@noy-db/hub 0.4.0-pre.2 → 0.4.0-pre.4

package/dist/{chunk-VZELV7ZJ.js → chunk-W7TCXZWU.js}

@@ -31,7 +31,7 @@ import {
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-J6U4BOKP.js";
+} from "./chunk-JW3XCZA2.js";
 import {
   derivePersistedSchema,
   isZod4Schema
@@ -44,7 +44,7 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-A64XXIIB.js";
+} from "./chunk-U73LHVPF.js";
 import {
   resolveManagedSecret,
   saveSealedPassphrase
@@ -56,7 +56,7 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-RGL53NXZ.js";
+} from "./chunk-WEC3JGBA.js";
 import {
   runDrainBarrier
 } from "./chunk-KMONEHDJ.js";
@@ -72,7 +72,7 @@ import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-IU22SQGU.js";
+} from "./chunk-5KI3REO3.js";
 import {
   NO_PORTABILITY
 } from "./chunk-GYB2QK5H.js";
@@ -115,7 +115,7 @@ import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-OTU5ZI3U.js";
+} from "./chunk-4X6DJZHY.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
@@ -133,7 +133,7 @@ import {
 } from "./chunk-NO272T7Q.js";
 import {
   canonicalGroupKey
-} from "./chunk-RI3OKC3Y.js";
+} from "./chunk-JIMEB4C6.js";
 import {
   readPath
 } from "./chunk-IGJCYUT5.js";
@@ -163,7 +163,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-4JYYIFHW.js";
+} from "./chunk-QUIG6BZT.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -176,7 +176,7 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-HVZT5T22.js";
+} from "./chunk-WJDYZP3U.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
@@ -293,6 +293,284 @@ import {
   ValidationError
 } from "./chunk-IGM563N5.js";
 
+// src/via/blob/binding.ts
+async function eraseBlobs(ctx, cfg) {
+  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
+  return { shredded: 0, residue: [] };
+}
+function buildBlobDescribeFragment(fields) {
+  return {
+    blobFields: Object.fromEntries(
+      Object.entries(fields).map(([field, p]) => [field, {
+        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
+        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
+        ...p.legalHold !== void 0 ? { legalHold: true } : {},
+        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
+        ...p.external === true ? { external: true } : {},
+        ...p.public === true ? { public: true } : {},
+        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
+      }])
+    )
+  };
+}
+function blobBinding(cfg) {
+  return {
+    brand: "blob",
+    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
+    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
+    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
+    // is a first-class door; forgettable — shredAllForRecord participates in
+    // vault.forget().
+    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
+    covers: (field) => field in cfg.fields,
+    erase: (ctx) => eraseBlobs(ctx, cfg),
+    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
+  };
+}
+function linkBlobVia() {
+  installViaBinder("blob", (c) => blobBinding(c));
+}
+
+// src/port/with/blob-strategy.ts
+linkBlobVia();
+var NO_BLOBS = {
+  openSlot() {
+    throw new Error(
+      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
+    );
+  }
+};
+
+// src/with-audit/consent/strategy.ts
+var NO_CONSENT = {
+  async write() {
+  },
+  async read() {
+    return [];
+  }
+};
+
+// src/with-commit/crdt/strategy.ts
+var NOT_ENABLED = new Error(
+  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
+);
+var NO_CRDT = {
+  buildLwwMapState() {
+    throw NOT_ENABLED;
+  },
+  buildRgaState() {
+    throw NOT_ENABLED;
+  },
+  mergeCrdtStates() {
+    throw NOT_ENABLED;
+  },
+  resolveCrdtSnapshot() {
+    throw NOT_ENABLED;
+  }
+};
+
+// src/with-commit/history/strategy.ts
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
+  );
+}
+var NO_HISTORY = {
+  async saveHistory() {
+  },
+  async getHistoryEntries() {
+    throw notEnabled("collection.history()");
+  },
+  async getVersionEnvelope() {
+    throw notEnabled("collection.getVersion()");
+  },
+  async pruneHistory() {
+    return 0;
+  },
+  async clearHistory() {
+    return 0;
+  },
+  async tombstoneHistory() {
+    return 0;
+  },
+  async rewrapHistory() {
+  },
+  async envelopePayloadHash() {
+    return "";
+  },
+  computePatch() {
+    return [];
+  },
+  diff() {
+    throw notEnabled("collection.diff()");
+  },
+  buildLedger() {
+    return null;
+  },
+  buildVaultInstant() {
+    throw notEnabled("vault.at() / vault.timeMachine()");
+  }
+};
+
+// src/with-lookup/indexing/strategy.ts
+var NO_INDEXING = {
+  createState() {
+    return DISABLED_STATE;
+  }
+};
+var DISABLED_STATE = {
+  isEnabled: false,
+  getEagerIndexes: () => null,
+  getPersistedIndexes: () => null
+};
+
+// src/with-audit/periods/strategy.ts
+var NOT_ENABLED2 = new Error(
+  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
+);
+var NO_PERIODS = {
+  async loadPeriods() {
+    return [];
+  },
+  async chainAnchor() {
+    return { priorPeriodHash: "" };
+  },
+  assertTsWritable() {
+  },
+  validatePeriodName() {
+    throw NOT_ENABLED2;
+  },
+  async appendPeriodLedgerEntry() {
+    throw NOT_ENABLED2;
+  }
+};
+
+// src/with-party/session/strategy.ts
+function notEnabled2(op) {
+  return new Error(
+    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
+  );
+}
+var NO_SESSION = {
+  validateSessionPolicy() {
+    throw notEnabled2("sessionPolicy");
+  },
+  createEnforcer() {
+    throw notEnabled2("session policy enforcement");
+  },
+  revokeAllSessions() {
+  }
+};
+
+// src/with-fork/shadow/strategy.ts
+var NOT_ENABLED3 = new Error(
+  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
+);
+var NO_SHADOW = {
+  buildFrame() {
+    throw NOT_ENABLED3;
+  }
+};
+
+// src/with-fork/snapshots/strategy.ts
+var NOT_ENABLED4 = new Error(
+  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
+);
+var NO_SNAPSHOTS = {
+  async snapshot() {
+    throw NOT_ENABLED4;
+  },
+  async listSnapshots() {
+    throw NOT_ENABLED4;
+  },
+  async restoreSnapshot() {
+    throw NOT_ENABLED4;
+  },
+  async autoSnapshot() {
+    throw NOT_ENABLED4;
+  }
+};
+
+// src/with-party/team/sync-strategy.ts
+function notEnabled3(op) {
+  return new Error(
+    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
+  );
+}
+var NO_SYNC = {
+  buildSyncEngine() {
+    throw notEnabled3("SyncEngine");
+  },
+  buildSyncTransaction() {
+    throw notEnabled3("SyncTransaction");
+  },
+  buildPresence() {
+    throw notEnabled3("collection.presence()");
+  }
+};
+
+// src/with-commit/tx/strategy.ts
+var NOT_ENABLED5 = new Error(
+  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
+);
+var NO_TX = {
+  async runTransaction(_db, _fn, _options, _txInvariants) {
+    throw NOT_ENABLED5;
+  },
+  async runDryRun() {
+    throw NOT_ENABLED5;
+  }
+};
+
+// src/port/with/archive-strategy.ts
+var ARCHIVE_NOT_ENABLED = "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb";
+var NO_ARCHIVE = {
+  get store() {
+    throw new Error(ARCHIVE_NOT_ENABLED);
+  }
+};
+
+// src/port/with/strategies.ts
+var STRATEGY_DEFAULTS = {
+  aggregate: NO_AGGREGATE,
+  archive: NO_ARCHIVE,
+  attestation: NO_ATTESTATION,
+  blob: NO_BLOBS,
+  broker: NO_BROKER,
+  cargo: NO_CARGO,
+  classified: NO_CLASSIFIED,
+  consent: NO_CONSENT,
+  crdt: NO_CRDT,
+  custody: NO_CUSTODY,
+  forget: NO_FORGET,
+  history: NO_HISTORY,
+  i18n: NO_I18N,
+  index: NO_INDEXING,
+  lazy: IMPLICIT_LAZY,
+  periods: NO_PERIODS,
+  portability: NO_PORTABILITY,
+  sealedRecord: NO_SEALED_RECORD,
+  search: NO_SEARCH,
+  sequence: NO_SEQUENCE,
+  session: NO_SESSION,
+  shadow: NO_SHADOW,
+  snapshot: NO_SNAPSHOTS,
+  sync: NO_SYNC,
+  team: NO_TEAM,
+  tiers: NO_TIERS,
+  tx: NO_TX
+};
+var STRATEGY_KEYS = Object.keys(STRATEGY_DEFAULTS);
+function resolveStrategies(options) {
+  const provided = options;
+  const resolved = { ...STRATEGY_DEFAULTS };
+  for (const key of STRATEGY_KEYS) {
+    const value = provided[`${key}Strategy`];
+    if (value !== void 0) resolved[key] = value;
+  }
+  return resolved;
+}
+
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
   const { StoreCoordinationProvider } = await import("./store-coordination-provider-3AELCZ4Y.js");
@@ -964,61 +1242,6 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
 }
 
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-// src/with-lookup/indexing/strategy.ts
-var NO_INDEXING = {
-  createState() {
-    return DISABLED_STATE;
-  }
-};
-var DISABLED_STATE = {
-  isEnabled: false,
-  getEagerIndexes: () => null,
-  getPersistedIndexes: () => null
-};
-
 // src/with-lookup/search/serialize.ts
 function serializeIndex(idx) {
   return JSON.stringify(idx.toSnapshot());
@@ -1621,54 +1844,6 @@ function buildDescription(input) {
   };
 }
 
-// src/via/blob/binding.ts
-async function eraseBlobs(ctx, cfg) {
-  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id);
-  return { shredded: 0, residue: [] };
-}
-function buildBlobDescribeFragment(fields) {
-  return {
-    blobFields: Object.fromEntries(
-      Object.entries(fields).map(([field, p]) => [field, {
-        ...p.retainDays !== void 0 ? { retainDays: p.retainDays } : {},
-        ...p.evictWhen !== void 0 ? { evictWhen: true } : {},
-        ...p.legalHold !== void 0 ? { legalHold: true } : {},
-        ...p.retainUntil !== void 0 ? { retainUntil: true } : {},
-        ...p.external === true ? { external: true } : {},
-        ...p.public === true ? { public: true } : {},
-        ...p.backlink !== void 0 ? { backlink: p.backlink } : {}
-      }])
-    )
-  };
-}
-function blobBinding(cfg) {
-  return {
-    brand: "blob",
-    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes
-    // in `_blob_chunks` (service-side), not sealed record fields; queryable:
-    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()
-    // is a first-class door; forgettable — shredAllForRecord participates in
-    // vault.forget().
-    posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
-    covers: (field) => field in cfg.fields,
-    erase: (ctx) => eraseBlobs(ctx, cfg),
-    describeFragment: () => buildBlobDescribeFragment(cfg.fields)
-  };
-}
-function linkBlobVia() {
-  installViaBinder("blob", (c) => blobBinding(c));
-}
-
-// src/port/with/blob-strategy.ts
-linkBlobVia();
-var NO_BLOBS = {
-  openSlot() {
-    throw new Error(
-      'Blob storage is not enabled on this Noydb instance. Import `{ withBlobs }` from "@noy-db/hub/blobs" and pass `withBlobs()` to `createNoydb({ blobStrategy: withBlobs() })`.'
-    );
-  }
-};
-
 // src/with-formula/derivations/stale.ts
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
@@ -1742,43 +1917,6 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
   }
 }
 
-// src/with-commit/crdt/strategy.ts
-var NOT_ENABLED = new Error(
-  'CRDT mode requires the CRDT strategy. Import `{ withCrdt }` from "@noy-db/hub/crdt" and pass it to `createNoydb({ crdtStrategy: withCrdt() })`.'
-);
-var NO_CRDT = {
-  buildLwwMapState() {
-    throw NOT_ENABLED;
-  },
-  buildRgaState() {
-    throw NOT_ENABLED;
-  },
-  mergeCrdtStates() {
-    throw NOT_ENABLED;
-  },
-  resolveCrdtSnapshot() {
-    throw NOT_ENABLED;
-  }
-};
-
-// src/with-party/team/sync-strategy.ts
-function notEnabled2(op) {
-  return new Error(
-    `${op} requires the sync strategy. Import \`{ withSync }\` from "@noy-db/hub/sync" and pass it to \`createNoydb({ syncStrategy: withSync() })\`.`
-  );
-}
-var NO_SYNC = {
-  buildSyncEngine() {
-    throw notEnabled2("SyncEngine");
-  },
-  buildSyncTransaction() {
-    throw notEnabled2("SyncTransaction");
-  },
-  buildPresence() {
-    throw notEnabled2("collection.presence()");
-  }
-};
-
 // src/kernel/via/compose.ts
 function via(...descriptors) {
   if (descriptors.length === 0) {
@@ -1942,7 +2080,7 @@ function compileViaBindings(opts, classifiedGuardCtx, eraseCfgOut) {
       ...i18nFields !== void 0 ? { i18nFields } : {},
       ...dictKeyFields !== void 0 ? { dictKeyFields } : {},
       ...i18nDensifyFields !== void 0 ? { i18nDensifyFields } : {},
-      strategy: opts.i18nStrategy ?? NO_I18N,
+      strategy: opts.strategies.i18n,
       ...opts.defaultLocale !== void 0 ? { defaultLocale: opts.defaultLocale } : {},
       ...opts.autoTranslateHook !== void 0 ? { autoTranslateHook: opts.autoTranslateHook } : {},
       ...opts.dictLabelResolver !== void 0 ? { dictLabelResolver: opts.dictLabelResolver } : {},
@@ -2056,6 +2194,11 @@ function resolveCollectionConfig(opts) {
       `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
     );
   }
+  if (opts.sensitive && opts.sensitive.length > 0 && opts.crdt) {
+    throw new Error(
+      `Collection "${opts.name}": sensitive (structural group-encryption) is not supported on CRDT collections \u2014 the CRDT write path bypasses per-field sealing, so the fields would be stored in the ordinary encrypted body with no \`_sealed\` slot and no per-field key. Use a non-CRDT collection for sealed fields.`
+    );
+  }
   if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0 && Object.keys(opts.blobFields).length > 0 && opts.perRecordKeys !== true) {
     throw new UnsupportedTierCompositionError(
       "blobs",
@@ -2172,14 +2315,9 @@ function resolveCollectionConfig(opts) {
     writeHooks: opts.writeHooks,
     subsystemBus: opts.subsystemBus,
     activeTxId: opts.activeTxId,
-    blobStrategy: opts.blobStrategy ?? NO_BLOBS,
+    strategies: opts.strategies,
     objectStore: opts.objectStore,
     blobFields: opts.blobFields,
-    aggregateStrategy: opts.aggregateStrategy ?? NO_AGGREGATE,
-    crdtStrategy: opts.crdtStrategy ?? NO_CRDT,
-    historyStrategy: opts.historyStrategy ?? NO_HISTORY,
-    i18nStrategy: opts.i18nStrategy ?? NO_I18N,
-    syncStrategy: opts.syncStrategy ?? NO_SYNC,
     reconcileOnOpen: opts.reconcileOnOpen ?? "off",
     getDEK: opts.getDEK,
     onDirty: opts.onDirty,
@@ -2208,7 +2346,6 @@ function resolveCollectionConfig(opts) {
     moneyFields: effectiveViaFields.moneyFields,
     classified: resolvedClassified,
     classifiedGuardCtx,
-    classifiedStrategy: opts.classifiedStrategy ?? NO_CLASSIFIED,
     computed: mergedComputed,
     computedEdges,
     viaDepsEdges,
@@ -2230,8 +2367,6 @@ function resolveCollectionConfig(opts) {
     materializedViewSource: opts.materializedViewSource,
     graphDispatch: opts.graphDispatch,
     tiers: opts.tiers && opts.tiers.length > 0 ? new Set(opts.tiers) : null,
-    tiersStrategy: opts.tiersStrategy ?? NO_TIERS,
-    searchStrategy: opts.searchStrategy ?? NO_SEARCH,
     tierMode: opts.tierMode ?? "invisibility",
     blobTierPolicy: opts.blobTierPolicy ?? "isolate",
     onCrossTierAccess: opts.onCrossTierAccess,
@@ -2293,25 +2428,20 @@ var Collection = class {
   /** True when the caller explicitly provided a `historyConfig` option (vs. inheriting the vault default). */
   historyConfigExplicit;
   /**
-   * tree-shake seam — the strategy that backs `collection.blob(id)`.
-   * Defaults to `NO_BLOBS`, a ~10-line stub that throws with an actionable
-   * message. Consumers opt into real blob storage by importing
-   * `{ blobs }` from `@noy-db/hub/blobs` and passing the returned
-   * strategy to `createNoydb({ blobStrategy: blobs() })`. With the
-   * default stub, none of the BlobSet / chunk / MIME-magic machinery
-   * reaches the bundle.
+   * Every opt-in service, resolved once by `createNoydb` (#838) and shared by
+   * reference with the owning `Vault` and `Noydb`.
+   *
+   * Each entry is a tree-shake seam. An un-opted-in service resolves to its
+   * `NO_*` stub — a tiny module that throws with an actionable message —
+   * so, for example, none of the BlobSet / chunk / MIME-magic machinery
+   * reaches the bundle unless the consumer imports `@noy-db/hub/blobs` and
+   * passes `blobStrategy: blobs()` to `createNoydb`.
    */
-  blobStrategy;
+  strategies;
   objectStore;
   blobFields;
   blobTierPolicy;
   // #724 T2/T3
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  historyStrategy;
-  syncStrategy;
   // In-memory cache of decrypted records (eager mode only). Lazy mode
   // uses `lru` instead. Both fields exist so a single Collection instance
   // doesn't need a runtime branch on every cache access.
@@ -2481,12 +2611,6 @@ var Collection = class {
   /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
   _markerDigestOnlyCache = void 0;
   _markerPersisted = false;
-  /**
-   * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
-   * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
-   * `createNoydb()` option (opt in with `withClassified()`).
-   */
-  classifiedStrategy;
   /** Async callback provided by the Vault to open a dynamic dictionary handle (for label-map pre-computation in the search index). Only used in `resolveDictLabelMaps()`; static dicts bypass this entirely. Mutable, assign-once — see {@link _reconcileReadState} (#671 item 1). */
   getDictionary;
   /**
@@ -2635,16 +2759,10 @@ var Collection = class {
     this.writeHooks = cfg.writeHooks;
     this.subsystemBus = cfg.subsystemBus;
     this.activeTxId = cfg.activeTxId;
-    this.blobStrategy = cfg.blobStrategy;
+    this.strategies = cfg.strategies;
     this.objectStore = cfg.objectStore;
     this.blobFields = cfg.blobFields;
     this.blobTierPolicy = cfg.blobTierPolicy ?? "isolate";
-    this.aggregateStrategy = cfg.aggregateStrategy;
-    this.crdtStrategy = cfg.crdtStrategy;
-    this.tiersStrategy = cfg.tiersStrategy;
-    this.searchStrategy = cfg.searchStrategy;
-    this.historyStrategy = cfg.historyStrategy;
-    this.syncStrategy = cfg.syncStrategy;
     this.reconcileOnOpen = cfg.reconcileOnOpen;
     this.getDEK = cfg.getDEK;
     this.onDirty = cfg.onDirty;
@@ -2671,7 +2789,6 @@ var Collection = class {
     this.classified = cfg.classified;
     this.classifiedGuardCtx = cfg.classifiedGuardCtx;
     this.vdigFields = cfg.vdigFields;
-    this.classifiedStrategy = cfg.classifiedStrategy;
     this.computed = cfg.computed;
     this.getDictionary = cfg.getDictionary;
     this.defaultLocale = cfg.defaultLocale;
@@ -2719,7 +2836,7 @@ var Collection = class {
       deterministicFields: this.deterministicFields,
       vdigFields: this.vdigFields,
       crdtMode: this.crdtMode,
-      crdtStrategy: this.crdtStrategy,
+      crdtStrategy: this.strategies.crdt,
       schema: this.schema,
       getDEK: (collection) => this.getDEK(collection ?? this.name),
       cekCache: this.cekCache,
@@ -2737,7 +2854,7 @@ var Collection = class {
         const remoteJson = await this.codec.decryptJsonString(remote, id);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
-        const merged = this.crdtStrategy.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
+        const merged = this.strategies.crdt.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
         return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
@@ -2795,12 +2912,12 @@ var Collection = class {
     }
     this.lazy = opts.prefetch === false;
     if (this.lazy) {
-      this.lru = (opts.lazyStrategy ?? IMPLICIT_LAZY).createCache(this.name, opts.cache);
+      this.lru = opts.strategies.lazy.createCache(this.name, opts.cache);
       this.hydrated = true;
     } else {
       this.lru = null;
     }
-    const strategy = opts.indexStrategy ?? NO_INDEXING;
+    const strategy = opts.strategies.index;
     this.indexState = strategy.createState({
       defs: opts.indexes ?? [],
       lazy: this.lazy
@@ -2955,7 +3072,7 @@ var Collection = class {
     if (spec.storage === "digest-only") {
       throw new ClassifiedRevealError(this.name, field, `storage:'digest-only' \u2014 verify-only; nothing recoverable to reveal`);
     }
-    return this.classifiedStrategy.reveal({
+    return this.strategies.classified.reveal({
       collection: this.name,
       spec,
       encrypted: this.storeCiphertext,
@@ -2975,7 +3092,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, field, `storage:'never' \u2014 nothing is stored to verify against`);
     }
     const ctx = this._classifiedVerifyCtx(spec);
-    return spec.storage === "digest-only" ? this.classifiedStrategy.verify(ctx, id, field, candidate) : this.classifiedStrategy.verifyText(ctx, id, field, candidate);
+    return spec.storage === "digest-only" ? this.strategies.classified.verify(ctx, id, field, candidate) : this.strategies.classified.verifyText(ctx, id, field, candidate);
   }
   /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
   async verifyGroup(id, answers, opts) {
@@ -2984,7 +3101,7 @@ var Collection = class {
       throw new ClassifiedVerifyError(this.name, "*", "no groupable digest-only (secretAnswer) fields declared");
     }
     const ctx = { ...this._classifiedVerifyCtx(members[0].spec), groupMembers: members };
-    return this.classifiedStrategy.matchGroup(ctx, id, answers, opts);
+    return this.strategies.classified.matchGroup(ctx, id, answers, opts);
   }
   _classifiedVerifyCtx(spec) {
     return {
@@ -3039,7 +3156,7 @@ var Collection = class {
     if (typeof candidate !== "string") {
       throw new ClassifiedVerifyError(this.name, "*", "candidate must be a string");
     }
-    const target = await this.classifiedStrategy.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
+    const target = await this.strategies.classified.computeTarget(this._classifiedVerifyCtx(spec), field, candidate);
     const ids = await this.adapter.list(this.vault, this.name);
     const hits = [];
     const hitMap = /* @__PURE__ */ new Map();
@@ -3126,7 +3243,7 @@ var Collection = class {
           id,
           version: scrubbed._v,
           actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(scrubbed),
+          payloadHash: await this.strategies.history.envelopePayloadHash(scrubbed),
           reason: "classified:scrub-equatable-tags"
         });
       }
@@ -3258,7 +3375,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NB5BGRVU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3352,7 +3469,7 @@ var Collection = class {
     if (this.syncAdapter !== void 0) presenceOpts.syncAdapter = this.syncAdapter;
     if (opts?.staleMs !== void 0) presenceOpts.staleMs = opts.staleMs;
     if (opts?.pollIntervalMs !== void 0) presenceOpts.pollIntervalMs = opts.pollIntervalMs;
-    return this.syncStrategy.buildPresence(presenceOpts);
+    return this.strategies.sync.buildPresence(presenceOpts);
   }
   /**
    * Create or update a record. Runs inside the hub's write-queue tracker
@@ -3572,7 +3689,7 @@ var Collection = class {
             }
           }
         }
-        crdtState = this.crdtStrategy.buildLwwMapState(record, existingState, now);
+        crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
         let existingState;
         if (existingEnvelope) {
@@ -3584,7 +3701,7 @@ var Collection = class {
             }
           }
         }
-        crdtState = this.crdtStrategy.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
+        crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
@@ -3592,14 +3709,14 @@ var Collection = class {
       const cek2 = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const envelope2 = await this.codec.encryptJsonString(JSON.stringify(crdtState), version2, cek2, options?.source, options?.sourceTs);
       await this.adapter.put(this.vault, this.name, id, envelope2);
-      const resolvedRecord = this.crdtStrategy.resolveCrdtSnapshot(crdtState);
+      const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
       const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved && this.historyConfig.enabled !== false) {
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
+        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existingResolved.record, existingResolved.version, cek2, void 0, void 0, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0, id));
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: existingResolved.version });
         if (this.historyConfig.maxVersions) {
-          await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+          await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
         }
       }
       if (this.ledger) {
@@ -3609,9 +3726,9 @@ var Collection = class {
           id,
           version: version2,
           actor: this.keyring.userId,
-          payloadHash: await this.historyStrategy.envelopePayloadHash(envelope2)
+          payloadHash: await this.strategies.history.envelopePayloadHash(envelope2)
         };
-        if (existingResolved) appendInput.delta = this.historyStrategy.computePatch(resolvedRecord, existingResolved.record);
+        if (existingResolved) appendInput.delta = this.strategies.history.computePatch(resolvedRecord, existingResolved.record);
         if (options?.reason !== void 0) appendInput.reason = options.reason;
         await this.ledger.append(appendInput);
       }
@@ -3658,21 +3775,21 @@ var Collection = class {
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
     if (existing && this.historyConfig.enabled !== false) {
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
       this.emitter.emit("history:save", {
         vault: this.vault,
         collection: this.name,
         id,
         version: existing.version
       });
-      if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+      if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
     }
     const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
     await this.adapter.put(this.vault, this.name, id, envelope);
     this.markerIds.delete(id);
     await this._ensureClassifiedMarker();
     if (this.embeddings) {
-      await this.searchStrategy.embedOnWrite(this.searchContext(), id, record, version);
+      await this.strategies.search.embedOnWrite(this.searchContext(), id, record, version);
     }
     if (this.ledger) {
       const appendInput = {
@@ -3681,10 +3798,10 @@ var Collection = class {
         id,
         version,
         actor: this.keyring.userId,
-        payloadHash: await this.historyStrategy.envelopePayloadHash(envelope)
+        payloadHash: await this.strategies.history.envelopePayloadHash(envelope)
       };
       if (existing) {
-        appendInput.delta = this.historyStrategy.computePatch(record, existing.record);
+        appendInput.delta = this.strategies.history.computePatch(record, existing.record);
       }
       if (options?.reason !== void 0) appendInput.reason = options.reason;
       await this.ledger.append(appendInput);
@@ -3727,7 +3844,7 @@ var Collection = class {
         if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-UF7LTX6O.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3737,7 +3854,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-NB5BGRVU.js");
+          staleHelpers = await import("./stale-4UNPHWOU.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -4203,10 +4320,10 @@ var Collection = class {
     if (existing && this.historyConfig.enabled !== false) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id));
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
-    const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
+    const previousPayloadHash = await this.strategies.history.envelopePayloadHash(previousEnvelope);
     let markerVersion;
     if (this.onDirty) {
       const live = previousEnvelope;
@@ -4356,7 +4473,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-UF7LTX6O.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-YORMIBWV.js"));
         }
         const rr = await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -4369,7 +4486,7 @@ var Collection = class {
         residueDeclined.push(...rr.residueDeclined);
       } else {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-NB5BGRVU.js");
+          staleHelpers = await import("./stale-4UNPHWOU.js");
         }
         const inv = await staleHelpers.invalidateMVAtRest(this.materializedViewSource, reg, mode);
         deleted += inv.deleted;
@@ -4396,7 +4513,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-NB5BGRVU.js");
+      const { resolveStaleMVOnRead } = await import("./stale-4UNPHWOU.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4417,28 +4534,28 @@ var Collection = class {
    * see `src/search/tokenize.ts` for the Thai/CJK caveat.
    */
   search(field, query, opts = {}) {
-    return this.searchStrategy.search(this.searchContext(), field, query, opts);
+    return this.strategies.search.search(this.searchContext(), field, query, opts);
   }
   /** Force-persist the lexical index now — gated behind `searchStrategy: withSearch()`. */
   flushIndex() {
-    return this.searchStrategy.flushIndex(this.searchContext());
+    return this.strategies.search.flushIndex(this.searchContext());
   }
   /** Pre-build the lexical index — gated behind `searchStrategy: withSearch()`. */
   warmIndex() {
-    return this.searchStrategy.warmIndex(this.searchContext());
+    return this.strategies.search.warmIndex(this.searchContext());
   }
   /** Retrieval (lexical | semantic | hybrid) — gated behind `searchStrategy: withSearch()`. */
   retrieve(query, opts = {}) {
-    return this.searchStrategy.retrieve(this.searchContext(), query, opts);
+    return this.strategies.search.retrieve(this.searchContext(), query, opts);
   }
   /** Raw-vector kNN — gated behind `searchStrategy: withSearch()`. */
   similarTo(vector, opts = {}) {
-    return this.searchStrategy.similarTo(this.searchContext(), vector, opts);
+    return this.strategies.search.similarTo(this.searchContext(), vector, opts);
   }
   /** Opt-in bulk `_vec` re-derive (#788) — a plain collection has nothing to rebuild; gated behind `searchStrategy: withSearch()` otherwise. */
   rebuildEmbeddings() {
     if (!this.embeddings) return Promise.resolve({ rebuilt: 0, skipped: 0 });
-    return this.searchStrategy.rebuildEmbeddings(this.searchContext());
+    return this.strategies.search.rebuildEmbeddings(this.searchContext());
   }
   /**
    * Bind the {@link SearchContext} the search/retrieval surface needs. The
@@ -4648,7 +4765,7 @@ var Collection = class {
       ...this.defaultLocale !== void 0 ? { defaultLocale: this.defaultLocale } : {},
       ...resolver.resolveDictSource ? { resolveDictSource: (field) => resolver.resolveDictSource(leftCollection, field) } : {}
     } : void 0;
-    return new Query(source, void 0, joinContext, this.aggregateStrategy);
+    return new Query(source, void 0, joinContext, this.strategies.aggregate);
   }
   /**
    * Subscribe to every put/delete on this collection. Returns an
@@ -4762,7 +4879,7 @@ var Collection = class {
   // ─── History Methods ────────────────────────────────────────────
   /** Get version history for a record, newest first. */
   async history(id, options) {
-    const envelopes = await this.historyStrategy.getHistoryEntries(
+    const envelopes = await this.strategies.history.getHistoryEntries(
       this.adapter,
       this.vault,
       this.name,
@@ -4794,7 +4911,7 @@ var Collection = class {
    * and re-put the records through the normal `put()` path.
    */
   async getVersion(id, version) {
-    const envelope = await this.historyStrategy.getVersionEnvelope(
+    const envelope = await this.strategies.history.getVersionEnvelope(
       this.adapter,
       this.vault,
       this.name,
@@ -4819,7 +4936,7 @@ var Collection = class {
    */
   async diff(id, versionA, versionB) {
     const recordA = versionA === 0 ? null : await this.resolveVersion(id, versionA);
-    return this.historyStrategy.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
+    return this.strategies.history.diff(recordA, versionB === void 0 || versionB === 0 ? versionB === 0 ? null : await this.resolveCurrentOrVersion(id) : await this.resolveVersion(id, versionB));
   }
   /** Resolve a version: try history first, then check if it's the current version. */
   async resolveVersion(id, version) {
@@ -4836,7 +4953,7 @@ var Collection = class {
   }
   /** Prune history entries for a record (or all records if id is undefined). */
   async pruneRecordHistory(id, options) {
-    const pruned = await this.historyStrategy.pruneHistory(
+    const pruned = await this.strategies.history.pruneHistory(
       this.adapter,
       this.vault,
       this.name,
@@ -4855,7 +4972,7 @@ var Collection = class {
   }
   /** Clear all history for this collection (or a specific record). */
   async clearHistory(id) {
-    return this.historyStrategy.clearHistory(this.adapter, this.vault, this.name, id);
+    return this.strategies.history.clearHistory(this.adapter, this.vault, this.name, id);
   }
   // ─── Core Methods ─────────────────────────────────────────────
   /**
@@ -5277,7 +5394,7 @@ var Collection = class {
    * vault-shared `_blob` DEK (enabling cross-collection deduplication).
    */
   blob(id) {
-    return this.blobStrategy.openSlot({
+    return this.strategies.blob.openSlot({
       store: this.adapter,
       vault: this.vault,
       collection: this.name,
@@ -5598,23 +5715,23 @@ var Collection = class {
   // ─── Hierarchical Access ──────────────────────────
   /** tier-aware put — gated behind `tiersStrategy: withTiers()`. `searchResidue: true` = stuck search compensation (#774, mirroring #764's elevate/demote posture); the write itself always completes. */
   putAtTier(id, record, tier, opts) {
-    return this.tiersStrategy.putAtTier(this.tiersContext(), id, record, tier, opts);
+    return this.strategies.tiers.putAtTier(this.tiersContext(), id, record, tier, opts);
   }
   /** tier-aware get — gated behind `tiersStrategy: withTiers()`. */
   getAtTier(id) {
-    return this.tiersStrategy.getAtTier(this.tiersContext(), id);
+    return this.strategies.tiers.getAtTier(this.tiersContext(), id);
   }
   /** list ids grouped by the caller's readability — gated behind `withTiers()`. */
   listAtTier() {
-    return this.tiersStrategy.listAtTier(this.tiersContext());
+    return this.strategies.tiers.listAtTier(this.tiersContext());
   }
   /** elevate a record to a higher tier — gated behind `withTiers()`. `searchResidue: true` = stuck search compensation (#764); the move itself always completes. */
   elevate(id, toTier) {
-    return this.tiersStrategy.elevate(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.elevate(this.tiersContext(), id, toTier);
   }
   /** demote a record to a lower tier — gated behind `withTiers()`. Same `searchResidue` posture as {@link elevate} (#764). */
   demote(id, toTier) {
-    return this.tiersStrategy.demote(this.tiersContext(), id, toTier);
+    return this.strategies.tiers.demote(this.tiersContext(), id, toTier);
   }
   /**
    * Emit a cross-tier access event. The subscriber sink stays collection-resident (it captures `onCrossTierAccess`); the tiers module reaches it via the {@link TiersContext.emitCrossTierEvent} callback.
@@ -5675,16 +5792,16 @@ var Collection = class {
       },
       syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
       syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
-      syncHistory: async (id, fromDek, toDek) => this.historyStrategy.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
+      syncHistory: async (id, fromDek, toDek) => this.strategies.history.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
       saveHistorySnapshot: async (id, envelope) => {
         if (this.historyConfig.enabled === false) return;
-        await this.historyStrategy.saveHistory(this.adapter, this.vault, this.name, id, envelope);
+        await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, envelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
-        if (this.historyConfig.maxVersions) await this.historyStrategy.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
+        if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
       },
-      historyEnabled: this.historyConfig.enabled !== false && this.historyStrategy !== NO_HISTORY,
+      historyEnabled: this.historyConfig.enabled !== false && this.strategies.history !== NO_HISTORY,
       // #728/#737: lets putAtTier skip decrypting `existing` when no real history strategy is wired
-      syncBlobs: (id, fromTier, toTier) => this.blobStrategy !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
+      syncBlobs: (id, fromTier, toTier) => this.strategies.blob !== NO_BLOBS ? this.blob(id).syncTierMove(fromTier, toTier, this.blobTierPolicy) : Promise.resolve(),
       // #724 I1: gate on blob storage enabled (not on declared blobFields) so undeclared-field blobs still rehome; #746: syncTierMove mints/resumes the rehome journal marker; self-no-ops on an empty slot map
       syncLedger: async (id) => {
         await this.ledger?.purgeRecordDeltas(this.name, id);
@@ -6012,46 +6129,6 @@ var DeferredNumberingStore = class {
   }
 };
 
-// src/with-fork/shadow/strategy.ts
-var NOT_ENABLED2 = new Error(
-  'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-);
-var NO_SHADOW = {
-  buildFrame() {
-    throw NOT_ENABLED2;
-  }
-};
-
-// src/with-audit/consent/strategy.ts
-var NO_CONSENT = {
-  async write() {
-  },
-  async read() {
-    return [];
-  }
-};
-
-// src/with-audit/periods/strategy.ts
-var NOT_ENABLED3 = new Error(
-  'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-);
-var NO_PERIODS = {
-  async loadPeriods() {
-    return [];
-  },
-  async chainAnchor() {
-    return { priorPeriodHash: "" };
-  },
-  assertTsWritable() {
-  },
-  validatePeriodName() {
-    throw NOT_ENABLED3;
-  },
-  async appendPeriodLedgerEntry() {
-    throw NOT_ENABLED3;
-  }
-};
-
 // src/with-audit/periods/vault-facade.ts
 var VaultPeriods = class {
   constructor(deps) {
@@ -8053,36 +8130,22 @@ var Vault = class {
   syncAdapter;
   getPurgeableTargets;
   historyConfig;
-  /** tree-shake seam for the optional blob service; `undefined` means "blobs are off for this
-   *  vault" — every `collection.blob(id)` call throws with a pointer at `@noy-db/hub/blobs`. */
-  blobStrategy;
+  /**
+   * Every opt-in service, resolved once by `createNoydb` (#838). Shared by
+   * reference with the owning `Noydb` and with every `Collection` this vault
+   * opens, so all three always agree about which services are enabled.
+   */
+  strategies;
   objectStore;
-  /** Cold-storage archival strategy (the archive target store). */
-  archiveStrategy;
   /** Per-collection record archival policies. Indexed by collection name. */
   archiveRegistry = /* @__PURE__ */ new Map();
-  indexStrategy;
-  lazyStrategy;
-  aggregateStrategy;
-  crdtStrategy;
-  tiersStrategy;
-  searchStrategy;
-  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
-   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
-  cargoStrategy;
-  brokerStrategy;
-  sealedRecordStrategy;
-  portabilityStrategy;
-  sequenceStrategy;
-  consentStrategy;
   periods;
   linksEnforcer;
-  shadowStrategy;
-  historyStrategy;
-  forgetStrategy;
-  i18nStrategy;
-  syncStrategy;
-  classifiedStrategy;
+  /** Cargo (partition extraction) strategy — `NO_CARGO` (throwing) unless `withCargo()` was passed.
+   *  Public so the `extractPartition` free function (which takes a `Vault`) routes through it. */
+  get cargoStrategy() {
+    return this.strategies.cargo;
+  }
   /** Per-vault guard registry; `null` until `_initGuards()` runs (or for vaults that never register
    *  one) — the runtime class is dynamic-imported on demand to keep it out of the floor bundle. */
   guardRegistry = null;
@@ -8264,23 +8327,10 @@ var Vault = class {
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
     this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
-    this.blobStrategy = opts.blobStrategy;
+    this.strategies = opts.strategies;
     this.objectStore = opts.objectStore;
-    this.archiveStrategy = opts.archiveStrategy;
-    this.indexStrategy = opts.indexStrategy;
-    this.lazyStrategy = opts.lazyStrategy;
-    this.aggregateStrategy = opts.aggregateStrategy;
-    this.crdtStrategy = opts.crdtStrategy;
-    this.tiersStrategy = opts.tiersStrategy;
-    this.searchStrategy = opts.searchStrategy;
-    this.cargoStrategy = opts.cargoStrategy ?? NO_CARGO;
-    this.brokerStrategy = opts.brokerStrategy ?? NO_BROKER;
-    this.sealedRecordStrategy = opts.sealedRecordStrategy ?? NO_SEALED_RECORD;
-    this.portabilityStrategy = opts.portabilityStrategy ?? NO_PORTABILITY;
-    this.sequenceStrategy = opts.sequenceStrategy ?? NO_SEQUENCE;
-    this.consentStrategy = opts.consentStrategy ?? NO_CONSENT;
     this.periods = new VaultPeriods({
-      strategy: opts.periodsStrategy ?? NO_PERIODS,
+      strategy: this.strategies.periods,
       adapter: this.adapter,
       vault: this.name,
       encrypted: this.encrypted,
@@ -8305,12 +8355,6 @@ var Vault = class {
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       emitter: this.emitter
     });
-    this.shadowStrategy = opts.shadowStrategy ?? NO_SHADOW;
-    this.historyStrategy = opts.historyStrategy ?? NO_HISTORY;
-    this.forgetStrategy = opts.forgetStrategy ?? NO_FORGET;
-    this.i18nStrategy = opts.i18nStrategy ?? NO_I18N;
-    this.syncStrategy = opts.syncStrategy ?? NO_SYNC;
-    this.classifiedStrategy = opts.classifiedStrategy ?? NO_CLASSIFIED;
     this.graph = new ViaGraph();
     void opts.guardStrategies;
     this.historyConfig = opts.historyConfig ?? { enabled: true };
@@ -8325,19 +8369,19 @@ var Vault = class {
       getDEK: (collection) => this.getDEK(collection),
       role: () => this.keyring.role,
       getRawRecord: async (collection, recId) => await this.collection(collection).get(recId, { locale: "raw" })
-    }, opts.attestationStrategy ?? NO_ATTESTATION);
+    }, this.strategies.attestation);
     this.user = this.noydb.userApiFactory({
       adapter: this.adapter,
       vaultName: this.name,
       writerKeyringId: this.keyring.userId,
       getDek: () => this.getDEK(USER_ENVELOPE_COLLECTION),
       checkGate: (gate, presented) => this.noydb.checkGate(this.name, gate, presented),
-      exportAccessible: (opts2) => this.portabilityStrategy.exportAccessibleData(this, opts2),
-      unilateralWithdraw: (opts2) => this.portabilityStrategy.withdrawAccessibleData(this, opts2),
-      requestWithdraw: (opts2) => this.portabilityStrategy.requestWithdrawal(this, opts2),
-      listWithdrawals: (opts2) => this.portabilityStrategy.listWithdrawalRequests(this, opts2),
-      approveWithdraw: (requestId, opts2) => this.portabilityStrategy.approveWithdrawal(this, requestId, opts2),
-      rejectWithdraw: (requestId, opts2) => this.portabilityStrategy.rejectWithdrawal(this, requestId, opts2)
+      exportAccessible: (opts2) => this.strategies.portability.exportAccessibleData(this, opts2),
+      unilateralWithdraw: (opts2) => this.strategies.portability.withdrawAccessibleData(this, opts2),
+      requestWithdraw: (opts2) => this.strategies.portability.requestWithdrawal(this, opts2),
+      listWithdrawals: (opts2) => this.strategies.portability.listWithdrawalRequests(this, opts2),
+      approveWithdraw: (requestId, opts2) => this.strategies.portability.approveWithdrawal(this, requestId, opts2),
+      rejectWithdraw: (requestId, opts2) => this.strategies.portability.rejectWithdrawal(this, requestId, opts2)
     });
     this.custody = new CustodyApi(
       (options, factors) => this.noydb.grantCustodian(this.name, options, factors),
@@ -8395,7 +8439,7 @@ var Vault = class {
    *  dispatch reads/writes — from this vault's OWN privates, rather than passing `this` itself. */
   _viaReconcileCtx() {
     return {
-      i18nStrategy: this.i18nStrategy,
+      i18nStrategy: this.strategies.i18n,
       locale: this.locale,
       translateText: this.translateText,
       i18nFieldRegistry: this.i18nFieldRegistry,
@@ -8436,7 +8480,7 @@ var Vault = class {
       this.satelliteRegistry = declareSatellite({
         adapter: this.adapter,
         vaultName: this.name,
-        forgetSubjects: this.forgetStrategy.subjects,
+        forgetSubjects: this.strategies.forget.subjects,
         getDEK: this.getDEK,
         getBaseSchema: (base) => this.collectionCache.get(base)?.getSchema(),
         getBaseCrdt: (base) => this.collectionCache.get(base)?.getConfig()?.crdt,
@@ -8556,22 +8600,9 @@ var Vault = class {
         // #693: re-create gate fallback
         historyConfig: effectiveHistoryConfig,
         historyConfigExplicit: options?.historyConfig !== void 0,
-        // thread the vault-wide blob strategy into every
-        // collection. `undefined` is intentionally preserved so the
-        // Collection constructor uses its NO_BLOBS default.
-        ...this.blobStrategy !== void 0 ? { blobStrategy: this.blobStrategy } : {},
         ...this.objectStore !== void 0 ? { objectStore: this.objectStore } : {},
         ...options?.blobFields !== void 0 ? { blobFields: options.blobFields } : {},
-        ...this.indexStrategy !== void 0 ? { indexStrategy: this.indexStrategy } : {},
-        ...this.lazyStrategy !== void 0 ? { lazyStrategy: this.lazyStrategy } : {},
-        ...this.aggregateStrategy !== void 0 ? { aggregateStrategy: this.aggregateStrategy } : {},
-        ...this.crdtStrategy !== void 0 ? { crdtStrategy: this.crdtStrategy } : {},
-        ...this.tiersStrategy !== void 0 ? { tiersStrategy: this.tiersStrategy } : {},
-        ...this.searchStrategy !== void 0 ? { searchStrategy: this.searchStrategy } : {},
-        historyStrategy: this.historyStrategy,
-        i18nStrategy: this.i18nStrategy,
-        syncStrategy: this.syncStrategy,
-        classifiedStrategy: this.classifiedStrategy,
+        strategies: this.strategies,
         // Per-collection ledger opt-out: when this collection sets
         // `historyConfig.ledger: false`, withhold the ledger reference so all
         // four `if (this.ledger)` append sites in Collection no-op. The chain
@@ -8629,7 +8660,7 @@ var Vault = class {
         collOpts.sensitive = options.sensitive;
       }
       if (options?.perRecordKeys !== void 0) collOpts.perRecordKeys = options.perRecordKeys;
-      const subjectKey = this.forgetStrategy.subjects[collectionName];
+      const subjectKey = this.strategies.forget.subjects[collectionName];
       if (subjectKey !== void 0) {
         if (options?.perRecordKeys === false) {
           console.warn(
@@ -9010,7 +9041,7 @@ var Vault = class {
       const values = getAtPath(obj, field);
       for (const value of values) {
         if (value === void 0 || value === null) continue;
-        this.i18nStrategy.validateI18nTextValue(value, field, descriptor);
+        this.strategies.i18n.validateI18nTextValue(value, field, descriptor);
       }
     }
   }
@@ -9051,7 +9082,7 @@ var Vault = class {
     this.reservedLookupCollections.set(dictCollectionName(name), name);
     let handle = this.dictionaryCache.get(name);
     if (!handle) {
-      handle = this.i18nStrategy.buildDictionaryHandle({
+      handle = this.strategies.i18n.buildDictionaryHandle({
         adapter: this.adapter,
         compartmentName: this.name,
         dictionaryName: name,
@@ -9264,7 +9295,7 @@ var Vault = class {
       };
     }
     if (!this.sequenceStore) {
-      this.sequenceStore = this.sequenceStrategy.createStore({
+      this.sequenceStore = this.strategies.sequence.createStore({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9362,7 +9393,7 @@ var Vault = class {
     return runListArchived(this._archiveContext(), collection);
   }
   _archiveContext() {
-    const strategy = this.archiveStrategy;
+    const strategy = this.strategies.archive;
     if (!strategy) {
       throw new Error(
         "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb"
@@ -9529,7 +9560,7 @@ var Vault = class {
    */
   getLedgerOrNull() {
     if (!this.ledgerStore) {
-      this.ledgerStore = this.historyStrategy.buildLedger({
+      this.ledgerStore = this.strategies.history.buildLedger({
         adapter: this.adapter,
         vault: this.name,
         encrypted: this.encrypted,
@@ -9554,7 +9585,7 @@ var Vault = class {
    * number of distinct subjects re-indexed.
    */
   async rebuildSubjectIndex() {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     return rebuildSubjectIndex(
@@ -9562,7 +9593,7 @@ var Vault = class {
       this.name,
       this.getDEK,
       this.encrypted,
-      this.forgetStrategy.subjects,
+      this.strategies.forget.subjects,
       async (collectionName, id, env) => {
         const coll = this.collection(collectionName);
         return coll._decodeEnvelope(env, id);
@@ -9587,7 +9618,7 @@ var Vault = class {
    * @throws ForgetStrategyNotConfiguredError when no `withForgetCascade` was set.
    */
   async forget(subjectId) {
-    if (Object.keys(this.forgetStrategy.subjects).length === 0) {
+    if (Object.keys(this.strategies.forget.subjects).length === 0) {
       throw new ForgetStrategyNotConfiguredError();
     }
     const ledger = this.getLedgerOrNull();
@@ -9609,17 +9640,17 @@ var Vault = class {
     const sealedResidue = [];
     const indexResidue = [];
     const ledgerDeltaResidue = [];
-    const blobsEnabled = this.blobStrategy !== void 0;
+    const blobsEnabled = this.strategies.blob !== NO_BLOBS;
     const actor = this.keyring.userId;
     const fanoutStats = { recordsErased: 0, aggregatesRecomputed: 0, residueFrozen: [], lookupReferencesCascaded: 0, lookupReferencesNullified: 0, lookupReferencesResidue: [], derivedResidueUndecodable: [], derivedResidueDeclined: [] };
     const { partitionSealedCekKeys, shouldSkipBlobScan, bumpResidueCount, residueNoticesFromMap } = await import("./purge-scope-FGNNLWHD.js");
-    const scopedPurge = this.forgetStrategy.scopedPurge === true;
+    const scopedPurge = this.strategies.forget.scopedPurge === true;
     const sealedCekScopedSkipped = /* @__PURE__ */ new Map();
     const blobScopedSkipped = /* @__PURE__ */ new Map();
     for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
       const satelliteOf = ref2.satelliteOf;
-      const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
+      const perRecordKeys = this.strategies.forget.subjects[satelliteOf ?? ref2.collection] !== void 0;
       const lookupCompareKeys = await this.linksEnforcer.checkLookupRefsRestrict(this.graph, ref2.collection, ref2.collection, ref2.id);
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
@@ -9679,7 +9710,7 @@ var Vault = class {
         collections.add(ref2.collection);
         await forgetDerivedFanout(this, { collection: ref2.collection, id: ref2.id }, live, fanoutStats, lookupCompareKeys);
       }
-      historyVersionsShredded += await this.historyStrategy.tombstoneHistory(
+      historyVersionsShredded += await this.strategies.history.tombstoneHistory(
         this.adapter,
         this.name,
         ref2.collection,
@@ -9809,7 +9840,7 @@ var Vault = class {
    *   `<collection>/<id>/<pid>` key the delivery envelope was written under.
    */
   async sealRecordToHost(collection, id, hostSealer, opts) {
-    return this.sealedRecordStrategy.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
+    return this.strategies.sealedRecord.sealRecordToHost(this._sealingContext(), collection, id, hostSealer, opts);
   }
   /**
    * Revoke a sealed-CEK grant. **Default is SOFT**: deletes the `pid` delivery
@@ -9819,7 +9850,7 @@ var Vault = class {
    * longer open the record. See `revokeSealedRecord` in `record-keys/sealing.ts`.
    */
   async revokeSealedRecord(collection, id, pid, opts) {
-    return this.sealedRecordStrategy.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
+    return this.strategies.sealedRecord.revokeSealedRecord(this._sealingContext(), collection, id, pid, opts);
   }
   /**
    * HARD-rotate a record's CEK: decrypt the live body under the old CEK,
@@ -9839,7 +9870,7 @@ var Vault = class {
    * @throws {@link RecordCekNotFoundError} if the record is missing or has no `_cek`.
    */
   async rotateRecordCek(collection, id) {
-    return this.sealedRecordStrategy.rotateRecordCek(this._sealingContext(), collection, id);
+    return this.strategies.sealedRecord.rotateRecordCek(this._sealingContext(), collection, id);
   }
   /**
    * Build the {@link SealingContext} the record-keys grantor functions need:
@@ -10005,14 +10036,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-UF7LTX6O.js");
+    const { MaterializedViewExecutor } = await import("./executor-YORMIBWV.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-NB5BGRVU.js");
+    const { clearMVStaleFully } = await import("./stale-4UNPHWOU.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10146,7 +10177,7 @@ var Vault = class {
    */
   at(timestamp) {
     const iso = timestamp instanceof Date ? timestamp.toISOString() : timestamp;
-    return this.historyStrategy.buildVaultInstant(
+    return this.strategies.history.buildVaultInstant(
       {
         adapter: this.adapter,
         name: this.name,
@@ -10178,11 +10209,11 @@ var Vault = class {
    *.
    */
   frame() {
-    return this.shadowStrategy.buildFrame(this);
+    return this.strategies.shadow.buildFrame(this);
   }
   /** Credential-broker handle (#479); `NO_BROKER` throws unless `brokerStrategy: withBroker(config)` was passed to createNoydb(). */
   broker() {
-    return buildCredentialBrokerHandle(this.brokerStrategy, this.adapter, this.name, () => this.keyring);
+    return buildCredentialBrokerHandle(this.strategies.broker, this.adapter, this.name, () => this.keyring);
   }
   /**
    * Run `fn` under a consent scope. Every `get` / `put` / `delete`
@@ -10224,7 +10255,7 @@ var Vault = class {
    *.
    */
   async consentAudit(filter = {}) {
-    return this.consentStrategy.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
+    return this.strategies.consent.read(this.adapter, this.name, this.encrypted, this.getDEK, filter);
   }
   /**
    * Called by Collection after every access when a consent scope is
@@ -10235,7 +10266,7 @@ var Vault = class {
   async _logConsent(op, collection, recordId) {
     const ctx = this.consentContext;
     if (!ctx) return;
-    await this.consentStrategy.write(
+    await this.strategies.consent.write(
       this.adapter,
       this.name,
       this.encrypted,
@@ -10714,7 +10745,7 @@ var Vault = class {
       vault: this.name,
       userId: () => this.keyring.userId,
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      envelopePayloadHash: (envelope) => this.historyStrategy.envelopePayloadHash(envelope),
+      envelopePayloadHash: (envelope) => this.strategies.history.envelopePayloadHash(envelope),
       reloadKeyringAndRebuildDEK: async () => {
         if (this.reloadKeyring) {
           this.keyring = await this.reloadKeyring();
@@ -11399,25 +11430,6 @@ var QuickUnlockStore = class {
   }
 };
 
-// src/with-fork/snapshots/strategy.ts
-var NOT_ENABLED4 = new Error(
-  'Snapshots require the snapshot strategy. Import `{ withSnapshots }` from "@noy-db/hub/snapshots" and pass it to `createNoydb({ snapshotStrategy: withSnapshots({ store }) })`.'
-);
-var NO_SNAPSHOTS = {
-  async snapshot() {
-    throw NOT_ENABLED4;
-  },
-  async listSnapshots() {
-    throw NOT_ENABLED4;
-  },
-  async restoreSnapshot() {
-    throw NOT_ENABLED4;
-  },
-  async autoSnapshot() {
-    throw NOT_ENABLED4;
-  }
-};
-
 // src/with-fork/snapshots/scheduler.ts
 var SnapshotScheduler = class {
   policy;
@@ -11618,19 +11630,6 @@ var NoydbSnapshots = class {
   }
 };
 
-// src/with-commit/tx/strategy.ts
-var NOT_ENABLED5 = new Error(
-  'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/tx" and pass it to `createNoydb({ txStrategy: withTransactions() })`.'
-);
-var NO_TX = {
-  async runTransaction(_db, _fn, _options, _txInvariants) {
-    throw NOT_ENABLED5;
-  },
-  async runDryRun() {
-    throw NOT_ENABLED5;
-  }
-};
-
 // src/kernel/memory-store.ts
 function memoryStore() {
   const store = /* @__PURE__ */ new Map();
@@ -11714,23 +11713,6 @@ function memoryStore() {
   };
 }
 
-// src/with-party/session/strategy.ts
-function notEnabled3(op) {
-  return new Error(
-    `${op} requires the session strategy. Import \`{ withSession }\` from "@noy-db/hub/session" and pass it to \`createNoydb({ sessionStrategy: withSession() })\`.`
-  );
-}
-var NO_SESSION = {
-  validateSessionPolicy() {
-    throw notEnabled3("sessionPolicy");
-  },
-  createEnforcer() {
-    throw notEnabled3("session policy enforcement");
-  },
-  revokeAllSessions() {
-  }
-};
-
 // src/with-party/auth-introspection/index.ts
 async function describeAuthConfig(store, vault) {
   const policy = await loadVaultPolicy(store, vault) ?? defaultPolicySnapshot();
@@ -12684,21 +12666,22 @@ var Noydb = class {
   writeRelay;
   /** Per-vault policy enforcers. */
   policyEnforcers = /* @__PURE__ */ new Map();
-  txStrategy;
-  forgetStrategy;
   /**
-   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
-   * `withCustody()` was passed. Public so `Vault` routes `vault.custody.liberate`
-   * through it; grant/revoke route through it from this class. @internal
+   * Every opt-in service, resolved once (#838). Shared by reference with each
+   * `Vault` this instance opens and, through them, every `Collection` — so
+   * there is exactly one resolution and no construction path can disagree
+   * about which services are enabled (the #834 bug class).
    */
-  custodyStrategy;
+  strategies;
   /**
-   * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
-   * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
-   * engines are linked only by the active strategy, not by this file. */
-  teamStrategy;
-  sessionStrategy;
-  syncStrategy;
+   * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
+   * `withCustody()` was passed. Kept as a public accessor because `Vault`
+   * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+   * @internal
+   */
+  get custodyStrategy() {
+    return this.strategies.custody;
+  }
   snapshots;
   policyManager;
   /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
@@ -12742,14 +12725,9 @@ var Noydb = class {
     this.userApiFactory = options.userApiFactory;
     if (!options.policyFactory || !options.policyCheckGateFn) throw new ValidationError("Noydb must be constructed via createNoydb(), which resolves the default policy service.");
     this.policyCheckGate = options.policyCheckGateFn;
-    this.txStrategy = options.txStrategy ?? NO_TX;
-    this.forgetStrategy = options.forgetStrategy ?? NO_FORGET;
-    this.custodyStrategy = options.custodyStrategy ?? NO_CUSTODY;
-    this.teamStrategy = options.teamStrategy ?? NO_TEAM;
-    this.sessionStrategy = options.sessionStrategy ?? NO_SESSION;
-    this.syncStrategy = options.syncStrategy ?? NO_SYNC;
+    this.strategies = resolveStrategies(options);
     this.snapshots = new NoydbSnapshots({
-      strategy: options.snapshotStrategy ?? NO_SNAPSHOTS,
+      strategy: this.strategies.snapshot,
       user: options.user,
       isClosed: () => this.closed,
       getVault: (name) => this.vaultCache.get(name),
@@ -12786,7 +12764,7 @@ var Noydb = class {
       }
     });
     if (options.sessionPolicy) {
-      this.sessionStrategy.validateSessionPolicy(options.sessionPolicy);
+      this.strategies.session.validateSessionPolicy(options.sessionPolicy);
     }
     this.#registerGuardGate();
     this.#registerPeriodGate();
@@ -12795,7 +12773,7 @@ var Noydb = class {
   }
   /** @internal — resolved forget strategy (NO_FORGET when not configured). */
   get _forgetStrategy() {
-    return this.forgetStrategy;
+    return this.strategies.forget;
   }
   // GDPR subject-index maintenance. When `withForgetCascade` declares
   // any subject fields, keep the encrypted `_subject_index` in lock-step with
@@ -12808,7 +12786,7 @@ var Noydb = class {
   //     does NOT) — drop the ref so a deleted record never lingers in the
   //     index (RISK #2). Without it, forget() would try to shred a ghost.
   #registerForgetHooks() {
-    const subjects = this.forgetStrategy.subjects;
+    const subjects = this.strategies.forget.subjects;
     if (Object.keys(subjects).length === 0) return;
     const subjectFieldFor = (collection) => subjects[collection];
     this.writeHooks.onAfterWrite(async (event) => {
@@ -12997,7 +12975,7 @@ var Noydb = class {
     if (targets.length > 0) {
       const primary = targets.find((t) => t.role === "sync-peer") ?? targets[0];
       const effectivePolicy = this.options.syncPolicy ?? primary.policy ?? INDEXED_STORE_POLICY;
-      syncEngine = this.syncStrategy.buildSyncEngine({
+      syncEngine = this.strategies.sync.buildSyncEngine({
         local: this.options.store,
         remote: primary.store,
         vault: name,
@@ -13011,7 +12989,7 @@ var Noydb = class {
       for (const target of targets) {
         if (target === primary) continue;
         const targetPolicy = target.policy ?? this.options.syncPolicy ?? INDEXED_STORE_POLICY;
-        const engine = this.syncStrategy.buildSyncEngine({
+        const engine = this.strategies.sync.buildSyncEngine({
           local: this.options.store,
           remote: target.store,
           vault: name,
@@ -13044,31 +13022,14 @@ var Noydb = class {
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
       getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+      // #838 — the 21 conditional strategy spreads that used to live here are
+      // one shared reference. This block is where #834's drift happened: a
+      // copy of it silently omitted six strategies, and there was nothing to
+      // catch that. There is no longer a per-service line to omit.
+      strategies: this.strategies,
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
       ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
       ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      forgetStrategy: this.forgetStrategy,
-      ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-      ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-      ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-      ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-      ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {},
       locale: opts?.locale,
       ...opts?.meta !== void 0 ? { meta: opts.meta } : {},
       // Thread the translator hook so Collection.put() can invoke it
@@ -13105,85 +13066,25 @@ var Noydb = class {
     this.vaultCache.set(name, comp);
     return comp;
   }
-  /** Synchronous vault access (must call openVault first, or auto-opens). */
+  /**
+   * Synchronous access to an ALREADY-OPEN vault.
+   *
+   * Returns the instance `openVault()` produced, or throws — it never
+   * constructs. It used to fall back to building a Vault itself (once for
+   * plaintext, once for encrypted-with-cached-keyring), and those copies
+   * drifted from the real open path: the encrypted one silently omitted six
+   * strategies, so a vault reached this way threw `*NotEnabledError` for
+   * services the caller had configured (#834). Both fallbacks also skipped
+   * the async registry init and schema-fence snapshot that `openVault`
+   * performs, which a synchronous method cannot await. One construction
+   * path is the only way that divergence stays fixed.
+   */
   vault(name) {
     const cached = this.vaultCache.get(name);
     if (cached) return cached;
-    if (this.options.encrypt === false) {
-      const keyring2 = createPlaintextKeyring(this.options.user, this.options.debugPlaintext === true);
-      const comp2 = new Vault({
-        adapter: this.options.store,
-        name,
-        noydb: this,
-        keyring: keyring2,
-        encrypted: false,
-        emitter: this.emitter,
-        historyConfig: this.options.history,
-        ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-        ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-        ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-        ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-        ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-        ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-        ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-        ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-        ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-        ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-        ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-        ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-        ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-        ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-        ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-        ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-        ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-        ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-        ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-        forgetStrategy: this.forgetStrategy,
-        ...this.options.attestationStrategy !== void 0 ? { attestationStrategy: this.options.attestationStrategy } : {},
-        ...this.options.classifiedStrategy !== void 0 ? { classifiedStrategy: this.options.classifiedStrategy } : {},
-        ...this.options.sealedRecordStrategy !== void 0 ? { sealedRecordStrategy: this.options.sealedRecordStrategy } : {},
-        ...this.options.portabilityStrategy !== void 0 ? { portabilityStrategy: this.options.portabilityStrategy } : {},
-        ...this.options.sequenceStrategy !== void 0 ? { sequenceStrategy: this.options.sequenceStrategy } : {}
-      });
-      this.vaultCache.set(name, comp2);
-      return comp2;
-    }
-    const keyring = this.keyringCache.get(name);
-    if (!keyring) {
-      throw new ValidationError(
-        `Vault "${name}" not opened. Use await db.openVault("${name}") first.`
-      );
-    }
-    const comp = new Vault({
-      adapter: this.options.store,
-      name,
-      noydb: this,
-      keyring,
-      encrypted: true,
-      historyConfig: this.options.history,
-      ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
-      ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
-      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
-      ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
-      ...this.options.lazyStrategy !== void 0 ? { lazyStrategy: this.options.lazyStrategy } : {},
-      ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
-      ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
-      ...this.options.tiersStrategy !== void 0 ? { tiersStrategy: this.options.tiersStrategy } : {},
-      ...this.options.searchStrategy !== void 0 ? { searchStrategy: this.options.searchStrategy } : {},
-      ...this.options.cargoStrategy !== void 0 ? { cargoStrategy: this.options.cargoStrategy } : {},
-      ...this.options.brokerStrategy !== void 0 ? { brokerStrategy: this.options.brokerStrategy } : {},
-      ...this.options.consentStrategy !== void 0 ? { consentStrategy: this.options.consentStrategy } : {},
-      ...this.options.periodsStrategy !== void 0 ? { periodsStrategy: this.options.periodsStrategy } : {},
-      ...this.options.shadowStrategy !== void 0 ? { shadowStrategy: this.options.shadowStrategy } : {},
-      ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
-      ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
-      ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-      ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
-      ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
-      emitter: this.emitter
-    });
-    this.vaultCache.set(name, comp);
-    return comp;
+    throw new ValidationError(
+      `Vault "${name}" is not open. Call \`await db.openVault("${name}")\` first \u2014 vault() only returns an already-open vault, because opening involves async work (registry init, schema fence) that a sync accessor cannot do.`
+    );
   }
   /**
    * Grant access to a user for a vault.
@@ -13197,7 +13098,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async grant(vault, options, factors) {
-    return this.teamStrategy.grant(this.team, vault, options, factors);
+    return this.strategies.team.grant(this.team, vault, options, factors);
   }
   /**
    * Revoke a user's access to a vault.
@@ -13210,7 +13111,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async revoke(vault, options, factors) {
-    return this.teamStrategy.revoke(this.team, vault, options, factors);
+    return this.strategies.team.revoke(this.team, vault, options, factors);
   }
   /**
    * Grant the FR-6 `custodian` role to a user (owner-only custody API).
@@ -13223,7 +13124,7 @@ var Noydb = class {
    * owner-only invariant even if a host mis-configures the gate.
    */
   async grantCustodian(vault, options, factors) {
-    return this.custodyStrategy.grantCustodian(this, vault, options, factors);
+    return this.strategies.custody.grantCustodian(this, vault, options, factors);
   }
   /** @internal — grant-custodian engine, reached only via withCustody(); the
    * keyring engine arrives as an argument so the floor never carries it (#267). */
@@ -13242,7 +13143,7 @@ var Noydb = class {
    * 'owner'` check, so an admin cannot unwind a custodianship.
    */
   async revokeCustodian(vault, options, factors) {
-    return this.custodyStrategy.revokeCustodian(this, vault, options, factors);
+    return this.strategies.custody.revokeCustodian(this, vault, options, factors);
   }
   /** @internal — revoke-custodian engine, reached only via withCustody().
    * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
@@ -13321,7 +13222,7 @@ var Noydb = class {
    * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
    */
   async rotate(vault, collections) {
-    return this.teamStrategy.rotate(this.team, vault, collections);
+    return this.strategies.team.rotate(this.team, vault, collections);
   }
   /** List all users with access to a vault. */
   async listUsers(vault) {
@@ -13611,7 +13512,7 @@ var Noydb = class {
   }
   transaction(arg, maybeFn) {
     if (typeof arg === "function") {
-      return this.txStrategy.runTransaction(this, arg);
+      return this.strategies.tx.runTransaction(this, arg);
     }
     if (typeof arg === "object" && arg !== null && arg.dryRun === true) {
       if (typeof maybeFn !== "function") {
@@ -13619,7 +13520,7 @@ var Noydb = class {
           "db.transaction({ dryRun: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runDryRun(this, maybeFn);
+      return this.strategies.tx.runDryRun(this, maybeFn);
     }
     if (typeof arg === "object" && arg !== null && arg.amendment === true) {
       if (typeof maybeFn !== "function") {
@@ -13627,7 +13528,7 @@ var Noydb = class {
           "db.transaction({ amendment: true }, fn) requires the callback as the second argument."
         );
       }
-      return this.txStrategy.runTransaction(this, maybeFn, arg);
+      return this.strategies.tx.runTransaction(this, maybeFn, arg);
     }
     const vault = arg;
     const comp = this.vaultCache.get(vault);
@@ -13637,7 +13538,7 @@ var Noydb = class {
       );
     }
     const engine = this.getSyncEngine(vault);
-    return this.syncStrategy.buildSyncTransaction(comp, engine);
+    return this.strategies.sync.buildSyncTransaction(comp, engine);
   }
   /**
    * Internal accessor for the primary store — used by the tx
@@ -13918,7 +13819,7 @@ var Noydb = class {
       enforcer.destroy();
     }
     this.policyEnforcers.clear();
-    this.sessionStrategy.revokeAllSessions();
+    this.strategies.session.revokeAllSessions();
     for (const engine of this.syncEngines.values()) {
       engine.stopAutoSync();
     }
@@ -14419,4 +14320,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-VZELV7ZJ.js.map
+//# sourceMappingURL=chunk-W7TCXZWU.js.map