chunk-UIU2THRG.js";
+} from "./chunk-N2FP26NH.js";
 import {
   canonicalGroupKey
-} from "./chunk-LV7M27WM.js";
+} from "./chunk-NPVICKZE.js";
 import {
   readPath
-} from "./chunk-M2YKN37S.js";
+} from "./chunk-QLQS5A7X.js";
 import {
   getAtPath,
   resolvePolicy,
   setAtPathInPlace,
   stripI18nFilled
-} from "./chunk-5LUY7UTV.js";
+} from "./chunk-7IP75FP2.js";
 import {
   AlreadyElevatedError,
   AttestationError,
+  ClassifiedConfigError,
+  ClassifiedRevealError,
+  ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
   DerivationCapExceededError,
@@ -207,14 +219,66 @@ import {
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3I7XWZZK.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-KTRIC6PR.js");
   return new StoreCoordinationProvider(store);
 }
 
+// src/with-shape/classified/guards.ts
+function guardClassifiedCompat(collection, byField, ctx) {
+  const digestOnly = Object.entries(byField).filter(([, s]) => s.storage === "digest-only");
+  const protectedForms = Object.values(byField).filter((s) => s.storage === "digest-only" || s.storage === "recoverable");
+  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {
+    throw new ClassifiedConfigError(
+      collection,
+      "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
+    );
+  }
+  if (digestOnly.length === 0) return;
+  if (!ctx.storeCiphertext) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires an encrypted collection \u2014 with encrypt: false the write path skips the digest slot entirely and the secret would persist as raw plaintext`
+    );
+  }
+  if (!ctx.perRecordKeys) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires perRecordKeys: true \u2014 vdig keys derive from the per-record CEK so forget() shreds them (R1)`
+    );
+  }
+  for (const [f, spec] of digestOnly) {
+    const n = spec.notLastN ?? 0;
+    if (!Number.isInteger(n) || n < 0 || n > 8) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" declares notLastN ${n} \u2014 must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented)`
+      );
+    }
+    if (ctx.bareSensitiveFields.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" is digest-only AND listed in sensitive[] \u2014 storage forms are mutually exclusive per field (R5)`
+      );
+    }
+    if (ctx.deterministicFields?.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be deterministic \u2014 equality-correlatable ciphertext defeats per-write salts (R3)`
+      );
+    }
+    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f) || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`
+      );
+    }
+  }
+}
+
 // src/with-formula/computed/index.ts
 var ComputedFieldError = class extends NoydbError {
   constructor(field, id, cause) {
@@ -985,7 +1049,7 @@ function deriveWidget(opts) {
   return "text";
 }
 function buildDescription(input) {
-  const { collection, fieldMeta, moneyFields, dictKeyFields, computed, refs, zodFields, dictLabels, meta, i18nFields } = input;
+  const { collection, fieldMeta, moneyFields, dictKeyFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified } = input;
   if (zodFields !== void 0 && Object.keys(zodFields).length > 0 && fieldMeta !== void 0) {
     const knownFields = /* @__PURE__ */ new Set([
       ...Object.keys(moneyFields ?? {}),
@@ -1004,7 +1068,8 @@ function buildDescription(input) {
     ...Object.keys(computed ?? {}),
     ...Object.keys(fieldMeta ?? {}),
     ...Object.keys(zodFields ?? {}),
-    ...Object.keys(i18nFields ?? {})
+    ...Object.keys(i18nFields ?? {}),
+    ...Object.keys(classified ?? {})
   ]);
   const fields = [];
   for (const key of [...allKeys].sort()) {
@@ -1014,6 +1079,7 @@ function buildDescription(input) {
     const refDesc = refs[key];
     const isComputed = computed !== void 0 && key in computed;
     const i18nDesc = i18nFields?.[key];
+    const cls = classified?.[key];
     let type = zod?.type ?? "unknown";
     const inferred = {};
     let moneyBlock;
@@ -1069,6 +1135,7 @@ function buildDescription(input) {
       type = "string";
     } else if (isComputed) {
     }
+    if (cls !== void 0) inferred.sensitivity = cls.sensitivity;
     const channelEntry = fieldMeta?.[key];
     const zodMeta = zod?.meta;
     const resolved = resolveFieldMeta(key, {
@@ -1096,6 +1163,7 @@ function buildDescription(input) {
       key,
       type,
       optional: zod?.optional ?? false,
+      ...zod?.constraints !== void 0 ? { constraints: zod.constraints } : {},
       label: resolved.label,
       ...resolved.description !== void 0 ? { description: resolved.description } : {},
       ...resolved.group !== void 0 ? { group: resolved.group } : {},
@@ -1112,7 +1180,14 @@ function buildDescription(input) {
       ...isComputed ? { computed: true } : {},
       ...i18nBlock !== void 0 ? { i18n: i18nBlock } : {},
       widget,
-      editable
+      editable,
+      ...cls !== void 0 ? {
+        classified: {
+          preset: cls.preset,
+          storage: cls.storage,
+          list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider }
+        }
+      } : {}
     };
     fields.push(field);
   }
@@ -1160,6 +1235,7 @@ function buildJsonSchema(desc, base) {
       for (const v of f.dict.values) if (v.label !== void 0) labels[v.value] = v.label;
       if (Object.keys(labels).length) prop["x-enumLabels"] = labels;
     }
+    if (f.classified !== void 0) prop["x-classified"] = f.classified;
     properties[f.key] = prop;
   }
   return base != null && typeof base === "object" ? { ...base, properties } : { type: "object", properties };
@@ -1360,7 +1436,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-Z5ZLJVTV.js"));
+      ({ DerivationExecutor } = await import("./executor-ANFBCOYA.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1518,6 +1594,16 @@ function resolveCollectionConfig(opts) {
     );
   }
   if (opts.moneyFields) validateMoneyFieldPaths(opts.moneyFields);
+  const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
+  let mergedComputed = opts.computed;
+  if (resolvedClassified !== void 0) {
+    for (const key of Object.keys(opts.computed ?? {})) {
+      if (resolvedClassified.riderComputed[key] !== void 0) {
+        throw new ClassifiedConfigError(opts.name, `computed field "${key}" collides with a rider companion`);
+      }
+    }
+    mergedComputed = { ...resolvedClassified.riderComputed, ...opts.computed ?? {} };
+  }
   let deterministicFields;
   if (opts.deterministicFields && opts.deterministicFields.length > 0) {
     if (opts.acknowledgeDeterministicRisk !== true) {
@@ -1533,7 +1619,37 @@ function resolveCollectionConfig(opts) {
     Object.entries(opts.i18nFields).filter(([, d]) => d.options.densifyOnWrite === true)
   ) : {};
   const i18nDensifyFields = Object.keys(densifyFields).length > 0 ? densifyFields : void 0;
-  const sensitiveFields = opts.sensitive && opts.sensitive.length > 0 ? Object.freeze(new Set(opts.sensitive)) : Object.freeze(/* @__PURE__ */ new Set());
+  const guardIndexedFields = /* @__PURE__ */ new Set();
+  for (const ix of opts.indexes ?? []) {
+    if (typeof ix === "string") guardIndexedFields.add(ix);
+    else if (Array.isArray(ix)) for (const f of ix) guardIndexedFields.add(f);
+    else for (const f of ix.fields) guardIndexedFields.add(f);
+  }
+  const embeddingSources = opts.embeddings === void 0 ? [] : typeof opts.embeddings.source === "string" ? [opts.embeddings.source] : [...opts.embeddings.source];
+  const classifiedGuardCtx = {
+    perRecordKeys: opts.perRecordKeys === true,
+    crdt: opts.crdt !== void 0,
+    hasConflictPolicy: opts.conflictPolicy !== void 0,
+    storeCiphertext: opts.encrypted,
+    deterministicFields,
+    indexedFields: guardIndexedFields,
+    textIndexFields: new Set(opts.textIndexes ?? []),
+    vectorSourceFields: new Set(embeddingSources),
+    subjectKeyField: opts.subjectKeyField,
+    bareSensitiveFields: new Set(opts.sensitive ?? [])
+  };
+  if (resolvedClassified !== void 0) {
+    guardClassifiedCompat(opts.name, resolvedClassified.byField, classifiedGuardCtx);
+  }
+  const classifiedSensitive = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "recoverable").map(([f]) => f);
+  const sensitiveList = [...opts.sensitive ?? [], ...classifiedSensitive];
+  const sensitiveFields = sensitiveList.length > 0 ? Object.freeze(new Set(sensitiveList)) : Object.freeze(/* @__PURE__ */ new Set());
+  const vdigEntries = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "digest-only").map(([f, s]) => [f, {
+    normalize: s.verifyNormalize ?? "password",
+    notLastN: s.notLastN ?? 0,
+    ...s.rotateDays !== void 0 ? { rotateDays: s.rotateDays } : {}
+  }]);
+  const vdigFields = vdigEntries.length > 0 ? new Map(vdigEntries) : null;
   const perRecordCek = opts.perRecordKeys === true;
   const cekCache = perRecordCek ? new Lru({ maxRecords: 4096 }) : null;
   return {
@@ -1577,7 +1693,10 @@ function resolveCollectionConfig(opts) {
     meta: opts.meta,
     _refs: opts.declaredRefs ?? {},
     moneyFields: opts.moneyFields,
-    computed: opts.computed,
+    classified: resolvedClassified,
+    classifiedGuardCtx,
+    classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
+    computed: mergedComputed,
     dictLabelResolver: opts.dictLabelResolver,
     getDictionary: opts.getDictionary,
     i18nPutValidator: opts.i18nPutValidator,
@@ -1595,6 +1714,7 @@ function resolveCollectionConfig(opts) {
     onCrossTierAccess: opts.onCrossTierAccess,
     deterministicFields,
     sensitiveFields,
+    vdigFields,
     perRecordCek,
     cekCache,
     provenance: opts.provenance === true
@@ -1827,6 +1947,32 @@ var Collection = class {
    * the same MV-pre-creation reconcile as {@link moneyFields}.
    */
   computed;
+  /**
+   * Resolved classified() sensitive-field descriptors, declared via the
+   * `classifiedFields` collection option. Mutable so {@link _applyClassifiedFields}
+   * can attach a declaration to a collection MV-analysis pre-created.
+   */
+  classified;
+  /**
+   * Frozen construction-time facts the refusal matrix (R1-R5) checks against.
+   * Stored so {@link _applyClassifiedFields} — door 2, the reconcile seam —
+   * can re-run the SAME guard the config resolver ran at door 1 (C5's lesson:
+   * crdt/conflictPolicy/perRecordKeys are construction-only but
+   * classifiedFields can attach later).
+   */
+  classifiedGuardCtx;
+  /**
+   * Digest-only classified fields (`storage: 'digest-only'`), keyed by field
+   * name — the enclave-consumable policy map the codec's write path carries
+   * `_vdig` forward under (C6). `null` when the collection declares none.
+   */
+  vdigFields;
+  /**
+   * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
+   * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
+   * `createNoydb()` option (opt in with `withClassified()`).
+   */
+  classifiedStrategy;
   /**
    * Async callback provided by the Vault that resolves a dict key
    * to its label for a given locale. Used by the locale-read path for
@@ -2031,6 +2177,10 @@ var Collection = class {
     this.meta = cfg.meta;
     this._refs = cfg._refs;
     this.moneyFields = cfg.moneyFields;
+    this.classified = cfg.classified;
+    this.classifiedGuardCtx = cfg.classifiedGuardCtx;
+    this.vdigFields = cfg.vdigFields;
+    this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
     this.dictLabelResolver = cfg.dictLabelResolver;
     this.getDictionary = cfg.getDictionary;
@@ -2077,6 +2227,7 @@ var Collection = class {
       provenance: this.provenance,
       sensitiveFields: this.sensitiveFields,
       deterministicFields: this.deterministicFields,
+      vdigFields: this.vdigFields,
       crdtMode: this.crdtMode,
       crdtStrategy: this.crdtStrategy,
       schema: this.schema,
@@ -2248,7 +2399,8 @@ var Collection = class {
       refs: this._refs,
       zodFields: void 0,
       ...this.meta !== void 0 ? { meta: this.meta } : {},
-      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {}
+      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
     });
   }
   /**
@@ -2285,7 +2437,8 @@ var Collection = class {
       zodFields,
       ...dictLabels !== void 0 ? { dictLabels } : {},
       ...this.meta !== void 0 ? { meta: this.meta } : {},
-      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {}
+      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
     });
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
@@ -2298,6 +2451,61 @@ var Collection = class {
     }
     return buildJsonSchema(desc, base);
   }
+  /** Single-point audited reveal of one classified field. Requires withClassified(). */
+  async reveal(id, field) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0) throw new ClassifiedRevealError(this.name, field, "field is not classified");
+    if (spec.storage === "never") {
+      throw new ClassifiedRevealError(this.name, field, `storage:'never' \u2014 nothing is stored to reveal`);
+    }
+    if (spec.storage === "digest-only") {
+      throw new ClassifiedRevealError(this.name, field, `storage:'digest-only' \u2014 verify-only; nothing recoverable to reveal`);
+    }
+    return this.classifiedStrategy.reveal({
+      collection: this.name,
+      spec,
+      encrypted: this.storeCiphertext,
+      getEnvelope: (rid) => this.adapter.get(this.vault, this.name, rid),
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      ...this.onAccess !== void 0 ? { onAccess: async (_op, rid) => {
+        await this.onAccess("reveal", rid);
+      } } : {}
+    }, id, field);
+  }
+  /** Verify-without-reveal: verdict-only oracle for one classified field. Requires withClassified(). */
+  async verify(id, field, candidate) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0) throw new ClassifiedVerifyError(this.name, field, "field is not classified");
+    if (spec.storage === "never") {
+      throw new ClassifiedVerifyError(this.name, field, `storage:'never' \u2014 nothing is stored to verify against`);
+    }
+    const ctx = this._classifiedVerifyCtx(spec);
+    return spec.storage === "digest-only" ? this.classifiedStrategy.verify(ctx, id, field, candidate) : this.classifiedStrategy.verifyText(ctx, id, field, candidate);
+  }
+  /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
+  async verifyGroup(id, answers, opts) {
+    const members = Object.entries(this.classified?.byField ?? {}).filter(([, s]) => s.storage === "digest-only" && s.verifyGroupMember === true).map(([field, spec]) => ({ field, spec }));
+    if (members.length === 0) {
+      throw new ClassifiedVerifyError(this.name, "*", "no groupable digest-only (secretAnswer) fields declared");
+    }
+    const ctx = { ...this._classifiedVerifyCtx(members[0].spec), groupMembers: members };
+    return this.classifiedStrategy.matchGroup(ctx, id, answers, opts);
+  }
+  _classifiedVerifyCtx(spec) {
+    return {
+      collection: this.name,
+      spec,
+      getEnvelope: (rid) => this.adapter.get(this.vault, this.name, rid),
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      now: () => Date.now(),
+      // Q7: injected here; engine tests inject their own
+      ...this.onAccess !== void 0 ? { onAccess: async (_op, rid) => {
+        await this.onAccess("verify", rid);
+      } } : {}
+    };
+  }
   /**
    * @internal — attach money descriptors post-construction. MV dependency
    * analysis auto-creates a source collection (without options) during
@@ -2321,6 +2529,52 @@ var Collection = class {
   _applyMeta(meta) {
     if (this.meta === void 0) this.meta = meta;
   }
+  /**
+   * @internal — attach classified fields post-construction. See {@link _applyMoneyFields}.
+   * First-wins. Note: unlike money/computed/meta, this cannot retro-seal a
+   * collection that was already auto-created — `sensitiveFields` is frozen at
+   * construction time. A reconciled declaration is only accepted when none of
+   * its members are `storage: 'recoverable'` (those require sealing at first
+   * open); otherwise this throws rather than silently persisting the value as
+   * inline plaintext while `describe()` advertises protection.
+   */
+  _applyClassifiedFields(classifiedFields) {
+    const resolved = resolveClassifiedFields(this.name, classifiedFields);
+    if (this.classified !== void 0) {
+      for (const [field, spec] of Object.entries(resolved.byField)) {
+        const prior = this.classified.byField[field];
+        if (prior !== void 0 && prior.storage !== spec.storage) {
+          throw new ClassifiedConfigError(
+            this.name,
+            `field "${field}" was already declared storage:'${prior.storage}' \u2014 storage-form transitions are refused (R6); migrate explicitly`
+          );
+        }
+      }
+      return;
+    }
+    guardClassifiedCompat(this.name, resolved.byField, this.classifiedGuardCtx);
+    for (const key of Object.keys(resolved.riderComputed)) {
+      if (this.computed?.[key] !== void 0) {
+        throw new ClassifiedConfigError(this.name, `rider companion "${key}" collides with a declared field`);
+      }
+    }
+    const retroDigest = Object.entries(resolved.byField).filter(([, spec]) => spec.storage === "digest-only").map(([field]) => field);
+    if (retroDigest.length > 0) {
+      throw new ClassifiedConfigError(
+        this.name,
+        `digest-only classified field(s) ${retroDigest.map((f) => `"${f}"`).join(", ")} were declared after the collection was first opened without them \u2014 the digest write path is fixed at first open, so these values would persist recoverably in _data. Declare classifiedFields at the collection's first vault.collection() call.`
+      );
+    }
+    const unsealable = Object.entries(resolved.byField).filter(([field, spec]) => spec.storage === "recoverable" && !this.sensitiveFields.has(field)).map(([field]) => field);
+    if (unsealable.length > 0) {
+      throw new ClassifiedConfigError(
+        this.name,
+        `recoverable classified field(s) ${unsealable.map((f) => `"${f}"`).join(", ")} were declared after the collection was first opened without them \u2014 sealing is fixed at first open, so these values would persist as inline plaintext. Declare classifiedFields at the collection's first vault.collection() call (for materialized-view sources this means recoverable classified fields are not supported in stage 1).`
+      );
+    }
+    this.classified = resolved;
+    this.computed = { ...resolved.riderComputed, ...this.computed ?? {} };
+  }
   /** @internal — used only in tests; do not read in production code. */
   get _ramCiphertext() {
     return this.ramCiphertext;
@@ -2346,7 +2600,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-3JWHNDIY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-LX4BR43V.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2578,6 +2832,21 @@ var Collection = class {
     const cached = this.cache.get(id);
     return cached ? { record: cached.record, version: cached.version } : void 0;
   }
+  /**
+   * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
+   * digest-only classified fields: the codec already omits them from `_data`
+   * on write, but the write path caches the pre-encrypt `record` object
+   * directly (to skip a redundant decrypt) — without this, a vdig field's
+   * plaintext would sit in the working-set cache and `get()` would leak it
+   * right back out, defeating C6.
+   */
+  async _toCacheableRecord(record, envelope, id) {
+    const base = await this.codec.toCacheRecord(record, envelope, id);
+    if (this.vdigFields === null) return base;
+    const clone = { ...base };
+    for (const field of this.vdigFields.keys()) delete clone[field];
+    return clone;
+  }
   /** @internal Untracked put body — call {@link put}, not this. */
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
@@ -2609,6 +2878,9 @@ var Collection = class {
       };
       await this.subsystemBus.dispatchGate("beforePut", gateEvent);
     }
+    if (this.classified !== void 0) {
+      enforceClassifiedWrite(record, this.classified.byField, this.name);
+    }
     if (this.computed !== void 0) {
       record = evalComputedFields(record, this.computed, id);
     }
@@ -2744,7 +3016,8 @@ var Collection = class {
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved && this.historyConfig.enabled !== false) {
-        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2);
+        const vdigCtx2 = this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0;
+        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, vdigCtx2);
         await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, histEnvelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
         if (this.historyConfig.maxVersions) {
@@ -2803,8 +3076,9 @@ var Collection = class {
     const version = existing ? existing.version + 1 : 1;
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
+    const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     if (existing && this.historyConfig.enabled !== false) {
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek);
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
       this.emitter.emit("history:save", {
         vault: this.vault,
@@ -2818,7 +3092,7 @@ var Collection = class {
         });
       }
     }
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs);
+    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx);
     await this.adapter.put(this.vault, this.name, id, envelope);
     if (this.embeddings) {
       await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
@@ -2839,10 +3113,10 @@ var Collection = class {
       await this.ledger.append(appendInput);
     }
     if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this.codec.toCacheRecord(record, envelope, id), version }, estimateRecordBytes(record));
+      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
       await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
     } else {
-      this.cache.set(id, { record: await this.codec.toCacheRecord(record, envelope, id), version });
+      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
       this.indexes?.upsert(id, record, existing ? existing.record : null);
       this.uniqueConstraints?.upsert(id, record, existing?.record);
     }
@@ -2885,7 +3159,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-2FWQRLMG.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-OIECZXTV.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2894,7 +3168,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-3JWHNDIY.js");
+          staleHelpers = await import("./stale-LX4BR43V.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3079,7 +3353,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-Z5ZLJVTV.js"));
+        ({ DerivationExecutor } = await import("./executor-ANFBCOYA.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3098,7 +3372,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-GF3DJ6KR.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DDKRG2MX.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3225,7 +3499,7 @@ var Collection = class {
       const next = transform(record);
       const nextVersion = (env._v ?? 0) + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek);
+      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0);
       await this.adapter.put(this.vault, this.name, id, newEnv);
       await this._invalidateCacheEntry(id);
       if (this.ledger) {
@@ -3347,7 +3621,8 @@ var Collection = class {
     }
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek);
+      const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
@@ -3456,7 +3731,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-GF3DJ6KR.js");
+          helpers = await import("./fanout-sidecar-DDKRG2MX.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3490,7 +3765,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-2FWQRLMG.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-OIECZXTV.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3499,7 +3774,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-3JWHNDIY.js");
+          staleHelpers = await import("./stale-LX4BR43V.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3522,7 +3797,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-3JWHNDIY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-LX4BR43V.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4351,7 +4626,8 @@ var Collection = class {
     const result = {};
     for (const [id, entry] of this.cache) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek);
+      const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
+      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
     }
     return result;
   }
@@ -6448,6 +6724,7 @@ var Vault = class {
   forgetStrategy;
   i18nStrategy;
   syncStrategy;
+  classifiedStrategy;
   /**
    * Per-vault guard registry. `null` until `_initGuards()` runs; stays
    * `null` for vaults that never register any guard strategy. The
@@ -6713,6 +6990,7 @@ var Vault = class {
     this.forgetStrategy = opts.forgetStrategy ?? NO_FORGET;
     this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
     this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
+    this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
     this.reloadKeyring = opts.reloadKeyring;
@@ -6825,6 +7103,9 @@ var Vault = class {
     if (coll && options?.meta) {
       coll._applyMeta(options.meta);
     }
+    if (coll && options?.classifiedFields) {
+      coll._applyClassifiedFields(options.classifiedFields);
+    }
     if (!coll) {
       if (options?.refs) {
         this.refRegistry.register(collectionName, options.refs);
@@ -6921,6 +7202,7 @@ var Vault = class {
         historyStrategy: this.historyStrategy,
         i18nStrategy: this.i18nStrategy,
         syncStrategy: this.syncStrategy,
+        classifiedStrategy: this.classifiedStrategy,
         // Per-collection ledger opt-out: when this collection sets
         // `historyConfig.ledger: false`, withhold the ledger reference so all
         // four `if (this.ledger)` append sites in Collection no-op. The chain
@@ -6976,13 +7258,15 @@ var Vault = class {
       if (options?.perRecordKeys !== void 0) {
         collOpts.perRecordKeys = options.perRecordKeys;
       }
-      if (this.forgetStrategy.subjects[collectionName] !== void 0) {
+      const subjectKey = this.forgetStrategy.subjects[collectionName];
+      if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
             `[noy-db] Collection "${collectionName}" is declared in withForgetCascade but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
           );
         }
         collOpts.perRecordKeys = true;
+        collOpts.subjectKeyField = subjectKey;
       }
       if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
       if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
@@ -6997,6 +7281,7 @@ var Vault = class {
       if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
       if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
       if (options?.computed !== void 0) collOpts.computed = options.computed;
+      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (options?.dictKeyFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -8114,7 +8399,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-WEUCHBO4.js"),
+      import("./registry-6HZ2JSQ7.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -8145,7 +8430,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-5GRV5VXI.js");
+    const { MaterializedViewRegistry } = await import("./registry-USYD2ECC.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -8169,7 +8454,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-45RJNWGU.js");
+    const { OverlayedViewRegistry } = await import("./registry-GPXZQ7DT.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -8216,13 +8501,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-2FWQRLMG.js");
+    const { MaterializedViewExecutor } = await import("./executor-OIECZXTV.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-3JWHNDIY.js");
+    const { clearMVStale } = await import("./stale-LX4BR43V.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -8238,7 +8523,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-Z5ZLJVTV.js");
+    const { DerivationExecutor } = await import("./executor-ANFBCOYA.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -8263,7 +8548,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-GF3DJ6KR.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DDKRG2MX.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8485,7 +8770,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UL5HKLER.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-4HUHUE6T.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8507,7 +8792,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UL5HKLER.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-4HUHUE6T.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8857,7 +9142,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-JHDQCPSX.js");
+    const { readPublicEnvelope } = await import("./public-envelope-WVRRUVAJ.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -8872,7 +9157,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-KMJQ66MF.js");
+    const { dumpVault } = await import("./backup-NGRJ46SH.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -8924,7 +9209,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-KMJQ66MF.js");
+    const { loadVault } = await import("./backup-NGRJ46SH.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -8956,7 +9241,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-KMJQ66MF.js");
+    const { verifyBackupIntegrity } = await import("./backup-NGRJ46SH.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9174,7 +9459,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-KMJQ66MF.js");
+    const { exportVaultJSON } = await import("./backup-NGRJ46SH.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -11001,7 +11286,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-QZ7BXICW.js");
+      const { GuardExecutor } = await import("./executor-IKT47SH2.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -11178,6 +11463,7 @@ var Noydb = class {
       ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
       forgetStrategy: this.forgetStrategy,
       ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
+      ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
       ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
       ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
       ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {},
@@ -11243,6 +11529,7 @@ var Noydb = class {
         ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
         forgetStrategy: this.forgetStrategy,
         ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
+        ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
         ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
         ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
         ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {}
@@ -12239,7 +12526,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-JHDQCPSX.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-WVRRUVAJ.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12268,7 +12555,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-JHDQCPSX.js");
+    const { readPublicEnvelope } = await import("./public-envelope-WVRRUVAJ.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12459,9 +12746,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-RW3KP7WU.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-LORZ2EZU.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-IXK4FVXP.js");
+    const policyModule = await import("./policy-LRE6HTO5.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12507,4 +12794,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-PSHOXR6C.js.map
+//# sourceMappingURL=chunk-ADBMJDBW.js.map