@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.4

package/dist/chunk-NO272T7Q.js

@@ -0,0 +1,194 @@
+// src/kernel/cache/lru.ts
+var Lru = class {
+  entries = /* @__PURE__ */ new Map();
+  maxRecords;
+  maxBytes;
+  currentBytes = 0;
+  hits = 0;
+  misses = 0;
+  evictions = 0;
+  constructor(options) {
+    if (options.maxRecords === void 0 && options.maxBytes === void 0) {
+      throw new Error("Lru: must specify maxRecords, maxBytes, or both");
+    }
+    this.maxRecords = options.maxRecords;
+    this.maxBytes = options.maxBytes;
+  }
+  /**
+   * Look up a key. Hits promote the entry to most-recently-used; misses
+   * return undefined. Both update the running stats counters.
+   */
+  get(key) {
+    const entry = this.entries.get(key);
+    if (!entry) {
+      this.misses++;
+      return void 0;
+    }
+    this.entries.delete(key);
+    this.entries.set(key, entry);
+    this.hits++;
+    return entry.value;
+  }
+  /**
+   * Insert or update a key. If the key already exists, its size is
+   * accounted for and the entry is promoted to MRU. After insertion,
+   * eviction runs to maintain both budgets.
+   */
+  set(key, value, size) {
+    const existing = this.entries.get(key);
+    if (existing) {
+      this.currentBytes -= existing.size;
+      this.entries.delete(key);
+    }
+    this.entries.set(key, { value, size });
+    this.currentBytes += size;
+    this.evictUntilUnderBudget();
+  }
+  /**
+   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.
+   * Returns true if the key was present.
+   */
+  remove(key) {
+    const existing = this.entries.get(key);
+    if (!existing) return false;
+    this.currentBytes -= existing.size;
+    this.entries.delete(key);
+    return true;
+  }
+  /** True if the cache currently holds an entry for the given key. */
+  has(key) {
+    return this.entries.has(key);
+  }
+  /**
+   * Drop every entry. Stats counters survive — call `resetStats()` if you
+   * want a clean slate. Used by `Collection.invalidate()` on key rotation.
+   */
+  clear() {
+    this.entries.clear();
+    this.currentBytes = 0;
+  }
+  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */
+  resetStats() {
+    this.hits = 0;
+    this.misses = 0;
+    this.evictions = 0;
+  }
+  /** Snapshot of current cache statistics. Cheap — no copying. */
+  stats() {
+    return {
+      hits: this.hits,
+      misses: this.misses,
+      evictions: this.evictions,
+      size: this.entries.size,
+      bytes: this.currentBytes
+    };
+  }
+  /**
+   * Iterate over all currently-cached values. Order is least-recently-used
+   * first. Used by tests and devtools — production callers should use
+   * `Collection.scan()` instead.
+   */
+  *values() {
+    for (const entry of this.entries.values()) yield entry.value;
+  }
+  /**
+   * Walk the cache from the LRU end and drop entries until both budgets
+   * are satisfied. Called after every `set()`. Single pass — entries are
+   * never re-promoted during eviction.
+   */
+  evictUntilUnderBudget() {
+    while (this.overBudget()) {
+      const oldest = this.entries.keys().next();
+      if (oldest.done) return;
+      const key = oldest.value;
+      const entry = this.entries.get(key);
+      if (entry) this.currentBytes -= entry.size;
+      this.entries.delete(key);
+      this.evictions++;
+    }
+  }
+  overBudget() {
+    if (this.maxRecords !== void 0 && this.entries.size > this.maxRecords) return true;
+    if (this.maxBytes !== void 0 && this.currentBytes > this.maxBytes) return true;
+    return false;
+  }
+};
+
+// src/kernel/cache/policy.ts
+var UNITS = {
+  "": 1,
+  "B": 1,
+  "KB": 1024,
+  "MB": 1024 * 1024,
+  "GB": 1024 * 1024 * 1024
+  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.
+};
+function parseBytes(input) {
+  if (typeof input === "number") {
+    if (!Number.isFinite(input) || input <= 0) {
+      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`);
+    }
+    return Math.floor(input);
+  }
+  const trimmed = input.trim();
+  if (trimmed === "") {
+    throw new Error("parseBytes: empty string is not a valid byte budget");
+  }
+  const match = /^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]*)$/.exec(trimmed);
+  if (!match) {
+    throw new Error(`parseBytes: invalid byte budget "${input}". Expected format: "1024", "50KB", "50MB", "1GB"`);
+  }
+  const value = parseFloat(match[1]);
+  const unit = (match[2] ?? "").toUpperCase();
+  if (!(unit in UNITS)) {
+    throw new Error(`parseBytes: unknown unit "${match[2]}" in "${input}". Supported: B, KB, MB, GB`);
+  }
+  const bytes = Math.floor(value * UNITS[unit]);
+  if (bytes <= 0) {
+    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from "${input}"`);
+  }
+  return bytes;
+}
+function estimateRecordBytes(record) {
+  try {
+    return JSON.stringify(record).length;
+  } catch {
+    return 0;
+  }
+}
+
+// src/port/with/lazy-strategy.ts
+function buildLazyCache(collection, cache) {
+  if (!cache || cache.maxRecords === void 0 && cache.maxBytes === void 0) {
+    throw new Error(
+      `Collection "${collection}": lazy mode (prefetch: false) requires a cache option with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`
+    );
+  }
+  const lruOptions = {};
+  if (cache.maxRecords !== void 0) lruOptions.maxRecords = cache.maxRecords;
+  if (cache.maxBytes !== void 0) lruOptions.maxBytes = parseBytes(cache.maxBytes);
+  return new Lru(lruOptions);
+}
+var implicitLazyWarned = false;
+var IMPLICIT_LAZY = {
+  createCache(collection, cache) {
+    if (!implicitLazyWarned) {
+      implicitLazyWarned = true;
+      if (!(typeof process !== "undefined" && process.env["NODE_ENV"] === "test")) {
+        console.warn(
+          `[noy-db] Collection "${collection}": lazy mode (prefetch: false) without the lazy service is deprecated \u2014 pass \`lazyStrategy: withLazy()\` (from "@noy-db/hub/lazy") to createNoydb(). The implicit path will be removed at 1.0.`
+        );
+      }
+    }
+    return buildLazyCache(collection, cache);
+  }
+};
+
+export {
+  Lru,
+  parseBytes,
+  estimateRecordBytes,
+  buildLazyCache,
+  IMPLICIT_LAZY
+};
+//# sourceMappingURL=chunk-NO272T7Q.js.map

package/dist/chunk-NO272T7Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/cache/lru.ts","../src/kernel/cache/policy.ts","../src/port/with/lazy-strategy.ts"],"sourcesContent":["/**\n * Generic LRU cache for `Collection`'s lazy hydration mode.\n *\n * Backed by a JavaScript `Map`, which preserves insertion order. Promotion\n * is implemented as `delete()` + `set()` — O(1) on `Map` since both\n * operations are constant-time. Eviction walks the iterator from the front\n * (least recently used) until both budgets are satisfied.\n *\n * ships in-memory only. The cache is never persisted; on collection\n * close every entry is dropped. Persisting cache state is a follow-up\n * once the access patterns from real consumers tell us whether it would\n * pay back the complexity.\n */\n\nexport interface LruEntry<V> {\n  /** The cached value. */\n  readonly value: V\n  /**\n   * Approximate decrypted byte size of the entry. Used by the byte-budget\n   * eviction path. Callers compute this once at insert time and pass it\n   * in — recomputing on every access would dominate the per-record cost.\n   */\n  readonly size: number\n}\n\nexport interface LruOptions {\n  /** Maximum number of entries before eviction. Required if `maxBytes` is unset. */\n  maxRecords?: number\n  /** Maximum total bytes before eviction. Computed from per-entry `size`. */\n  maxBytes?: number\n}\n\nexport interface LruStats {\n  /** Total cache hits since construction (or `resetStats()`). */\n  hits: number\n  /** Total cache misses since construction (or `resetStats()`). */\n  misses: number\n  /** Total entries evicted since construction (or `resetStats()`). */\n  evictions: number\n  /** Current number of cached entries. */\n  size: number\n  /** Current sum of cached entry sizes (in bytes, approximate). */\n  bytes: number\n}\n\n/**\n * O(1) LRU cache. Both `get()` and `set()` promote the touched entry to\n * the most-recently-used end. Eviction happens after every insert and\n * walks the front of the Map iterator dropping entries until both\n * budgets are satisfied.\n */\nexport class Lru<K, V> {\n  private readonly entries = new Map<K, LruEntry<V>>()\n  private readonly maxRecords: number | undefined\n  private readonly maxBytes: number | undefined\n  private currentBytes = 0\n  private hits = 0\n  private misses = 0\n  private evictions = 0\n\n  constructor(options: LruOptions) {\n    if (options.maxRecords === undefined && options.maxBytes === undefined) {\n      throw new Error('Lru: must specify maxRecords, maxBytes, or both')\n    }\n    this.maxRecords = options.maxRecords\n    this.maxBytes = options.maxBytes\n  }\n\n  /**\n   * Look up a key. Hits promote the entry to most-recently-used; misses\n   * return undefined. Both update the running stats counters.\n   */\n  get(key: K): V | undefined {\n    const entry = this.entries.get(key)\n    if (!entry) {\n      this.misses++\n      return undefined\n    }\n    // Promote: re-insert moves the entry to the end of the iteration order.\n    this.entries.delete(key)\n    this.entries.set(key, entry)\n    this.hits++\n    return entry.value\n  }\n\n  /**\n   * Insert or update a key. If the key already exists, its size is\n   * accounted for and the entry is promoted to MRU. After insertion,\n   * eviction runs to maintain both budgets.\n   */\n  set(key: K, value: V, size: number): void {\n    const existing = this.entries.get(key)\n    if (existing) {\n      // Update path: subtract the old size before adding the new one.\n      this.currentBytes -= existing.size\n      this.entries.delete(key)\n    }\n    this.entries.set(key, { value, size })\n    this.currentBytes += size\n    this.evictUntilUnderBudget()\n  }\n\n  /**\n   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.\n   * Returns true if the key was present.\n   */\n  remove(key: K): boolean {\n    const existing = this.entries.get(key)\n    if (!existing) return false\n    this.currentBytes -= existing.size\n    this.entries.delete(key)\n    return true\n  }\n\n  /** True if the cache currently holds an entry for the given key. */\n  has(key: K): boolean {\n    return this.entries.has(key)\n  }\n\n  /**\n   * Drop every entry. Stats counters survive — call `resetStats()` if you\n   * want a clean slate. Used by `Collection.invalidate()` on key rotation.\n   */\n  clear(): void {\n    this.entries.clear()\n    this.currentBytes = 0\n  }\n\n  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */\n  resetStats(): void {\n    this.hits = 0\n    this.misses = 0\n    this.evictions = 0\n  }\n\n  /** Snapshot of current cache statistics. Cheap — no copying. */\n  stats(): LruStats {\n    return {\n      hits: this.hits,\n      misses: this.misses,\n      evictions: this.evictions,\n      size: this.entries.size,\n      bytes: this.currentBytes,\n    }\n  }\n\n  /**\n   * Iterate over all currently-cached values. Order is least-recently-used\n   * first. Used by tests and devtools — production callers should use\n   * `Collection.scan()` instead.\n   */\n  *values(): IterableIterator<V> {\n    for (const entry of this.entries.values()) yield entry.value\n  }\n\n  /**\n   * Walk the cache from the LRU end and drop entries until both budgets\n   * are satisfied. Called after every `set()`. Single pass — entries are\n   * never re-promoted during eviction.\n   */\n  private evictUntilUnderBudget(): void {\n    while (this.overBudget()) {\n      const oldest = this.entries.keys().next()\n      if (oldest.done) return // empty cache; nothing more to evict\n      const key = oldest.value\n      const entry = this.entries.get(key)\n      if (entry) this.currentBytes -= entry.size\n      this.entries.delete(key)\n      this.evictions++\n    }\n  }\n\n  private overBudget(): boolean {\n    if (this.maxRecords !== undefined && this.entries.size > this.maxRecords) return true\n    if (this.maxBytes !== undefined && this.currentBytes > this.maxBytes) return true\n    return false\n  }\n}\n","/**\n * Cache policy helpers — parse human-friendly byte budgets into raw numbers.\n *\n * Accepted shapes (case-insensitive on suffix):\n *   number       — interpreted as raw bytes\n *   '1024'       — string of digits, raw bytes\n *   '50KB'       — kilobytes (×1024)\n *   '50MB'       — megabytes (×1024²)\n *   '1GB'        — gigabytes (×1024³)\n *\n * Decimals are accepted (`'1.5GB'` → 1610612736 bytes).\n *\n * Anything else throws — better to fail loud at construction time than\n * to silently treat a typo as 0 bytes (which would evict everything).\n */\n\nconst UNITS: Record<string, number> = {\n  '': 1,\n  'B': 1,\n  'KB': 1024,\n  'MB': 1024 * 1024,\n  'GB': 1024 * 1024 * 1024,\n  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.\n}\n\n/** Parse a byte budget into a positive integer number of bytes. */\nexport function parseBytes(input: number | string): number {\n  if (typeof input === 'number') {\n    if (!Number.isFinite(input) || input <= 0) {\n      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`)\n    }\n    return Math.floor(input)\n  }\n\n  const trimmed = input.trim()\n  if (trimmed === '') {\n    throw new Error('parseBytes: empty string is not a valid byte budget')\n  }\n\n  // Accept either a bare number or a number followed by a unit suffix.\n  // Regex: optional sign, digits with optional decimal, optional unit.\n  const match = /^([0-9]+(?:\\.[0-9]+)?)\\s*([A-Za-z]*)$/.exec(trimmed)\n  if (!match) {\n    throw new Error(`parseBytes: invalid byte budget \"${input}\". Expected format: \"1024\", \"50KB\", \"50MB\", \"1GB\"`)\n  }\n\n  const value = parseFloat(match[1]!)\n  const unit = (match[2] ?? '').toUpperCase()\n\n  if (!(unit in UNITS)) {\n    throw new Error(`parseBytes: unknown unit \"${match[2]}\" in \"${input}\". Supported: B, KB, MB, GB`)\n  }\n\n  const bytes = Math.floor(value * UNITS[unit]!)\n  if (bytes <= 0) {\n    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from \"${input}\"`)\n  }\n  return bytes\n}\n\n/**\n * Estimate the in-memory byte size of a decrypted record.\n *\n * Uses `JSON.stringify().length` as a stand-in for actual heap usage.\n * It's a deliberate approximation: real V8 heap size includes pointer\n * overhead, hidden classes, and string interning that we can't measure\n * from JavaScript. The JSON length is a stable, monotonic proxy that\n * costs O(record size) per insert — fine when records are typically\n * < 1 KB and the cache eviction is the slow path anyway.\n *\n * Returns `0` (and the caller must treat it as 1 for accounting) if\n * stringification throws on circular references; this is documented\n * but in practice records always come from JSON-decoded envelopes.\n */\nexport function estimateRecordBytes(record: unknown): number {\n  try {\n    return JSON.stringify(record).length\n  } catch {\n    return 0\n  }\n}\n","/**\n * Lazy-mode capability contract (#267 Track A tail — lazy-mode promoted out\n * of `routing` into its own `lazy` service). Lives on the `/with` port (the\n * one seam the kernel spine may import statically) so `Collection` can hold\n * the back-compat default without a spine→service static import.\n *\n * Lazy mode (`prefetch: false`) skips bulk hydration: reads go per-id\n * against the store and land in a bounded LRU working set. The strategy owns\n * constructing that LRU:\n *\n *  - `withLazy()` (`with-store/lazy/active.ts`, subpath `@noy-db/hub/lazy`)\n *    is the explicit catalog opt-in — silent, forward-stable.\n *  - {@link IMPLICIT_LAZY} is the floor default reached when a collection\n *    declares `prefetch: false` WITHOUT `lazyStrategy: withLazy()`. It keeps\n *    the pre-#267 behavior byte-for-byte (back-compat delegation, pre-1.0)\n *    but emits a one-time deprecation warn outside test env. It will become\n *    a throwing stub at 1.0, letting the LRU leave the floor bundle\n *    entirely once the per-record-CEK cache stops pinning `Lru` there.\n *\n * The on-demand read/write branches themselves stay kernel-resident (they\n * are `if (this.lazy)` forks on the hot get/put/scan paths); the service\n * seam owns cache construction + budget validation, which is where the\n * opt-in and the future tree-shake win live.\n * @internal\n */\nimport { Lru, parseBytes } from '../../kernel/cache/index.js'\nimport type { CacheOptions } from '../../kernel/collection.js'\n\nexport interface LazyStrategy {\n  /**\n   * Build the bounded LRU working-set cache for a lazy collection.\n   * MUST throw when `cache` declares neither `maxRecords` nor `maxBytes` —\n   * an unbounded lazy cache defeats the purpose.\n   */\n  createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V>\n}\n\n/**\n * Shared budget validation + LRU construction — the one implementation both\n * {@link IMPLICIT_LAZY} and `withLazy()` run, so the two paths cannot drift.\n * @internal\n */\nexport function buildLazyCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V> {\n  if (!cache || (cache.maxRecords === undefined && cache.maxBytes === undefined)) {\n    throw new Error(\n      `Collection \"${collection}\": lazy mode (prefetch: false) requires a cache option ` +\n      `with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`,\n    )\n  }\n  const lruOptions: { maxRecords?: number; maxBytes?: number } = {}\n  if (cache.maxRecords !== undefined) lruOptions.maxRecords = cache.maxRecords\n  if (cache.maxBytes !== undefined) lruOptions.maxBytes = parseBytes(cache.maxBytes)\n  return new Lru<string, V>(lruOptions)\n}\n\nlet implicitLazyWarned = false\n\n/**\n * Back-compat default (deprecated): `prefetch: false` without\n * `lazyStrategy: withLazy()`. Identical behavior to the explicit opt-in,\n * plus a one-time deprecation warn (suppressed under NODE_ENV=test,\n * mirroring the listPage fallback warn). @internal\n */\nexport const IMPLICIT_LAZY: LazyStrategy = {\n  createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V> {\n    if (!implicitLazyWarned) {\n      implicitLazyWarned = true\n      if (!(typeof process !== 'undefined' && process.env['NODE_ENV'] === 'test')) {\n        console.warn(\n          `[noy-db] Collection \"${collection}\": lazy mode (prefetch: false) without the lazy ` +\n          `service is deprecated — pass \\`lazyStrategy: withLazy()\\` (from \"@noy-db/hub/lazy\") ` +\n          `to createNoydb(). The implicit path will be removed at 1.0.`,\n        )\n      }\n    }\n    return buildLazyCache<V>(collection, cache)\n  },\n}\n"],"mappings":";AAmDO,IAAM,MAAN,MAAgB;AAAA,EACJ,UAAU,oBAAI,IAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACT,eAAe;AAAA,EACf,OAAO;AAAA,EACP,SAAS;AAAA,EACT,YAAY;AAAA,EAEpB,YAAY,SAAqB;AAC/B,QAAI,QAAQ,eAAe,UAAa,QAAQ,aAAa,QAAW;AACtE,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,SAAK,aAAa,QAAQ;AAC1B,SAAK,WAAW,QAAQ;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,KAAuB;AACzB,UAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAClC,QAAI,CAAC,OAAO;AACV,WAAK;AACL,aAAO;AAAA,IACT;AAEA,SAAK,QAAQ,OAAO,GAAG;AACvB,SAAK,QAAQ,IAAI,KAAK,KAAK;AAC3B,SAAK;AACL,WAAO,MAAM;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,KAAQ,OAAU,MAAoB;AACxC,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,UAAU;AAEZ,WAAK,gBAAgB,SAAS;AAC9B,WAAK,QAAQ,OAAO,GAAG;AAAA,IACzB;AACA,SAAK,QAAQ,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC;AACrC,SAAK,gBAAgB;AACrB,SAAK,sBAAsB;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,KAAiB;AACtB,UAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;AACrC,QAAI,CAAC,SAAU,QAAO;AACtB,SAAK,gBAAgB,SAAS;AAC9B,SAAK,QAAQ,OAAO,GAAG;AACvB,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,IAAI,KAAiB;AACnB,WAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAc;AACZ,SAAK,QAAQ,MAAM;AACnB,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA,EAGA,QAAkB;AAChB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,CAAC,SAA8B;AAC7B,eAAW,SAAS,KAAK,QAAQ,OAAO,EAAG,OAAM,MAAM;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,wBAA8B;AACpC,WAAO,KAAK,WAAW,GAAG;AACxB,YAAM,SAAS,KAAK,QAAQ,KAAK,EAAE,KAAK;AACxC,UAAI,OAAO,KAAM;AACjB,YAAM,MAAM,OAAO;AACnB,YAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAClC,UAAI,MAAO,MAAK,gBAAgB,MAAM;AACtC,WAAK,QAAQ,OAAO,GAAG;AACvB,WAAK;AAAA,IACP;AAAA,EACF;AAAA,EAEQ,aAAsB;AAC5B,QAAI,KAAK,eAAe,UAAa,KAAK,QAAQ,OAAO,KAAK,WAAY,QAAO;AACjF,QAAI,KAAK,aAAa,UAAa,KAAK,eAAe,KAAK,SAAU,QAAO;AAC7E,WAAO;AAAA,EACT;AACF;;;ACjKA,IAAM,QAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,KAAK;AAAA,EACL,MAAM;AAAA,EACN,MAAM,OAAO;AAAA,EACb,MAAM,OAAO,OAAO;AAAA;AAEtB;AAGO,SAAS,WAAW,OAAgC;AACzD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACzC,YAAM,IAAI,MAAM,mEAAmE,OAAO,KAAK,CAAC,EAAE;AAAA,IACpG;AACA,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB;AAEA,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,YAAY,IAAI;AAClB,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAIA,QAAM,QAAQ,wCAAwC,KAAK,OAAO;AAClE,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oCAAoC,KAAK,mDAAmD;AAAA,EAC9G;AAEA,QAAM,QAAQ,WAAW,MAAM,CAAC,CAAE;AAClC,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,YAAY;AAE1C,MAAI,EAAE,QAAQ,QAAQ;AACpB,UAAM,IAAI,MAAM,6BAA6B,MAAM,CAAC,CAAC,SAAS,KAAK,6BAA6B;AAAA,EAClG;AAEA,QAAM,QAAQ,KAAK,MAAM,QAAQ,MAAM,IAAI,CAAE;AAC7C,MAAI,SAAS,GAAG;AACd,UAAM,IAAI,MAAM,4CAA4C,KAAK,UAAU,KAAK,GAAG;AAAA,EACrF;AACA,SAAO;AACT;AAgBO,SAAS,oBAAoB,QAAyB;AAC3D,MAAI;AACF,WAAO,KAAK,UAAU,MAAM,EAAE;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACtCO,SAAS,eAAkB,YAAoB,OAAiD;AACrG,MAAI,CAAC,SAAU,MAAM,eAAe,UAAa,MAAM,aAAa,QAAY;AAC9E,UAAM,IAAI;AAAA,MACR,eAAe,UAAU;AAAA,IAE3B;AAAA,EACF;AACA,QAAM,aAAyD,CAAC;AAChE,MAAI,MAAM,eAAe,OAAW,YAAW,aAAa,MAAM;AAClE,MAAI,MAAM,aAAa,OAAW,YAAW,WAAW,WAAW,MAAM,QAAQ;AACjF,SAAO,IAAI,IAAe,UAAU;AACtC;AAEA,IAAI,qBAAqB;AAQlB,IAAM,gBAA8B;AAAA,EACzC,YAAe,YAAoB,OAAiD;AAClF,QAAI,CAAC,oBAAoB;AACvB,2BAAqB;AACrB,UAAI,EAAE,OAAO,YAAY,eAAe,QAAQ,IAAI,UAAU,MAAM,SAAS;AAC3E,gBAAQ;AAAA,UACN,wBAAwB,UAAU;AAAA,QAGpC;AAAA,MACF;AAAA,IACF;AACA,WAAO,eAAkB,YAAY,KAAK;AAAA,EAC5C;AACF;","names":[]}

package/dist/{chunk-6OQ7NKMZ.js → chunk-O2DB4C3M.js}

@@ -1,14 +1,14 @@
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-6OQ7NKMZ.js.map
+//# sourceMappingURL=chunk-O2DB4C3M.js.map

package/dist/{chunk-LHYQE3BP.js → chunk-OFBFAVLI.js}

@@ -1,19 +1,19 @@
 import {
   SyncScheduler
 } from "./chunk-VQNJ7UZL.js";
+import {
+  NOYDB_SYNC_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   bufferToBase64,
   decrypt,
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_SYNC_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   ConflictError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-party/team/presence.ts
 var PresenceHandle = class {
@@ -719,4 +719,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-LHYQE3BP.js.map
+//# sourceMappingURL=chunk-OFBFAVLI.js.map

package/dist/{chunk-ZFME46HJ.js → chunk-OPTFANOX.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   encrypt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-TLJOJBZD.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -72,4 +72,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-ZFME46HJ.js.map
+//# sourceMappingURL=chunk-OPTFANOX.js.map

package/dist/chunk-OPTFANOX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `with-shape/classified/strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: 1,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: 1,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;AAuDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/{chunk-5EZAJEES.js → chunk-OVO2RZAE.js}

@@ -1,14 +1,27 @@
 import {
   isTombstone
-} from "./chunk-6RASM2J4.js";
+} from "./chunk-QKVILR7N.js";
+import {
+  NOYDB_FORMAT_VERSION,
+  SealedHandle
+} from "./chunk-LN22XH4B.js";
 import {
-  VDIG_ITERATIONS,
   blindedEqual,
-  normalizeForVerify,
   openVdigPayload,
-  pbkdf2VerifyDigest,
   sealVdigPayload
-} from "./chunk-CPAROOKP.js";
+} from "./chunk-PGFY7IRW.js";
+import {
+  dualReadSealedSlot,
+  parseSealedSlot
+} from "./chunk-TCIUO62Z.js";
+import {
+  mintBidxTag
+} from "./chunk-UOEWDCUX.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -16,19 +29,13 @@ import {
   deriveDeterministicKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
-  dualReadSealedSlot,
   encrypt,
   encryptDeterministic,
   generateDEK,
   generateSalt,
-  parseSealedSlot,
   unwrapCek,
   wrapCek
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION,
-  SealedHandle
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   ClassifiedConfigError,
   ClassifiedRotationError,
@@ -37,7 +44,7 @@ import {
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -234,6 +241,28 @@ var RecordCodec = class _RecordCodec {
     if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
       return this.buildDebugEnvelope(record, version, source, sourceTs);
     }
+    if (this.ctx.storeCiphertext) {
+      const declared = this.ctx.vdigFields;
+      const storedClassified = /* @__PURE__ */ new Set();
+      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k);
+      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k);
+      if (this.ctx.classifiedMarkerDigestOnly !== void 0) {
+        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k);
+      }
+      let undeclared;
+      for (const field of storedClassified) {
+        if (declared === null || !declared.has(field)) {
+          undeclared = field;
+          break;
+        }
+      }
+      if (undeclared !== void 0) {
+        throw new ClassifiedConfigError(
+          this.ctx.name,
+          `this collection has classified digest-only field "${undeclared}" but this handle does not declare it \u2014 refusing to write (would drop its tag or serialize the secret as plaintext)`
+        );
+      }
+    }
     let openRecord = record;
     let sealed;
     if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
@@ -256,6 +285,7 @@ var RecordCodec = class _RecordCodec {
       }
     }
     let vdigOut;
+    let bidxOutMap;
     if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
       if (vdig === void 0) {
         throw new Error(
@@ -269,6 +299,8 @@ var RecordCodec = class _RecordCodec {
       }
       const open = { ...openRecord };
       const out = {};
+      const bidxOut = {};
+      let bidxDek;
       for (const [field, policy] of this.ctx.vdigFields) {
         const value = open[field];
         const prevBlob = vdig.prev?._vdig?.[field];
@@ -279,7 +311,11 @@ var RecordCodec = class _RecordCodec {
           );
         }
         if (value === void 0) {
-          if (prevBlob !== void 0) out[field] = prevBlob;
+          if (prevBlob !== void 0) {
+            out[field] = prevBlob;
+            const prevTag = vdig.prev?._bidx?.[field];
+            if (prevTag !== void 0) bidxOut[field] = prevTag;
+          }
           continue;
         }
         if (value === null) {
@@ -292,15 +328,22 @@ var RecordCodec = class _RecordCodec {
           );
         }
         out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
+        if (policy.equatable === true) {
+          if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
+          const normalized = normalizeForVerify(policy.normalize, value);
+          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
+        }
         delete open[field];
       }
       openRecord = open;
       if (Object.keys(out).length > 0) vdigOut = out;
+      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
     }
     const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
     const withSealed = sealed ? { ...base, _sealed: sealed } : base;
     const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
-    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withVdig;
+    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
+    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
     const dek = await this.ctx.getDEK();
     const detKey = await deriveDeterministicKey(dek);
     const rec = record;
@@ -314,8 +357,8 @@ var RecordCodec = class _RecordCodec {
       const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
       det[field] = `${iv}:${data}`;
     }
-    if (Object.keys(det).length === 0) return withVdig;
-    return { ...withVdig, _det: det };
+    if (Object.keys(det).length === 0) return withBidx;
+    return { ...withBidx, _det: det };
   }
   // ──────────────────────────────────────────────────────────────────────
   // Read path
@@ -391,28 +434,32 @@ var RecordCodec = class _RecordCodec {
    * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
    */
   async classifySealedShred(live) {
-    const shreddable = [];
-    const dekResidue = [];
+    const slots = [];
     if (live._vdig !== void 0 && live._cek !== void 0) {
-      shreddable.push(...Object.keys(live._vdig));
+      for (const field of Object.keys(live._vdig)) {
+        slots.push({
+          field,
+          class: live._bidx?.[field] !== void 0 ? "live-shreddable+dekResidue-in-backups" : "shreddable"
+        });
+      }
     }
     const sealed = live._sealed;
-    if (sealed === void 0) return { shreddable, dekResidue };
+    if (sealed === void 0) return { slots };
     const cek = await this.resolveEnvelopeCek(live);
     for (const [field, blob] of Object.entries(sealed)) {
       if (cek === void 0) {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
         continue;
       }
       const { iv, data } = parseSealedSlot(blob);
       try {
         await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
-        shreddable.push(field);
+        slots.push({ field, class: "shreddable" });
       } catch {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
       }
     }
-    return { shreddable, dekResidue };
+    return { slots };
   }
   /**
    * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
@@ -582,6 +629,12 @@ async function rotateRecordCek(ctx, collection, id) {
     ...ctx.actor ? { _by: ctx.actor } : {},
     ...live._tier !== void 0 ? { _tier: live._tier } : {},
     ...live._det !== void 0 ? { _det: live._det } : {},
+    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+    // below, which are CEK-bound and must be re-sealed under the new CEK.
+    // Dropping this line would silently orphan the equality index on rotation
+    // (the #306 Slice-A data-loss bug, replayed on the index).
+    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
     // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
     // keys derive off the per-record CEK, so the rotated record's old CEK is
     // destroyed here — carrying the old `_sealed` slots forward verbatim would
@@ -678,7 +731,7 @@ function hasPerRecordKey(env) {
   return env._cek !== void 0;
 }
 function envelopeBodyForHash(env) {
-  if (env._sealed === void 0 && env._vdig === void 0) return env._data;
+  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
   const mapPart = (key, map) => {
     const parts = Object.keys(map).sort().map(
       (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
@@ -688,6 +741,7 @@ function envelopeBodyForHash(env) {
   const segments = [`"_data":${JSON.stringify(env._data)}`];
   if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
   if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
+  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
   return `{${segments.join(",")}}`;
 }
 
@@ -708,4 +762,4 @@ export {
   hasPerRecordKey,
   envelopeBodyForHash
 };
-//# sourceMappingURL=chunk-5EZAJEES.js.map
+//# sourceMappingURL=chunk-OVO2RZAE.js.map