@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.4

package/dist/{chunk-PSHOXR6C.js → chunk-ZPHDGUZZ.js}

@@ -1,22 +1,35 @@
 import {
-  loadVaultPolicy
-} from "./chunk-SM3AVUHC.js";
+  jsonSchemaToFields
+} from "./chunk-TQ3REHVF.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-GYGWYIOZ.js";
+} from "./chunk-P27Z66EB.js";
+import {
+  loadVaultPolicy
+} from "./chunk-T45LAT2Y.js";
+import {
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-P3NGV5RV.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-ULIHDPKL.js";
 import {
   loadFence
-} from "./chunk-IAGBDSCS.js";
+} from "./chunk-YFF2RP3X.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-TEILUWOI.js";
+} from "./chunk-GOUNIHFA.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -24,58 +37,65 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-5R3ERCDH.js";
+} from "./chunk-P3V7JTB6.js";
 import {
   NO_ATTESTATION
-} from "./chunk-WYSO2NIH.js";
+} from "./chunk-Z7KI4WHR.js";
+import {
+  NO_CLASSIFIED,
+  enforceClassifiedWrite,
+  resolveClassifiedFields
+} from "./chunk-AF5ZRTZ4.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-IPB7FTQX.js";
+} from "./chunk-VMJ5URU7.js";
 import {
   NO_PORTABILITY
-} from "./chunk-KVOXU4T5.js";
+} from "./chunk-N5YVZHCB.js";
 import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-TJYQIGAP.js";
+} from "./chunk-7J7JRYXW.js";
 import {
   runDrainBarrier
-} from "./chunk-QHJW5EXU.js";
+} from "./chunk-3Y4QLJ6K.js";
+import {
+  PERIODS_COLLECTION
+} from "./chunk-GZZL5R73.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-SKF73JOP.js";
+} from "./chunk-T65UZXR6.js";
 import {
   OverlayedCollection
-} from "./chunk-CMGR4ZEW.js";
+} from "./chunk-ZROMNP7Q.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-Y22T3KQE.js";
+} from "./chunk-5MRE3C4Q.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-V7RWQRG7.js";
+} from "./chunk-QNTEDPWP.js";
 import {
-  loadPersistedSchema,
-  savePersistedSchema
-} from "./chunk-26LGBE4T.js";
+  IMPLICIT_LAZY,
+  Lru,
+  estimateRecordBytes
+} from "./chunk-NO272T7Q.js";
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-ZCGAHGUS.js";
-import {
-  PERIODS_COLLECTION
-} from "./chunk-IELYAOGG.js";
+} from "./chunk-VWGCJUTV.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-LFLXAY2W.js";
+} from "./chunk-SEQ2JI3Y.js";
 import {
+  NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
   recoverPassphrase,
@@ -84,7 +104,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-UPJNJGGA.js";
+} from "./chunk-K5P46KB3.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -94,7 +114,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-IGUYVGGI.js";
+} from "./chunk-LPRPVCNY.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -104,25 +124,22 @@ import {
   changeSecret,
   createOwnerKeyring,
   ensureCollectionDEK,
-  grant,
   hasAccess,
   hasWritePermission,
   listUsers,
   loadKeyring,
-  revoke,
-  rotateKeys,
   updateKeyringIdentity
-} from "./chunk-WWGT2MDV.js";
+} from "./chunk-VAWY44JW.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-ITNUCOXM.js";
+} from "./chunk-TB5RNNJ4.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
-  sha256Hex as sha256Hex2
-} from "./chunk-AIWULCUO.js";
+  sha256Hex
+} from "./chunk-M66NAZA4.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -131,52 +148,54 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-SRB2XEWB.js";
+} from "./chunk-O2DB4C3M.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-UV5MFVO3.js";
+} from "./chunk-G7RDYYTE.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
-  buildTombstone,
-  encrypt,
   findByDet,
   hasPerRecordKey,
-  isTombstone,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
-  sha256Hex,
   validateSchemaInput
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  buildTombstone,
+  isTombstone
+} from "./chunk-QKVILR7N.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
 import {
   NO_AGGREGATE,
   Query,
-  ScanBuilder,
-  canonicalizeIncomingMoney,
-  canonicalizeStoredMoney,
-  decodeMoneyFields,
-  quantizeMoneyFields,
-  validateMoneyFieldPaths
-} from "./chunk-UIU2THRG.js";
+  ScanBuilder
+} from "./chunk-GBTUANXF.js";
 import {
   canonicalGroupKey
-} from "./chunk-LV7M27WM.js";
+} from "./chunk-P5WXDYMD.js";
 import {
+  moneyRuntime,
   readPath
-} from "./chunk-M2YKN37S.js";
+} from "./chunk-ZKF6HH7V.js";
 import {
   getAtPath,
   resolvePolicy,
   setAtPathInPlace,
   stripI18nFilled
-} from "./chunk-5LUY7UTV.js";
+} from "./chunk-4K3MQ5S3.js";
 import {
   AlreadyElevatedError,
   AttestationError,
+  ClassifiedConfigError,
+  ClassifiedRevealError,
+  ClassifiedVerifyError,
   ConflictError,
   DebugPlaintextError,
   DerivationCapExceededError,
@@ -207,40 +226,79 @@ import {
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-3I7XWZZK.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-JJCEMTAE.js");
   return new StoreCoordinationProvider(store);
 }
 
-// src/with-formula/computed/index.ts
-var ComputedFieldError = class extends NoydbError {
-  constructor(field, id, cause) {
-    super(
-      "COMPUTED_FIELD",
-      `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
+// src/with-shape/classified/guards.ts
+function guardClassifiedCompat(collection, byField, ctx) {
+  const digestOnly = Object.entries(byField).filter(([, s]) => s.storage === "digest-only");
+  const protectedForms = Object.values(byField).filter((s) => s.storage === "digest-only" || s.storage === "recoverable");
+  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {
+    throw new ClassifiedConfigError(
+      collection,
+      "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
     );
-    this.field = field;
-    this.id = id;
-    this.cause = cause;
-    this.name = "ComputedFieldError";
   }
-  field;
-  id;
-  cause;
-};
-function evalComputedFields(record, computed, id) {
-  const out = { ...record };
-  for (const [field, fn] of Object.entries(computed)) {
-    try {
-      out[field] = fn(out);
-    } catch (cause) {
-      throw new ComputedFieldError(field, id, cause);
+  for (const [f, spec] of Object.entries(byField)) {
+    if (spec.equatable === true && spec.storage !== "digest-only") {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" declares equatable but storage is '${spec.storage}' \u2014 equatable is a digest-only knob; recoverable equality is _det's job (R7)`
+      );
+    }
+  }
+  const hasEquatable = Object.values(byField).some((s) => s.equatable === true);
+  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {
+    throw new ClassifiedConfigError(
+      collection,
+      `classified equatable fields require \`acknowledgeEquatableRisk: true\` \u2014 equal values produce equal store-visible index tags (a partition leak a DEK holder can offline-dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`
+    );
+  }
+  if (digestOnly.length === 0) return;
+  if (!ctx.storeCiphertext) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires an encrypted collection \u2014 with encrypt: false the write path skips the digest slot entirely and the secret would persist as raw plaintext`
+    );
+  }
+  if (!ctx.perRecordKeys) {
+    throw new ClassifiedConfigError(
+      collection,
+      `storage:'digest-only' requires perRecordKeys: true \u2014 vdig keys derive from the per-record CEK so forget() shreds them (R1)`
+    );
+  }
+  for (const [f, spec] of digestOnly) {
+    const n = spec.notLastN ?? 0;
+    if (!Number.isInteger(n) || n < 0 || n > 8) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" declares notLastN ${n} \u2014 must be an integer 0..8 (write cost is n \xD7 600K PBKDF2; ring blast radius is documented)`
+      );
+    }
+    if (ctx.bareSensitiveFields.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" is digest-only AND listed in sensitive[] \u2014 storage forms are mutually exclusive per field (R5)`
+      );
+    }
+    if (ctx.deterministicFields?.has(f)) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be deterministic \u2014 equality-correlatable ciphertext defeats per-write salts (R3)`
+      );
+    }
+    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f) || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {
+      throw new ClassifiedConfigError(
+        collection,
+        `digest-only field "${f}" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`
+      );
     }
   }
-  return out;
 }
 
 // src/with-lookup/indexing/collection-facade.ts
@@ -497,89 +555,6 @@ async function purgePersistedIndexes(ctx, id) {
   return { purged, residue };
 }
 
-// src/with-shape/persisted-schemas/canonicalize.ts
-function canonicalize(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return "[" + value.map(canonicalize).join(",") + "]";
-  }
-  const obj = value;
-  const keys = Object.keys(obj).sort();
-  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
-  return "{" + parts.join(",") + "}";
-}
-
-// src/with-shape/persisted-schemas/derive.ts
-function isZodSchema(value) {
-  if (value === null || typeof value !== "object") return false;
-  const std = value["~standard"];
-  if (std && typeof std === "object" && std.vendor === "zod") return true;
-  const def = value._def;
-  if (!def || typeof def !== "object") return false;
-  return typeof def.typeName === "string" && def.typeName.startsWith("Zod");
-}
-function detectKind(validator) {
-  if (isZodSchema(validator)) return "Zod";
-  return "Unknown";
-}
-function isZod4Schema(value) {
-  if (value === null || typeof value !== "object") return false;
-  return "_zod" in value;
-}
-async function loadZodToJsonSchemaConverter() {
-  try {
-    const mod = await import("zod-to-json-schema");
-    if (!mod.zodToJsonSchema) {
-      throw new Error("zod-to-json-schema export missing");
-    }
-    return mod.zodToJsonSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema requires the optional peer-dep \`zod-to-json-schema\`. Install it: \`pnpm add zod-to-json-schema\` (or npm/yarn equivalent). Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function loadZodV4Converter() {
-  try {
-    const mod = await import("./zod-HAJM7LMS.js");
-    if (typeof mod.toJSONSchema !== "function") {
-      throw new Error("zod.toJSONSchema not available (zod v4 required)");
-    }
-    return mod.toJSONSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function derivePersistedSchema(validator) {
-  const kind = detectKind(validator);
-  const derivedAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (kind === "Zod") {
-    let jsonSchema;
-    if (isZod4Schema(validator)) {
-      const convert = await loadZodV4Converter();
-      jsonSchema = convert(validator);
-    } else {
-      const convert = await loadZodToJsonSchemaConverter();
-      jsonSchema = convert(validator);
-    }
-    const canonical = canonicalize(jsonSchema);
-    const hash = await sha256Hex(new TextEncoder().encode(canonical));
-    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
-  }
-  return {
-    _noydb_schema: 1,
-    kind,
-    jsonSchema: null,
-    hash: null,
-    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,
-    derivedAt
-  };
-}
-
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
   createState() {
@@ -825,97 +800,6 @@ function resolveFieldMeta(key, inputs) {
   };
 }
 
-// src/with-shape/introspection/fields.ts
-function jsonSchemaType(node) {
-  if (Array.isArray(node.type)) {
-    const non = node.type.filter((t) => t !== "null");
-    return non[0] ?? "opaque";
-  }
-  if (node.enum && Array.isArray(node.enum)) return "enum";
-  if (node.const !== void 0) return "enum";
-  if (typeof node.type === "string") return node.type;
-  return "opaque";
-}
-function constraintsFor(node) {
-  const out = {};
-  if (node.enum) out.values = node.enum;
-  if (node.const !== void 0) out.values = [node.const];
-  if (node.minLength !== void 0) out.minLength = node.minLength;
-  if (node.maxLength !== void 0) out.maxLength = node.maxLength;
-  if (node.pattern !== void 0) out.pattern = node.pattern;
-  if (node.format !== void 0) out.format = node.format;
-  if (node.minimum !== void 0) out.minimum = node.minimum;
-  if (node.maximum !== void 0) out.maximum = node.maximum;
-  if (node.exclusiveMinimum !== void 0) out.gt = node.exclusiveMinimum;
-  if (node.exclusiveMaximum !== void 0) out.lt = node.exclusiveMaximum;
-  return Object.keys(out).length === 0 ? void 0 : out;
-}
-function extractObjectFields(obj, source, refs) {
-  const required = new Set(Array.isArray(obj.required) ? obj.required : []);
-  const fields = {};
-  if (!obj.properties || typeof obj.properties !== "object") return { fields, required };
-  for (const [name, node] of Object.entries(obj.properties)) {
-    const descriptor = {
-      type: jsonSchemaType(node),
-      source,
-      ...required.has(name) ? {} : { optional: true },
-      ...refs?.[name] ? { references: `${refs[name].target}.id` } : {}
-    };
-    const constraints = constraintsFor(node);
-    if (constraints) descriptor.constraints = constraints;
-    fields[name] = descriptor;
-  }
-  return { fields, required };
-}
-function mergeUnionMembers(members, source, refs) {
-  if (members.length === 0) return {};
-  const extracted = members.filter((m) => m.properties && typeof m.properties === "object").map((m) => extractObjectFields(m, source, refs));
-  if (extracted.length === 0) return {};
-  const allNames = /* @__PURE__ */ new Set();
-  for (const { fields } of extracted) {
-    for (const name of Object.keys(fields)) allNames.add(name);
-  }
-  const memberCount = extracted.length;
-  const out = {};
-  for (const name of allNames) {
-    const presentIn = extracted.filter(({ fields }) => name in fields);
-    const requiredInAll = presentIn.length === memberCount && presentIn.every(({ required }) => required.has(name));
-    const base = presentIn[0].fields[name];
-    const allValues = [];
-    for (const { fields } of presentIn) {
-      const fd = fields[name];
-      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {
-        for (const v of fd.constraints.values) {
-          if (!allValues.includes(v)) allValues.push(v);
-        }
-      }
-    }
-    const mergedConstraints = allValues.length > 0 ? { ...base.constraints ?? {}, values: allValues } : base.constraints;
-    const descriptor = {
-      type: base.type,
-      source,
-      ...requiredInAll ? {} : { optional: true },
-      ...base.references ? { references: base.references } : {}
-    };
-    if (mergedConstraints) {
-      descriptor.constraints = mergedConstraints;
-    }
-    out[name] = descriptor;
-  }
-  return out;
-}
-function jsonSchemaToFields(jsonSchema, source, refs) {
-  if (!jsonSchema || typeof jsonSchema !== "object") return {};
-  const root = jsonSchema;
-  const unionMembers = root.anyOf ?? root.oneOf;
-  if (Array.isArray(unionMembers) && unionMembers.length > 0) {
-    return mergeUnionMembers(unionMembers, source, refs);
-  }
-  if (!root.properties || typeof root.properties !== "object") return {};
-  const { fields } = extractObjectFields(root, source, refs);
-  return fields;
-}
-
 // src/with-shape/introspection/describe.ts
 var ZOD_META_KEYS = /* @__PURE__ */ new Set([
   "label",
@@ -985,7 +869,7 @@ function deriveWidget(opts) {
   return "text";
 }
 function buildDescription(input) {
-  const { collection, fieldMeta, moneyFields, dictKeyFields, computed, refs, zodFields, dictLabels, meta, i18nFields } = input;
+  const { collection, fieldMeta, moneyFields, dictKeyFields, computed, refs, zodFields, dictLabels, meta, i18nFields, classified } = input;
   if (zodFields !== void 0 && Object.keys(zodFields).length > 0 && fieldMeta !== void 0) {
     const knownFields = /* @__PURE__ */ new Set([
       ...Object.keys(moneyFields ?? {}),
@@ -1004,7 +888,8 @@ function buildDescription(input) {
     ...Object.keys(computed ?? {}),
     ...Object.keys(fieldMeta ?? {}),
     ...Object.keys(zodFields ?? {}),
-    ...Object.keys(i18nFields ?? {})
+    ...Object.keys(i18nFields ?? {}),
+    ...Object.keys(classified ?? {})
   ]);
   const fields = [];
   for (const key of [...allKeys].sort()) {
@@ -1014,6 +899,7 @@ function buildDescription(input) {
     const refDesc = refs[key];
     const isComputed = computed !== void 0 && key in computed;
     const i18nDesc = i18nFields?.[key];
+    const cls = classified?.[key];
     let type = zod?.type ?? "unknown";
     const inferred = {};
     let moneyBlock;
@@ -1069,6 +955,7 @@ function buildDescription(input) {
       type = "string";
     } else if (isComputed) {
     }
+    if (cls !== void 0) inferred.sensitivity = cls.sensitivity;
     const channelEntry = fieldMeta?.[key];
     const zodMeta = zod?.meta;
     const resolved = resolveFieldMeta(key, {
@@ -1096,6 +983,7 @@ function buildDescription(input) {
       key,
       type,
       optional: zod?.optional ?? false,
+      ...zod?.constraints !== void 0 ? { constraints: zod.constraints } : {},
       label: resolved.label,
       ...resolved.description !== void 0 ? { description: resolved.description } : {},
       ...resolved.group !== void 0 ? { group: resolved.group } : {},
@@ -1112,7 +1000,15 @@ function buildDescription(input) {
       ...isComputed ? { computed: true } : {},
       ...i18nBlock !== void 0 ? { i18n: i18nBlock } : {},
       widget,
-      editable
+      editable,
+      ...cls !== void 0 ? {
+        classified: {
+          preset: cls.preset,
+          storage: cls.storage,
+          list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider },
+          ...cls.equatable === true ? { equatable: true } : {}
+        }
+      } : {}
     };
     fields.push(field);
   }
@@ -1127,203 +1023,6 @@ function buildDescription(input) {
   };
 }
 
-// src/with-shape/introspection/json-schema.ts
-function jsonType(t) {
-  switch (t) {
-    case "number":
-      return "number";
-    case "boolean":
-      return "boolean";
-    case "array":
-      return "array";
-    case "object":
-      return "object";
-    default:
-      return "string";
-  }
-}
-function buildJsonSchema(desc, base) {
-  const baseProps = base?.["properties"] ?? {};
-  const properties = {};
-  for (const f of desc.fields) {
-    const prop = { ...baseProps[f.key] ?? { type: jsonType(f.type) } };
-    prop["x-label"] = f.label;
-    if (f.unit !== void 0) prop["x-unit"] = f.unit;
-    if (f.semanticType !== void 0) prop["x-semanticType"] = f.semanticType;
-    if (f.sensitivity !== void 0) prop["x-sensitivity"] = f.sensitivity;
-    if (f.widget !== void 0) prop["x-widget"] = f.widget;
-    if (f.editable === false) prop["x-readonly"] = true;
-    if (f.money !== void 0) prop["x-money"] = f.money;
-    if (f.ref !== void 0) prop["x-ref"] = f.ref.target;
-    if (f.dict?.values) {
-      const labels = {};
-      for (const v of f.dict.values) if (v.label !== void 0) labels[v.value] = v.label;
-      if (Object.keys(labels).length) prop["x-enumLabels"] = labels;
-    }
-    properties[f.key] = prop;
-  }
-  return base != null && typeof base === "object" ? { ...base, properties } : { type: "object", properties };
-}
-
-// src/kernel/cache/lru.ts
-var Lru = class {
-  entries = /* @__PURE__ */ new Map();
-  maxRecords;
-  maxBytes;
-  currentBytes = 0;
-  hits = 0;
-  misses = 0;
-  evictions = 0;
-  constructor(options) {
-    if (options.maxRecords === void 0 && options.maxBytes === void 0) {
-      throw new Error("Lru: must specify maxRecords, maxBytes, or both");
-    }
-    this.maxRecords = options.maxRecords;
-    this.maxBytes = options.maxBytes;
-  }
-  /**
-   * Look up a key. Hits promote the entry to most-recently-used; misses
-   * return undefined. Both update the running stats counters.
-   */
-  get(key) {
-    const entry = this.entries.get(key);
-    if (!entry) {
-      this.misses++;
-      return void 0;
-    }
-    this.entries.delete(key);
-    this.entries.set(key, entry);
-    this.hits++;
-    return entry.value;
-  }
-  /**
-   * Insert or update a key. If the key already exists, its size is
-   * accounted for and the entry is promoted to MRU. After insertion,
-   * eviction runs to maintain both budgets.
-   */
-  set(key, value, size) {
-    const existing = this.entries.get(key);
-    if (existing) {
-      this.currentBytes -= existing.size;
-      this.entries.delete(key);
-    }
-    this.entries.set(key, { value, size });
-    this.currentBytes += size;
-    this.evictUntilUnderBudget();
-  }
-  /**
-   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.
-   * Returns true if the key was present.
-   */
-  remove(key) {
-    const existing = this.entries.get(key);
-    if (!existing) return false;
-    this.currentBytes -= existing.size;
-    this.entries.delete(key);
-    return true;
-  }
-  /** True if the cache currently holds an entry for the given key. */
-  has(key) {
-    return this.entries.has(key);
-  }
-  /**
-   * Drop every entry. Stats counters survive — call `resetStats()` if you
-   * want a clean slate. Used by `Collection.invalidate()` on key rotation.
-   */
-  clear() {
-    this.entries.clear();
-    this.currentBytes = 0;
-  }
-  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */
-  resetStats() {
-    this.hits = 0;
-    this.misses = 0;
-    this.evictions = 0;
-  }
-  /** Snapshot of current cache statistics. Cheap — no copying. */
-  stats() {
-    return {
-      hits: this.hits,
-      misses: this.misses,
-      evictions: this.evictions,
-      size: this.entries.size,
-      bytes: this.currentBytes
-    };
-  }
-  /**
-   * Iterate over all currently-cached values. Order is least-recently-used
-   * first. Used by tests and devtools — production callers should use
-   * `Collection.scan()` instead.
-   */
-  *values() {
-    for (const entry of this.entries.values()) yield entry.value;
-  }
-  /**
-   * Walk the cache from the LRU end and drop entries until both budgets
-   * are satisfied. Called after every `set()`. Single pass — entries are
-   * never re-promoted during eviction.
-   */
-  evictUntilUnderBudget() {
-    while (this.overBudget()) {
-      const oldest = this.entries.keys().next();
-      if (oldest.done) return;
-      const key = oldest.value;
-      const entry = this.entries.get(key);
-      if (entry) this.currentBytes -= entry.size;
-      this.entries.delete(key);
-      this.evictions++;
-    }
-  }
-  overBudget() {
-    if (this.maxRecords !== void 0 && this.entries.size > this.maxRecords) return true;
-    if (this.maxBytes !== void 0 && this.currentBytes > this.maxBytes) return true;
-    return false;
-  }
-};
-
-// src/kernel/cache/policy.ts
-var UNITS = {
-  "": 1,
-  "B": 1,
-  "KB": 1024,
-  "MB": 1024 * 1024,
-  "GB": 1024 * 1024 * 1024
-  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.
-};
-function parseBytes(input) {
-  if (typeof input === "number") {
-    if (!Number.isFinite(input) || input <= 0) {
-      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`);
-    }
-    return Math.floor(input);
-  }
-  const trimmed = input.trim();
-  if (trimmed === "") {
-    throw new Error("parseBytes: empty string is not a valid byte budget");
-  }
-  const match = /^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]*)$/.exec(trimmed);
-  if (!match) {
-    throw new Error(`parseBytes: invalid byte budget "${input}". Expected format: "1024", "50KB", "50MB", "1GB"`);
-  }
-  const value = parseFloat(match[1]);
-  const unit = (match[2] ?? "").toUpperCase();
-  if (!(unit in UNITS)) {
-    throw new Error(`parseBytes: unknown unit "${match[2]}" in "${input}". Supported: B, KB, MB, GB`);
-  }
-  const bytes = Math.floor(value * UNITS[unit]);
-  if (bytes <= 0) {
-    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from "${input}"`);
-  }
-  return bytes;
-}
-function estimateRecordBytes(record) {
-  try {
-    return JSON.stringify(record).length;
-  } catch {
-    return 0;
-  }
-}
-
 // src/with-formula/derivations/stale.ts
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
@@ -1360,7 +1059,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-Z5ZLJVTV.js"));
+      ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1517,7 +1216,17 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
-  if (opts.moneyFields) validateMoneyFieldPaths(opts.moneyFields);
+  if (opts.moneyFields) moneyRuntime().validateMoneyFieldPaths(opts.moneyFields);
+  const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
+  let mergedComputed = opts.computed;
+  if (resolvedClassified !== void 0) {
+    for (const key of Object.keys(opts.computed ?? {})) {
+      if (resolvedClassified.riderComputed[key] !== void 0) {
+        throw new ClassifiedConfigError(opts.name, `computed field "${key}" collides with a rider companion`);
+      }
+    }
+    mergedComputed = { ...resolvedClassified.riderComputed, ...opts.computed ?? {} };
+  }
   let deterministicFields;
   if (opts.deterministicFields && opts.deterministicFields.length > 0) {
     if (opts.acknowledgeDeterministicRisk !== true) {
@@ -1533,7 +1242,39 @@ function resolveCollectionConfig(opts) {
     Object.entries(opts.i18nFields).filter(([, d]) => d.options.densifyOnWrite === true)
   ) : {};
   const i18nDensifyFields = Object.keys(densifyFields).length > 0 ? densifyFields : void 0;
-  const sensitiveFields = opts.sensitive && opts.sensitive.length > 0 ? Object.freeze(new Set(opts.sensitive)) : Object.freeze(/* @__PURE__ */ new Set());
+  const guardIndexedFields = /* @__PURE__ */ new Set();
+  for (const ix of opts.indexes ?? []) {
+    if (typeof ix === "string") guardIndexedFields.add(ix);
+    else if (Array.isArray(ix)) for (const f of ix) guardIndexedFields.add(f);
+    else for (const f of ix.fields) guardIndexedFields.add(f);
+  }
+  const embeddingSources = opts.embeddings === void 0 ? [] : typeof opts.embeddings.source === "string" ? [opts.embeddings.source] : [...opts.embeddings.source];
+  const classifiedGuardCtx = {
+    perRecordKeys: opts.perRecordKeys === true,
+    crdt: opts.crdt !== void 0,
+    hasConflictPolicy: opts.conflictPolicy !== void 0,
+    storeCiphertext: opts.encrypted,
+    deterministicFields,
+    indexedFields: guardIndexedFields,
+    textIndexFields: new Set(opts.textIndexes ?? []),
+    vectorSourceFields: new Set(embeddingSources),
+    subjectKeyField: opts.subjectKeyField,
+    bareSensitiveFields: new Set(opts.sensitive ?? []),
+    acknowledgeEquatableRisk: opts.acknowledgeEquatableRisk === true
+  };
+  if (resolvedClassified !== void 0) {
+    guardClassifiedCompat(opts.name, resolvedClassified.byField, classifiedGuardCtx);
+  }
+  const classifiedSensitive = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "recoverable").map(([f]) => f);
+  const sensitiveList = [...opts.sensitive ?? [], ...classifiedSensitive];
+  const sensitiveFields = sensitiveList.length > 0 ? Object.freeze(new Set(sensitiveList)) : Object.freeze(/* @__PURE__ */ new Set());
+  const vdigEntries = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "digest-only").map(([f, s]) => [f, {
+    normalize: s.verifyNormalize ?? "password",
+    notLastN: s.notLastN ?? 0,
+    equatable: s.equatable === true,
+    ...s.rotateDays !== void 0 ? { rotateDays: s.rotateDays } : {}
+  }]);
+  const vdigFields = vdigEntries.length > 0 ? new Map(vdigEntries) : null;
   const perRecordCek = opts.perRecordKeys === true;
   const cekCache = perRecordCek ? new Lru({ maxRecords: 4096 }) : null;
   return {
@@ -1577,7 +1318,10 @@ function resolveCollectionConfig(opts) {
     meta: opts.meta,
     _refs: opts.declaredRefs ?? {},
     moneyFields: opts.moneyFields,
-    computed: opts.computed,
+    classified: resolvedClassified,
+    classifiedGuardCtx,
+    classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
+    computed: mergedComputed,
     dictLabelResolver: opts.dictLabelResolver,
     getDictionary: opts.getDictionary,
     i18nPutValidator: opts.i18nPutValidator,
@@ -1595,12 +1339,20 @@ function resolveCollectionConfig(opts) {
     onCrossTierAccess: opts.onCrossTierAccess,
     deterministicFields,
     sensitiveFields,
+    vdigFields,
     perRecordCek,
     cekCache,
     provenance: opts.provenance === true
   };
 }
 
+// src/with-formula/computed/lazy.ts
+var fn = null;
+async function loadEvalComputedFields() {
+  fn ??= (await import("./computed-BMMEFRFJ.js")).evalComputedFields;
+  return fn;
+}
+
 // src/kernel/collection.ts
 function selfWriteFieldEqual(a, b) {
   if (a === b) return true;
@@ -1827,6 +1579,35 @@ var Collection = class {
    * the same MV-pre-creation reconcile as {@link moneyFields}.
    */
   computed;
+  /**
+   * Resolved classified() sensitive-field descriptors, declared via the
+   * `classifiedFields` collection option. Mutable so {@link _applyClassifiedFields}
+   * can attach a declaration to a collection MV-analysis pre-created.
+   */
+  classified;
+  /**
+   * Frozen construction-time facts the refusal matrix (R1-R5) checks against.
+   * Stored so {@link _applyClassifiedFields} — door 2, the reconcile seam —
+   * can re-run the SAME guard the config resolver ran at door 1 (C5's lesson:
+   * crdt/conflictPolicy/perRecordKeys are construction-only but
+   * classifiedFields can attach later).
+   */
+  classifiedGuardCtx;
+  /**
+   * Digest-only classified fields (`storage: 'digest-only'`), keyed by field
+   * name — the enclave-consumable policy map the codec's write path carries
+   * `_vdig` forward under (C6). `null` when the collection declares none.
+   */
+  vdigFields;
+  /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
+  _markerDigestOnlyCache = void 0;
+  _markerPersisted = false;
+  /**
+   * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
+   * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
+   * `createNoydb()` option (opt in with `withClassified()`).
+   */
+  classifiedStrategy;
   /**
    * Async callback provided by the Vault that resolves a dict key
    * to its label for a given locale. Used by the locale-read path for
@@ -2031,6 +1812,10 @@ var Collection = class {
     this.meta = cfg.meta;
     this._refs = cfg._refs;
     this.moneyFields = cfg.moneyFields;
+    this.classified = cfg.classified;
+    this.classifiedGuardCtx = cfg.classifiedGuardCtx;
+    this.vdigFields = cfg.vdigFields;
+    this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
     this.dictLabelResolver = cfg.dictLabelResolver;
     this.getDictionary = cfg.getDictionary;
@@ -2077,11 +1862,13 @@ var Collection = class {
       provenance: this.provenance,
       sensitiveFields: this.sensitiveFields,
       deterministicFields: this.deterministicFields,
+      vdigFields: this.vdigFields,
       crdtMode: this.crdtMode,
       crdtStrategy: this.crdtStrategy,
       schema: this.schema,
       getDEK: () => this.getDEK(this.name),
-      cekCache: this.cekCache
+      cekCache: this.cekCache,
+      classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly()
     });
     if (opts.crdt && opts.onRegisterConflictResolver) {
       const crdtMode = opts.crdt;
@@ -2153,15 +1940,7 @@ var Collection = class {
     }
     this.lazy = opts.prefetch === false;
     if (this.lazy) {
-      if (!opts.cache || opts.cache.maxRecords === void 0 && opts.cache.maxBytes === void 0) {
-        throw new Error(
-          `Collection "${this.name}": lazy mode (prefetch: false) requires a cache option with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`
-        );
-      }
-      const lruOptions = {};
-      if (opts.cache.maxRecords !== void 0) lruOptions.maxRecords = opts.cache.maxRecords;
-      if (opts.cache.maxBytes !== void 0) lruOptions.maxBytes = parseBytes(opts.cache.maxBytes);
-      this.lru = new Lru(lruOptions);
+      this.lru = (opts.lazyStrategy ?? IMPLICIT_LAZY).createCache(this.name, opts.cache);
       this.hydrated = true;
     } else {
       this.lru = null;
@@ -2248,7 +2027,8 @@ var Collection = class {
       refs: this._refs,
       zodFields: void 0,
       ...this.meta !== void 0 ? { meta: this.meta } : {},
-      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {}
+      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
     });
   }
   /**
@@ -2285,11 +2065,13 @@ var Collection = class {
       zodFields,
       ...dictLabels !== void 0 ? { dictLabels } : {},
       ...this.meta !== void 0 ? { meta: this.meta } : {},
-      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {}
+      ...this.i18nFields !== void 0 ? { i18nFields: this.i18nFields } : {},
+      ...this.classified !== void 0 ? { classified: this.classified.byField } : {}
     });
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
   async toJSONSchema() {
+    const { buildJsonSchema } = await import("./json-schema-I22JCYCG.js");
     const desc = await this.describe({});
     let base = null;
     if (this.schema !== void 0) {
@@ -2298,6 +2080,195 @@ var Collection = class {
     }
     return buildJsonSchema(desc, base);
   }
+  /** Single-point audited reveal of one classified field. Requires withClassified(). */
+  async reveal(id, field) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0) throw new ClassifiedRevealError(this.name, field, "field is not classified");
+    if (spec.storage === "never") {
+      throw new ClassifiedRevealError(this.name, field, `storage:'never' \u2014 nothing is stored to reveal`);
+    }
+    if (spec.storage === "digest-only") {
+      throw new ClassifiedRevealError(this.name, field, `storage:'digest-only' \u2014 verify-only; nothing recoverable to reveal`);
+    }
+    return this.classifiedStrategy.reveal({
+      collection: this.name,
+      spec,
+      encrypted: this.storeCiphertext,
+      getEnvelope: (rid) => this.adapter.get(this.vault, this.name, rid),
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      ...this.onAccess !== void 0 ? { onAccess: async (_op, rid) => {
+        await this.onAccess("reveal", rid);
+      } } : {}
+    }, id, field);
+  }
+  /** Verify-without-reveal: verdict-only oracle for one classified field. Requires withClassified(). */
+  async verify(id, field, candidate) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0) throw new ClassifiedVerifyError(this.name, field, "field is not classified");
+    if (spec.storage === "never") {
+      throw new ClassifiedVerifyError(this.name, field, `storage:'never' \u2014 nothing is stored to verify against`);
+    }
+    const ctx = this._classifiedVerifyCtx(spec);
+    return spec.storage === "digest-only" ? this.classifiedStrategy.verify(ctx, id, field, candidate) : this.classifiedStrategy.verifyText(ctx, id, field, candidate);
+  }
+  /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
+  async verifyGroup(id, answers, opts) {
+    const members = Object.entries(this.classified?.byField ?? {}).filter(([, s]) => s.storage === "digest-only" && s.verifyGroupMember === true).map(([field, spec]) => ({ field, spec }));
+    if (members.length === 0) {
+      throw new ClassifiedVerifyError(this.name, "*", "no groupable digest-only (secretAnswer) fields declared");
+    }
+    const ctx = { ...this._classifiedVerifyCtx(members[0].spec), groupMembers: members };
+    return this.classifiedStrategy.matchGroup(ctx, id, answers, opts);
+  }
+  _classifiedVerifyCtx(spec) {
+    return {
+      collection: this.name,
+      spec,
+      getEnvelope: (rid) => this.adapter.get(this.vault, this.name, rid),
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      now: () => Date.now(),
+      // Q7: injected here; engine tests inject their own
+      ...this.onAccess !== void 0 ? { onAccess: async (_op, rid) => {
+        await this.onAccess("verify", rid);
+      } } : {}
+    };
+  }
+  /**
+   * Equatable blind-index lookup: the ids whose classified digest-only
+   * `equatable` field carries a `_bidx` tag matching `candidate` AND whose
+   * `_vdig` payload confirms it. Requires the field to be declared
+   * `classified.password({ equatable: true })` (or `secretAnswer`) and the
+   * collection to have opened its `acknowledgeEquatableRisk` door.
+   *
+   * The algorithm order is load-bearing (spec §3):
+   *  1. Caller-bug refusals thrown at ~0 elapsed, BEFORE any PBKDF2 (R9 /
+   *     Oracle #6): the three field mis-declarations share ONE constant,
+   *     field-name-free message so the refusal text cannot enumerate which
+   *     fields are classified / digest-only / equatable.
+   *  2. Derive the ONE blind-index target UNCONDITIONALLY (I-1 / F1): an empty
+   *     collection still pays exactly one 600K PBKDF2, so wall-time can never
+   *     distinguish "no records" from "no match". No early return may precede
+   *     this line.
+   *  3. Scan `list + one get` per id, string-comparing the stored `_bidx` tag —
+   *     decrypting NOTHING — and retain each hit's already-fetched envelope.
+   *  4. Emit the single sweep consent op (`onAccess('find', '*')`) now — after
+   *     the scan, before confirm (Oracle #5) — fixing its store-write timestamp
+   *     independent of hit count.
+   *  5. Confirm-by-verify against the ALREADY-FETCHED envelope (C-B): run the
+   *     enclave `verifyDigestField` on an in-memory `getEnvelope` closure so the
+   *     confirm reads ZERO additional envelopes. A tag-hit whose `_vdig` fails
+   *     to confirm is dropped silently (a splice is indistinguishable from a
+   *     stale tag). Store-shape law: the only store calls are `list + N get`.
+   */
+  async findByDigest(field, candidate) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0 || spec.storage !== "digest-only" || spec.equatable !== true) {
+      throw new ClassifiedVerifyError(
+        this.name,
+        "*",
+        "not a declared equatable digest-only classified field"
+      );
+    }
+    if (typeof candidate !== "string") {
+      throw new ClassifiedVerifyError(this.name, "*", "candidate must be a string");
+    }
+    const target = await this.classifiedStrategy.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
+    const ids = await this.adapter.list(this.vault, this.name);
+    const hits = [];
+    const hitMap = /* @__PURE__ */ new Map();
+    for (const id of ids) {
+      const env = await this.adapter.get(this.vault, this.name, id);
+      if (target !== null && env?._bidx?.[field] === target) {
+        hits.push(id);
+        hitMap.set(id, env);
+      }
+    }
+    await this.onAccess?.("find", "*");
+    if (hits.length === 0) return [];
+    const { verifyDigestField } = await import("./verify-YB5LQHNA.js");
+    const policy = {
+      normalize: spec.verifyNormalize ?? "password",
+      notLastN: spec.notLastN ?? 0,
+      equatable: true,
+      ...spec.rotateDays !== void 0 ? { rotateDays: spec.rotateDays } : {}
+    };
+    const confirmCtx = {
+      collection: this.name,
+      getEnvelope: async (rid) => hitMap.get(rid) ?? null,
+      // in-memory: zero extra store.get
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      now: () => Date.now()
+    };
+    const confirmed = [];
+    for (const id of hits) {
+      const verdict = await verifyDigestField(confirmCtx, id, field, candidate, policy);
+      if (verdict.ok === true) confirmed.push(id);
+    }
+    return confirmed;
+  }
+  /**
+   * Retire a field's equatable blind-index (`_bidx`) coverage across every
+   * live record — the SOLE lazy-write-independent drop-path for a still-live
+   * record's tag (besides clear / `forget()` / DEK-rotation). For each envelope
+   * carrying `_bidx[field]`, rewrite it WITHOUT that slot (dropping the whole
+   * `_bidx` map when it becomes empty), leaving `_vdig[field]` and everything
+   * else INTACT — the field stays `digest-only`, only the index coverage is
+   * retired. NO crypto, NO re-mint, NO re-encrypt: a targeted envelope rewrite.
+   * Returns the count of records scrubbed.
+   *
+   * This is a maintenance write, not a read-egress: it emits NO `'find'` op and
+   * no consent. The field is validated to a declared equatable digest-only
+   * classified field (only such a field ever carries `_bidx`).
+   *
+   * **Ledger consistency**: dropping `_bidx[field]` changes the envelope's
+   * payload hash (`_bidx` is bound into `envelopeBodyForHash`), so a raw
+   * `adapter.put` of the scrubbed envelope WITHOUT a matching ledger entry would
+   * desync the chain and make a future integrity cross-check flag false
+   * tampering. After each rewrite we therefore append an `op:'migration'` entry
+   * recording the NEW payloadHash at the SAME version — this is index retirement,
+   * not a new record version, so `_v` is NOT bumped; the migration op is
+   * reverse-delta-inert (`ledger.reconstruct` skips non-put/delete ops) yet
+   * keeps the hash chain and the record's latest recorded payloadHash correct.
+   */
+  async scrubEquatableTags(field) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0 || spec.storage !== "digest-only" || spec.equatable !== true) {
+      throw new ClassifiedVerifyError(
+        this.name,
+        "*",
+        "not a declared equatable digest-only classified field"
+      );
+    }
+    const ids = await this.adapter.list(this.vault, this.name);
+    let count = 0;
+    for (const id of ids) {
+      const env = await this.adapter.get(this.vault, this.name, id);
+      if (env?._bidx?.[field] === void 0) continue;
+      const nextBidx = { ...env._bidx };
+      delete nextBidx[field];
+      const scrubbedRaw = { ...env };
+      delete scrubbedRaw._bidx;
+      if (Object.keys(nextBidx).length > 0) scrubbedRaw._bidx = nextBidx;
+      const scrubbed = scrubbedRaw;
+      await this.adapter.put(this.vault, this.name, id, scrubbed);
+      if (this.ledger) {
+        await this.ledger.append({
+          op: "migration",
+          collection: this.name,
+          id,
+          version: scrubbed._v,
+          actor: this.keyring.userId,
+          payloadHash: await this.historyStrategy.envelopePayloadHash(scrubbed),
+          reason: "classified:scrub-equatable-tags"
+        });
+      }
+      count++;
+    }
+    return count;
+  }
   /**
    * @internal — attach money descriptors post-construction. MV dependency
    * analysis auto-creates a source collection (without options) during
@@ -2306,7 +2277,7 @@ var Collection = class {
    */
   _applyMoneyFields(moneyFields) {
     if (this.moneyFields !== void 0) return;
-    validateMoneyFieldPaths(moneyFields);
+    moneyRuntime().validateMoneyFieldPaths(moneyFields);
     this.moneyFields = moneyFields;
   }
   /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
@@ -2321,6 +2292,52 @@ var Collection = class {
   _applyMeta(meta) {
     if (this.meta === void 0) this.meta = meta;
   }
+  /**
+   * @internal — attach classified fields post-construction. See {@link _applyMoneyFields}.
+   * First-wins. Note: unlike money/computed/meta, this cannot retro-seal a
+   * collection that was already auto-created — `sensitiveFields` is frozen at
+   * construction time. A reconciled declaration is only accepted when none of
+   * its members are `storage: 'recoverable'` (those require sealing at first
+   * open); otherwise this throws rather than silently persisting the value as
+   * inline plaintext while `describe()` advertises protection.
+   */
+  _applyClassifiedFields(classifiedFields) {
+    const resolved = resolveClassifiedFields(this.name, classifiedFields);
+    if (this.classified !== void 0) {
+      for (const [field, spec] of Object.entries(resolved.byField)) {
+        const prior = this.classified.byField[field];
+        if (prior !== void 0 && prior.storage !== spec.storage) {
+          throw new ClassifiedConfigError(
+            this.name,
+            `field "${field}" was already declared storage:'${prior.storage}' \u2014 storage-form transitions are refused (R6); migrate explicitly`
+          );
+        }
+      }
+      return;
+    }
+    guardClassifiedCompat(this.name, resolved.byField, this.classifiedGuardCtx);
+    for (const key of Object.keys(resolved.riderComputed)) {
+      if (this.computed?.[key] !== void 0) {
+        throw new ClassifiedConfigError(this.name, `rider companion "${key}" collides with a declared field`);
+      }
+    }
+    const retroDigest = Object.entries(resolved.byField).filter(([, spec]) => spec.storage === "digest-only").map(([field]) => field);
+    if (retroDigest.length > 0) {
+      throw new ClassifiedConfigError(
+        this.name,
+        `digest-only classified field(s) ${retroDigest.map((f) => `"${f}"`).join(", ")} were declared after the collection was first opened without them \u2014 the digest write path is fixed at first open, so these values would persist recoverably in _data. Declare classifiedFields at the collection's first vault.collection() call.`
+      );
+    }
+    const unsealable = Object.entries(resolved.byField).filter(([field, spec]) => spec.storage === "recoverable" && !this.sensitiveFields.has(field)).map(([field]) => field);
+    if (unsealable.length > 0) {
+      throw new ClassifiedConfigError(
+        this.name,
+        `recoverable classified field(s) ${unsealable.map((f) => `"${f}"`).join(", ")} were declared after the collection was first opened without them \u2014 sealing is fixed at first open, so these values would persist as inline plaintext. Declare classifiedFields at the collection's first vault.collection() call (for materialized-view sources this means recoverable classified fields are not supported in stage 1).`
+      );
+    }
+    this.classified = resolved;
+    this.computed = { ...resolved.riderComputed, ...this.computed ?? {} };
+  }
   /** @internal — used only in tests; do not read in production code. */
   get _ramCiphertext() {
     return this.ramCiphertext;
@@ -2346,7 +2363,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-3JWHNDIY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2578,29 +2595,47 @@ var Collection = class {
     const cached = this.cache.get(id);
     return cached ? { record: cached.record, version: cached.version } : void 0;
   }
+  /** Resolves the prior envelope/record for a gate event; elides the read (#267) when no handler at `point` needs it (`elided: true`, `env`/`record` null). */
+  async resolveGatePrior(point, id) {
+    if (!this.subsystemBus.gateNeedsPrior(point)) return { env: null, record: null, elided: true };
+    const env = await this.adapter.get(this.vault, this.name, id);
+    if (!env) return { env: null, record: null, elided: false };
+    try {
+      return { env, record: await this.codec.decryptRecord(env, { skipValidation: true }), elided: false };
+    } catch {
+      return { env, record: null, elided: false };
+    }
+  }
+  /**
+   * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
+   * digest-only classified fields: the codec already omits them from `_data`
+   * on write, but the write path caches the pre-encrypt `record` object
+   * directly (to skip a redundant decrypt) — without this, a vdig field's
+   * plaintext would sit in the working-set cache and `get()` would leak it
+   * right back out, defeating C6.
+   */
+  async _toCacheableRecord(record, envelope, id) {
+    const base = await this.codec.toCacheRecord(record, envelope, id);
+    if (this.vdigFields === null) return base;
+    const clone = { ...base };
+    for (const field of this.vdigFields.keys()) delete clone[field];
+    return clone;
+  }
   /** @internal Untracked put body — call {@link put}, not this. */
   async _putInternal(id, record, options) {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
-    record = canonicalizeIncomingMoney(record, this.moneyFields);
+    if (this.moneyFields) record = moneyRuntime().canonicalizeIncomingMoney(record, this.moneyFields);
     if (this.subsystemBus?.hasGateHandlers("beforePut")) {
-      const existingEnv = await this.adapter.get(this.vault, this.name, id);
-      let existingRecord = null;
-      if (existingEnv) {
-        try {
-          existingRecord = await this.codec.decryptRecord(existingEnv, { skipValidation: true });
-        } catch {
-          existingRecord = null;
-        }
-      }
+      const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
       const gateEvent = {
         op: existingEnv ? "update" : "create",
         vault: this.vault,
         collection: this.name,
         docId: id,
         incoming: record,
-        existing: canonicalizeStoredMoney(existingRecord, this.moneyFields),
+        existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
         existingVersion: existingEnv?._v ?? 0,
         existingTs: existingEnv?._ts,
         userId: this.keyring.userId,
@@ -2609,14 +2644,17 @@ var Collection = class {
       };
       await this.subsystemBus.dispatchGate("beforePut", gateEvent);
     }
+    if (this.classified !== void 0) {
+      enforceClassifiedWrite(record, this.classified.byField, this.name);
+    }
     if (this.computed !== void 0) {
-      record = evalComputedFields(record, this.computed, id);
+      record = (await loadEvalComputedFields())(record, this.computed, id);
     }
     if (this.schema !== void 0) {
       record = await validateSchemaInput(this.schema, record, `put(${id})`);
     }
     if (this.moneyFields) {
-      record = quantizeMoneyFields(record, this.moneyFields);
+      record = moneyRuntime().quantizeMoneyFields(record, this.moneyFields);
     }
     if (this.i18nFields) {
       const obj = record;
@@ -2744,7 +2782,8 @@ var Collection = class {
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved && this.historyConfig.enabled !== false) {
-        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2);
+        const vdigCtx2 = this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0;
+        const histEnvelope = await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, vdigCtx2);
         await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, histEnvelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
         if (this.historyConfig.maxVersions) {
@@ -2803,8 +2842,9 @@ var Collection = class {
     const version = existing ? existing.version + 1 : 1;
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
+    const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     if (existing && this.historyConfig.enabled !== false) {
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek);
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
       this.emitter.emit("history:save", {
         vault: this.vault,
@@ -2818,8 +2858,9 @@ var Collection = class {
         });
       }
     }
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs);
+    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx);
     await this.adapter.put(this.vault, this.name, id, envelope);
+    await this._ensureClassifiedMarker();
     if (this.embeddings) {
       await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
     }
@@ -2839,10 +2880,10 @@ var Collection = class {
       await this.ledger.append(appendInput);
     }
     if (this.lazy && this.lru) {
-      this.lru.set(id, { record: await this.codec.toCacheRecord(record, envelope, id), version }, estimateRecordBytes(record));
+      this.lru.set(id, { record: await this._toCacheableRecord(record, envelope, id), version }, estimateRecordBytes(record));
       await this.maintainPersistedIndexesOnPut(id, record, existing ? existing.record : null, version);
     } else {
-      this.cache.set(id, { record: await this.codec.toCacheRecord(record, envelope, id), version });
+      this.cache.set(id, { record: await this._toCacheableRecord(record, envelope, id), version });
       this.indexes?.upsert(id, record, existing ? existing.record : null);
       this.uniqueConstraints?.upsert(id, record, existing?.record);
     }
@@ -2885,7 +2926,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-2FWQRLMG.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2894,7 +2935,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-3JWHNDIY.js");
+          staleHelpers = await import("./stale-7Q62KVI3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -2946,7 +2987,7 @@ var Collection = class {
       raw = (await this.resolvePriorValues(id))?.record ?? null;
     }
     if (raw === null) return null;
-    return canonicalizeStoredMoney(raw, this.moneyFields);
+    return this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(raw, this.moneyFields) : raw;
   }
   /**
    * @internal Ids of records whose top-level `field` equals `value`.
@@ -3029,7 +3070,7 @@ var Collection = class {
   }
   async dispatchDerivations(id, record, version) {
     if (this.derivationSource === void 0) return;
-    const incoming = canonicalizeStoredMoney(record, this.moneyFields);
+    const incoming = this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(record, this.moneyFields) : record;
     if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
     const registry = this.derivationSource.registry();
     const strategies = registry.strategiesForSource(this.name);
@@ -3079,7 +3120,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-Z5ZLJVTV.js"));
+        ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3098,7 +3139,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-GF3DJ6KR.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3225,7 +3266,7 @@ var Collection = class {
       const next = transform(record);
       const nextVersion = (env._v ?? 0) + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek);
+      const newEnv = await this.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: env } : void 0);
       await this.adapter.put(this.vault, this.name, id, newEnv);
       await this._invalidateCacheEntry(id);
       if (this.ledger) {
@@ -3306,21 +3347,15 @@ var Collection = class {
       throw new ReadOnlyError();
     }
     if (this.subsystemBus?.hasGateHandlers("beforeDelete")) {
-      const existingEnv = await this.adapter.get(this.vault, this.name, id);
-      if (existingEnv) {
-        let existingRecord = null;
-        try {
-          existingRecord = await this.codec.decryptRecord(existingEnv, { skipValidation: true });
-        } catch {
-          existingRecord = null;
-        }
+      const { env: existingEnv, record: existingRecord, elided } = await this.resolveGatePrior("beforeDelete", id);
+      if (existingEnv || elided) {
         await this.subsystemBus.dispatchGate("beforeDelete", {
           vault: this.vault,
           collection: this.name,
           docId: id,
-          existing: canonicalizeStoredMoney(existingRecord, this.moneyFields),
-          existingVersion: existingEnv._v,
-          existingTs: existingEnv._ts,
+          existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
+          existingVersion: existingEnv?._v ?? 0,
+          existingTs: existingEnv?._ts,
           internal,
           userId: this.keyring.userId,
           role: this.keyring.role
@@ -3347,7 +3382,8 @@ var Collection = class {
     }
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek);
+      const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
+      const historyEnvelope = await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
       await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, historyEnvelope);
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
@@ -3456,7 +3492,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-GF3DJ6KR.js");
+          helpers = await import("./fanout-sidecar-WS22Q5WH.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3490,7 +3526,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-2FWQRLMG.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3499,7 +3535,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-3JWHNDIY.js");
+          staleHelpers = await import("./stale-7Q62KVI3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3522,7 +3558,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-3JWHNDIY.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4351,7 +4387,8 @@ var Collection = class {
     const result = {};
     for (const [id, entry] of this.cache) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek);
+      const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
+      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
     }
     return result;
   }
@@ -4377,7 +4414,7 @@ var Collection = class {
     const locale = localeOpts?.locale ?? this.defaultLocale;
     let result = record;
     if (hasMoney && this.moneyFields) {
-      result = decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
+      result = moneyRuntime().decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
     }
     const hasStaticDisplay = hasDict && this.dictKeyFields !== void 0 && Object.values(this.dictKeyFields).some(
       (d) => isStaticDictDescriptor(d) && d.displayLocale !== void 0
@@ -4663,6 +4700,20 @@ var Collection = class {
       id
     );
   }
+  /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
+  async _ensureClassifiedMarker() {
+    if (this._markerPersisted || this.vdigFields === null) return;
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-KGM7ZRW4.js");
+    await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
+    this._markerPersisted = true;
+  }
+  /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
+  async _classifiedMarkerDigestOnly() {
+    if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-KGM7ZRW4.js");
+    this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
+    return this._markerDigestOnlyCache;
+  }
   /**
    * find the first record whose deterministic field matches
    * the given plaintext. Returns `null` when no match exists.
@@ -5384,141 +5435,6 @@ var RefRegistry = class {
   }
 };
 
-// src/with-shape/links/link-set.ts
-var LINK_COLLECTION_PREFIX = "_links_";
-function linkCollectionName(name) {
-  return `${LINK_COLLECTION_PREFIX}${name}`;
-}
-function isLinkCollectionName(name) {
-  return name.startsWith(LINK_COLLECTION_PREFIX);
-}
-function linkRowKey(aId, bId) {
-  return `${encodeURIComponent(aId)}|${encodeURIComponent(bId)}`;
-}
-var LinkSet = class {
-  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
-    this.adapter = adapter;
-    this.vault = vault;
-    this.name = name;
-    this.spec = spec;
-    this.encrypted = encrypted;
-    this.getDEK = getDEK;
-    this.actor = actor;
-    this.emitter = emitter;
-    this.endpointExists = endpointExists;
-    this.collName = linkCollectionName(name);
-  }
-  adapter;
-  vault;
-  name;
-  spec;
-  encrypted;
-  getDEK;
-  actor;
-  emitter;
-  endpointExists;
-  collName;
-  dekPromise = null;
-  dek() {
-    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
-    return this.dekPromise;
-  }
-  async encryptEntry(entry, version) {
-    const json = JSON.stringify(entry);
-    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
-    if (!this.encrypted) return { ...base, _iv: "", _data: json };
-    const { iv, data } = await encrypt(json, await this.dek());
-    return { ...base, _iv: iv, _data: data };
-  }
-  async decryptEntry(env) {
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
-    return JSON.parse(json);
-  }
-  async connect(aId, bId, meta) {
-    if (!await this.endpointExists(this.spec.a, aId)) {
-      throw new LinkEndpointError(this.name, this.spec.a, aId);
-    }
-    if (!await this.endpointExists(this.spec.b, bId)) {
-      throw new LinkEndpointError(this.name, this.spec.b, bId);
-    }
-    const key = linkRowKey(aId, bId);
-    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
-    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
-  }
-  async disconnect(aId, bId) {
-    const key = linkRowKey(aId, bId);
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    if (!existing) return;
-    await this.adapter.delete(this.vault, this.collName, key);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
-  }
-  async has(aId, bId) {
-    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
-  }
-  async of(id) {
-    const rows = await this.list();
-    return rows.filter((r) => r.a === id || r.b === id);
-  }
-  async list() {
-    const keys = await this.adapter.list(this.vault, this.collName);
-    const out = [];
-    for (const key of keys) {
-      const env = await this.adapter.get(this.vault, this.collName, key);
-      if (!env) continue;
-      const e = await this.decryptEntry(env);
-      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
-    }
-    return out;
-  }
-  // ── Vault-internal cascade helpers ──────────────────────────────────
-  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
-  async _rowsTouchingEndpoint(collection, id) {
-    const rows = await this.list();
-    return rows.filter(
-      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
-    );
-  }
-  /** @internal — the storage collection name (for tx pre-image capture). */
-  get _collectionName() {
-    return this.collName;
-  }
-};
-var LinkEndpointError = class extends NoydbError {
-  link;
-  endpoint;
-  missingId;
-  constructor(link, endpoint, missingId) {
-    super(
-      "LINK_ENDPOINT",
-      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
-    );
-    this.name = "LinkEndpointError";
-    this.link = link;
-    this.endpoint = endpoint;
-    this.missingId = missingId;
-  }
-};
-var LinkIntegrityError = class extends NoydbError {
-  link;
-  endpoint;
-  id;
-  count;
-  constructor(link, endpoint, id, count) {
-    super(
-      "LINK_INTEGRITY",
-      `Cannot delete "${endpoint}"/"${id}": ${count} link(s) in "${link}" still reference it (onDelete: 'strict').`
-    );
-    this.name = "LinkIntegrityError";
-    this.link = link;
-    this.endpoint = endpoint;
-    this.id = id;
-    this.count = count;
-  }
-};
-
 // src/with-shape/links/vault-facade.ts
 var VaultLinks = class {
   constructor(deps) {
@@ -5838,74 +5754,21 @@ var VaultLinks = class {
   }
 };
 
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek);
-  if (stored && isEquivalent(stored, fresh)) {
-    return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-  }
-  let decision = { action: "allow" };
-  const strategies = opts.strategies ?? [];
-  if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-    const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-    decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-  }
-  if (decision.action !== "allow") {
-    return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-  }
-  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, fresh);
-  return { written: true, skipped: false, envelope: fresh, decision };
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
+// src/with-shape/links/lazy-handle.ts
+function makeLazyLinkSetHandle(d) {
+  let engine = null;
+  const load = () => engine ??= import("./link-set-UQEIYQAM.js").then(
+    ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
+  );
+  return {
+    _collectionName: linkCollectionName(d.name),
+    connect: async (aId, bId, meta) => (await load()).connect(aId, bId, meta),
+    disconnect: async (aId, bId) => (await load()).disconnect(aId, bId),
+    has: async (aId, bId) => (await load()).has(aId, bId),
+    of: async (id) => (await load()).of(id),
+    list: async () => (await load()).list(),
+    _rowsTouchingEndpoint: async (collection, id) => (await load())._rowsTouchingEndpoint(collection, id)
+  };
 }
 
 // src/with-shape/schema-update/gate.ts
@@ -6021,70 +5884,6 @@ var SchemaFenceController = class {
   }
 };
 
-// src/with-shape/schema-update/fence-watcher.ts
-var FenceWatcher = class {
-  #coordination;
-  #vault;
-  #writerId;
-  #sessionId;
-  #onFlush;
-  #now;
-  #emit;
-  #lastState = null;
-  #quiescedAtVersion = null;
-  #timer;
-  constructor(opts) {
-    this.#coordination = opts.coordination;
-    this.#vault = opts.vault;
-    this.#writerId = opts.clientId;
-    this.#sessionId = opts.sessionId ?? opts.clientId;
-    this.#onFlush = opts.onFlush;
-    this.#now = opts.now ?? (() => Date.now());
-    this.#emit = opts.emit ?? (() => {
-    });
-  }
-  /** Publish liveness (and the current ack) without changing quiesce state. */
-  async beat() {
-    await this.#coordination.reportPresence(this.#vault, {
-      writerId: this.#writerId,
-      sessionId: this.#sessionId,
-      lastSeen: this.#now(),
-      quiescedAtVersion: this.#quiescedAtVersion
-    });
-  }
-  /** Poll the fence; quiesce on draining; emit on transitions. */
-  async check() {
-    const fence = await this.#coordination.readFence(this.#vault);
-    if (fence.fenceState !== this.#lastState) {
-      this.#lastState = fence.fenceState;
-      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState });
-    }
-    if (fence.fenceState === "draining" && this.#quiescedAtVersion !== fence.currentSchemaVersion) {
-      await this.#onFlush();
-      this.#quiescedAtVersion = fence.currentSchemaVersion;
-      await this.beat();
-    }
-    if (fence.fenceState === "normal") {
-      this.#quiescedAtVersion = null;
-    }
-  }
-  start(intervalMs) {
-    if (this.#timer) return;
-    this.#timer = setInterval(() => {
-      void this.beat();
-      void this.check();
-    }, intervalMs);
-    const timer = this.#timer;
-    if (typeof timer.unref === "function") timer.unref();
-  }
-  stop() {
-    if (this.#timer) {
-      clearInterval(this.#timer);
-      this.#timer = void 0;
-    }
-  }
-};
-
 // src/with-audit/attestation/vault-facade.ts
 var VaultAttestation = class {
   constructor(deps, strategy) {
@@ -6157,224 +5956,6 @@ var VaultAttestation = class {
   }
 };
 
-// src/with-shape/introspection/walk.ts
-var INTERNAL_PREFIX = "_";
-var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
-async function dumpVaultSchema(vault, opts) {
-  const state = vault._introspectState();
-  const sampleSize = opts.sampleSize ?? 50;
-  const withStats = opts.withStats === true;
-  const cacheNames = [...state.collectionCache.keys()];
-  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
-  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
-  const collections = {};
-  for (const name of allNames) {
-    collections[name] = await describeCollection(state, name, sampleSize, withStats);
-  }
-  const materializedViews = describeMVs(state.mvRegistry);
-  const overlayViews = describeOverlays(state.overlayRegistry);
-  const derivations = describeDerivations(state.derivationRegistry);
-  let internal;
-  if (withStats) {
-    internal = {};
-    for (const name of KNOWN_INTERNAL_NAMES) {
-      const stats = await statsForCollection(state.adapter, state.name, name);
-      if (stats.records > 0) {
-        internal[name] = { records: stats.records, bytes: stats.bytes };
-      }
-    }
-  }
-  const snap = {
-    _noydb_snapshot: 1,
-    vault: state.name,
-    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    subsystems: state.subsystems,
-    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
-    collections,
-    materializedViews,
-    overlayViews,
-    derivations,
-    ...internal !== void 0 ? { internal } : {}
-  };
-  return snap;
-}
-async function safeListAllCollections(adapter, vault) {
-  try {
-    const snap = await adapter.loadAll(vault);
-    return Object.keys(snap);
-  } catch {
-    return [];
-  }
-}
-async function describeCollection(state, collectionName, sampleSize, withStats) {
-  let fields = {};
-  let validator;
-  const refsRaw = state.refRegistry.getOutbound(collectionName);
-  const refs = {};
-  for (const [name, desc] of Object.entries(refsRaw)) {
-    refs[name] = { target: desc.target, mode: desc.mode };
-  }
-  try {
-    const dek = await state.getDEK(collectionName);
-    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
-    if (persisted) {
-      validator = { kind: persisted.kind, source: "persisted" };
-      if (persisted.jsonSchema) {
-        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
-      }
-    }
-  } catch {
-  }
-  const liveColl = state.collectionCache.get(collectionName);
-  if (!validator) {
-    const schema = liveColl?.getSchema();
-    if (schema) {
-      try {
-        const derived = await derivePersistedSchema(schema);
-        validator = { kind: derived.kind, source: "live-validator" };
-        if (derived.jsonSchema) {
-          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
-        }
-      } catch {
-      }
-    }
-  }
-  if (Object.keys(fields).length === 0 && sampleSize > 0) {
-  }
-  const collMeta = liveColl?.getMeta();
-  const collConfig = liveColl?.getConfig();
-  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
-  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
-  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
-  let mergedConfig;
-  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
-    mergedConfig = {
-      ...collConfig ?? {},
-      ...archivePresent ? { archive: true } : {},
-      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
-    };
-  }
-  const descriptor = {
-    fields,
-    indexes: [],
-    refs,
-    ...validator ? { validator } : {},
-    ...collMeta !== void 0 ? { meta: collMeta } : {},
-    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
-  };
-  if (withStats) {
-    const stats = await statsForCollection(state.adapter, state.name, collectionName);
-    descriptor.stats = stats;
-  }
-  return descriptor;
-}
-async function statsForCollection(adapter, vault, collection) {
-  const ids = await adapter.list(vault, collection);
-  if (ids.length === 0) {
-    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
-  }
-  let total = 0;
-  let min = Number.POSITIVE_INFINITY;
-  let max = 0;
-  let oldest = "\uFFFF";
-  let newest = "";
-  for (const id of ids) {
-    const env = await adapter.get(vault, collection, id);
-    if (!env) continue;
-    const size = env._data.length;
-    total += size;
-    if (size < min) min = size;
-    if (size > max) max = size;
-    if (env._ts < oldest) oldest = env._ts;
-    if (env._ts > newest) newest = env._ts;
-  }
-  return {
-    records: ids.length,
-    bytes: total,
-    bytesAvg: Math.round(total / ids.length),
-    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
-    bytesMax: max,
-    oldest: oldest === "\uFFFF" ? "" : oldest,
-    newest
-  };
-}
-function describeMVs(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const spec = reg.spec;
-    if (!spec?.name) continue;
-    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
-    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
-    const aggregate = spec.aggregate ? Object.fromEntries(
-      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
-    ) : void 0;
-    out[spec.name] = {
-      sources,
-      ...groupBy ? { groupBy } : {},
-      ...aggregate ? { aggregate } : {},
-      refresh: spec.refresh ?? "eager"
-    };
-  }
-  return out;
-}
-function describeOverlays(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const specs = listFromRegistry(registry);
-  const out = {};
-  for (const spec of specs) {
-    const s = spec;
-    if (!s.name || !s.base || !s.overlay) continue;
-    out[s.name] = { base: s.base, overlay: s.overlay };
-  }
-  return out;
-}
-function describeDerivations(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const s = reg.spec ?? reg;
-    if (!s.source) continue;
-    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
-    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
-    out[key] = {
-      source: s.source,
-      outputs: outputCollections
-    };
-  }
-  return out;
-}
-function listFromRegistry(reg) {
-  for (const method of ["all", "list", "specs", "values"]) {
-    const fn = reg[method];
-    if (typeof fn === "function") {
-      try {
-        const out = fn.call(reg);
-        if (Array.isArray(out)) return out;
-        if (out && typeof out.values === "function") {
-          return [...out.values()];
-        }
-      } catch {
-        continue;
-      }
-    }
-  }
-  return [];
-}
-function summariseAggregateOp(value) {
-  if (value && typeof value === "object") {
-    const op = value.op ?? value.kind;
-    const field = value.field;
-    if (op && field) return `${op}(${field})`;
-    if (op) return op;
-  }
-  return String(value);
-}
-
 // src/kernel/vault.ts
 function resolveLabelFromMap(labels, locale, fallback) {
   if (labels[locale] !== void 0) return labels[locale];
@@ -6427,6 +6008,7 @@ var Vault = class {
   /** Per-collection record archival policies. Indexed by collection name. */
   archiveRegistry = /* @__PURE__ */ new Map();
   indexStrategy;
+  lazyStrategy;
   aggregateStrategy;
   crdtStrategy;
   tiersStrategy;
@@ -6448,6 +6030,7 @@ var Vault = class {
   forgetStrategy;
   i18nStrategy;
   syncStrategy;
+  classifiedStrategy;
   /**
    * Per-vault guard registry. `null` until `_initGuards()` runs; stays
    * `null` for vaults that never register any guard strategy. The
@@ -6645,7 +6228,7 @@ var Vault = class {
   dictionaryCache = /* @__PURE__ */ new Map();
   /** Registered link specs, keyed by link name; set by `vault.link()`. */
   linkRegistry = /* @__PURE__ */ new Map();
-  /** Cache of LinkSet handles, one per link name. */
+  /** Cache of link-set handles, one per link name (lazy -- see links()). */
   linkSetCache = /* @__PURE__ */ new Map();
   /** — subscribers for cross-tier access events. */
   crossTierSubs = /* @__PURE__ */ new Set();
@@ -6679,6 +6262,7 @@ var Vault = class {
     this.objectStore = opts.objectStore;
     this.archiveStrategy = opts.archiveStrategy;
     this.indexStrategy = opts.indexStrategy;
+    this.lazyStrategy = opts.lazyStrategy;
     this.aggregateStrategy = opts.aggregateStrategy;
     this.crdtStrategy = opts.crdtStrategy;
     this.tiersStrategy = opts.tiersStrategy;
@@ -6713,6 +6297,7 @@ var Vault = class {
     this.forgetStrategy = opts.forgetStrategy ?? NO_FORGET;
     this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
     this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
+    this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
     this.reloadKeyring = opts.reloadKeyring;
@@ -6825,6 +6410,9 @@ var Vault = class {
     if (coll && options?.meta) {
       coll._applyMeta(options.meta);
     }
+    if (coll && options?.classifiedFields) {
+      coll._applyClassifiedFields(options.classifiedFields);
+    }
     if (!coll) {
       if (options?.refs) {
         this.refRegistry.register(collectionName, options.refs);
@@ -6869,6 +6457,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
+          const { persistSchemaIfNeeded } = await import("./register-K6DDSIXN.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -6880,7 +6469,7 @@ var Vault = class {
           const decision = result.decision ?? { action: "allow" };
           if (decision.action === "cutover") {
             this.schemaFence.registerPendingCutover(collectionName, decision.transform);
-            this._ensureFenceCoordination();
+            await this._ensureFenceCoordination();
           }
           return decision;
         })();
@@ -6914,6 +6503,7 @@ var Vault = class {
         ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
         ...options?.blobFields !== void 0 ? { blobFields: options.blobFields } : {},
         ...this.indexStrategy !== void 0 ? { indexStrategy: this.indexStrategy } : {},
+        ...this.lazyStrategy !== void 0 ? { lazyStrategy: this.lazyStrategy } : {},
         ...this.aggregateStrategy !== void 0 ? { aggregateStrategy: this.aggregateStrategy } : {},
         ...this.crdtStrategy !== void 0 ? { crdtStrategy: this.crdtStrategy } : {},
         ...this.tiersStrategy !== void 0 ? { tiersStrategy: this.tiersStrategy } : {},
@@ -6921,6 +6511,7 @@ var Vault = class {
         historyStrategy: this.historyStrategy,
         i18nStrategy: this.i18nStrategy,
         syncStrategy: this.syncStrategy,
+        classifiedStrategy: this.classifiedStrategy,
         // Per-collection ledger opt-out: when this collection sets
         // `historyConfig.ledger: false`, withhold the ledger reference so all
         // four `if (this.ledger)` append sites in Collection no-op. The chain
@@ -6970,19 +6561,24 @@ var Vault = class {
       if (options?.acknowledgeDeterministicRisk !== void 0) {
         collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
       }
+      if (options?.acknowledgeEquatableRisk !== void 0) {
+        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
+      }
       if (options?.sensitive !== void 0) {
         collOpts.sensitive = options.sensitive;
       }
       if (options?.perRecordKeys !== void 0) {
         collOpts.perRecordKeys = options.perRecordKeys;
       }
-      if (this.forgetStrategy.subjects[collectionName] !== void 0) {
+      const subjectKey = this.forgetStrategy.subjects[collectionName];
+      if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
             `[noy-db] Collection "${collectionName}" is declared in withForgetCascade but opened with perRecordKeys: false. Forcing perRecordKeys: true \u2014 GDPR crypto-shred requires per-record CEKs.`
           );
         }
         collOpts.perRecordKeys = true;
+        collOpts.subjectKeyField = subjectKey;
       }
       if (options?.provenance !== void 0) collOpts.provenance = options.provenance;
       if (options?.ramCiphertext !== void 0) collOpts.ramCiphertext = options.ramCiphertext;
@@ -6997,6 +6593,7 @@ var Vault = class {
       if (options?.textIndexPersist !== void 0) collOpts.textIndexPersist = options.textIndexPersist;
       if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
       if (options?.computed !== void 0) collOpts.computed = options.computed;
+      if (options?.classifiedFields !== void 0) collOpts.classifiedFields = options.classifiedFields;
       if (options?.dictKeyFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const stat = this.staticByName.get(dictName);
@@ -7039,7 +6636,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await persistSchemaIfNeeded({
+            await (await import("./register-K6DDSIXN.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7123,10 +6720,12 @@ var Vault = class {
   async schemaFenceState() {
     return loadFence(this.adapter, this.name);
   }
-  /** @internal Start the per-client heartbeat + fence watcher once a cutover is registered. */
-  _ensureFenceCoordination() {
+  /** @internal Start heartbeat + fence watcher once a cutover is registered. Async since #553: FenceWatcher dynamic-imports on demand. */
+  async _ensureFenceCoordination() {
     if (this.#fenceCoordinationStarted) return;
     this.#fenceCoordinationStarted = true;
+    const { FenceWatcher } = await import("./fence-watcher-DHQ775JB.js");
+    if (!this.#fenceCoordinationStarted) return;
     this.#fenceWatcher = new FenceWatcher({
       coordination: this.noydb.coordination,
       vault: this.name,
@@ -7155,7 +6754,7 @@ var Vault = class {
   }
   /** @internal Drive one heartbeat + watch cycle deterministically (tests). */
   async _fenceTick() {
-    this._ensureFenceCoordination();
+    await this._ensureFenceCoordination();
     await this.#fenceWatcher.beat();
     await this.#fenceWatcher.check();
   }
@@ -7367,17 +6966,17 @@ var Vault = class {
       if (!spec) {
         throw new ValidationError(`vault.links("${name}"): not declared. Call vault.link("${name}", { a, b }) first.`);
       }
-      handle = new LinkSet(
-        this.adapter,
-        this.name,
+      handle = makeLazyLinkSetHandle({
+        adapter: this.adapter,
+        vault: this.name,
         name,
         spec,
-        this.encrypted,
-        this.getDEK,
-        this.keyring.userId,
-        this.emitter,
-        async (collection, id) => await this.collection(collection).get(id) !== null
-      );
+        encrypted: this.encrypted,
+        getDEK: this.getDEK,
+        actor: this.keyring.userId,
+        emitter: this.emitter,
+        endpointExists: async (collection, id) => await this.collection(collection).get(id) !== null
+      });
       this.linkSetCache.set(name, handle);
     }
     return handle;
@@ -7886,8 +7485,14 @@ var Vault = class {
       if (live?._sealed !== void 0) {
         try {
           const cls = await coll._classifySealedShred(live);
-          sealedFieldsShredded += cls.shreddable.length;
-          for (const field of cls.dekResidue) sealedResidue.push(`${ref2.collection}:${ref2.id}:${field}`);
+          for (const slot of cls.slots) {
+            if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") {
+              sealedFieldsShredded += 1;
+            }
+            if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") {
+              sealedResidue.push(`${ref2.collection}:${ref2.id}:${slot.field}`);
+            }
+          }
         } catch {
           for (const field of Object.keys(live._sealed)) sealedResidue.push(`${ref2.collection}:${ref2.id}:${field}`);
         }
@@ -7946,7 +7551,7 @@ var Vault = class {
         indexResidue.push(`${collName}:_ftindex`);
       }
     }
-    const subjectHash = await sha256Hex2(subjectId);
+    const subjectHash = await sha256Hex(subjectId);
     const ledger = this.getLedgerOrNull();
     if (!ledger) {
       throw new Error(
@@ -8114,7 +7719,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-WEUCHBO4.js"),
+      import("./registry-IMNMHWTM.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -8145,7 +7750,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-5GRV5VXI.js");
+    const { MaterializedViewRegistry } = await import("./registry-K6VUQXKV.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -8169,7 +7774,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-45RJNWGU.js");
+    const { OverlayedViewRegistry } = await import("./registry-ZVO3T4M5.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -8216,13 +7821,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-2FWQRLMG.js");
+    const { MaterializedViewExecutor } = await import("./executor-FGISLQIN.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-3JWHNDIY.js");
+    const { clearMVStale } = await import("./stale-7Q62KVI3.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -8238,7 +7843,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-Z5ZLJVTV.js");
+    const { DerivationExecutor } = await import("./executor-CBTNU5VZ.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -8263,7 +7868,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-GF3DJ6KR.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8413,11 +8018,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn) {
+  async withConsent(ctx, fn2) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn();
+      return await fn2();
     } finally {
       this.consentContext = prior;
     }
@@ -8485,7 +8090,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UL5HKLER.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8507,7 +8112,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-UL5HKLER.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8723,6 +8328,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
+    const { dumpVaultSchema } = await import("./walk-5C3GPKT2.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -8857,7 +8463,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-JHDQCPSX.js");
+    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -8872,7 +8478,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-KMJQ66MF.js");
+    const { dumpVault } = await import("./backup-MOB27UUN.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -8924,7 +8530,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-KMJQ66MF.js");
+    const { loadVault } = await import("./backup-MOB27UUN.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -8956,7 +8562,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-KMJQ66MF.js");
+    const { verifyBackupIntegrity } = await import("./backup-MOB27UUN.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9174,7 +8780,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-KMJQ66MF.js");
+    const { exportVaultJSON } = await import("./backup-MOB27UUN.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -9251,10 +8857,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn) {
+  async track(fn2) {
     this.begin();
     try {
-      const value = await fn();
+      const value = await fn2();
       this.settle();
       return value;
     } catch (error) {
@@ -9339,13 +8945,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn) {
-    this.#roleHandlers.add(fn);
-    return () => this.#roleHandlers.delete(fn);
+  onTabRoleChange(fn2) {
+    this.#roleHandlers.add(fn2);
+    return () => this.#roleHandlers.delete(fn2);
   }
-  onActiveTabsChange(fn) {
-    this.#tabsHandlers.add(fn);
-    return () => this.#tabsHandlers.delete(fn);
+  onActiveTabsChange(fn2) {
+    this.#tabsHandlers.add(fn2);
+    return () => this.#tabsHandlers.delete(fn2);
   }
   dispose() {
     if (this.#disposed) return;
@@ -10042,6 +9648,35 @@ var TeamFacade = class {
     }
     return p;
   }
+  // ─── Multi-user grant / revoke / rotate runners (#267 team split) ──
+  //
+  // The kernel's `db.grant` / `db.revoke` / `db.rotate` route through the
+  // TeamStrategy seam, which calls back here with the keyring ENGINE as an
+  // argument (statically linked in `active.ts`, i.e. only in the
+  // `@noy-db/hub/team` subpath bundle). These runners own the policy-gate +
+  // keyring plumbing so the kernel keeps single-line delegators and the
+  // engines stay off the single-user floor.
+  /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
+  async runGrant(engine, vault, options, factors) {
+    this.deps.checkPolicyOperation(vault, "grant");
+    await this.deps.checkGate(vault, "enroll-user", factors);
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, options);
+  }
+  /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
+  async runRevoke(engine, vault, options, factors) {
+    this.deps.checkPolicyOperation(vault, "revoke");
+    await this.deps.checkGate(vault, "revoke-user", factors);
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, options);
+  }
+  /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
+  async runRotate(engine, vault, collections) {
+    this.deps.checkPolicyOperation(vault, "rotate");
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, collections);
+    this.deps.keyringCache.set(vault, keyring);
+  }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
    * Add a tier-2 authenticator slot to the calling user's keyring.
@@ -10787,6 +10422,15 @@ var Noydb = class {
   /** Pre-resolved `vault.user` API factory (mirrors `coordinationProvider` above). Public so `Vault` can call it. */
   userApiFactory;
   vaultCache = /* @__PURE__ */ new Map();
+  /**
+   * In-flight `openVault` promise per name — concurrent opens of the same
+   * vault must converge on ONE Vault instance. Without this, two callers
+   * racing past the `vaultCache` miss each construct a Vault (and later two
+   * Collections with independent DEKs for the same store slice), so a record
+   * written through one fails decryption through the other with a spurious
+   * `TamperedError` (#564).
+   */
+  vaultOpening = /* @__PURE__ */ new Map();
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
@@ -10826,6 +10470,11 @@ var Noydb = class {
    * through it; grant/revoke route through it from this class. @internal
    */
   custodyStrategy;
+  /**
+   * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
+   * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
+   * engines are linked only by the active strategy, not by this file. */
+  teamStrategy;
   sessionStrategy;
   syncStrategy;
   snapshots;
@@ -10876,6 +10525,7 @@ var Noydb = class {
     this.txStrategy = options.txStrategy ?? NO_TX;
     this.forgetStrategy = options.forgetStrategy ?? NO_FORGET;
     this.custodyStrategy = options.custodyStrategy ?? NO_CUSTODY;
+    this.teamStrategy = options.teamStrategy ?? NO_TEAM;
     this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
     this.syncStrategy = options.syncStrategy ?? NO_SYNC;
     this.snapshots = new NoydbSnapshots({
@@ -10907,6 +10557,7 @@ var Noydb = class {
       quickUnlock: this.quickUnlock,
       policyCache: this.policyCache,
       checkGate: (vault, gate, factors) => this.checkGate(vault, gate, factors),
+      checkPolicyOperation: (vault, op) => this.checkPolicyOperation(vault, op),
       getKeyringInternal: (vault, opts) => this._getKeyringInternal(vault, opts),
       assertRecoveryEnrolled: (vault, policy, opts) => this.assertRecoveryEnrolled(vault, policy, opts),
       openVault: (vault, opts) => this.openVault(vault, opts),
@@ -11001,7 +10652,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-QZ7BXICW.js");
+      const { GuardExecutor } = await import("./executor-DJHNSTIR.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -11096,12 +10747,26 @@ var Noydb = class {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.touchPolicy(name);
     let comp = this.vaultCache.get(name);
+    if (!comp) {
+      const pending = this.vaultOpening.get(name);
+      if (pending) comp = await pending;
+    }
     if (comp) {
       if (opts?.locale !== void 0) {
         comp.setLocale(opts.locale);
       }
       return comp;
     }
+    const opening = this.#openVaultFresh(name, opts);
+    this.vaultOpening.set(name, opening);
+    try {
+      return await opening;
+    } finally {
+      this.vaultOpening.delete(name);
+    }
+  }
+  /** Uncached single-flight body of {@link openVault} — see `vaultOpening`. */
+  async #openVaultFresh(name, opts) {
     const keyring = await this._getKeyringInternal(name, { create: opts?.create !== false });
     if (!this.activeTier.has(name)) {
       this.activeTier.set(name, 1);
@@ -11142,7 +10807,7 @@ var Noydb = class {
         this.syncEngines.set(key, engine);
       }
     }
-    comp = new Vault({
+    const comp = new Vault({
       adapter: this.options.store,
       name,
       noydb: this,
@@ -11163,6 +10828,7 @@ var Noydb = class {
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
       ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
       ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11178,6 +10844,7 @@ var Noydb = class {
       ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
       forgetStrategy: this.forgetStrategy,
       ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
+      ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
       ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
       ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
       ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {},
@@ -11228,6 +10895,7 @@ var Noydb = class {
         ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
         ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
         ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+        ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
         ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
         ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
         ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11243,6 +10911,7 @@ var Noydb = class {
         ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
         forgetStrategy: this.forgetStrategy,
         ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
+        ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
         ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
         ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
         ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {}
@@ -11267,6 +10936,7 @@ var Noydb = class {
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
       ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
       ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11294,12 +10964,10 @@ var Noydb = class {
    *
    * The legacy `requireReAuthFor: ['grant']` session-policy check still
    * fires on top — both are independent opt-ins.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    this.checkPolicyOperation(vault, "grant");
-    await this.checkGate(vault, "enroll-user", factors);
-    const keyring = await this._getKeyringInternal(vault);
-    await grant(this.options.store, vault, keyring, options);
+    return this.teamStrategy.grant(this.team, vault, options, factors);
   }
   /**
    * Revoke a user's access to a vault.
@@ -11309,12 +10977,10 @@ var Noydb = class {
    *
    * The legacy `requireReAuthFor: ['revoke']` session-policy check still
    * fires on top — both are independent opt-ins.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    this.checkPolicyOperation(vault, "revoke");
-    await this.checkGate(vault, "revoke-user", factors);
-    const keyring = await this._getKeyringInternal(vault);
-    await revoke(this.options.store, vault, keyring, options);
+    return this.teamStrategy.revoke(this.team, vault, options, factors);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -11329,13 +10995,14 @@ var Noydb = class {
   async grantCustodian(vault, options, factors) {
     return this.custodyStrategy.grantCustodian(this, vault, options, factors);
   }
-  /** @internal — the grant-custodian engine, reached only when withCustody() is opted in. */
-  async _grantCustodianImpl(vault, options, factors) {
+  /** @internal — grant-custodian engine, reached only via withCustody(); the
+   * keyring engine arrives as an argument so the floor never carries it (#267). */
+  async _grantCustodianImpl(engine, vault, options, factors) {
     this.checkPolicyOperation(vault, "grant");
     await this.checkGate(vault, "grant-custodian", factors);
     const keyring = await this._getKeyringInternal(vault);
     if (keyring.role !== "owner") throw new PermissionDeniedError("only the Deed owner can grant a custodian");
-    await grant(this.options.store, vault, keyring, { ...options, role: "custodian" });
+    await engine(this.options.store, vault, keyring, { ...options, role: "custodian" });
   }
   /**
    * Revoke a custodian (owner-only custody API).
@@ -11347,13 +11014,14 @@ var Noydb = class {
   async revokeCustodian(vault, options, factors) {
     return this.custodyStrategy.revokeCustodian(this, vault, options, factors);
   }
-  /** @internal — the revoke-custodian engine, reached only when withCustody() is opted in. */
-  async _revokeCustodianImpl(vault, options, factors) {
+  /** @internal — revoke-custodian engine, reached only via withCustody().
+   * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
+  async _revokeCustodianImpl(engine, vault, options, factors) {
     this.checkPolicyOperation(vault, "revoke");
     await this.checkGate(vault, "revoke-user", factors);
     const keyring = await this._getKeyringInternal(vault);
     if (keyring.role !== "owner") throw new PermissionDeniedError("only the Deed owner can revoke a custodian");
-    await revoke(this.options.store, vault, keyring, options);
+    await engine(this.options.store, vault, keyring, options);
   }
   /**
    * Mutate post-grant identity fields on an existing keyring — `role`,
@@ -11420,12 +11088,10 @@ var Noydb = class {
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
    * reaching into internals. See `noy-db rotate` for the CLI wrapper.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async rotate(vault, collections) {
-    this.checkPolicyOperation(vault, "rotate");
-    const keyring = await this._getKeyringInternal(vault);
-    await rotateKeys(this.options.store, vault, keyring, collections);
-    this.keyringCache.set(vault, keyring);
+    return this.teamStrategy.rotate(this.team, vault, collections);
   }
   /** List all users with access to a vault. */
   async listUsers(vault) {
@@ -11585,7 +11251,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn, options = {}) {
+  async queryAcross(vaultIds, fn2, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -11599,7 +11265,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn(comp);
+          const result = await fn2(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -11859,9 +11525,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn) {
-    this.on("write:conflict", fn);
-    return () => this.off("write:conflict", fn);
+  onWriteConflict(fn2) {
+    this.on("write:conflict", fn2);
+    return () => this.off("write:conflict", fn2);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -11935,12 +11601,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn) {
-    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
+  onTabRoleChange(fn2) {
+    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
     });
   }
-  onActiveTabsChange(fn) {
-    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
+  onActiveTabsChange(fn2) {
+    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -12239,7 +11905,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-JHDQCPSX.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-MRN5YYZZ.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12268,7 +11934,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-JHDQCPSX.js");
+    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12459,9 +12125,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-RW3KP7WU.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JOXUNSKP.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-IXK4FVXP.js");
+    const policyModule = await import("./policy-YIKUH4AD.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12478,13 +12144,6 @@ function normalizeSyncTargets(sync) {
 export {
   memoryStore,
   withArchive,
-  ComputedFieldError,
-  evalComputedFields,
-  isZodSchema,
-  derivePersistedSchema,
-  Lru,
-  parseBytes,
-  estimateRecordBytes,
   Collection,
   ELEVATION_AUDIT_COLLECTION,
   ElevatedHandle,
@@ -12494,10 +12153,6 @@ export {
   ref,
   refArray,
   RefRegistry,
-  isLinkCollectionName,
-  LinkEndpointError,
-  LinkIntegrityError,
-  persistSchemaIfNeeded,
   Vault,
   QuickUnlockStore,
   describeAuthConfig,
@@ -12507,4 +12162,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-PSHOXR6C.js.map
+//# sourceMappingURL=chunk-ZPHDGUZZ.js.map