@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.5

package/dist/{chunk-ADBMJDBW.js → chunk-IEUIUSBO.js}

@@ -1,22 +1,35 @@
 import {
-  loadVaultPolicy
-} from "./chunk-LES2Z7B4.js";
+  jsonSchemaToFields
+} from "./chunk-TQ3REHVF.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-6I2YPLAG.js";
+} from "./chunk-P27Z66EB.js";
+import {
+  loadVaultPolicy
+} from "./chunk-T45LAT2Y.js";
+import {
+  LinkIntegrityError,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-P3NGV5RV.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-ULIHDPKL.js";
 import {
   loadFence
-} from "./chunk-4NZCZUGL.js";
+} from "./chunk-YFF2RP3X.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-UP6EMMDI.js";
+} from "./chunk-A4DWPOP3.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -24,63 +37,65 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-YN66UOXT.js";
+} from "./chunk-7SY3PTED.js";
 import {
   NO_ATTESTATION
-} from "./chunk-ZRDYQZYH.js";
+} from "./chunk-Z7KI4WHR.js";
 import {
   NO_CLASSIFIED,
   enforceClassifiedWrite,
   resolveClassifiedFields
-} from "./chunk-MIOLJG2R.js";
+} from "./chunk-AF5ZRTZ4.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-4DZGZ7II.js";
+} from "./chunk-VMJ5URU7.js";
 import {
   NO_PORTABILITY
-} from "./chunk-HGQG3VIP.js";
+} from "./chunk-N5YVZHCB.js";
 import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-Z44OY24N.js";
+} from "./chunk-PI5CG2OV.js";
 import {
   runDrainBarrier
-} from "./chunk-JFYIHLU3.js";
+} from "./chunk-3Y4QLJ6K.js";
+import {
+  PERIODS_COLLECTION
+} from "./chunk-GZZL5R73.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-4NMFWOS2.js";
+} from "./chunk-T65UZXR6.js";
 import {
   OverlayedCollection
-} from "./chunk-NMRKAGHE.js";
+} from "./chunk-ZROMNP7Q.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-2KSPDSWI.js";
+} from "./chunk-5MRE3C4Q.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-LKBLAUOB.js";
+} from "./chunk-QNTEDPWP.js";
 import {
-  loadPersistedSchema,
-  savePersistedSchema
-} from "./chunk-U6OM4E67.js";
+  IMPLICIT_LAZY,
+  Lru,
+  estimateRecordBytes
+} from "./chunk-NO272T7Q.js";
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-AY4P6PHN.js";
-import {
-  PERIODS_COLLECTION
-} from "./chunk-YTIAXSUE.js";
+} from "./chunk-VWGCJUTV.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-PYWW4KLO.js";
+} from "./chunk-44UTIDE2.js";
 import {
+  NO_TEAM,
   enrollAuthenticator,
   findAuthenticator,
   recoverPassphrase,
@@ -89,7 +104,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-OVIVYAQL.js";
+} from "./chunk-LEA7WJEZ.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -99,7 +114,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-IJW6K6UX.js";
+} from "./chunk-LPRPVCNY.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -109,25 +124,23 @@ import {
   changeSecret,
   createOwnerKeyring,
   ensureCollectionDEK,
-  grant,
   hasAccess,
   hasWritePermission,
+  isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
-  revoke,
-  rotateKeys,
   updateKeyringIdentity
-} from "./chunk-5A6TC3RQ.js";
+} from "./chunk-ZT4GWVTX.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-2N4MUSF3.js";
+} from "./chunk-TB5RNNJ4.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
-  sha256Hex as sha256Hex2
-} from "./chunk-6EVZXETK.js";
+  sha256Hex
+} from "./chunk-M66NAZA4.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -136,10 +149,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-6OQ7NKMZ.js";
+} from "./chunk-O2DB4C3M.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-FELHYKIO.js";
+} from "./chunk-G7RDYYTE.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -149,40 +162,35 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   buildTombstone,
   isTombstone
-} from "./chunk-6RASM2J4.js";
-import {
-  encrypt,
-  sha256Hex
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-QKVILR7N.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
 import {
   NO_AGGREGATE,
   Query,
-  ScanBuilder,
-  canonicalizeIncomingMoney,
-  canonicalizeStoredMoney,
-  decodeMoneyFields,
-  quantizeMoneyFields,
-  validateMoneyFieldPaths
-} from "./chunk-N2FP26NH.js";
+  ScanBuilder
+} from "./chunk-GBTUANXF.js";
 import {
   canonicalGroupKey
-} from "./chunk-NPVICKZE.js";
+} from "./chunk-P5WXDYMD.js";
 import {
+  moneyRuntime,
   readPath
-} from "./chunk-QLQS5A7X.js";
+} from "./chunk-ZKF6HH7V.js";
 import {
   getAtPath,
   resolvePolicy,
   setAtPathInPlace,
   stripI18nFilled
-} from "./chunk-7IP75FP2.js";
+} from "./chunk-4K3MQ5S3.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -219,11 +227,11 @@ import {
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-KTRIC6PR.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-JJCEMTAE.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -237,6 +245,21 @@ function guardClassifiedCompat(collection, byField, ctx) {
       "digest-only/recoverable classified fields cannot combine with a crdt mode or a conflictPolicy resolver \u2014 merge paths bypass write enforcement (R2)"
     );
   }
+  for (const [f, spec] of Object.entries(byField)) {
+    if (spec.equatable === true && spec.storage !== "digest-only") {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${f}" declares equatable but storage is '${spec.storage}' \u2014 equatable is a digest-only knob; recoverable equality is _det's job (R7)`
+      );
+    }
+  }
+  const hasEquatable = Object.values(byField).some((s) => s.equatable === true);
+  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {
+    throw new ClassifiedConfigError(
+      collection,
+      `classified equatable fields require \`acknowledgeEquatableRisk: true\` \u2014 equal values produce equal store-visible index tags (a partition leak a DEK holder can offline-dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`
+    );
+  }
   if (digestOnly.length === 0) return;
   if (!ctx.storeCiphertext) {
     throw new ClassifiedConfigError(
@@ -279,34 +302,6 @@ function guardClassifiedCompat(collection, byField, ctx) {
   }
 }
 
-// src/with-formula/computed/index.ts
-var ComputedFieldError = class extends NoydbError {
-  constructor(field, id, cause) {
-    super(
-      "COMPUTED_FIELD",
-      `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
-    );
-    this.field = field;
-    this.id = id;
-    this.cause = cause;
-    this.name = "ComputedFieldError";
-  }
-  field;
-  id;
-  cause;
-};
-function evalComputedFields(record, computed, id) {
-  const out = { ...record };
-  for (const [field, fn] of Object.entries(computed)) {
-    try {
-      out[field] = fn(out);
-    } catch (cause) {
-      throw new ComputedFieldError(field, id, cause);
-    }
-  }
-  return out;
-}
-
 // src/with-lookup/indexing/collection-facade.ts
 function readPersistedValue(record, field) {
   if (!field.includes(".")) return record[field];
@@ -561,89 +556,6 @@ async function purgePersistedIndexes(ctx, id) {
   return { purged, residue };
 }
 
-// src/with-shape/persisted-schemas/canonicalize.ts
-function canonicalize(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return "[" + value.map(canonicalize).join(",") + "]";
-  }
-  const obj = value;
-  const keys = Object.keys(obj).sort();
-  const parts = keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k]));
-  return "{" + parts.join(",") + "}";
-}
-
-// src/with-shape/persisted-schemas/derive.ts
-function isZodSchema(value) {
-  if (value === null || typeof value !== "object") return false;
-  const std = value["~standard"];
-  if (std && typeof std === "object" && std.vendor === "zod") return true;
-  const def = value._def;
-  if (!def || typeof def !== "object") return false;
-  return typeof def.typeName === "string" && def.typeName.startsWith("Zod");
-}
-function detectKind(validator) {
-  if (isZodSchema(validator)) return "Zod";
-  return "Unknown";
-}
-function isZod4Schema(value) {
-  if (value === null || typeof value !== "object") return false;
-  return "_zod" in value;
-}
-async function loadZodToJsonSchemaConverter() {
-  try {
-    const mod = await import("zod-to-json-schema");
-    if (!mod.zodToJsonSchema) {
-      throw new Error("zod-to-json-schema export missing");
-    }
-    return mod.zodToJsonSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema requires the optional peer-dep \`zod-to-json-schema\`. Install it: \`pnpm add zod-to-json-schema\` (or npm/yarn equivalent). Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function loadZodV4Converter() {
-  try {
-    const mod = await import("./zod-HAJM7LMS.js");
-    if (typeof mod.toJSONSchema !== "function") {
-      throw new Error("zod.toJSONSchema not available (zod v4 required)");
-    }
-    return mod.toJSONSchema;
-  } catch (err) {
-    throw new Error(
-      `persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function derivePersistedSchema(validator) {
-  const kind = detectKind(validator);
-  const derivedAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (kind === "Zod") {
-    let jsonSchema;
-    if (isZod4Schema(validator)) {
-      const convert = await loadZodV4Converter();
-      jsonSchema = convert(validator);
-    } else {
-      const convert = await loadZodToJsonSchemaConverter();
-      jsonSchema = convert(validator);
-    }
-    const canonical = canonicalize(jsonSchema);
-    const hash = await sha256Hex(new TextEncoder().encode(canonical));
-    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
-  }
-  return {
-    _noydb_schema: 1,
-    kind,
-    jsonSchema: null,
-    hash: null,
-    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,
-    derivedAt
-  };
-}
-
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
   createState() {
@@ -889,97 +801,6 @@ function resolveFieldMeta(key, inputs) {
   };
 }
 
-// src/with-shape/introspection/fields.ts
-function jsonSchemaType(node) {
-  if (Array.isArray(node.type)) {
-    const non = node.type.filter((t) => t !== "null");
-    return non[0] ?? "opaque";
-  }
-  if (node.enum && Array.isArray(node.enum)) return "enum";
-  if (node.const !== void 0) return "enum";
-  if (typeof node.type === "string") return node.type;
-  return "opaque";
-}
-function constraintsFor(node) {
-  const out = {};
-  if (node.enum) out.values = node.enum;
-  if (node.const !== void 0) out.values = [node.const];
-  if (node.minLength !== void 0) out.minLength = node.minLength;
-  if (node.maxLength !== void 0) out.maxLength = node.maxLength;
-  if (node.pattern !== void 0) out.pattern = node.pattern;
-  if (node.format !== void 0) out.format = node.format;
-  if (node.minimum !== void 0) out.minimum = node.minimum;
-  if (node.maximum !== void 0) out.maximum = node.maximum;
-  if (node.exclusiveMinimum !== void 0) out.gt = node.exclusiveMinimum;
-  if (node.exclusiveMaximum !== void 0) out.lt = node.exclusiveMaximum;
-  return Object.keys(out).length === 0 ? void 0 : out;
-}
-function extractObjectFields(obj, source, refs) {
-  const required = new Set(Array.isArray(obj.required) ? obj.required : []);
-  const fields = {};
-  if (!obj.properties || typeof obj.properties !== "object") return { fields, required };
-  for (const [name, node] of Object.entries(obj.properties)) {
-    const descriptor = {
-      type: jsonSchemaType(node),
-      source,
-      ...required.has(name) ? {} : { optional: true },
-      ...refs?.[name] ? { references: `${refs[name].target}.id` } : {}
-    };
-    const constraints = constraintsFor(node);
-    if (constraints) descriptor.constraints = constraints;
-    fields[name] = descriptor;
-  }
-  return { fields, required };
-}
-function mergeUnionMembers(members, source, refs) {
-  if (members.length === 0) return {};
-  const extracted = members.filter((m) => m.properties && typeof m.properties === "object").map((m) => extractObjectFields(m, source, refs));
-  if (extracted.length === 0) return {};
-  const allNames = /* @__PURE__ */ new Set();
-  for (const { fields } of extracted) {
-    for (const name of Object.keys(fields)) allNames.add(name);
-  }
-  const memberCount = extracted.length;
-  const out = {};
-  for (const name of allNames) {
-    const presentIn = extracted.filter(({ fields }) => name in fields);
-    const requiredInAll = presentIn.length === memberCount && presentIn.every(({ required }) => required.has(name));
-    const base = presentIn[0].fields[name];
-    const allValues = [];
-    for (const { fields } of presentIn) {
-      const fd = fields[name];
-      if (fd?.constraints?.values && Array.isArray(fd.constraints.values)) {
-        for (const v of fd.constraints.values) {
-          if (!allValues.includes(v)) allValues.push(v);
-        }
-      }
-    }
-    const mergedConstraints = allValues.length > 0 ? { ...base.constraints ?? {}, values: allValues } : base.constraints;
-    const descriptor = {
-      type: base.type,
-      source,
-      ...requiredInAll ? {} : { optional: true },
-      ...base.references ? { references: base.references } : {}
-    };
-    if (mergedConstraints) {
-      descriptor.constraints = mergedConstraints;
-    }
-    out[name] = descriptor;
-  }
-  return out;
-}
-function jsonSchemaToFields(jsonSchema, source, refs) {
-  if (!jsonSchema || typeof jsonSchema !== "object") return {};
-  const root = jsonSchema;
-  const unionMembers = root.anyOf ?? root.oneOf;
-  if (Array.isArray(unionMembers) && unionMembers.length > 0) {
-    return mergeUnionMembers(unionMembers, source, refs);
-  }
-  if (!root.properties || typeof root.properties !== "object") return {};
-  const { fields } = extractObjectFields(root, source, refs);
-  return fields;
-}
-
 // src/with-shape/introspection/describe.ts
 var ZOD_META_KEYS = /* @__PURE__ */ new Set([
   "label",
@@ -1185,7 +1006,8 @@ function buildDescription(input) {
         classified: {
           preset: cls.preset,
           storage: cls.storage,
-          list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider }
+          list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider },
+          ...cls.equatable === true ? { equatable: true } : {}
         }
       } : {}
     };
@@ -1202,204 +1024,6 @@ function buildDescription(input) {
   };
 }
 
-// src/with-shape/introspection/json-schema.ts
-function jsonType(t) {
-  switch (t) {
-    case "number":
-      return "number";
-    case "boolean":
-      return "boolean";
-    case "array":
-      return "array";
-    case "object":
-      return "object";
-    default:
-      return "string";
-  }
-}
-function buildJsonSchema(desc, base) {
-  const baseProps = base?.["properties"] ?? {};
-  const properties = {};
-  for (const f of desc.fields) {
-    const prop = { ...baseProps[f.key] ?? { type: jsonType(f.type) } };
-    prop["x-label"] = f.label;
-    if (f.unit !== void 0) prop["x-unit"] = f.unit;
-    if (f.semanticType !== void 0) prop["x-semanticType"] = f.semanticType;
-    if (f.sensitivity !== void 0) prop["x-sensitivity"] = f.sensitivity;
-    if (f.widget !== void 0) prop["x-widget"] = f.widget;
-    if (f.editable === false) prop["x-readonly"] = true;
-    if (f.money !== void 0) prop["x-money"] = f.money;
-    if (f.ref !== void 0) prop["x-ref"] = f.ref.target;
-    if (f.dict?.values) {
-      const labels = {};
-      for (const v of f.dict.values) if (v.label !== void 0) labels[v.value] = v.label;
-      if (Object.keys(labels).length) prop["x-enumLabels"] = labels;
-    }
-    if (f.classified !== void 0) prop["x-classified"] = f.classified;
-    properties[f.key] = prop;
-  }
-  return base != null && typeof base === "object" ? { ...base, properties } : { type: "object", properties };
-}
-
-// src/kernel/cache/lru.ts
-var Lru = class {
-  entries = /* @__PURE__ */ new Map();
-  maxRecords;
-  maxBytes;
-  currentBytes = 0;
-  hits = 0;
-  misses = 0;
-  evictions = 0;
-  constructor(options) {
-    if (options.maxRecords === void 0 && options.maxBytes === void 0) {
-      throw new Error("Lru: must specify maxRecords, maxBytes, or both");
-    }
-    this.maxRecords = options.maxRecords;
-    this.maxBytes = options.maxBytes;
-  }
-  /**
-   * Look up a key. Hits promote the entry to most-recently-used; misses
-   * return undefined. Both update the running stats counters.
-   */
-  get(key) {
-    const entry = this.entries.get(key);
-    if (!entry) {
-      this.misses++;
-      return void 0;
-    }
-    this.entries.delete(key);
-    this.entries.set(key, entry);
-    this.hits++;
-    return entry.value;
-  }
-  /**
-   * Insert or update a key. If the key already exists, its size is
-   * accounted for and the entry is promoted to MRU. After insertion,
-   * eviction runs to maintain both budgets.
-   */
-  set(key, value, size) {
-    const existing = this.entries.get(key);
-    if (existing) {
-      this.currentBytes -= existing.size;
-      this.entries.delete(key);
-    }
-    this.entries.set(key, { value, size });
-    this.currentBytes += size;
-    this.evictUntilUnderBudget();
-  }
-  /**
-   * Remove a key without affecting hit/miss stats. Used by `Collection.delete()`.
-   * Returns true if the key was present.
-   */
-  remove(key) {
-    const existing = this.entries.get(key);
-    if (!existing) return false;
-    this.currentBytes -= existing.size;
-    this.entries.delete(key);
-    return true;
-  }
-  /** True if the cache currently holds an entry for the given key. */
-  has(key) {
-    return this.entries.has(key);
-  }
-  /**
-   * Drop every entry. Stats counters survive — call `resetStats()` if you
-   * want a clean slate. Used by `Collection.invalidate()` on key rotation.
-   */
-  clear() {
-    this.entries.clear();
-    this.currentBytes = 0;
-  }
-  /** Reset hit/miss/eviction counters to zero. Does NOT touch entries. */
-  resetStats() {
-    this.hits = 0;
-    this.misses = 0;
-    this.evictions = 0;
-  }
-  /** Snapshot of current cache statistics. Cheap — no copying. */
-  stats() {
-    return {
-      hits: this.hits,
-      misses: this.misses,
-      evictions: this.evictions,
-      size: this.entries.size,
-      bytes: this.currentBytes
-    };
-  }
-  /**
-   * Iterate over all currently-cached values. Order is least-recently-used
-   * first. Used by tests and devtools — production callers should use
-   * `Collection.scan()` instead.
-   */
-  *values() {
-    for (const entry of this.entries.values()) yield entry.value;
-  }
-  /**
-   * Walk the cache from the LRU end and drop entries until both budgets
-   * are satisfied. Called after every `set()`. Single pass — entries are
-   * never re-promoted during eviction.
-   */
-  evictUntilUnderBudget() {
-    while (this.overBudget()) {
-      const oldest = this.entries.keys().next();
-      if (oldest.done) return;
-      const key = oldest.value;
-      const entry = this.entries.get(key);
-      if (entry) this.currentBytes -= entry.size;
-      this.entries.delete(key);
-      this.evictions++;
-    }
-  }
-  overBudget() {
-    if (this.maxRecords !== void 0 && this.entries.size > this.maxRecords) return true;
-    if (this.maxBytes !== void 0 && this.currentBytes > this.maxBytes) return true;
-    return false;
-  }
-};
-
-// src/kernel/cache/policy.ts
-var UNITS = {
-  "": 1,
-  "B": 1,
-  "KB": 1024,
-  "MB": 1024 * 1024,
-  "GB": 1024 * 1024 * 1024
-  // 'TB' deliberately not supported — if you need it, you're not using NOYDB.
-};
-function parseBytes(input) {
-  if (typeof input === "number") {
-    if (!Number.isFinite(input) || input <= 0) {
-      throw new Error(`parseBytes: numeric input must be a positive finite number, got ${String(input)}`);
-    }
-    return Math.floor(input);
-  }
-  const trimmed = input.trim();
-  if (trimmed === "") {
-    throw new Error("parseBytes: empty string is not a valid byte budget");
-  }
-  const match = /^([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]*)$/.exec(trimmed);
-  if (!match) {
-    throw new Error(`parseBytes: invalid byte budget "${input}". Expected format: "1024", "50KB", "50MB", "1GB"`);
-  }
-  const value = parseFloat(match[1]);
-  const unit = (match[2] ?? "").toUpperCase();
-  if (!(unit in UNITS)) {
-    throw new Error(`parseBytes: unknown unit "${match[2]}" in "${input}". Supported: B, KB, MB, GB`);
-  }
-  const bytes = Math.floor(value * UNITS[unit]);
-  if (bytes <= 0) {
-    throw new Error(`parseBytes: byte budget must be > 0, got ${bytes} from "${input}"`);
-  }
-  return bytes;
-}
-function estimateRecordBytes(record) {
-  try {
-    return JSON.stringify(record).length;
-  } catch {
-    return 0;
-  }
-}
-
 // src/with-formula/derivations/stale.ts
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
@@ -1436,7 +1060,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-ANFBCOYA.js"));
+      ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1593,7 +1217,7 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
-  if (opts.moneyFields) validateMoneyFieldPaths(opts.moneyFields);
+  if (opts.moneyFields) moneyRuntime().validateMoneyFieldPaths(opts.moneyFields);
   const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
   let mergedComputed = opts.computed;
   if (resolvedClassified !== void 0) {
@@ -1636,7 +1260,8 @@ function resolveCollectionConfig(opts) {
     textIndexFields: new Set(opts.textIndexes ?? []),
     vectorSourceFields: new Set(embeddingSources),
     subjectKeyField: opts.subjectKeyField,
-    bareSensitiveFields: new Set(opts.sensitive ?? [])
+    bareSensitiveFields: new Set(opts.sensitive ?? []),
+    acknowledgeEquatableRisk: opts.acknowledgeEquatableRisk === true
   };
   if (resolvedClassified !== void 0) {
     guardClassifiedCompat(opts.name, resolvedClassified.byField, classifiedGuardCtx);
@@ -1647,6 +1272,7 @@ function resolveCollectionConfig(opts) {
   const vdigEntries = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "digest-only").map(([f, s]) => [f, {
     normalize: s.verifyNormalize ?? "password",
     notLastN: s.notLastN ?? 0,
+    equatable: s.equatable === true,
     ...s.rotateDays !== void 0 ? { rotateDays: s.rotateDays } : {}
   }]);
   const vdigFields = vdigEntries.length > 0 ? new Map(vdigEntries) : null;
@@ -1721,6 +1347,13 @@ function resolveCollectionConfig(opts) {
   };
 }
 
+// src/with-formula/computed/lazy.ts
+var fn = null;
+async function loadEvalComputedFields() {
+  fn ??= (await import("./computed-BMMEFRFJ.js")).evalComputedFields;
+  return fn;
+}
+
 // src/kernel/collection.ts
 function selfWriteFieldEqual(a, b) {
   if (a === b) return true;
@@ -1967,6 +1600,9 @@ var Collection = class {
    * `_vdig` forward under (C6). `null` when the collection declares none.
    */
   vdigFields;
+  /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
+  _markerDigestOnlyCache = void 0;
+  _markerPersisted = false;
   /**
    * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
    * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
@@ -2232,7 +1868,8 @@ var Collection = class {
       crdtStrategy: this.crdtStrategy,
       schema: this.schema,
       getDEK: () => this.getDEK(this.name),
-      cekCache: this.cekCache
+      cekCache: this.cekCache,
+      classifiedMarkerDigestOnly: () => this._classifiedMarkerDigestOnly()
     });
     if (opts.crdt && opts.onRegisterConflictResolver) {
       const crdtMode = opts.crdt;
@@ -2304,15 +1941,7 @@ var Collection = class {
     }
     this.lazy = opts.prefetch === false;
     if (this.lazy) {
-      if (!opts.cache || opts.cache.maxRecords === void 0 && opts.cache.maxBytes === void 0) {
-        throw new Error(
-          `Collection "${this.name}": lazy mode (prefetch: false) requires a cache option with maxRecords and/or maxBytes. An unbounded lazy cache defeats the purpose.`
-        );
-      }
-      const lruOptions = {};
-      if (opts.cache.maxRecords !== void 0) lruOptions.maxRecords = opts.cache.maxRecords;
-      if (opts.cache.maxBytes !== void 0) lruOptions.maxBytes = parseBytes(opts.cache.maxBytes);
-      this.lru = new Lru(lruOptions);
+      this.lru = (opts.lazyStrategy ?? IMPLICIT_LAZY).createCache(this.name, opts.cache);
       this.hydrated = true;
     } else {
       this.lru = null;
@@ -2443,6 +2072,7 @@ var Collection = class {
   }
   /** JSON Schema for this collection with describe() metadata as x- extensions. */
   async toJSONSchema() {
+    const { buildJsonSchema } = await import("./json-schema-I22JCYCG.js");
     const desc = await this.describe({});
     let base = null;
     if (this.schema !== void 0) {
@@ -2506,6 +2136,140 @@ var Collection = class {
       } } : {}
     };
   }
+  /**
+   * Equatable blind-index lookup: the ids whose classified digest-only
+   * `equatable` field carries a `_bidx` tag matching `candidate` AND whose
+   * `_vdig` payload confirms it. Requires the field to be declared
+   * `classified.password({ equatable: true })` (or `secretAnswer`) and the
+   * collection to have opened its `acknowledgeEquatableRisk` door.
+   *
+   * The algorithm order is load-bearing (spec §3):
+   *  1. Caller-bug refusals thrown at ~0 elapsed, BEFORE any PBKDF2 (R9 /
+   *     Oracle #6): the three field mis-declarations share ONE constant,
+   *     field-name-free message so the refusal text cannot enumerate which
+   *     fields are classified / digest-only / equatable.
+   *  2. Derive the ONE blind-index target UNCONDITIONALLY (I-1 / F1): an empty
+   *     collection still pays exactly one 600K PBKDF2, so wall-time can never
+   *     distinguish "no records" from "no match". No early return may precede
+   *     this line.
+   *  3. Scan `list + one get` per id, string-comparing the stored `_bidx` tag —
+   *     decrypting NOTHING — and retain each hit's already-fetched envelope.
+   *  4. Emit the single sweep consent op (`onAccess('find', '*')`) now — after
+   *     the scan, before confirm (Oracle #5) — fixing its store-write timestamp
+   *     independent of hit count.
+   *  5. Confirm-by-verify against the ALREADY-FETCHED envelope (C-B): run the
+   *     enclave `verifyDigestField` on an in-memory `getEnvelope` closure so the
+   *     confirm reads ZERO additional envelopes. A tag-hit whose `_vdig` fails
+   *     to confirm is dropped silently (a splice is indistinguishable from a
+   *     stale tag). Store-shape law: the only store calls are `list + N get`.
+   */
+  async findByDigest(field, candidate) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0 || spec.storage !== "digest-only" || spec.equatable !== true) {
+      throw new ClassifiedVerifyError(
+        this.name,
+        "*",
+        "not a declared equatable digest-only classified field"
+      );
+    }
+    if (typeof candidate !== "string") {
+      throw new ClassifiedVerifyError(this.name, "*", "candidate must be a string");
+    }
+    const target = await this.classifiedStrategy.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
+    const ids = await this.adapter.list(this.vault, this.name);
+    const hits = [];
+    const hitMap = /* @__PURE__ */ new Map();
+    for (const id of ids) {
+      const env = await this.adapter.get(this.vault, this.name, id);
+      if (target !== null && env?._bidx?.[field] === target) {
+        hits.push(id);
+        hitMap.set(id, env);
+      }
+    }
+    await this.onAccess?.("find", "*");
+    if (hits.length === 0) return [];
+    const { verifyDigestField } = await import("./verify-YB5LQHNA.js");
+    const policy = {
+      normalize: spec.verifyNormalize ?? "password",
+      notLastN: spec.notLastN ?? 0,
+      equatable: true,
+      ...spec.rotateDays !== void 0 ? { rotateDays: spec.rotateDays } : {}
+    };
+    const confirmCtx = {
+      collection: this.name,
+      getEnvelope: async (rid) => hitMap.get(rid) ?? null,
+      // in-memory: zero extra store.get
+      resolveCek: (env) => this.codec.resolveEnvelopeCek(env),
+      getDEK: () => this.getDEK(this.name),
+      now: () => Date.now()
+    };
+    const confirmed = [];
+    for (const id of hits) {
+      const verdict = await verifyDigestField(confirmCtx, id, field, candidate, policy);
+      if (verdict.ok === true) confirmed.push(id);
+    }
+    return confirmed;
+  }
+  /**
+   * Retire a field's equatable blind-index (`_bidx`) coverage across every
+   * live record — the SOLE lazy-write-independent drop-path for a still-live
+   * record's tag (besides clear / `forget()` / DEK-rotation). For each envelope
+   * carrying `_bidx[field]`, rewrite it WITHOUT that slot (dropping the whole
+   * `_bidx` map when it becomes empty), leaving `_vdig[field]` and everything
+   * else INTACT — the field stays `digest-only`, only the index coverage is
+   * retired. NO crypto, NO re-mint, NO re-encrypt: a targeted envelope rewrite.
+   * Returns the count of records scrubbed.
+   *
+   * This is a maintenance write, not a read-egress: it emits NO `'find'` op and
+   * no consent. The field is validated to a declared equatable digest-only
+   * classified field (only such a field ever carries `_bidx`).
+   *
+   * **Ledger consistency**: dropping `_bidx[field]` changes the envelope's
+   * payload hash (`_bidx` is bound into `envelopeBodyForHash`), so a raw
+   * `adapter.put` of the scrubbed envelope WITHOUT a matching ledger entry would
+   * desync the chain and make a future integrity cross-check flag false
+   * tampering. After each rewrite we therefore append an `op:'migration'` entry
+   * recording the NEW payloadHash at the SAME version — this is index retirement,
+   * not a new record version, so `_v` is NOT bumped; the migration op is
+   * reverse-delta-inert (`ledger.reconstruct` skips non-put/delete ops) yet
+   * keeps the hash chain and the record's latest recorded payloadHash correct.
+   */
+  async scrubEquatableTags(field) {
+    const spec = this.classified?.byField[field];
+    if (spec === void 0 || spec.storage !== "digest-only" || spec.equatable !== true) {
+      throw new ClassifiedVerifyError(
+        this.name,
+        "*",
+        "not a declared equatable digest-only classified field"
+      );
+    }
+    const ids = await this.adapter.list(this.vault, this.name);
+    let count = 0;
+    for (const id of ids) {
+      const env = await this.adapter.get(this.vault, this.name, id);
+      if (env?._bidx?.[field] === void 0) continue;
+      const nextBidx = { ...env._bidx };
+      delete nextBidx[field];
+      const scrubbedRaw = { ...env };
+      delete scrubbedRaw._bidx;
+      if (Object.keys(nextBidx).length > 0) scrubbedRaw._bidx = nextBidx;
+      const scrubbed = scrubbedRaw;
+      await this.adapter.put(this.vault, this.name, id, scrubbed);
+      if (this.ledger) {
+        await this.ledger.append({
+          op: "migration",
+          collection: this.name,
+          id,
+          version: scrubbed._v,
+          actor: this.keyring.userId,
+          payloadHash: await this.historyStrategy.envelopePayloadHash(scrubbed),
+          reason: "classified:scrub-equatable-tags"
+        });
+      }
+      count++;
+    }
+    return count;
+  }
   /**
    * @internal — attach money descriptors post-construction. MV dependency
    * analysis auto-creates a source collection (without options) during
@@ -2514,7 +2278,7 @@ var Collection = class {
    */
   _applyMoneyFields(moneyFields) {
     if (this.moneyFields !== void 0) return;
-    validateMoneyFieldPaths(moneyFields);
+    moneyRuntime().validateMoneyFieldPaths(moneyFields);
     this.moneyFields = moneyFields;
   }
   /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
@@ -2600,7 +2364,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-LX4BR43V.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2832,6 +2596,17 @@ var Collection = class {
     const cached = this.cache.get(id);
     return cached ? { record: cached.record, version: cached.version } : void 0;
   }
+  /** Resolves the prior envelope/record for a gate event; elides the read (#267) when no handler at `point` needs it (`elided: true`, `env`/`record` null). */
+  async resolveGatePrior(point, id) {
+    if (!this.subsystemBus.gateNeedsPrior(point)) return { env: null, record: null, elided: true };
+    const env = await this.adapter.get(this.vault, this.name, id);
+    if (!env) return { env: null, record: null, elided: false };
+    try {
+      return { env, record: await this.codec.decryptRecord(env, { skipValidation: true }), elided: false };
+    } catch {
+      return { env, record: null, elided: false };
+    }
+  }
   /**
    * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
    * digest-only classified fields: the codec already omits them from `_data`
@@ -2852,24 +2627,16 @@ var Collection = class {
     if (!hasWritePermission(this.keyring, this.name)) {
       throw new ReadOnlyError();
     }
-    record = canonicalizeIncomingMoney(record, this.moneyFields);
+    if (this.moneyFields) record = moneyRuntime().canonicalizeIncomingMoney(record, this.moneyFields);
     if (this.subsystemBus?.hasGateHandlers("beforePut")) {
-      const existingEnv = await this.adapter.get(this.vault, this.name, id);
-      let existingRecord = null;
-      if (existingEnv) {
-        try {
-          existingRecord = await this.codec.decryptRecord(existingEnv, { skipValidation: true });
-        } catch {
-          existingRecord = null;
-        }
-      }
+      const { env: existingEnv, record: existingRecord } = await this.resolveGatePrior("beforePut", id);
       const gateEvent = {
         op: existingEnv ? "update" : "create",
         vault: this.vault,
         collection: this.name,
         docId: id,
         incoming: record,
-        existing: canonicalizeStoredMoney(existingRecord, this.moneyFields),
+        existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
         existingVersion: existingEnv?._v ?? 0,
         existingTs: existingEnv?._ts,
         userId: this.keyring.userId,
@@ -2882,13 +2649,13 @@ var Collection = class {
       enforceClassifiedWrite(record, this.classified.byField, this.name);
     }
     if (this.computed !== void 0) {
-      record = evalComputedFields(record, this.computed, id);
+      record = (await loadEvalComputedFields())(record, this.computed, id);
     }
     if (this.schema !== void 0) {
       record = await validateSchemaInput(this.schema, record, `put(${id})`);
     }
     if (this.moneyFields) {
-      record = quantizeMoneyFields(record, this.moneyFields);
+      record = moneyRuntime().quantizeMoneyFields(record, this.moneyFields);
     }
     if (this.i18nFields) {
       const obj = record;
@@ -3094,6 +2861,7 @@ var Collection = class {
     }
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx);
     await this.adapter.put(this.vault, this.name, id, envelope);
+    await this._ensureClassifiedMarker();
     if (this.embeddings) {
       await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
     }
@@ -3159,7 +2927,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-OIECZXTV.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3168,7 +2936,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-LX4BR43V.js");
+          staleHelpers = await import("./stale-7Q62KVI3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3220,7 +2988,7 @@ var Collection = class {
       raw = (await this.resolvePriorValues(id))?.record ?? null;
     }
     if (raw === null) return null;
-    return canonicalizeStoredMoney(raw, this.moneyFields);
+    return this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(raw, this.moneyFields) : raw;
   }
   /**
    * @internal Ids of records whose top-level `field` equals `value`.
@@ -3303,7 +3071,7 @@ var Collection = class {
   }
   async dispatchDerivations(id, record, version) {
     if (this.derivationSource === void 0) return;
-    const incoming = canonicalizeStoredMoney(record, this.moneyFields);
+    const incoming = this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(record, this.moneyFields) : record;
     if (incoming && typeof incoming === "object" && "_derivedFrom" in incoming) return;
     const registry = this.derivationSource.registry();
     const strategies = registry.strategiesForSource(this.name);
@@ -3353,7 +3121,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-ANFBCOYA.js"));
+        ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3372,7 +3140,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DDKRG2MX.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3580,21 +3348,15 @@ var Collection = class {
       throw new ReadOnlyError();
     }
     if (this.subsystemBus?.hasGateHandlers("beforeDelete")) {
-      const existingEnv = await this.adapter.get(this.vault, this.name, id);
-      if (existingEnv) {
-        let existingRecord = null;
-        try {
-          existingRecord = await this.codec.decryptRecord(existingEnv, { skipValidation: true });
-        } catch {
-          existingRecord = null;
-        }
+      const { env: existingEnv, record: existingRecord, elided } = await this.resolveGatePrior("beforeDelete", id);
+      if (existingEnv || elided) {
         await this.subsystemBus.dispatchGate("beforeDelete", {
           vault: this.vault,
           collection: this.name,
           docId: id,
-          existing: canonicalizeStoredMoney(existingRecord, this.moneyFields),
-          existingVersion: existingEnv._v,
-          existingTs: existingEnv._ts,
+          existing: this.moneyFields ? moneyRuntime().canonicalizeStoredMoney(existingRecord, this.moneyFields) : existingRecord,
+          existingVersion: existingEnv?._v ?? 0,
+          existingTs: existingEnv?._ts,
           internal,
           userId: this.keyring.userId,
           role: this.keyring.role
@@ -3731,7 +3493,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-DDKRG2MX.js");
+          helpers = await import("./fanout-sidecar-WS22Q5WH.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3765,7 +3527,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-OIECZXTV.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3774,7 +3536,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-LX4BR43V.js");
+          staleHelpers = await import("./stale-7Q62KVI3.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3797,7 +3559,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-LX4BR43V.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4653,7 +4415,7 @@ var Collection = class {
     const locale = localeOpts?.locale ?? this.defaultLocale;
     let result = record;
     if (hasMoney && this.moneyFields) {
-      result = decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
+      result = moneyRuntime().decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
     }
     const hasStaticDisplay = hasDict && this.dictKeyFields !== void 0 && Object.values(this.dictKeyFields).some(
       (d) => isStaticDictDescriptor(d) && d.displayLocale !== void 0
@@ -4939,6 +4701,20 @@ var Collection = class {
       id
     );
   }
+  /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
+  async _ensureClassifiedMarker() {
+    if (this._markerPersisted || this.vdigFields === null) return;
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-3UIJVI5G.js");
+    await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
+    this._markerPersisted = true;
+  }
+  /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
+  async _classifiedMarkerDigestOnly() {
+    if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-3UIJVI5G.js");
+    this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
+    return this._markerDigestOnlyCache;
+  }
   /**
    * find the first record whose deterministic field matches
    * the given plaintext. Returns `null` when no match exists.
@@ -5660,141 +5436,6 @@ var RefRegistry = class {
   }
 };
 
-// src/with-shape/links/link-set.ts
-var LINK_COLLECTION_PREFIX = "_links_";
-function linkCollectionName(name) {
-  return `${LINK_COLLECTION_PREFIX}${name}`;
-}
-function isLinkCollectionName(name) {
-  return name.startsWith(LINK_COLLECTION_PREFIX);
-}
-function linkRowKey(aId, bId) {
-  return `${encodeURIComponent(aId)}|${encodeURIComponent(bId)}`;
-}
-var LinkSet = class {
-  constructor(adapter, vault, name, spec, encrypted, getDEK, actor, emitter, endpointExists) {
-    this.adapter = adapter;
-    this.vault = vault;
-    this.name = name;
-    this.spec = spec;
-    this.encrypted = encrypted;
-    this.getDEK = getDEK;
-    this.actor = actor;
-    this.emitter = emitter;
-    this.endpointExists = endpointExists;
-    this.collName = linkCollectionName(name);
-  }
-  adapter;
-  vault;
-  name;
-  spec;
-  encrypted;
-  getDEK;
-  actor;
-  emitter;
-  endpointExists;
-  collName;
-  dekPromise = null;
-  dek() {
-    if (!this.dekPromise) this.dekPromise = this.getDEK(this.collName);
-    return this.dekPromise;
-  }
-  async encryptEntry(entry, version) {
-    const json = JSON.stringify(entry);
-    const base = { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _by: this.actor };
-    if (!this.encrypted) return { ...base, _iv: "", _data: json };
-    const { iv, data } = await encrypt(json, await this.dek());
-    return { ...base, _iv: iv, _data: data };
-  }
-  async decryptEntry(env) {
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
-    return JSON.parse(json);
-  }
-  async connect(aId, bId, meta) {
-    if (!await this.endpointExists(this.spec.a, aId)) {
-      throw new LinkEndpointError(this.name, this.spec.a, aId);
-    }
-    if (!await this.endpointExists(this.spec.b, bId)) {
-      throw new LinkEndpointError(this.name, this.spec.b, bId);
-    }
-    const key = linkRowKey(aId, bId);
-    const entry = meta !== void 0 ? { a: aId, b: bId, meta } : { a: aId, b: bId };
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    const env = await this.encryptEntry(entry, (existing?._v ?? 0) + 1);
-    await this.adapter.put(this.vault, this.collName, key, env, existing?._v);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "put" });
-  }
-  async disconnect(aId, bId) {
-    const key = linkRowKey(aId, bId);
-    const existing = await this.adapter.get(this.vault, this.collName, key);
-    if (!existing) return;
-    await this.adapter.delete(this.vault, this.collName, key);
-    this.emitter.emit("change", { vault: this.vault, collection: this.collName, id: key, action: "delete" });
-  }
-  async has(aId, bId) {
-    return await this.adapter.get(this.vault, this.collName, linkRowKey(aId, bId)) !== null;
-  }
-  async of(id) {
-    const rows = await this.list();
-    return rows.filter((r) => r.a === id || r.b === id);
-  }
-  async list() {
-    const keys = await this.adapter.list(this.vault, this.collName);
-    const out = [];
-    for (const key of keys) {
-      const env = await this.adapter.get(this.vault, this.collName, key);
-      if (!env) continue;
-      const e = await this.decryptEntry(env);
-      out.push(e.meta !== void 0 ? { a: e.a, b: e.b, meta: e.meta } : { a: e.a, b: e.b });
-    }
-    return out;
-  }
-  // ── Vault-internal cascade helpers ──────────────────────────────────
-  /** @internal — rows where the deleted endpoint id matches the relevant slot. */
-  async _rowsTouchingEndpoint(collection, id) {
-    const rows = await this.list();
-    return rows.filter(
-      (r) => this.spec.a === collection && r.a === id || this.spec.b === collection && r.b === id
-    );
-  }
-  /** @internal — the storage collection name (for tx pre-image capture). */
-  get _collectionName() {
-    return this.collName;
-  }
-};
-var LinkEndpointError = class extends NoydbError {
-  link;
-  endpoint;
-  missingId;
-  constructor(link, endpoint, missingId) {
-    super(
-      "LINK_ENDPOINT",
-      `link("${link}").connect: endpoint "${endpoint}" has no record "${missingId}".`
-    );
-    this.name = "LinkEndpointError";
-    this.link = link;
-    this.endpoint = endpoint;
-    this.missingId = missingId;
-  }
-};
-var LinkIntegrityError = class extends NoydbError {
-  link;
-  endpoint;
-  id;
-  count;
-  constructor(link, endpoint, id, count) {
-    super(
-      "LINK_INTEGRITY",
-      `Cannot delete "${endpoint}"/"${id}": ${count} link(s) in "${link}" still reference it (onDelete: 'strict').`
-    );
-    this.name = "LinkIntegrityError";
-    this.link = link;
-    this.endpoint = endpoint;
-    this.id = id;
-    this.count = count;
-  }
-};
-
 // src/with-shape/links/vault-facade.ts
 var VaultLinks = class {
   constructor(deps) {
@@ -6114,74 +5755,21 @@ var VaultLinks = class {
   }
 };
 
-// src/with-shape/schema-update/delta.ts
-function computeSchemaDelta(stored, fresh, collection) {
-  const a = stored;
-  const b = fresh;
-  const aProps = a.properties ?? {};
-  const bProps = b.properties ?? {};
-  const aReq = new Set(a.required ?? []);
-  const bReq = new Set(b.required ?? []);
-  const aKeys = Object.keys(aProps);
-  const bKeys = Object.keys(bProps);
-  const added = bKeys.filter((k) => !(k in aProps));
-  const removed = aKeys.filter((k) => !(k in bProps));
-  const changed = [];
-  for (const k of bKeys) {
-    if (!(k in aProps)) continue;
-    const shapeChanged = canonicalize(aProps[k]) !== canonicalize(bProps[k]);
-    const requiredChanged = aReq.has(k) !== bReq.has(k);
-    if (shapeChanged || requiredChanged) {
-      changed.push({ field: k, requiredChanged, shapeChanged });
-    }
-  }
-  let kind;
-  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
-    kind = "none";
-  } else if (removed.length === 0 && changed.length === 0 && added.every((k) => !bReq.has(k))) {
-    kind = "additive";
-  } else {
-    kind = "non-additive";
-  }
-  return { collection, kind, added, removed, changed };
-}
-
-// src/with-shape/schema-update/dispatch.ts
-async function evaluateStrategies(delta, strategies, ctx) {
-  for (const strategy of strategies) {
-    const decision = await strategy.onSchemaDelta(delta, ctx);
-    if (decision.action !== "allow") return decision;
-  }
-  return { action: "allow" };
-}
-
-// src/with-shape/persisted-schemas/register.ts
-async function persistSchemaIfNeeded(opts) {
-  const fresh = await derivePersistedSchema(opts.validator);
-  const stored = await loadPersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek);
-  if (stored && isEquivalent(stored, fresh)) {
-    return { written: false, skipped: true, envelope: stored, decision: { action: "allow" } };
-  }
-  let decision = { action: "allow" };
-  const strategies = opts.strategies ?? [];
-  if (stored && strategies.length > 0 && stored.kind === fresh.kind && isPlainObject(stored.jsonSchema) && isPlainObject(fresh.jsonSchema)) {
-    const delta = computeSchemaDelta(stored.jsonSchema, fresh.jsonSchema, opts.collectionName);
-    decision = await evaluateStrategies(delta, strategies, { collection: opts.collectionName });
-  }
-  if (decision.action !== "allow") {
-    return { written: false, skipped: false, envelope: stored ?? fresh, decision };
-  }
-  await savePersistedSchema(opts.store, opts.vault, opts.collectionName, opts.dek, fresh);
-  return { written: true, skipped: false, envelope: fresh, decision };
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isEquivalent(a, b) {
-  if (a.kind !== b.kind) return false;
-  if (a.hash && b.hash) return a.hash === b.hash;
-  if (a.hash === null && b.hash === null) return true;
-  return false;
+// src/with-shape/links/lazy-handle.ts
+function makeLazyLinkSetHandle(d) {
+  let engine = null;
+  const load = () => engine ??= import("./link-set-UQEIYQAM.js").then(
+    ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
+  );
+  return {
+    _collectionName: linkCollectionName(d.name),
+    connect: async (aId, bId, meta) => (await load()).connect(aId, bId, meta),
+    disconnect: async (aId, bId) => (await load()).disconnect(aId, bId),
+    has: async (aId, bId) => (await load()).has(aId, bId),
+    of: async (id) => (await load()).of(id),
+    list: async () => (await load()).list(),
+    _rowsTouchingEndpoint: async (collection, id) => (await load())._rowsTouchingEndpoint(collection, id)
+  };
 }
 
 // src/with-shape/schema-update/gate.ts
@@ -6297,70 +5885,6 @@ var SchemaFenceController = class {
   }
 };
 
-// src/with-shape/schema-update/fence-watcher.ts
-var FenceWatcher = class {
-  #coordination;
-  #vault;
-  #writerId;
-  #sessionId;
-  #onFlush;
-  #now;
-  #emit;
-  #lastState = null;
-  #quiescedAtVersion = null;
-  #timer;
-  constructor(opts) {
-    this.#coordination = opts.coordination;
-    this.#vault = opts.vault;
-    this.#writerId = opts.clientId;
-    this.#sessionId = opts.sessionId ?? opts.clientId;
-    this.#onFlush = opts.onFlush;
-    this.#now = opts.now ?? (() => Date.now());
-    this.#emit = opts.emit ?? (() => {
-    });
-  }
-  /** Publish liveness (and the current ack) without changing quiesce state. */
-  async beat() {
-    await this.#coordination.reportPresence(this.#vault, {
-      writerId: this.#writerId,
-      sessionId: this.#sessionId,
-      lastSeen: this.#now(),
-      quiescedAtVersion: this.#quiescedAtVersion
-    });
-  }
-  /** Poll the fence; quiesce on draining; emit on transitions. */
-  async check() {
-    const fence = await this.#coordination.readFence(this.#vault);
-    if (fence.fenceState !== this.#lastState) {
-      this.#lastState = fence.fenceState;
-      this.#emit({ currentSchemaVersion: fence.currentSchemaVersion, fenceState: fence.fenceState });
-    }
-    if (fence.fenceState === "draining" && this.#quiescedAtVersion !== fence.currentSchemaVersion) {
-      await this.#onFlush();
-      this.#quiescedAtVersion = fence.currentSchemaVersion;
-      await this.beat();
-    }
-    if (fence.fenceState === "normal") {
-      this.#quiescedAtVersion = null;
-    }
-  }
-  start(intervalMs) {
-    if (this.#timer) return;
-    this.#timer = setInterval(() => {
-      void this.beat();
-      void this.check();
-    }, intervalMs);
-    const timer = this.#timer;
-    if (typeof timer.unref === "function") timer.unref();
-  }
-  stop() {
-    if (this.#timer) {
-      clearInterval(this.#timer);
-      this.#timer = void 0;
-    }
-  }
-};
-
 // src/with-audit/attestation/vault-facade.ts
 var VaultAttestation = class {
   constructor(deps, strategy) {
@@ -6433,224 +5957,6 @@ var VaultAttestation = class {
   }
 };
 
-// src/with-shape/introspection/walk.ts
-var INTERNAL_PREFIX = "_";
-var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
-async function dumpVaultSchema(vault, opts) {
-  const state = vault._introspectState();
-  const sampleSize = opts.sampleSize ?? 50;
-  const withStats = opts.withStats === true;
-  const cacheNames = [...state.collectionCache.keys()];
-  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
-  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
-  const collections = {};
-  for (const name of allNames) {
-    collections[name] = await describeCollection(state, name, sampleSize, withStats);
-  }
-  const materializedViews = describeMVs(state.mvRegistry);
-  const overlayViews = describeOverlays(state.overlayRegistry);
-  const derivations = describeDerivations(state.derivationRegistry);
-  let internal;
-  if (withStats) {
-    internal = {};
-    for (const name of KNOWN_INTERNAL_NAMES) {
-      const stats = await statsForCollection(state.adapter, state.name, name);
-      if (stats.records > 0) {
-        internal[name] = { records: stats.records, bytes: stats.bytes };
-      }
-    }
-  }
-  const snap = {
-    _noydb_snapshot: 1,
-    vault: state.name,
-    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    subsystems: state.subsystems,
-    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
-    collections,
-    materializedViews,
-    overlayViews,
-    derivations,
-    ...internal !== void 0 ? { internal } : {}
-  };
-  return snap;
-}
-async function safeListAllCollections(adapter, vault) {
-  try {
-    const snap = await adapter.loadAll(vault);
-    return Object.keys(snap);
-  } catch {
-    return [];
-  }
-}
-async function describeCollection(state, collectionName, sampleSize, withStats) {
-  let fields = {};
-  let validator;
-  const refsRaw = state.refRegistry.getOutbound(collectionName);
-  const refs = {};
-  for (const [name, desc] of Object.entries(refsRaw)) {
-    refs[name] = { target: desc.target, mode: desc.mode };
-  }
-  try {
-    const dek = await state.getDEK(collectionName);
-    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
-    if (persisted) {
-      validator = { kind: persisted.kind, source: "persisted" };
-      if (persisted.jsonSchema) {
-        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
-      }
-    }
-  } catch {
-  }
-  const liveColl = state.collectionCache.get(collectionName);
-  if (!validator) {
-    const schema = liveColl?.getSchema();
-    if (schema) {
-      try {
-        const derived = await derivePersistedSchema(schema);
-        validator = { kind: derived.kind, source: "live-validator" };
-        if (derived.jsonSchema) {
-          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
-        }
-      } catch {
-      }
-    }
-  }
-  if (Object.keys(fields).length === 0 && sampleSize > 0) {
-  }
-  const collMeta = liveColl?.getMeta();
-  const collConfig = liveColl?.getConfig();
-  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
-  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
-  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
-  let mergedConfig;
-  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
-    mergedConfig = {
-      ...collConfig ?? {},
-      ...archivePresent ? { archive: true } : {},
-      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
-    };
-  }
-  const descriptor = {
-    fields,
-    indexes: [],
-    refs,
-    ...validator ? { validator } : {},
-    ...collMeta !== void 0 ? { meta: collMeta } : {},
-    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
-  };
-  if (withStats) {
-    const stats = await statsForCollection(state.adapter, state.name, collectionName);
-    descriptor.stats = stats;
-  }
-  return descriptor;
-}
-async function statsForCollection(adapter, vault, collection) {
-  const ids = await adapter.list(vault, collection);
-  if (ids.length === 0) {
-    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
-  }
-  let total = 0;
-  let min = Number.POSITIVE_INFINITY;
-  let max = 0;
-  let oldest = "\uFFFF";
-  let newest = "";
-  for (const id of ids) {
-    const env = await adapter.get(vault, collection, id);
-    if (!env) continue;
-    const size = env._data.length;
-    total += size;
-    if (size < min) min = size;
-    if (size > max) max = size;
-    if (env._ts < oldest) oldest = env._ts;
-    if (env._ts > newest) newest = env._ts;
-  }
-  return {
-    records: ids.length,
-    bytes: total,
-    bytesAvg: Math.round(total / ids.length),
-    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
-    bytesMax: max,
-    oldest: oldest === "\uFFFF" ? "" : oldest,
-    newest
-  };
-}
-function describeMVs(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const spec = reg.spec;
-    if (!spec?.name) continue;
-    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
-    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
-    const aggregate = spec.aggregate ? Object.fromEntries(
-      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
-    ) : void 0;
-    out[spec.name] = {
-      sources,
-      ...groupBy ? { groupBy } : {},
-      ...aggregate ? { aggregate } : {},
-      refresh: spec.refresh ?? "eager"
-    };
-  }
-  return out;
-}
-function describeOverlays(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const specs = listFromRegistry(registry);
-  const out = {};
-  for (const spec of specs) {
-    const s = spec;
-    if (!s.name || !s.base || !s.overlay) continue;
-    out[s.name] = { base: s.base, overlay: s.overlay };
-  }
-  return out;
-}
-function describeDerivations(registry) {
-  if (!registry || typeof registry !== "object") return {};
-  const items = listFromRegistry(registry);
-  const out = {};
-  for (const item of items) {
-    const reg = item;
-    const s = reg.spec ?? reg;
-    if (!s.source) continue;
-    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
-    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
-    out[key] = {
-      source: s.source,
-      outputs: outputCollections
-    };
-  }
-  return out;
-}
-function listFromRegistry(reg) {
-  for (const method of ["all", "list", "specs", "values"]) {
-    const fn = reg[method];
-    if (typeof fn === "function") {
-      try {
-        const out = fn.call(reg);
-        if (Array.isArray(out)) return out;
-        if (out && typeof out.values === "function") {
-          return [...out.values()];
-        }
-      } catch {
-        continue;
-      }
-    }
-  }
-  return [];
-}
-function summariseAggregateOp(value) {
-  if (value && typeof value === "object") {
-    const op = value.op ?? value.kind;
-    const field = value.field;
-    if (op && field) return `${op}(${field})`;
-    if (op) return op;
-  }
-  return String(value);
-}
-
 // src/kernel/vault.ts
 function resolveLabelFromMap(labels, locale, fallback) {
   if (labels[locale] !== void 0) return labels[locale];
@@ -6703,6 +6009,7 @@ var Vault = class {
   /** Per-collection record archival policies. Indexed by collection name. */
   archiveRegistry = /* @__PURE__ */ new Map();
   indexStrategy;
+  lazyStrategy;
   aggregateStrategy;
   crdtStrategy;
   tiersStrategy;
@@ -6922,7 +6229,7 @@ var Vault = class {
   dictionaryCache = /* @__PURE__ */ new Map();
   /** Registered link specs, keyed by link name; set by `vault.link()`. */
   linkRegistry = /* @__PURE__ */ new Map();
-  /** Cache of LinkSet handles, one per link name. */
+  /** Cache of link-set handles, one per link name (lazy -- see links()). */
   linkSetCache = /* @__PURE__ */ new Map();
   /** — subscribers for cross-tier access events. */
   crossTierSubs = /* @__PURE__ */ new Set();
@@ -6956,6 +6263,7 @@ var Vault = class {
     this.objectStore = opts.objectStore;
     this.archiveStrategy = opts.archiveStrategy;
     this.indexStrategy = opts.indexStrategy;
+    this.lazyStrategy = opts.lazyStrategy;
     this.aggregateStrategy = opts.aggregateStrategy;
     this.crdtStrategy = opts.crdtStrategy;
     this.tiersStrategy = opts.tiersStrategy;
@@ -7090,6 +6398,9 @@ var Vault = class {
     if (isLinkCollectionName(collectionName)) {
       throw new ReservedCollectionNameError(collectionName);
     }
+    if (isSecretBearingReservedCollection(collectionName)) {
+      throw new ReservedCollectionNameError(collectionName);
+    }
     let coll = this.collectionCache.get(collectionName);
     if (coll && options?.moneyFields) {
       coll._applyMoneyFields(options.moneyFields);
@@ -7150,6 +6461,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
+          const { persistSchemaIfNeeded } = await import("./register-V5AQTXNI.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7161,7 +6473,7 @@ var Vault = class {
           const decision = result.decision ?? { action: "allow" };
           if (decision.action === "cutover") {
             this.schemaFence.registerPendingCutover(collectionName, decision.transform);
-            this._ensureFenceCoordination();
+            await this._ensureFenceCoordination();
           }
           return decision;
         })();
@@ -7195,6 +6507,7 @@ var Vault = class {
         ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
         ...options?.blobFields !== void 0 ? { blobFields: options.blobFields } : {},
         ...this.indexStrategy !== void 0 ? { indexStrategy: this.indexStrategy } : {},
+        ...this.lazyStrategy !== void 0 ? { lazyStrategy: this.lazyStrategy } : {},
         ...this.aggregateStrategy !== void 0 ? { aggregateStrategy: this.aggregateStrategy } : {},
         ...this.crdtStrategy !== void 0 ? { crdtStrategy: this.crdtStrategy } : {},
         ...this.tiersStrategy !== void 0 ? { tiersStrategy: this.tiersStrategy } : {},
@@ -7252,6 +6565,9 @@ var Vault = class {
       if (options?.acknowledgeDeterministicRisk !== void 0) {
         collOpts.acknowledgeDeterministicRisk = options.acknowledgeDeterministicRisk;
       }
+      if (options?.acknowledgeEquatableRisk !== void 0) {
+        collOpts.acknowledgeEquatableRisk = options.acknowledgeEquatableRisk;
+      }
       if (options?.sensitive !== void 0) {
         collOpts.sensitive = options.sensitive;
       }
@@ -7324,7 +6640,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await persistSchemaIfNeeded({
+            await (await import("./register-V5AQTXNI.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7408,10 +6724,12 @@ var Vault = class {
   async schemaFenceState() {
     return loadFence(this.adapter, this.name);
   }
-  /** @internal Start the per-client heartbeat + fence watcher once a cutover is registered. */
-  _ensureFenceCoordination() {
+  /** @internal Start heartbeat + fence watcher once a cutover is registered. Async since #553: FenceWatcher dynamic-imports on demand. */
+  async _ensureFenceCoordination() {
     if (this.#fenceCoordinationStarted) return;
     this.#fenceCoordinationStarted = true;
+    const { FenceWatcher } = await import("./fence-watcher-DHQ775JB.js");
+    if (!this.#fenceCoordinationStarted) return;
     this.#fenceWatcher = new FenceWatcher({
       coordination: this.noydb.coordination,
       vault: this.name,
@@ -7440,7 +6758,7 @@ var Vault = class {
   }
   /** @internal Drive one heartbeat + watch cycle deterministically (tests). */
   async _fenceTick() {
-    this._ensureFenceCoordination();
+    await this._ensureFenceCoordination();
     await this.#fenceWatcher.beat();
     await this.#fenceWatcher.check();
   }
@@ -7652,17 +6970,17 @@ var Vault = class {
       if (!spec) {
         throw new ValidationError(`vault.links("${name}"): not declared. Call vault.link("${name}", { a, b }) first.`);
       }
-      handle = new LinkSet(
-        this.adapter,
-        this.name,
+      handle = makeLazyLinkSetHandle({
+        adapter: this.adapter,
+        vault: this.name,
         name,
         spec,
-        this.encrypted,
-        this.getDEK,
-        this.keyring.userId,
-        this.emitter,
-        async (collection, id) => await this.collection(collection).get(id) !== null
-      );
+        encrypted: this.encrypted,
+        getDEK: this.getDEK,
+        actor: this.keyring.userId,
+        emitter: this.emitter,
+        endpointExists: async (collection, id) => await this.collection(collection).get(id) !== null
+      });
       this.linkSetCache.set(name, handle);
     }
     return handle;
@@ -8171,8 +7489,14 @@ var Vault = class {
       if (live?._sealed !== void 0) {
         try {
           const cls = await coll._classifySealedShred(live);
-          sealedFieldsShredded += cls.shreddable.length;
-          for (const field of cls.dekResidue) sealedResidue.push(`${ref2.collection}:${ref2.id}:${field}`);
+          for (const slot of cls.slots) {
+            if (slot.class === "shreddable" || slot.class === "live-shreddable+dekResidue-in-backups") {
+              sealedFieldsShredded += 1;
+            }
+            if (slot.class === "dekResidue" || slot.class === "live-shreddable+dekResidue-in-backups") {
+              sealedResidue.push(`${ref2.collection}:${ref2.id}:${slot.field}`);
+            }
+          }
         } catch {
           for (const field of Object.keys(live._sealed)) sealedResidue.push(`${ref2.collection}:${ref2.id}:${field}`);
         }
@@ -8231,7 +7555,7 @@ var Vault = class {
         indexResidue.push(`${collName}:_ftindex`);
       }
     }
-    const subjectHash = await sha256Hex2(subjectId);
+    const subjectHash = await sha256Hex(subjectId);
     const ledger = this.getLedgerOrNull();
     if (!ledger) {
       throw new Error(
@@ -8399,7 +7723,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-6HZ2JSQ7.js"),
+      import("./registry-IMNMHWTM.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -8430,7 +7754,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-USYD2ECC.js");
+    const { MaterializedViewRegistry } = await import("./registry-K6VUQXKV.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -8454,7 +7778,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-GPXZQ7DT.js");
+    const { OverlayedViewRegistry } = await import("./registry-ZVO3T4M5.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -8501,13 +7825,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-OIECZXTV.js");
+    const { MaterializedViewExecutor } = await import("./executor-FGISLQIN.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-LX4BR43V.js");
+    const { clearMVStale } = await import("./stale-7Q62KVI3.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -8523,7 +7847,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-ANFBCOYA.js");
+    const { DerivationExecutor } = await import("./executor-CBTNU5VZ.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -8548,7 +7872,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-DDKRG2MX.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8698,11 +8022,11 @@ var Vault = class {
    *
    *.
    */
-  async withConsent(ctx, fn) {
+  async withConsent(ctx, fn2) {
     const prior = this.consentContext;
     this.consentContext = ctx;
     try {
-      return await fn();
+      return await fn2();
     } finally {
       this.consentContext = prior;
     }
@@ -8770,7 +8094,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-4HUHUE6T.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8792,7 +8116,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-4HUHUE6T.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -9008,6 +8332,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
+    const { dumpVaultSchema } = await import("./walk-T65TZDN2.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -9142,7 +8467,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-WVRRUVAJ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -9157,7 +8482,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-NGRJ46SH.js");
+    const { dumpVault } = await import("./backup-OPONO6Q5.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9209,7 +8534,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-NGRJ46SH.js");
+    const { loadVault } = await import("./backup-OPONO6Q5.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9241,7 +8566,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-NGRJ46SH.js");
+    const { verifyBackupIntegrity } = await import("./backup-OPONO6Q5.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9459,7 +8784,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-NGRJ46SH.js");
+    const { exportVaultJSON } = await import("./backup-OPONO6Q5.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -9536,10 +8861,10 @@ var WriteQueueTracker = class {
    * (success or failure). The fn's resolved value is returned; a thrown
    * error is re-thrown after the queue is decremented.
    */
-  async track(fn) {
+  async track(fn2) {
     this.begin();
     try {
-      const value = await fn();
+      const value = await fn2();
       this.settle();
       return value;
     } catch (error) {
@@ -9624,13 +8949,13 @@ var TabCoordinator = class {
     const out = [self, ...[...this.#peers.values()].filter((p) => p.lastSeen >= cutoff)];
     return out.sort((a, b) => a.tabId.localeCompare(b.tabId));
   }
-  onTabRoleChange(fn) {
-    this.#roleHandlers.add(fn);
-    return () => this.#roleHandlers.delete(fn);
+  onTabRoleChange(fn2) {
+    this.#roleHandlers.add(fn2);
+    return () => this.#roleHandlers.delete(fn2);
   }
-  onActiveTabsChange(fn) {
-    this.#tabsHandlers.add(fn);
-    return () => this.#tabsHandlers.delete(fn);
+  onActiveTabsChange(fn2) {
+    this.#tabsHandlers.add(fn2);
+    return () => this.#tabsHandlers.delete(fn2);
   }
   dispose() {
     if (this.#disposed) return;
@@ -10327,6 +9652,35 @@ var TeamFacade = class {
     }
     return p;
   }
+  // ─── Multi-user grant / revoke / rotate runners (#267 team split) ──
+  //
+  // The kernel's `db.grant` / `db.revoke` / `db.rotate` route through the
+  // TeamStrategy seam, which calls back here with the keyring ENGINE as an
+  // argument (statically linked in `active.ts`, i.e. only in the
+  // `@noy-db/hub/team` subpath bundle). These runners own the policy-gate +
+  // keyring plumbing so the kernel keeps single-line delegators and the
+  // engines stay off the single-user floor.
+  /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
+  async runGrant(engine, vault, options, factors) {
+    this.deps.checkPolicyOperation(vault, "grant");
+    await this.deps.checkGate(vault, "enroll-user", factors);
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, options);
+  }
+  /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
+  async runRevoke(engine, vault, options, factors) {
+    this.deps.checkPolicyOperation(vault, "revoke");
+    await this.deps.checkGate(vault, "revoke-user", factors);
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, options);
+  }
+  /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
+  async runRotate(engine, vault, collections) {
+    this.deps.checkPolicyOperation(vault, "rotate");
+    const keyring = await this.deps.getKeyringInternal(vault);
+    await engine(this.deps.options.store, vault, keyring, collections);
+    this.deps.keyringCache.set(vault, keyring);
+  }
   // ─── Tier-2 enroll / remove ─────────────────────────────────────
   /**
    * Add a tier-2 authenticator slot to the calling user's keyring.
@@ -11072,6 +10426,15 @@ var Noydb = class {
   /** Pre-resolved `vault.user` API factory (mirrors `coordinationProvider` above). Public so `Vault` can call it. */
   userApiFactory;
   vaultCache = /* @__PURE__ */ new Map();
+  /**
+   * In-flight `openVault` promise per name — concurrent opens of the same
+   * vault must converge on ONE Vault instance. Without this, two callers
+   * racing past the `vaultCache` miss each construct a Vault (and later two
+   * Collections with independent DEKs for the same store slice), so a record
+   * written through one fails decryption through the other with a spurious
+   * `TamperedError` (#564).
+   */
+  vaultOpening = /* @__PURE__ */ new Map();
   keyringCache = /* @__PURE__ */ new Map();
   syncEngines = /* @__PURE__ */ new Map();
   /**
@@ -11111,6 +10474,11 @@ var Noydb = class {
    * through it; grant/revoke route through it from this class. @internal
    */
   custodyStrategy;
+  /**
+   * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
+   * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
+   * engines are linked only by the active strategy, not by this file. */
+  teamStrategy;
   sessionStrategy;
   syncStrategy;
   snapshots;
@@ -11161,6 +10529,7 @@ var Noydb = class {
     this.txStrategy = options.txStrategy ?? NO_TX;
     this.forgetStrategy = options.forgetStrategy ?? NO_FORGET;
     this.custodyStrategy = options.custodyStrategy ?? NO_CUSTODY;
+    this.teamStrategy = options.teamStrategy ?? NO_TEAM;
     this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
     this.syncStrategy = options.syncStrategy ?? NO_SYNC;
     this.snapshots = new NoydbSnapshots({
@@ -11192,6 +10561,7 @@ var Noydb = class {
       quickUnlock: this.quickUnlock,
       policyCache: this.policyCache,
       checkGate: (vault, gate, factors) => this.checkGate(vault, gate, factors),
+      checkPolicyOperation: (vault, op) => this.checkPolicyOperation(vault, op),
       getKeyringInternal: (vault, opts) => this._getKeyringInternal(vault, opts),
       assertRecoveryEnrolled: (vault, policy, opts) => this.assertRecoveryEnrolled(vault, policy, opts),
       openVault: (vault, opts) => this.openVault(vault, opts),
@@ -11286,7 +10656,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-IKT47SH2.js");
+      const { GuardExecutor } = await import("./executor-DJHNSTIR.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -11381,12 +10751,26 @@ var Noydb = class {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.touchPolicy(name);
     let comp = this.vaultCache.get(name);
+    if (!comp) {
+      const pending = this.vaultOpening.get(name);
+      if (pending) comp = await pending;
+    }
     if (comp) {
       if (opts?.locale !== void 0) {
         comp.setLocale(opts.locale);
       }
       return comp;
     }
+    const opening = this.#openVaultFresh(name, opts);
+    this.vaultOpening.set(name, opening);
+    try {
+      return await opening;
+    } finally {
+      this.vaultOpening.delete(name);
+    }
+  }
+  /** Uncached single-flight body of {@link openVault} — see `vaultOpening`. */
+  async #openVaultFresh(name, opts) {
     const keyring = await this._getKeyringInternal(name, { create: opts?.create !== false });
     if (!this.activeTier.has(name)) {
       this.activeTier.set(name, 1);
@@ -11427,7 +10811,7 @@ var Noydb = class {
         this.syncEngines.set(key, engine);
       }
     }
-    comp = new Vault({
+    const comp = new Vault({
       adapter: this.options.store,
       name,
       noydb: this,
@@ -11448,6 +10832,7 @@ var Noydb = class {
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
       ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
       ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11514,6 +10899,7 @@ var Noydb = class {
         ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
         ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
         ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+        ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
         ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
         ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
         ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11554,6 +10940,7 @@ var Noydb = class {
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
       ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
+      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
       ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
@@ -11581,12 +10968,10 @@ var Noydb = class {
    *
    * The legacy `requireReAuthFor: ['grant']` session-policy check still
    * fires on top — both are independent opt-ins.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    this.checkPolicyOperation(vault, "grant");
-    await this.checkGate(vault, "enroll-user", factors);
-    const keyring = await this._getKeyringInternal(vault);
-    await grant(this.options.store, vault, keyring, options);
+    return this.teamStrategy.grant(this.team, vault, options, factors);
   }
   /**
    * Revoke a user's access to a vault.
@@ -11596,12 +10981,10 @@ var Noydb = class {
    *
    * The legacy `requireReAuthFor: ['revoke']` session-policy check still
    * fires on top — both are independent opt-ins.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    this.checkPolicyOperation(vault, "revoke");
-    await this.checkGate(vault, "revoke-user", factors);
-    const keyring = await this._getKeyringInternal(vault);
-    await revoke(this.options.store, vault, keyring, options);
+    return this.teamStrategy.revoke(this.team, vault, options, factors);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -11616,13 +10999,14 @@ var Noydb = class {
   async grantCustodian(vault, options, factors) {
     return this.custodyStrategy.grantCustodian(this, vault, options, factors);
   }
-  /** @internal — the grant-custodian engine, reached only when withCustody() is opted in. */
-  async _grantCustodianImpl(vault, options, factors) {
+  /** @internal — grant-custodian engine, reached only via withCustody(); the
+   * keyring engine arrives as an argument so the floor never carries it (#267). */
+  async _grantCustodianImpl(engine, vault, options, factors) {
     this.checkPolicyOperation(vault, "grant");
     await this.checkGate(vault, "grant-custodian", factors);
     const keyring = await this._getKeyringInternal(vault);
     if (keyring.role !== "owner") throw new PermissionDeniedError("only the Deed owner can grant a custodian");
-    await grant(this.options.store, vault, keyring, { ...options, role: "custodian" });
+    await engine(this.options.store, vault, keyring, { ...options, role: "custodian" });
   }
   /**
    * Revoke a custodian (owner-only custody API).
@@ -11634,13 +11018,14 @@ var Noydb = class {
   async revokeCustodian(vault, options, factors) {
     return this.custodyStrategy.revokeCustodian(this, vault, options, factors);
   }
-  /** @internal — the revoke-custodian engine, reached only when withCustody() is opted in. */
-  async _revokeCustodianImpl(vault, options, factors) {
+  /** @internal — revoke-custodian engine, reached only via withCustody().
+   * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
+  async _revokeCustodianImpl(engine, vault, options, factors) {
     this.checkPolicyOperation(vault, "revoke");
     await this.checkGate(vault, "revoke-user", factors);
     const keyring = await this._getKeyringInternal(vault);
     if (keyring.role !== "owner") throw new PermissionDeniedError("only the Deed owner can revoke a custodian");
-    await revoke(this.options.store, vault, keyring, options);
+    await engine(this.options.store, vault, keyring, options);
   }
   /**
    * Mutate post-grant identity fields on an existing keyring — `role`,
@@ -11707,12 +11092,10 @@ var Noydb = class {
    * Exposed on Noydb (rather than only on the lower-level keyring
    * module) so CLI and admin tooling can trigger rotation without
    * reaching into internals. See `noy-db rotate` for the CLI wrapper.
+   * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async rotate(vault, collections) {
-    this.checkPolicyOperation(vault, "rotate");
-    const keyring = await this._getKeyringInternal(vault);
-    await rotateKeys(this.options.store, vault, keyring, collections);
-    this.keyringCache.set(vault, keyring);
+    return this.teamStrategy.rotate(this.team, vault, collections);
   }
   /** List all users with access to a vault. */
   async listUsers(vault) {
@@ -11872,7 +11255,7 @@ var Noydb = class {
    * })
    * ```
    */
-  async queryAcross(vaultIds, fn, options = {}) {
+  async queryAcross(vaultIds, fn2, options = {}) {
     if (this.closed) throw new ValidationError("Instance is closed");
     this.resetSessionTimer();
     const concurrency = Math.max(1, options.concurrency ?? 1);
@@ -11886,7 +11269,7 @@ var Noydb = class {
       const task = (async () => {
         try {
           const comp = await this.openVault(vaultId, { create: options.create !== false });
-          const result = await fn(comp);
+          const result = await fn2(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
           results[idx] = {
@@ -12146,9 +11529,9 @@ var Noydb = class {
     return this.writeHooks.onAfterWrite(handler);
   }
   /** Subscribe to cross-tab write conflicts. Returns an unsubscribe. */
-  onWriteConflict(fn) {
-    this.on("write:conflict", fn);
-    return () => this.off("write:conflict", fn);
+  onWriteConflict(fn2) {
+    this.on("write:conflict", fn2);
+    return () => this.off("write:conflict", fn2);
   }
   /**
    * Enable same-device multi-tab coordination: primary/secondary
@@ -12222,12 +11605,12 @@ var Noydb = class {
   activeTabs() {
     return this.tabCoordinator?.activeTabs() ?? [];
   }
-  onTabRoleChange(fn) {
-    return this.tabCoordinator?.onTabRoleChange(fn) ?? (() => {
+  onTabRoleChange(fn2) {
+    return this.tabCoordinator?.onTabRoleChange(fn2) ?? (() => {
     });
   }
-  onActiveTabsChange(fn) {
-    return this.tabCoordinator?.onActiveTabsChange(fn) ?? (() => {
+  onActiveTabsChange(fn2) {
+    return this.tabCoordinator?.onActiveTabsChange(fn2) ?? (() => {
     });
   }
   /** @internal The write-hook registry, threaded into each Collection. */
@@ -12526,7 +11909,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-WVRRUVAJ.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-MRN5YYZZ.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12555,7 +11938,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-WVRRUVAJ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12746,9 +12129,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-LORZ2EZU.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JOXUNSKP.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-LRE6HTO5.js");
+    const policyModule = await import("./policy-YIKUH4AD.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12765,13 +12148,6 @@ function normalizeSyncTargets(sync) {
 export {
   memoryStore,
   withArchive,
-  ComputedFieldError,
-  evalComputedFields,
-  isZodSchema,
-  derivePersistedSchema,
-  Lru,
-  parseBytes,
-  estimateRecordBytes,
   Collection,
   ELEVATION_AUDIT_COLLECTION,
   ElevatedHandle,
@@ -12781,10 +12157,6 @@ export {
   ref,
   refArray,
   RefRegistry,
-  isLinkCollectionName,
-  LinkEndpointError,
-  LinkIntegrityError,
-  persistSchemaIfNeeded,
   Vault,
   QuickUnlockStore,
   describeAuthConfig,
@@ -12794,4 +12166,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-ADBMJDBW.js.map
+//# sourceMappingURL=chunk-IEUIUSBO.js.map