[{"data":1,"prerenderedAt":4918},["ShallowReactive",2],{"navigation":3,"\u002Fservices\u002Fclassified":927,"mdc--m8qwwq-key":4861,"mdc-vl4hlf-key":4876,"mdc--bp15nt-key":4885,"mdc-7l3wva-key":4897,"mdc-kqtr48-key":4909},[4,40,114,446,474,498,596,903],{"title":5,"path":6,"stem":7,"children":8},"Architecture","\u002Farchitecture","architecture",[9,14,28,32,36],{"title":10,"path":6,"stem":11,"access":12,"icon":13},"Overview","architecture\u002Findex","public","i-lucide-network",{"title":10,"path":15,"stem":16,"children":17,"access":12,"icon":19},"\u002Farchitecture\u002Fkernel","architecture\u002F1.kernel\u002Findex",[18,20,24],{"title":10,"path":15,"stem":16,"access":12,"icon":19},"i-lucide-box",{"title":21,"path":22,"stem":23,"access":12},"Enclave","\u002Farchitecture\u002Fkernel\u002Fenclave","architecture\u002F1.kernel\u002Fenclave",{"title":25,"path":26,"stem":27,"access":12},"Forking the enclave","\u002Farchitecture\u002Fkernel\u002Fforking-the-enclave","architecture\u002F1.kernel\u002Fforking-the-enclave",{"title":29,"path":30,"stem":31,"access":12},"Ports","\u002Farchitecture\u002Fports","architecture\u002F2.ports",{"title":33,"path":34,"stem":35,"access":12},"Service layers","\u002Farchitecture\u002Fservice-layers","architecture\u002F3.service-layers",{"title":37,"path":38,"stem":39,"access":12},"Families","\u002Farchitecture\u002Ffamilies","architecture\u002F4.families",{"title":41,"path":42,"stem":43,"children":44},"Core","\u002Fcore","core",[45,47,50,53,56,88,97],{"title":10,"path":42,"stem":46,"access":12,"icon":19},"core\u002Findex",{"title":10,"path":48,"stem":49,"access":12},"\u002Fcore\u002F01-overview","core\u002F01-overview",{"title":10,"path":51,"stem":52,"access":12},"\u002Fcore\u002F05-stores","core\u002F05-stores",{"title":10,"path":54,"stem":55,"access":12},"\u002Fcore\u002F06-permissions-and-keyring","core\u002F06-permissions-and-keyring",{"title":10,"path":57,"stem":58,"children":59,"access":12},"\u002Fcore\u002Fnoydb","core\u002F2.noydb\u002Findex",[60,61,65,68,72,76,80,84],{"title":10,"path":57,"stem":58,"access":12},{"title":62,"path":63,"stem":64,"access":12},"Noydb","\u002Fcore\u002Fnoydb\u002Fmethods","core\u002F2.noydb\u002F1.methods",{"title":21,"path":66,"stem":67,"access":12},"\u002Fcore\u002Fnoydb\u002Fenclave","core\u002F2.noydb\u002F2.enclave",{"title":69,"path":70,"stem":71,"access":12},"Secret & keyring","\u002Fcore\u002Fnoydb\u002Fkeyring","core\u002F2.noydb\u002F3.keyring",{"title":73,"path":74,"stem":75,"access":12},"Authentication","\u002Fcore\u002Fnoydb\u002Fauthentication","core\u002F2.noydb\u002F4.authentication",{"title":77,"path":78,"stem":79,"access":12},"Auth recovery","\u002Fcore\u002Fnoydb\u002Frecovery","core\u002F2.noydb\u002F5.recovery",{"title":81,"path":82,"stem":83,"access":12},"Configuration","\u002Fcore\u002Fnoydb\u002Fconfiguration","core\u002F2.noydb\u002F6.configuration",{"title":85,"path":86,"stem":87,"access":12},"Strategies","\u002Fcore\u002Fnoydb\u002Fstrategies","core\u002F2.noydb\u002F7.strategies",{"title":10,"path":89,"stem":90,"children":91,"access":12},"\u002Fcore\u002Fvault","core\u002F3.vault\u002Findex",[92,93],{"title":10,"path":89,"stem":90,"access":12},{"title":94,"path":95,"stem":96,"access":12},"Vault","\u002Fcore\u002Fvault\u002Fmethods","core\u002F3.vault\u002F1.methods",{"title":10,"path":98,"stem":99,"children":100,"access":12},"\u002Fcore\u002Fcollection","core\u002F4.collection\u002Findex",[101,102,106,110],{"title":10,"path":98,"stem":99,"access":12},{"title":103,"path":104,"stem":105,"access":12},"Collection","\u002Fcore\u002Fcollection\u002Fmethods","core\u002F4.collection\u002F1.methods",{"title":107,"path":108,"stem":109,"access":12},"Querying","\u002Fcore\u002Fcollection\u002Fquerying","core\u002F4.collection\u002F2.querying",{"title":111,"path":112,"stem":113,"access":12},"Schema","\u002Fcore\u002Fcollection\u002Fschema","core\u002F4.collection\u002F3.schema",{"title":37,"path":115,"stem":116,"children":117},"\u002Ffamilies","families",[118,121,168,194,208,212,216,294,340],{"title":10,"path":115,"stem":119,"access":12,"icon":120},"families\u002Findex","i-lucide-plug",{"title":122,"path":123,"stem":124,"children":125,"access":12,"icon":127},"as-Exports","\u002Ffamilies\u002Fas","families\u002Fas\u002Findex",[126,128,132,136,140,144,148,152,156,160,164],{"title":122,"path":123,"stem":124,"access":12,"icon":127},"i-lucide-book-open",{"title":129,"path":130,"stem":131,"access":12},"aws-s3","\u002Ffamilies\u002Fas\u002Faws-s3","families\u002Fas\u002Faws-s3",{"title":133,"path":134,"stem":135,"access":12},"blob","\u002Ffamilies\u002Fas\u002Fblob","families\u002Fas\u002Fblob",{"title":137,"path":138,"stem":139,"access":12},"csv","\u002Ffamilies\u002Fas\u002Fcsv","families\u002Fas\u002Fcsv",{"title":141,"path":142,"stem":143,"access":12},"json","\u002Ffamilies\u002Fas\u002Fjson","families\u002Fas\u002Fjson",{"title":145,"path":146,"stem":147,"access":12},"ndjson","\u002Ffamilies\u002Fas\u002Fndjson","families\u002Fas\u002Fndjson",{"title":149,"path":150,"stem":151,"access":12},"noydb","\u002Ffamilies\u002Fas\u002Fnoydb","families\u002Fas\u002Fnoydb",{"title":153,"path":154,"stem":155,"access":12},"sql","\u002Ffamilies\u002Fas\u002Fsql","families\u002Fas\u002Fsql",{"title":157,"path":158,"stem":159,"access":12},"xlsx","\u002Ffamilies\u002Fas\u002Fxlsx","families\u002Fas\u002Fxlsx",{"title":161,"path":162,"stem":163,"access":12},"xml","\u002Ffamilies\u002Fas\u002Fxml","families\u002Fas\u002Fxml",{"title":165,"path":166,"stem":167,"access":12},"zip","\u002Ffamilies\u002Fas\u002Fzip","families\u002Fas\u002Fzip",{"title":169,"path":170,"stem":171,"children":172,"access":12,"icon":127},"at-Seals","\u002Ffamilies\u002Fat","families\u002Fat\u002Findex",[173,174,178,182,186,190],{"title":169,"path":170,"stem":171,"access":12,"icon":127},{"title":175,"path":176,"stem":177,"access":12},"aws-kms","\u002Ffamilies\u002Fat\u002Faws-kms","families\u002Fat\u002Faws-kms",{"title":179,"path":180,"stem":181,"access":12},"azure-keyvault","\u002Ffamilies\u002Fat\u002Fazure-keyvault","families\u002Fat\u002Fazure-keyvault",{"title":183,"path":184,"stem":185,"access":12},"env","\u002Ffamilies\u002Fat\u002Fenv","families\u002Fat\u002Fenv",{"title":187,"path":188,"stem":189,"access":12},"gcp-kms","\u002Ffamilies\u002Fat\u002Fgcp-kms","families\u002Fat\u002Fgcp-kms",{"title":191,"path":192,"stem":193,"access":12},"macos-keychain","\u002Ffamilies\u002Fat\u002Fmacos-keychain","families\u002Fat\u002Fmacos-keychain",{"title":195,"path":196,"stem":197,"children":198,"access":12,"icon":127},"by-Sessions","\u002Ffamilies\u002Fby","families\u002Fby\u002Findex",[199,200,204],{"title":195,"path":196,"stem":197,"access":12,"icon":127},{"title":201,"path":202,"stem":203,"access":12},"peer","\u002Ffamilies\u002Fby\u002Fpeer","families\u002Fby\u002Fpeer",{"title":205,"path":206,"stem":207,"access":12},"tabs","\u002Ffamilies\u002Fby\u002Ftabs","families\u002Fby\u002Ftabs",{"title":209,"path":210,"stem":211,"access":12},"Classifying a package","\u002Ffamilies\u002Fclassification","families\u002Fclassification",{"title":213,"path":214,"stem":215,"access":12},"Command-line tools","\u002Ffamilies\u002Fcli","families\u002Fcli",{"title":217,"path":218,"stem":219,"children":220,"access":12,"icon":127},"in-Frameworks","\u002Ffamilies\u002Fin","families\u002Fin\u002Findex",[221,222,226,230,234,238,242,246,250,254,258,262,266,270,274,278,282,286,290],{"title":217,"path":218,"stem":219,"access":12,"icon":127},{"title":223,"path":224,"stem":225,"access":12},"ai","\u002Ffamilies\u002Fin\u002Fai","families\u002Fin\u002Fai",{"title":227,"path":228,"stem":229,"access":12},"devtools","\u002Ffamilies\u002Fin\u002Fdevtools","families\u002Fin\u002Fdevtools",{"title":231,"path":232,"stem":233,"access":12},"devtools-tui","\u002Ffamilies\u002Fin\u002Fdevtools-tui","families\u002Fin\u002Fdevtools-tui",{"title":235,"path":236,"stem":237,"access":12},"liff","\u002Ffamilies\u002Fin\u002Fliff","families\u002Fin\u002Fliff",{"title":239,"path":240,"stem":241,"access":12},"nextjs","\u002Ffamilies\u002Fin\u002Fnextjs","families\u002Fin\u002Fnextjs",{"title":243,"path":244,"stem":245,"access":12},"nuxt","\u002Ffamilies\u002Fin\u002Fnuxt","families\u002Fin\u002Fnuxt",{"title":247,"path":248,"stem":249,"access":12},"pinia","\u002Ffamilies\u002Fin\u002Fpinia","families\u002Fin\u002Fpinia",{"title":251,"path":252,"stem":253,"access":12},"pwa","\u002Ffamilies\u002Fin\u002Fpwa","families\u002Fin\u002Fpwa",{"title":255,"path":256,"stem":257,"access":12},"react","\u002Ffamilies\u002Fin\u002Freact","families\u002Fin\u002Freact",{"title":259,"path":260,"stem":261,"access":12},"relay","\u002Ffamilies\u002Fin\u002Frelay","families\u002Fin\u002Frelay",{"title":263,"path":264,"stem":265,"access":12},"rest","\u002Ffamilies\u002Fin\u002Frest","families\u002Fin\u002Frest",{"title":267,"path":268,"stem":269,"access":12},"solid","\u002Ffamilies\u002Fin\u002Fsolid","families\u002Fin\u002Fsolid",{"title":271,"path":272,"stem":273,"access":12},"svelte","\u002Ffamilies\u002Fin\u002Fsvelte","families\u002Fin\u002Fsvelte",{"title":275,"path":276,"stem":277,"access":12},"tanstack-query","\u002Ffamilies\u002Fin\u002Ftanstack-query","families\u002Fin\u002Ftanstack-query",{"title":279,"path":280,"stem":281,"access":12},"tanstack-table","\u002Ffamilies\u002Fin\u002Ftanstack-table","families\u002Fin\u002Ftanstack-table",{"title":283,"path":284,"stem":285,"access":12},"vue","\u002Ffamilies\u002Fin\u002Fvue","families\u002Fin\u002Fvue",{"title":287,"path":288,"stem":289,"access":12},"yjs","\u002Ffamilies\u002Fin\u002Fyjs","families\u002Fin\u002Fyjs",{"title":291,"path":292,"stem":293,"access":12},"zustand","\u002Ffamilies\u002Fin\u002Fzustand","families\u002Fin\u002Fzustand",{"title":295,"path":296,"stem":297,"children":298,"access":12,"icon":127},"on-Auth","\u002Ffamilies\u002Fon","families\u002Fon\u002Findex",[299,300,304,308,312,316,320,324,328,332,336],{"title":295,"path":296,"stem":297,"access":12,"icon":127},{"title":301,"path":302,"stem":303,"access":12},"email-otp","\u002Ffamilies\u002Fon\u002Femail-otp","families\u002Fon\u002Femail-otp",{"title":305,"path":306,"stem":307,"access":12},"magic-link","\u002Ffamilies\u002Fon\u002Fmagic-link","families\u002Fon\u002Fmagic-link",{"title":309,"path":310,"stem":311,"access":12},"oidc","\u002Ffamilies\u002Fon\u002Foidc","families\u002Fon\u002Foidc",{"title":313,"path":314,"stem":315,"access":12},"password","\u002Ffamilies\u002Fon\u002Fpassword","families\u002Fon\u002Fpassword",{"title":317,"path":318,"stem":319,"access":12},"pin","\u002Ffamilies\u002Fon\u002Fpin","families\u002Fon\u002Fpin",{"title":321,"path":322,"stem":323,"access":12},"recovery","\u002Ffamilies\u002Fon\u002Frecovery","families\u002Fon\u002Frecovery",{"title":325,"path":326,"stem":327,"access":12},"shamir","\u002Ffamilies\u002Fon\u002Fshamir","families\u002Fon\u002Fshamir",{"title":329,"path":330,"stem":331,"access":12},"threat","\u002Ffamilies\u002Fon\u002Fthreat","families\u002Fon\u002Fthreat",{"title":333,"path":334,"stem":335,"access":12},"totp","\u002Ffamilies\u002Fon\u002Ftotp","families\u002Fon\u002Ftotp",{"title":337,"path":338,"stem":339,"access":12},"webauthn","\u002Ffamilies\u002Fon\u002Fwebauthn","families\u002Fon\u002Fwebauthn",{"title":341,"path":342,"stem":343,"children":344,"access":12,"icon":127},"to-Stores","\u002Ffamilies\u002Fto","families\u002Fto\u002Findex",[345,346,350,353,357,361,365,370,374,378,382,386,390,394,398,402,406,410,414,417,421,425,429,434,438,442],{"title":341,"path":342,"stem":343,"access":12,"icon":127},{"title":347,"path":348,"stem":349,"access":12},"aws-dynamo","\u002Ffamilies\u002Fto\u002Faws-dynamo","families\u002Fto\u002Faws-dynamo",{"title":129,"path":351,"stem":352,"access":12},"\u002Ffamilies\u002Fto\u002Faws-s3","families\u002Fto\u002Faws-s3",{"title":354,"path":355,"stem":356,"access":12},"browser-fs","\u002Ffamilies\u002Fto\u002Fbrowser-fs","families\u002Fto\u002Fbrowser-fs",{"title":358,"path":359,"stem":360,"access":12},"browser-idb","\u002Ffamilies\u002Fto\u002Fbrowser-idb","families\u002Fto\u002Fbrowser-idb",{"title":362,"path":363,"stem":364,"access":12},"browser-local","\u002Ffamilies\u002Fto\u002Fbrowser-local","families\u002Fto\u002Fbrowser-local",{"title":366,"path":367,"stem":368,"access":12,"icon":369},"Choosing a store","\u002Ffamilies\u002Fto\u002Fchoosing-a-store","families\u002Fto\u002Fchoosing-a-store","i-lucide-split",{"title":371,"path":372,"stem":373,"access":12},"cloudflare-d1","\u002Ffamilies\u002Fto\u002Fcloudflare-d1","families\u002Fto\u002Fcloudflare-d1",{"title":375,"path":376,"stem":377,"access":12},"cloudflare-r2","\u002Ffamilies\u002Fto\u002Fcloudflare-r2","families\u002Fto\u002Fcloudflare-r2",{"title":379,"path":380,"stem":381,"access":12},"drive","\u002Ffamilies\u002Fto\u002Fdrive","families\u002Fto\u002Fdrive",{"title":383,"path":384,"stem":385,"access":12},"file","\u002Ffamilies\u002Fto\u002Ffile","families\u002Fto\u002Ffile",{"title":387,"path":388,"stem":389,"access":12},"icloud","\u002Ffamilies\u002Fto\u002Ficloud","families\u002Fto\u002Ficloud",{"title":391,"path":392,"stem":393,"access":12},"memory","\u002Ffamilies\u002Fto\u002Fmemory","families\u002Fto\u002Fmemory",{"title":395,"path":396,"stem":397,"access":12},"meter","\u002Ffamilies\u002Fto\u002Fmeter","families\u002Fto\u002Fmeter",{"title":399,"path":400,"stem":401,"access":12},"mysql","\u002Ffamilies\u002Fto\u002Fmysql","families\u002Fto\u002Fmysql",{"title":403,"path":404,"stem":405,"access":12},"nfs","\u002Ffamilies\u002Fto\u002Fnfs","families\u002Fto\u002Fnfs",{"title":407,"path":408,"stem":409,"access":12},"postgres","\u002Ffamilies\u002Fto\u002Fpostgres","families\u002Fto\u002Fpostgres",{"title":411,"path":412,"stem":413,"access":12},"probe","\u002Ffamilies\u002Fto\u002Fprobe","families\u002Fto\u002Fprobe",{"title":263,"path":415,"stem":416,"access":12},"\u002Ffamilies\u002Fto\u002Frest","families\u002Fto\u002Frest",{"title":418,"path":419,"stem":420,"access":12},"smb","\u002Ffamilies\u002Fto\u002Fsmb","families\u002Fto\u002Fsmb",{"title":422,"path":423,"stem":424,"access":12},"sqlite","\u002Ffamilies\u002Fto\u002Fsqlite","families\u002Fto\u002Fsqlite",{"title":426,"path":427,"stem":428,"access":12},"ssh","\u002Ffamilies\u002Fto\u002Fssh","families\u002Fto\u002Fssh",{"title":430,"path":431,"stem":432,"access":12,"icon":433},"Store-locator descriptors","\u002Ffamilies\u002Fto\u002Fstore-locator","families\u002Fto\u002Fstore-locator","i-lucide-map-pin",{"title":435,"path":436,"stem":437,"access":12},"supabase","\u002Ffamilies\u002Fto\u002Fsupabase","families\u002Fto\u002Fsupabase",{"title":439,"path":440,"stem":441,"access":12},"turso","\u002Ffamilies\u002Fto\u002Fturso","families\u002Fto\u002Fturso",{"title":443,"path":444,"stem":445,"access":12},"webdav","\u002Ffamilies\u002Fto\u002Fwebdav","families\u002Fto\u002Fwebdav",{"title":447,"path":448,"stem":449,"children":450},"Faq","\u002Ffaq","faq",[451,454,458,462,466,470],{"title":10,"path":448,"stem":452,"access":12,"icon":453},"faq\u002Findex","i-lucide-circle-help",{"title":455,"path":456,"stem":457,"access":12},"Where can noy-db run?","\u002Ffaq\u002Fwhere-can-noy-db-run","faq\u002F1.where-can-noy-db-run",{"title":459,"path":460,"stem":461,"access":12},"Native mobile & PWA","\u002Ffaq\u002Fmobile-and-pwa","faq\u002F2.mobile-and-pwa",{"title":463,"path":464,"stem":465,"access":12},"Threat model","\u002Ffaq\u002Fthreat-model","faq\u002F3.threat-model",{"title":467,"path":468,"stem":469,"access":12},"Community & ecosystem","\u002Ffaq\u002Fcommunity-and-ecosystem","faq\u002F4.community-and-ecosystem",{"title":471,"path":472,"stem":473,"access":12},"Licensing","\u002Ffaq\u002Flicensing","faq\u002F5.licensing",{"title":475,"path":476,"stem":477,"children":478},"Glossary","\u002Fglossary","glossary",[479,482,486,490,494],{"title":10,"path":476,"stem":480,"access":12,"icon":481},"glossary\u002Findex","i-lucide-book-a",{"title":483,"path":484,"stem":485,"access":12},"Core vocabulary","\u002Fglossary\u002Fcore-vocabulary","glossary\u002Fcore-vocabulary",{"title":487,"path":488,"stem":489,"access":12},"Deletion vocabulary","\u002Fglossary\u002Fdeletion","glossary\u002Fdeletion",{"title":491,"path":492,"stem":493,"access":12},"Satellite collection vocabulary","\u002Fglossary\u002Fsatellite-collections","glossary\u002Fsatellite-collections",{"title":495,"path":496,"stem":497,"access":12},"Schema migration vocabulary","\u002Fglossary\u002Fschema-migration","glossary\u002Fschema-migration",{"title":499,"path":500,"stem":501,"children":502},"Recipes","\u002Frecipes","recipes",[503,506,510,514,518,522,526,530,534,538,542,546,550,554,558,562,567,571,575,580,584,588,592],{"title":10,"path":500,"stem":504,"access":12,"icon":505},"recipes\u002Findex","i-lucide-play",{"title":507,"path":508,"stem":509,"access":12},"Accounting app","\u002Frecipes\u002Faccounting-app","recipes\u002Faccounting-app",{"title":511,"path":512,"stem":513,"access":12},"Analytics app","\u002Frecipes\u002Fanalytics-app","recipes\u002Fanalytics-app",{"title":515,"path":516,"stem":517,"access":12},"Attestation verifier","\u002Frecipes\u002Fattestation-verifier","recipes\u002Fattestation-verifier",{"title":519,"path":520,"stem":521,"access":12},"AWS-KMS attestation","\u002Frecipes\u002Faws-kms-pdf-attestation","recipes\u002Faws-kms-pdf-attestation",{"title":523,"path":524,"stem":525,"access":12},"Browser durability","\u002Frecipes\u002Fbrowser-durability","recipes\u002Fbrowser-durability",{"title":527,"path":528,"stem":529,"access":12},"Production cloud store","\u002Frecipes\u002Fcloud-store","recipes\u002Fcloud-store",{"title":531,"path":532,"stem":533,"access":12},"Compose your own setup","\u002Frecipes\u002Fcompose-your-own","recipes\u002Fcompose-your-own",{"title":535,"path":536,"stem":537,"access":12},"Confidential HR records","\u002Frecipes\u002Fconfidential-hr","recipes\u002Fconfidential-hr",{"title":539,"path":540,"stem":541,"access":12},"Composing an echo secret","\u002Frecipes\u002Fecho-secret-enrollment","recipes\u002Fecho-secret-enrollment",{"title":543,"path":544,"stem":545,"access":12},"Email archive","\u002Frecipes\u002Femail-archive","recipes\u002Femail-archive",{"title":547,"path":548,"stem":549,"access":12},"Email archive — threads & revisions","\u002Frecipes\u002Femail-archive-threads-revisions","recipes\u002Femail-archive-threads-revisions",{"title":551,"path":552,"stem":553,"access":12},"Export & portability","\u002Frecipes\u002Fexport-portability","recipes\u002Fexport-portability",{"title":555,"path":556,"stem":557,"access":12},"Passwordless OIDC (AWS Cognito)","\u002Frecipes\u002Fpasswordless-oidc","recipes\u002Fpasswordless-oidc",{"title":559,"path":560,"stem":561,"access":12},"Personal notebook","\u002Frecipes\u002Fpersonal-notebook","recipes\u002Fpersonal-notebook",{"title":563,"path":564,"stem":565,"access":12,"icon":566},"Playgrounds","\u002Frecipes\u002Fplaygrounds","recipes\u002Fplaygrounds","i-lucide-gamepad-2",{"title":568,"path":569,"stem":570,"access":12},"React invoice app","\u002Frecipes\u002Freact-invoices","recipes\u002Freact-invoices",{"title":572,"path":573,"stem":574,"access":12},"Collaborative app","\u002Frecipes\u002Frealtime-crdt-app","recipes\u002Frealtime-crdt-app",{"title":576,"path":577,"stem":578,"access":12,"icon":579},"Run the showcases","\u002Frecipes\u002Frun-the-showcases","recipes\u002Frun-the-showcases","i-lucide-flask-conical",{"title":581,"path":582,"stem":583,"access":12},"Search & RAG","\u002Frecipes\u002Fsearch-rag","recipes\u002Fsearch-rag",{"title":585,"path":586,"stem":587,"access":12},"Team vault topology","\u002Frecipes\u002Fteam-vault-topology","recipes\u002Fteam-vault-topology",{"title":589,"path":590,"stem":591,"access":12},"Unlock ceremonies","\u002Frecipes\u002Funlock-ceremonies","recipes\u002Funlock-ceremonies",{"title":593,"path":594,"stem":595,"access":12},"User preferences","\u002Frecipes\u002Fuser-preferences","recipes\u002Fuser-preferences",{"title":597,"path":598,"stem":599,"children":600},"Services","\u002Fservices","services",[601,604,608,612,616,620,624,628,632,636,640,644,648,652,656,660,664,668,672,676,680,684,688,692,696,700,704,710,714,718,722,726,730,734,738,742,746,750,755,759,763,767,771,775,779,783,787,791,795,799,803,807,811,815,819,823,827,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899],{"title":10,"path":598,"stem":602,"access":12,"icon":603},"services\u002Findex","i-lucide-layers",{"title":605,"path":606,"stem":607,"access":12},"archive","\u002Fservices\u002Farchive","services\u002Farchive",{"title":609,"path":610,"stem":611,"access":12},"attestation","\u002Fservices\u002Fattestation","services\u002Fattestation",{"title":613,"path":614,"stem":615,"access":12},"auth-introspection","\u002Fservices\u002Fauth-introspection","services\u002Fauth-introspection",{"title":617,"path":618,"stem":619,"access":12},"auth-landscape","\u002Fservices\u002Fauth-landscape","services\u002Fauth-landscape",{"title":621,"path":622,"stem":623,"access":12},"blobs","\u002Fservices\u002Fblobs","services\u002Fblobs",{"title":625,"path":626,"stem":627,"access":12},"broker","\u002Fservices\u002Fbroker","services\u002Fbroker",{"title":629,"path":630,"stem":631,"access":12},"bundle","\u002Fservices\u002Fbundle","services\u002Fbundle",{"title":633,"path":634,"stem":635,"access":12},"classified","\u002Fservices\u002Fclassified","services\u002Fclassified",{"title":637,"path":638,"stem":639,"access":12},"computed","\u002Fservices\u002Fcomputed","services\u002Fcomputed",{"title":641,"path":642,"stem":643,"access":12},"consent","\u002Fservices\u002Fconsent","services\u002Fconsent",{"title":645,"path":646,"stem":647,"access":12},"cover","\u002Fservices\u002Fcover","services\u002Fcover",{"title":649,"path":650,"stem":651,"access":12},"coverage","\u002Fservices\u002Fcoverage","services\u002Fcoverage",{"title":653,"path":654,"stem":655,"access":12},"crdt","\u002Fservices\u002Fcrdt","services\u002Fcrdt",{"title":657,"path":658,"stem":659,"access":12},"cross-join","\u002Fservices\u002Fcross-join","services\u002Fcross-join",{"title":661,"path":662,"stem":663,"access":12},"custody","\u002Fservices\u002Fcustody","services\u002Fcustody",{"title":665,"path":666,"stem":667,"access":12},"derivations","\u002Fservices\u002Fderivations","services\u002Fderivations",{"title":669,"path":670,"stem":671,"access":12},"directory","\u002Fservices\u002Fdirectory","services\u002Fdirectory",{"title":673,"path":674,"stem":675,"access":12},"search — AI","\u002Fservices\u002Fembeddings","services\u002Fembeddings",{"title":677,"path":678,"stem":679,"access":12},"Field metadata","\u002Fservices\u002Ffield-metadata","services\u002Ffield-metadata",{"title":681,"path":682,"stem":683,"access":12},"Foreign refs","\u002Fservices\u002Fforeign-refs","services\u002Fforeign-refs",{"title":685,"path":686,"stem":687,"access":12},"forget","\u002Fservices\u002Fforget","services\u002Fforget",{"title":689,"path":690,"stem":691,"access":12},"governance","\u002Fservices\u002Fgovernance","services\u002Fgovernance",{"title":693,"path":694,"stem":695,"access":12},"guards","\u002Fservices\u002Fguards","services\u002Fguards",{"title":697,"path":698,"stem":699,"access":12},"history","\u002Fservices\u002Fhistory","services\u002Fhistory",{"title":701,"path":702,"stem":703,"access":12},"i18n","\u002Fservices\u002Fi18n","services\u002Fi18n",{"title":705,"path":706,"stem":707,"children":708,"access":12},"indexing","\u002Fservices\u002Findexing","services\u002Findexing",[709],{"title":705,"path":706,"stem":707,"access":12},{"title":711,"path":712,"stem":713,"access":12},"introspection","\u002Fservices\u002Fintrospection","services\u002Fintrospection",{"title":715,"path":716,"stem":717,"access":12},"joins","\u002Fservices\u002Fjoins","services\u002Fjoins",{"title":719,"path":720,"stem":721,"access":12},"lazy","\u002Fservices\u002Flazy","services\u002Flazy",{"title":723,"path":724,"stem":725,"access":12},"links","\u002Fservices\u002Flinks","services\u002Flinks",{"title":727,"path":728,"stem":729,"access":12},"live","\u002Fservices\u002Flive","services\u002Flive",{"title":731,"path":732,"stem":733,"access":12},"lookup","\u002Fservices\u002Flookup","services\u002Flookup",{"title":735,"path":736,"stem":737,"access":12},"manifest","\u002Fservices\u002Fmanifest","services\u002Fmanifest",{"title":739,"path":740,"stem":741,"access":12},"materialized-views","\u002Fservices\u002Fmaterialized-views","services\u002Fmaterialized-views",{"title":743,"path":744,"stem":745,"access":12},"Metadata ladder","\u002Fservices\u002Fmetadata-ladder","services\u002Fmetadata-ladder",{"title":747,"path":748,"stem":749,"access":12},"Metadata riders","\u002Fservices\u002Fmetadata-riders","services\u002Fmetadata-riders",{"title":751,"path":752,"stem":753,"access":12,"badge":754},"metrics","\u002Fservices\u002Fmetrics","services\u002Fmetrics","Planned",{"title":756,"path":757,"stem":758,"access":12,"badge":754},"migrations","\u002Fservices\u002Fmigrations","services\u002Fmigrations",{"title":760,"path":761,"stem":762,"access":12},"money","\u002Fservices\u002Fmoney","services\u002Fmoney",{"title":764,"path":765,"stem":766,"access":12},"numbering","\u002Fservices\u002Fnumbering","services\u002Fnumbering",{"title":768,"path":769,"stem":770,"access":12},"overlay-views","\u002Fservices\u002Foverlay-views","services\u002Foverlay-views",{"title":772,"path":773,"stem":774,"access":12,"badge":754},"partitioning","\u002Fservices\u002Fpartitioning","services\u002Fpartitioning",{"title":776,"path":777,"stem":778,"access":12},"periods","\u002Fservices\u002Fperiods","services\u002Fperiods",{"title":780,"path":781,"stem":782,"access":12},"persisted-schemas","\u002Fservices\u002Fpersisted-schemas","services\u002Fpersisted-schemas",{"title":784,"path":785,"stem":786,"access":12},"plaintext-bypass","\u002Fservices\u002Fplaintext-bypass","services\u002Fplaintext-bypass",{"title":788,"path":789,"stem":790,"access":12},"pod-redirect","\u002Fservices\u002Fpod-redirect","services\u002Fpod-redirect",{"title":792,"path":793,"stem":794,"access":12},"pod-signature","\u002Fservices\u002Fpod-signature","services\u002Fpod-signature",{"title":796,"path":797,"stem":798,"access":12},"policy","\u002Fservices\u002Fpolicy","services\u002Fpolicy",{"title":800,"path":801,"stem":802,"access":12},"portability","\u002Fservices\u002Fportability","services\u002Fportability",{"title":804,"path":805,"stem":806,"access":12},"reduce","\u002Fservices\u002Freduce","services\u002Freduce",{"title":808,"path":809,"stem":810,"access":12},"routing","\u002Fservices\u002Frouting","services\u002Frouting",{"title":812,"path":813,"stem":814,"access":12},"satellites","\u002Fservices\u002Fsatellites","services\u002Fsatellites",{"title":816,"path":817,"stem":818,"access":12},"schema-identifiers","\u002Fservices\u002Fschema-identifiers","services\u002Fschema-identifiers",{"title":820,"path":821,"stem":822,"access":12},"schema-update","\u002Fservices\u002Fschema-update","services\u002Fschema-update",{"title":824,"path":825,"stem":826,"access":12},"sealed-record","\u002Fservices\u002Fsealed-record","services\u002Fsealed-record",{"title":828,"path":829,"stem":830,"access":12},"sealing provider id","\u002Fservices\u002Fsealing-pid-stability","services\u002Fsealing-pid-stability",{"title":832,"path":833,"stem":834,"access":12},"search — full-text","\u002Fservices\u002Fsearch","services\u002Fsearch",{"title":836,"path":837,"stem":838,"access":12},"sequence","\u002Fservices\u002Fsequence","services\u002Fsequence",{"title":840,"path":841,"stem":842,"access":12},"session","\u002Fservices\u002Fsession","services\u002Fsession",{"title":844,"path":845,"stem":846,"access":12},"session-tiers","\u002Fservices\u002Fsession-tiers","services\u002Fsession-tiers",{"title":848,"path":849,"stem":850,"access":12},"shadow","\u002Fservices\u002Fshadow","services\u002Fshadow",{"title":852,"path":853,"stem":854,"access":12},"share-link","\u002Fservices\u002Fshare-link","services\u002Fshare-link",{"title":856,"path":857,"stem":858,"access":12},"snapshots","\u002Fservices\u002Fsnapshots","services\u002Fsnapshots",{"title":860,"path":861,"stem":862,"access":12},"store capabilities","\u002Fservices\u002Fstorage-capability-matrix","services\u002Fstorage-capability-matrix",{"title":864,"path":865,"stem":866,"access":12},"sync","\u002Fservices\u002Fsync","services\u002Fsync",{"title":868,"path":869,"stem":870,"access":12},"team","\u002Fservices\u002Fteam","services\u002Fteam",{"title":872,"path":873,"stem":874,"access":12},"tiers","\u002Fservices\u002Ftiers","services\u002Ftiers",{"title":876,"path":877,"stem":878,"access":12},"transactions","\u002Fservices\u002Ftransactions","services\u002Ftransactions",{"title":880,"path":881,"stem":882,"access":12},"partitions","\u002Fservices\u002Ftransferable-partitions","services\u002Ftransferable-partitions",{"title":884,"path":885,"stem":886,"access":12},"user-envelope","\u002Fservices\u002Fuser-envelope","services\u002Fuser-envelope",{"title":888,"path":889,"stem":890,"access":12,"badge":754},"validation","\u002Fservices\u002Fvalidation","services\u002Fvalidation",{"title":892,"path":893,"stem":894,"access":12},"vault-head","\u002Fservices\u002Fvault-head","services\u002Fvault-head",{"title":896,"path":897,"stem":898,"access":12},"via","\u002Fservices\u002Fvia","services\u002Fvia",{"title":900,"path":901,"stem":902,"access":12},"withdrawal","\u002Fservices\u002Fwithdrawal","services\u002Fwithdrawal",{"title":904,"path":905,"stem":906,"children":907},"Start","\u002Fstart","start",[908,911,915,919,923],{"title":10,"path":905,"stem":909,"access":12,"icon":910},"start\u002Findex","i-lucide-flag",{"title":912,"path":913,"stem":914,"access":12},"Install","\u002Fstart\u002Finstall","start\u002F1.install",{"title":916,"path":917,"stem":918,"access":12},"Your first vault","\u002Fstart\u002Ffirst-vault","start\u002F2.first-vault",{"title":920,"path":921,"stem":922,"access":12},"Your first service","\u002Fstart\u002Ffirst-service","start\u002F3.first-service",{"title":924,"path":925,"stem":926,"access":12},"See the ciphertext","\u002Fstart\u002Fsee-the-ciphertext","start\u002F4.see-the-ciphertext",{"id":928,"title":633,"access":12,"apiToc":929,"body":930,"category":4852,"description":4853,"extension":4854,"meta":4855,"navigation":4852,"nest":4856,"path":634,"seo":4857,"sinceVersion":4852,"status":4858,"stem":635,"subtitle":4852,"tier":4859,"tocExternal":4852,"__hash__":4860},"docs\u002Fservices\u002Fclassified.md",false,{"type":931,"value":932,"toc":4826},"minimark",[933,936,940,945,954,961,1011,1030,1059,1063,1084,1088,1125,1129,1153,1567,1571,1576,1587,1854,2042,2048,2069,2123,2300,2304,2309,2415,2430,2434,2444,2764,2786,2795,2937,2945,2965,2969,2997,3254,3264,3287,3295,3313,3339,3351,3524,3541,3584,3686,3694,3734,3746,3750,3755,3773,3795,3802,4037,4080,4093,4099,4214,4218,4292,4296,4405,4417,4421,4424,4552,4556,4744,4748,4822],[934,935,633],"h1",{"id":633},[937,938],"service-meta",{":rows":939},"[{\"label\":\"Subpath\",\"value\":\"`@noy-db\u002Fhub\u002Fclassified`\"},{\"label\":\"Factory\",\"value\":\"`withClassified()`\"},{\"label\":\"Layer\",\"value\":\"`with-shape`\"},{\"label\":\"Cluster\",\"value\":\"D — Data Shape\"},{\"label\":\"LOC cost\",\"value\":\"~1,150 (off-bundle when not opted in)\"}]",[941,942,944],"h2",{"id":943},"what-it-does","What it does",[946,947,948,949,953],"p",{},"Some fields are more dangerous than the rest of the record: card numbers, passwords,\nbirth dates, security answers. The classified service lets you declare those fields\n",[950,951,952],"strong",{},"once",", with a behavioral preset, and the hub enforces the whole lifecycle for you:\nvalidation on write, how (or whether) the value is persisted, what a list may show, and\nhow the value can ever come back out.",[946,955,956,957,960],{},"Every classified field has exactly one ",[950,958,959],{},"storage form",":",[962,963,964,986,1003],"ul",{},[965,966,967,973,974,977,978,981,982,985],"li",{},[950,968,969],{},[970,971,972],"code",{},"recoverable"," — the value is stored encrypted and can be read back, but only through\na deliberate, auditable ",[970,975,976],{},"reveal()"," call. Normal reads return an opaque ",[950,979,980],{},"sealed handle","\n(it logs and serializes as ",[970,983,984],{},"\"[sealed]\"",", never the value).",[965,987,988,993,994,998,999,1002],{},[950,989,990],{},[970,991,992],{},"digest-only"," — the value itself is never stored; only a salted, key-bound digest\nis. You can ",[995,996,997],"em",{},"verify"," a candidate against it (",[970,1000,1001],{},"verify()","), never read it back. This is\nhow passwords and secret answers work.",[965,1004,1005,1010],{},[950,1006,1007],{},[970,1008,1009],{},"never"," — the value must not be persisted at all (a card's CVC). Writing it throws.",[946,1012,1013,1014,1017,1018,1021,1022,1025,1026,1029],{},"Alongside the protected value, presets can materialize ",[950,1015,1016],{},"riders"," — safe derived\ncompanion fields (",[970,1019,1020],{},"cardNumber_last4",", ",[970,1023,1024],{},"email_domain",") stored as plain fields — and\ndeclare a ",[950,1027,1028],{},"list projection"," (mask, omit, or rider) that tells list renderers and\nexporters what to show instead of the value.",[946,1031,1032,1033,1036,1037,1040,1041,1044,1045,1047,1048,1051,1052,1054,1055,1058],{},"Since ",[970,1034,1035],{},"0.3.0-pre.9",", a classified declaration is also a\n",[1038,1039,896],"a",{"href":897}," field-feature binding carrying an enforced ",[950,1042,1043],{},"security posture"," —\nsealed-at-rest, deterministic-exact-only querying, non-exportable, forgettable. The posture is\nconsulted generically by query, export, and ",[1038,1046,685],{"href":686}," (no classified-specific\nspecial cases), and — through the dependency graph — it is ",[950,1049,1050],{},"inherited"," by any\n",[1038,1053,637],{"href":638}," field that declares a classified source in its ",[970,1056,1057],{},"deps",": the\nderived value is sealed or redacted too, instead of silently leaking plaintext into an ordinary\nfield.",[941,1060,1062],{"id":1061},"when-you-need-it","When you need it",[962,1064,1065,1068,1071,1074],{},[965,1066,1067],{},"Storing payment-card data without hand-rolling PCI-style handling (PAN sealed,\nlast4\u002FBIN available for display, CVC refused at the write boundary)",[965,1069,1070],{},"Login secrets and account-recovery answers: verify a candidate without ever being able\nto read the stored value, including k-of-n \"answer 2 of 3 questions\" challenges",[965,1072,1073],{},"PII (emails, phone numbers, birth dates) that lists should show masked, with an\naudited path to the full value for support cases",[965,1075,1076,1077,1080,1081],{},"Looking up ",[995,1078,1079],{},"which record"," holds a given secret (invite codes, API tokens) without\nstoring the secret — the opt-in equatable blind index and ",[970,1082,1083],{},"findByDigest",[941,1085,1087],{"id":1086},"prerequisites","Prerequisites",[962,1089,1090,1099,1112],{},[965,1091,1092,1098],{},[950,1093,1094,1097],{},[970,1095,1096],{},"classifiedFields"," declared on the collection"," — this feature reads per-field declarations; the factory alone does nothing without them.",[965,1100,1101,1107,1108,1111],{},[995,1102,1103,1104,1106],{},"For ",[970,1105,1083],{}," on equatable digests:"," the collection must be opened with ",[970,1109,1110],{},"acknowledgeEquatableRisk"," (the \"Find by digest\" section below explains the equality-search trade-off).",[965,1113,1114,1117,1118,1121,1122,1124],{},[995,1115,1116],{},"For erasure flows:"," pairs with ",[970,1119,1120],{},"forgetStrategy: withForget()"," — see ",[1038,1123,685],{"href":686},".",[941,1126,1128],{"id":1127},"opt-in","Opt in",[946,1130,1131,1132,1134,1135,1021,1138,1021,1140,1021,1143,1145,1146,1149,1150,1124],{},"Declaring ",[970,1133,1096],{}," on a collection is always available — write enforcement,\nvalidation, and riders run with no factory. The four read-egress operations\n(",[970,1136,1137],{},"reveal",[970,1139,997],{},[970,1141,1142],{},"verifyGroup",[970,1144,1083],{},") are tree-shaken behind\n",[970,1147,1148],{},"withClassified()","; without it they throw ",[970,1151,1152],{},"ClassifiedNotEnabledError",[1154,1155,1160],"pre",{"className":1156,"code":1157,"language":1158,"meta":1159,"style":1159},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { createNoydb } from '@noy-db\u002Fhub'\nimport { classified, withClassified } from '@noy-db\u002Fhub\u002Fclassified'\nimport { toMemory } from '@noy-db\u002Fto-memory'\n\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'owner',\n  secret: 'correct horse battery staple',\n  classifiedStrategy: withClassified(),   \u002F\u002F enables reveal \u002F verify \u002F verifyGroup \u002F findByDigest\n})\n\nconst vault = await db.openVault('crm')\n\nconst customers = vault.collection('customers', {\n  classifiedFields: {\n    \u002F\u002F A group claims several record fields with one preset (differential policy per member):\n    card: classified.creditCard({ pan: 'cardNumber', expiry: 'cardExpiry', cvc: 'cardCvc' }),\n    \u002F\u002F A single-field entry: the key is the record field name.\n    email: classified.email(),\n    dob: classified.birthDate(),\n  },\n})\n","ts","",[970,1161,1162,1195,1222,1243,1250,1275,1292,1310,1327,1345,1354,1359,1390,1395,1427,1437,1443,1510,1516,1535,1554,1560],{"__ignoreMap":1159},[1163,1164,1167,1171,1175,1179,1182,1185,1188,1192],"span",{"class":1165,"line":1166},"line",1,[1163,1168,1170],{"class":1169},"s7zQu","import",[1163,1172,1174],{"class":1173},"sMK4o"," {",[1163,1176,1178],{"class":1177},"sTEyZ"," createNoydb",[1163,1180,1181],{"class":1173}," }",[1163,1183,1184],{"class":1169}," from",[1163,1186,1187],{"class":1173}," '",[1163,1189,1191],{"class":1190},"sfazB","@noy-db\u002Fhub",[1163,1193,1194],{"class":1173},"'\n",[1163,1196,1198,1200,1202,1205,1208,1211,1213,1215,1217,1220],{"class":1165,"line":1197},2,[1163,1199,1170],{"class":1169},[1163,1201,1174],{"class":1173},[1163,1203,1204],{"class":1177}," classified",[1163,1206,1207],{"class":1173},",",[1163,1209,1210],{"class":1177}," withClassified",[1163,1212,1181],{"class":1173},[1163,1214,1184],{"class":1169},[1163,1216,1187],{"class":1173},[1163,1218,1219],{"class":1190},"@noy-db\u002Fhub\u002Fclassified",[1163,1221,1194],{"class":1173},[1163,1223,1225,1227,1229,1232,1234,1236,1238,1241],{"class":1165,"line":1224},3,[1163,1226,1170],{"class":1169},[1163,1228,1174],{"class":1173},[1163,1230,1231],{"class":1177}," toMemory",[1163,1233,1181],{"class":1173},[1163,1235,1184],{"class":1169},[1163,1237,1187],{"class":1173},[1163,1239,1240],{"class":1190},"@noy-db\u002Fto-memory",[1163,1242,1194],{"class":1173},[1163,1244,1246],{"class":1165,"line":1245},4,[1163,1247,1249],{"emptyLinePlaceholder":1248},true,"\n",[1163,1251,1253,1257,1260,1263,1266,1269,1272],{"class":1165,"line":1252},5,[1163,1254,1256],{"class":1255},"spNyl","const",[1163,1258,1259],{"class":1177}," db ",[1163,1261,1262],{"class":1173},"=",[1163,1264,1265],{"class":1169}," await",[1163,1267,1178],{"class":1268},"s2Zo4",[1163,1270,1271],{"class":1177},"(",[1163,1273,1274],{"class":1173},"{\n",[1163,1276,1278,1282,1284,1286,1289],{"class":1165,"line":1277},6,[1163,1279,1281],{"class":1280},"swJcz","  store",[1163,1283,960],{"class":1173},[1163,1285,1231],{"class":1268},[1163,1287,1288],{"class":1177},"()",[1163,1290,1291],{"class":1173},",\n",[1163,1293,1295,1298,1300,1302,1305,1308],{"class":1165,"line":1294},7,[1163,1296,1297],{"class":1280},"  user",[1163,1299,960],{"class":1173},[1163,1301,1187],{"class":1173},[1163,1303,1304],{"class":1190},"owner",[1163,1306,1307],{"class":1173},"'",[1163,1309,1291],{"class":1173},[1163,1311,1313,1316,1318,1320,1323,1325],{"class":1165,"line":1312},8,[1163,1314,1315],{"class":1280},"  secret",[1163,1317,960],{"class":1173},[1163,1319,1187],{"class":1173},[1163,1321,1322],{"class":1190},"correct horse battery staple",[1163,1324,1307],{"class":1173},[1163,1326,1291],{"class":1173},[1163,1328,1330,1333,1335,1337,1339,1341],{"class":1165,"line":1329},9,[1163,1331,1332],{"class":1280},"  classifiedStrategy",[1163,1334,960],{"class":1173},[1163,1336,1210],{"class":1268},[1163,1338,1288],{"class":1177},[1163,1340,1207],{"class":1173},[1163,1342,1344],{"class":1343},"sHwdD","   \u002F\u002F enables reveal \u002F verify \u002F verifyGroup \u002F findByDigest\n",[1163,1346,1348,1351],{"class":1165,"line":1347},10,[1163,1349,1350],{"class":1173},"}",[1163,1352,1353],{"class":1177},")\n",[1163,1355,1357],{"class":1165,"line":1356},11,[1163,1358,1249],{"emptyLinePlaceholder":1248},[1163,1360,1362,1364,1367,1369,1371,1374,1376,1379,1381,1383,1386,1388],{"class":1165,"line":1361},12,[1163,1363,1256],{"class":1255},[1163,1365,1366],{"class":1177}," vault ",[1163,1368,1262],{"class":1173},[1163,1370,1265],{"class":1169},[1163,1372,1373],{"class":1177}," db",[1163,1375,1124],{"class":1173},[1163,1377,1378],{"class":1268},"openVault",[1163,1380,1271],{"class":1177},[1163,1382,1307],{"class":1173},[1163,1384,1385],{"class":1190},"crm",[1163,1387,1307],{"class":1173},[1163,1389,1353],{"class":1177},[1163,1391,1393],{"class":1165,"line":1392},13,[1163,1394,1249],{"emptyLinePlaceholder":1248},[1163,1396,1398,1400,1403,1405,1408,1410,1413,1415,1417,1420,1422,1424],{"class":1165,"line":1397},14,[1163,1399,1256],{"class":1255},[1163,1401,1402],{"class":1177}," customers ",[1163,1404,1262],{"class":1173},[1163,1406,1407],{"class":1177}," vault",[1163,1409,1124],{"class":1173},[1163,1411,1412],{"class":1268},"collection",[1163,1414,1271],{"class":1177},[1163,1416,1307],{"class":1173},[1163,1418,1419],{"class":1190},"customers",[1163,1421,1307],{"class":1173},[1163,1423,1207],{"class":1173},[1163,1425,1426],{"class":1173}," {\n",[1163,1428,1430,1433,1435],{"class":1165,"line":1429},15,[1163,1431,1432],{"class":1280},"  classifiedFields",[1163,1434,960],{"class":1173},[1163,1436,1426],{"class":1173},[1163,1438,1440],{"class":1165,"line":1439},16,[1163,1441,1442],{"class":1343},"    \u002F\u002F A group claims several record fields with one preset (differential policy per member):\n",[1163,1444,1446,1449,1451,1453,1455,1458,1460,1463,1466,1468,1470,1473,1475,1477,1480,1482,1484,1487,1489,1491,1494,1496,1498,1501,1503,1505,1508],{"class":1165,"line":1445},17,[1163,1447,1448],{"class":1280},"    card",[1163,1450,960],{"class":1173},[1163,1452,1204],{"class":1177},[1163,1454,1124],{"class":1173},[1163,1456,1457],{"class":1268},"creditCard",[1163,1459,1271],{"class":1177},[1163,1461,1462],{"class":1173},"{",[1163,1464,1465],{"class":1280}," pan",[1163,1467,960],{"class":1173},[1163,1469,1187],{"class":1173},[1163,1471,1472],{"class":1190},"cardNumber",[1163,1474,1307],{"class":1173},[1163,1476,1207],{"class":1173},[1163,1478,1479],{"class":1280}," expiry",[1163,1481,960],{"class":1173},[1163,1483,1187],{"class":1173},[1163,1485,1486],{"class":1190},"cardExpiry",[1163,1488,1307],{"class":1173},[1163,1490,1207],{"class":1173},[1163,1492,1493],{"class":1280}," cvc",[1163,1495,960],{"class":1173},[1163,1497,1187],{"class":1173},[1163,1499,1500],{"class":1190},"cardCvc",[1163,1502,1307],{"class":1173},[1163,1504,1181],{"class":1173},[1163,1506,1507],{"class":1177},")",[1163,1509,1291],{"class":1173},[1163,1511,1513],{"class":1165,"line":1512},18,[1163,1514,1515],{"class":1343},"    \u002F\u002F A single-field entry: the key is the record field name.\n",[1163,1517,1519,1522,1524,1526,1528,1531,1533],{"class":1165,"line":1518},19,[1163,1520,1521],{"class":1280},"    email",[1163,1523,960],{"class":1173},[1163,1525,1204],{"class":1177},[1163,1527,1124],{"class":1173},[1163,1529,1530],{"class":1268},"email",[1163,1532,1288],{"class":1177},[1163,1534,1291],{"class":1173},[1163,1536,1538,1541,1543,1545,1547,1550,1552],{"class":1165,"line":1537},20,[1163,1539,1540],{"class":1280},"    dob",[1163,1542,960],{"class":1173},[1163,1544,1204],{"class":1177},[1163,1546,1124],{"class":1173},[1163,1548,1549],{"class":1268},"birthDate",[1163,1551,1288],{"class":1177},[1163,1553,1291],{"class":1173},[1163,1555,1557],{"class":1165,"line":1556},21,[1163,1558,1559],{"class":1173},"  },\n",[1163,1561,1563,1565],{"class":1165,"line":1562},22,[1163,1564,1350],{"class":1173},[1163,1566,1353],{"class":1177},[941,1568,1570],{"id":1569},"usage","Usage",[1572,1573,1575],"h3",{"id":1574},"write-time-enforcement-sealed-reads-riders","Write-time enforcement, sealed reads, riders",[946,1577,1578,1579,1582,1583,1586],{},"On ",[970,1580,1581],{},"put()",", the hub rejects ",[970,1584,1585],{},"storage:'never'"," fields, runs the preset validator, and\nmaterializes the riders — all before encryption, inside the trust boundary:",[1154,1588,1590],{"className":1156,"code":1589,"language":1158,"meta":1159,"style":1159},"await customers.put('c1', {\n  holder: 'Nok P.',\n  cardNumber: '4242424242424242',\n  cardExpiry: '12\u002F28',\n  email: 'nok@example.com',\n  dob: '1990-04-12',\n})\n\n\u002F\u002F storage:'never' refuses persistence — validate the CVC at capture, drop it before put():\nawait customers.put('c2', { cardNumber: '4242424242424242', cardCvc: '123' })\n\u002F\u002F → throws ClassifiedNeverStoredError\n\n\u002F\u002F preset validators run on every write:\nawait customers.put('c3', { cardNumber: '1234' })\n\u002F\u002F → throws ClassifiedValidationError: not a Luhn-valid card number\n\nconst record = await customers.get('c1')\n",[970,1591,1592,1618,1634,1650,1666,1682,1698,1704,1708,1713,1765,1770,1774,1779,1817,1822,1826],{"__ignoreMap":1159},[1163,1593,1594,1597,1600,1602,1605,1607,1609,1612,1614,1616],{"class":1165,"line":1166},[1163,1595,1596],{"class":1169},"await",[1163,1598,1599],{"class":1177}," customers",[1163,1601,1124],{"class":1173},[1163,1603,1604],{"class":1268},"put",[1163,1606,1271],{"class":1177},[1163,1608,1307],{"class":1173},[1163,1610,1611],{"class":1190},"c1",[1163,1613,1307],{"class":1173},[1163,1615,1207],{"class":1173},[1163,1617,1426],{"class":1173},[1163,1619,1620,1623,1625,1627,1630,1632],{"class":1165,"line":1197},[1163,1621,1622],{"class":1280},"  holder",[1163,1624,960],{"class":1173},[1163,1626,1187],{"class":1173},[1163,1628,1629],{"class":1190},"Nok P.",[1163,1631,1307],{"class":1173},[1163,1633,1291],{"class":1173},[1163,1635,1636,1639,1641,1643,1646,1648],{"class":1165,"line":1224},[1163,1637,1638],{"class":1280},"  cardNumber",[1163,1640,960],{"class":1173},[1163,1642,1187],{"class":1173},[1163,1644,1645],{"class":1190},"4242424242424242",[1163,1647,1307],{"class":1173},[1163,1649,1291],{"class":1173},[1163,1651,1652,1655,1657,1659,1662,1664],{"class":1165,"line":1245},[1163,1653,1654],{"class":1280},"  cardExpiry",[1163,1656,960],{"class":1173},[1163,1658,1187],{"class":1173},[1163,1660,1661],{"class":1190},"12\u002F28",[1163,1663,1307],{"class":1173},[1163,1665,1291],{"class":1173},[1163,1667,1668,1671,1673,1675,1678,1680],{"class":1165,"line":1252},[1163,1669,1670],{"class":1280},"  email",[1163,1672,960],{"class":1173},[1163,1674,1187],{"class":1173},[1163,1676,1677],{"class":1190},"nok@example.com",[1163,1679,1307],{"class":1173},[1163,1681,1291],{"class":1173},[1163,1683,1684,1687,1689,1691,1694,1696],{"class":1165,"line":1277},[1163,1685,1686],{"class":1280},"  dob",[1163,1688,960],{"class":1173},[1163,1690,1187],{"class":1173},[1163,1692,1693],{"class":1190},"1990-04-12",[1163,1695,1307],{"class":1173},[1163,1697,1291],{"class":1173},[1163,1699,1700,1702],{"class":1165,"line":1294},[1163,1701,1350],{"class":1173},[1163,1703,1353],{"class":1177},[1163,1705,1706],{"class":1165,"line":1312},[1163,1707,1249],{"emptyLinePlaceholder":1248},[1163,1709,1710],{"class":1165,"line":1329},[1163,1711,1712],{"class":1343},"\u002F\u002F storage:'never' refuses persistence — validate the CVC at capture, drop it before put():\n",[1163,1714,1715,1717,1719,1721,1723,1725,1727,1730,1732,1734,1736,1739,1741,1743,1745,1747,1749,1752,1754,1756,1759,1761,1763],{"class":1165,"line":1347},[1163,1716,1596],{"class":1169},[1163,1718,1599],{"class":1177},[1163,1720,1124],{"class":1173},[1163,1722,1604],{"class":1268},[1163,1724,1271],{"class":1177},[1163,1726,1307],{"class":1173},[1163,1728,1729],{"class":1190},"c2",[1163,1731,1307],{"class":1173},[1163,1733,1207],{"class":1173},[1163,1735,1174],{"class":1173},[1163,1737,1738],{"class":1280}," cardNumber",[1163,1740,960],{"class":1173},[1163,1742,1187],{"class":1173},[1163,1744,1645],{"class":1190},[1163,1746,1307],{"class":1173},[1163,1748,1207],{"class":1173},[1163,1750,1751],{"class":1280}," cardCvc",[1163,1753,960],{"class":1173},[1163,1755,1187],{"class":1173},[1163,1757,1758],{"class":1190},"123",[1163,1760,1307],{"class":1173},[1163,1762,1181],{"class":1173},[1163,1764,1353],{"class":1177},[1163,1766,1767],{"class":1165,"line":1356},[1163,1768,1769],{"class":1343},"\u002F\u002F → throws ClassifiedNeverStoredError\n",[1163,1771,1772],{"class":1165,"line":1361},[1163,1773,1249],{"emptyLinePlaceholder":1248},[1163,1775,1776],{"class":1165,"line":1392},[1163,1777,1778],{"class":1343},"\u002F\u002F preset validators run on every write:\n",[1163,1780,1781,1783,1785,1787,1789,1791,1793,1796,1798,1800,1802,1804,1806,1808,1811,1813,1815],{"class":1165,"line":1397},[1163,1782,1596],{"class":1169},[1163,1784,1599],{"class":1177},[1163,1786,1124],{"class":1173},[1163,1788,1604],{"class":1268},[1163,1790,1271],{"class":1177},[1163,1792,1307],{"class":1173},[1163,1794,1795],{"class":1190},"c3",[1163,1797,1307],{"class":1173},[1163,1799,1207],{"class":1173},[1163,1801,1174],{"class":1173},[1163,1803,1738],{"class":1280},[1163,1805,960],{"class":1173},[1163,1807,1187],{"class":1173},[1163,1809,1810],{"class":1190},"1234",[1163,1812,1307],{"class":1173},[1163,1814,1181],{"class":1173},[1163,1816,1353],{"class":1177},[1163,1818,1819],{"class":1165,"line":1429},[1163,1820,1821],{"class":1343},"\u002F\u002F → throws ClassifiedValidationError: not a Luhn-valid card number\n",[1163,1823,1824],{"class":1165,"line":1439},[1163,1825,1249],{"emptyLinePlaceholder":1248},[1163,1827,1828,1830,1833,1835,1837,1839,1841,1844,1846,1848,1850,1852],{"class":1165,"line":1445},[1163,1829,1256],{"class":1255},[1163,1831,1832],{"class":1177}," record ",[1163,1834,1262],{"class":1173},[1163,1836,1265],{"class":1169},[1163,1838,1599],{"class":1177},[1163,1840,1124],{"class":1173},[1163,1842,1843],{"class":1268},"get",[1163,1845,1271],{"class":1177},[1163,1847,1307],{"class":1173},[1163,1849,1611],{"class":1190},[1163,1851,1307],{"class":1173},[1163,1853,1353],{"class":1177},[1154,1855,1858],{"className":1856,"code":1857,"language":141,"meta":1159,"style":1159},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"holder\": \"Nok P.\",\n  \"cardNumber\": \"[sealed]\",\n  \"cardExpiry\": \"[sealed]\",\n  \"email\": \"[sealed]\",\n  \"dob\": \"[sealed]\",\n  \"cardNumber_last4\": \"4242\",\n  \"cardNumber_bin\": \"424242\",\n  \"email_domain\": \"example.com\",\n  \"dob_yob\": \"1990\"\n}\n",[970,1859,1860,1864,1886,1905,1923,1941,1960,1979,1999,2018,2037],{"__ignoreMap":1159},[1163,1861,1862],{"class":1165,"line":1166},[1163,1863,1274],{"class":1173},[1163,1865,1866,1869,1872,1875,1877,1880,1882,1884],{"class":1165,"line":1197},[1163,1867,1868],{"class":1173},"  \"",[1163,1870,1871],{"class":1255},"holder",[1163,1873,1874],{"class":1173},"\"",[1163,1876,960],{"class":1173},[1163,1878,1879],{"class":1173}," \"",[1163,1881,1629],{"class":1190},[1163,1883,1874],{"class":1173},[1163,1885,1291],{"class":1173},[1163,1887,1888,1890,1892,1894,1896,1898,1901,1903],{"class":1165,"line":1224},[1163,1889,1868],{"class":1173},[1163,1891,1472],{"class":1255},[1163,1893,1874],{"class":1173},[1163,1895,960],{"class":1173},[1163,1897,1879],{"class":1173},[1163,1899,1900],{"class":1190},"[sealed]",[1163,1902,1874],{"class":1173},[1163,1904,1291],{"class":1173},[1163,1906,1907,1909,1911,1913,1915,1917,1919,1921],{"class":1165,"line":1245},[1163,1908,1868],{"class":1173},[1163,1910,1486],{"class":1255},[1163,1912,1874],{"class":1173},[1163,1914,960],{"class":1173},[1163,1916,1879],{"class":1173},[1163,1918,1900],{"class":1190},[1163,1920,1874],{"class":1173},[1163,1922,1291],{"class":1173},[1163,1924,1925,1927,1929,1931,1933,1935,1937,1939],{"class":1165,"line":1252},[1163,1926,1868],{"class":1173},[1163,1928,1530],{"class":1255},[1163,1930,1874],{"class":1173},[1163,1932,960],{"class":1173},[1163,1934,1879],{"class":1173},[1163,1936,1900],{"class":1190},[1163,1938,1874],{"class":1173},[1163,1940,1291],{"class":1173},[1163,1942,1943,1945,1948,1950,1952,1954,1956,1958],{"class":1165,"line":1277},[1163,1944,1868],{"class":1173},[1163,1946,1947],{"class":1255},"dob",[1163,1949,1874],{"class":1173},[1163,1951,960],{"class":1173},[1163,1953,1879],{"class":1173},[1163,1955,1900],{"class":1190},[1163,1957,1874],{"class":1173},[1163,1959,1291],{"class":1173},[1163,1961,1962,1964,1966,1968,1970,1972,1975,1977],{"class":1165,"line":1294},[1163,1963,1868],{"class":1173},[1163,1965,1020],{"class":1255},[1163,1967,1874],{"class":1173},[1163,1969,960],{"class":1173},[1163,1971,1879],{"class":1173},[1163,1973,1974],{"class":1190},"4242",[1163,1976,1874],{"class":1173},[1163,1978,1291],{"class":1173},[1163,1980,1981,1983,1986,1988,1990,1992,1995,1997],{"class":1165,"line":1312},[1163,1982,1868],{"class":1173},[1163,1984,1985],{"class":1255},"cardNumber_bin",[1163,1987,1874],{"class":1173},[1163,1989,960],{"class":1173},[1163,1991,1879],{"class":1173},[1163,1993,1994],{"class":1190},"424242",[1163,1996,1874],{"class":1173},[1163,1998,1291],{"class":1173},[1163,2000,2001,2003,2005,2007,2009,2011,2014,2016],{"class":1165,"line":1329},[1163,2002,1868],{"class":1173},[1163,2004,1024],{"class":1255},[1163,2006,1874],{"class":1173},[1163,2008,960],{"class":1173},[1163,2010,1879],{"class":1173},[1163,2012,2013],{"class":1190},"example.com",[1163,2015,1874],{"class":1173},[1163,2017,1291],{"class":1173},[1163,2019,2020,2022,2025,2027,2029,2031,2034],{"class":1165,"line":1347},[1163,2021,1868],{"class":1173},[1163,2023,2024],{"class":1255},"dob_yob",[1163,2026,1874],{"class":1173},[1163,2028,960],{"class":1173},[1163,2030,1879],{"class":1173},[1163,2032,2033],{"class":1190},"1990",[1163,2035,2036],{"class":1173},"\"\n",[1163,2038,2039],{"class":1165,"line":1356},[1163,2040,2041],{"class":1173},"}\n",[946,2043,2044,2045,2047],{},"The recoverable values come back as sealed handles (shown here as their ",[970,2046,984],{},"\nJSON form); the riders are ordinary plain fields you can display, query, and index.",[946,2049,2050,2051,2053,2054,2057,2058,2061,2062,2064,2065,2068],{},"The declared ",[950,2052,1028],{}," (mask \u002F omit \u002F rider) is a contract, not automatic\nredaction: kernel reads return sealed handles + riders as above, and\n",[970,2055,2056],{},"collection.describe()"," serializes each field's projection so UI layers know what to\nrender. ",[970,2059,2060],{},"applyListProjection"," (exported from ",[970,2063,1191],{},") is the vetted helper that\napplies it — the ",[970,2066,2067],{},"as-*"," exporters use the same function:",[1154,2070,2072],{"className":1156,"code":2071,"language":1158,"meta":1159,"style":1159},"import { applyListProjection } from '@noy-db\u002Fhub'\n\nconst row = applyListProjection(customers.describe(), record)\n",[970,2073,2074,2093,2097],{"__ignoreMap":1159},[1163,2075,2076,2078,2080,2083,2085,2087,2089,2091],{"class":1165,"line":1166},[1163,2077,1170],{"class":1169},[1163,2079,1174],{"class":1173},[1163,2081,2082],{"class":1177}," applyListProjection",[1163,2084,1181],{"class":1173},[1163,2086,1184],{"class":1169},[1163,2088,1187],{"class":1173},[1163,2090,1191],{"class":1190},[1163,2092,1194],{"class":1173},[1163,2094,2095],{"class":1165,"line":1197},[1163,2096,1249],{"emptyLinePlaceholder":1248},[1163,2098,2099,2101,2104,2106,2108,2111,2113,2116,2118,2120],{"class":1165,"line":1224},[1163,2100,1256],{"class":1255},[1163,2102,2103],{"class":1177}," row ",[1163,2105,1262],{"class":1173},[1163,2107,2082],{"class":1268},[1163,2109,2110],{"class":1177},"(customers",[1163,2112,1124],{"class":1173},[1163,2114,2115],{"class":1268},"describe",[1163,2117,1288],{"class":1177},[1163,2119,1207],{"class":1173},[1163,2121,2122],{"class":1177}," record)\n",[1154,2124,2126],{"className":1856,"code":2125,"language":141,"meta":1159,"style":1159},"{\n  \"holder\": \"Nok P.\",\n  \"cardNumber\": \"•••• 4242\",\n  \"cardExpiry\": \"••\u002F••\",\n  \"email\": \"•••@example.com\",\n  \"dob\": \"1990-••-••\",\n  \"cardNumber_last4\": \"4242\",\n  \"cardNumber_bin\": \"424242\",\n  \"email_domain\": \"example.com\",\n  \"dob_yob\": \"1990\"\n}\n",[970,2127,2128,2132,2150,2169,2188,2207,2226,2244,2262,2280,2296],{"__ignoreMap":1159},[1163,2129,2130],{"class":1165,"line":1166},[1163,2131,1274],{"class":1173},[1163,2133,2134,2136,2138,2140,2142,2144,2146,2148],{"class":1165,"line":1197},[1163,2135,1868],{"class":1173},[1163,2137,1871],{"class":1255},[1163,2139,1874],{"class":1173},[1163,2141,960],{"class":1173},[1163,2143,1879],{"class":1173},[1163,2145,1629],{"class":1190},[1163,2147,1874],{"class":1173},[1163,2149,1291],{"class":1173},[1163,2151,2152,2154,2156,2158,2160,2162,2165,2167],{"class":1165,"line":1224},[1163,2153,1868],{"class":1173},[1163,2155,1472],{"class":1255},[1163,2157,1874],{"class":1173},[1163,2159,960],{"class":1173},[1163,2161,1879],{"class":1173},[1163,2163,2164],{"class":1190},"•••• 4242",[1163,2166,1874],{"class":1173},[1163,2168,1291],{"class":1173},[1163,2170,2171,2173,2175,2177,2179,2181,2184,2186],{"class":1165,"line":1245},[1163,2172,1868],{"class":1173},[1163,2174,1486],{"class":1255},[1163,2176,1874],{"class":1173},[1163,2178,960],{"class":1173},[1163,2180,1879],{"class":1173},[1163,2182,2183],{"class":1190},"••\u002F••",[1163,2185,1874],{"class":1173},[1163,2187,1291],{"class":1173},[1163,2189,2190,2192,2194,2196,2198,2200,2203,2205],{"class":1165,"line":1252},[1163,2191,1868],{"class":1173},[1163,2193,1530],{"class":1255},[1163,2195,1874],{"class":1173},[1163,2197,960],{"class":1173},[1163,2199,1879],{"class":1173},[1163,2201,2202],{"class":1190},"•••@example.com",[1163,2204,1874],{"class":1173},[1163,2206,1291],{"class":1173},[1163,2208,2209,2211,2213,2215,2217,2219,2222,2224],{"class":1165,"line":1277},[1163,2210,1868],{"class":1173},[1163,2212,1947],{"class":1255},[1163,2214,1874],{"class":1173},[1163,2216,960],{"class":1173},[1163,2218,1879],{"class":1173},[1163,2220,2221],{"class":1190},"1990-••-••",[1163,2223,1874],{"class":1173},[1163,2225,1291],{"class":1173},[1163,2227,2228,2230,2232,2234,2236,2238,2240,2242],{"class":1165,"line":1294},[1163,2229,1868],{"class":1173},[1163,2231,1020],{"class":1255},[1163,2233,1874],{"class":1173},[1163,2235,960],{"class":1173},[1163,2237,1879],{"class":1173},[1163,2239,1974],{"class":1190},[1163,2241,1874],{"class":1173},[1163,2243,1291],{"class":1173},[1163,2245,2246,2248,2250,2252,2254,2256,2258,2260],{"class":1165,"line":1312},[1163,2247,1868],{"class":1173},[1163,2249,1985],{"class":1255},[1163,2251,1874],{"class":1173},[1163,2253,960],{"class":1173},[1163,2255,1879],{"class":1173},[1163,2257,1994],{"class":1190},[1163,2259,1874],{"class":1173},[1163,2261,1291],{"class":1173},[1163,2263,2264,2266,2268,2270,2272,2274,2276,2278],{"class":1165,"line":1329},[1163,2265,1868],{"class":1173},[1163,2267,1024],{"class":1255},[1163,2269,1874],{"class":1173},[1163,2271,960],{"class":1173},[1163,2273,1879],{"class":1173},[1163,2275,2013],{"class":1190},[1163,2277,1874],{"class":1173},[1163,2279,1291],{"class":1173},[1163,2281,2282,2284,2286,2288,2290,2292,2294],{"class":1165,"line":1347},[1163,2283,1868],{"class":1173},[1163,2285,2024],{"class":1255},[1163,2287,1874],{"class":1173},[1163,2289,960],{"class":1173},[1163,2291,1879],{"class":1173},[1163,2293,2033],{"class":1190},[1163,2295,2036],{"class":1173},[1163,2297,2298],{"class":1165,"line":1356},[1163,2299,2041],{"class":1173},[1572,2301,2303],{"id":2302},"audited-reveal","Audited reveal",[946,2305,2306,2308],{},[970,2307,976],{}," is the single deliberate path from a sealed field back to plaintext. It\ndecrypts one field of one record, and refuses everything that has nothing to reveal:",[1154,2310,2312],{"className":1156,"code":2311,"language":1158,"meta":1159,"style":1159},"await customers.reveal('c1', 'cardNumber')   \u002F\u002F → '4242424242424242'\n\nawait customers.reveal('c1', 'cardCvc')      \u002F\u002F rejects: ClassifiedRevealError — storage:'never', nothing stored\nawait customers.reveal('c1', 'nope')         \u002F\u002F rejects: ClassifiedRevealError — field is not classified\n",[970,2313,2314,2346,2350,2382],{"__ignoreMap":1159},[1163,2315,2316,2318,2320,2322,2324,2326,2328,2330,2332,2334,2336,2338,2340,2343],{"class":1165,"line":1166},[1163,2317,1596],{"class":1169},[1163,2319,1599],{"class":1177},[1163,2321,1124],{"class":1173},[1163,2323,1137],{"class":1268},[1163,2325,1271],{"class":1177},[1163,2327,1307],{"class":1173},[1163,2329,1611],{"class":1190},[1163,2331,1307],{"class":1173},[1163,2333,1207],{"class":1173},[1163,2335,1187],{"class":1173},[1163,2337,1472],{"class":1190},[1163,2339,1307],{"class":1173},[1163,2341,2342],{"class":1177},")   ",[1163,2344,2345],{"class":1343},"\u002F\u002F → '4242424242424242'\n",[1163,2347,2348],{"class":1165,"line":1197},[1163,2349,1249],{"emptyLinePlaceholder":1248},[1163,2351,2352,2354,2356,2358,2360,2362,2364,2366,2368,2370,2372,2374,2376,2379],{"class":1165,"line":1224},[1163,2353,1596],{"class":1169},[1163,2355,1599],{"class":1177},[1163,2357,1124],{"class":1173},[1163,2359,1137],{"class":1268},[1163,2361,1271],{"class":1177},[1163,2363,1307],{"class":1173},[1163,2365,1611],{"class":1190},[1163,2367,1307],{"class":1173},[1163,2369,1207],{"class":1173},[1163,2371,1187],{"class":1173},[1163,2373,1500],{"class":1190},[1163,2375,1307],{"class":1173},[1163,2377,2378],{"class":1177},")      ",[1163,2380,2381],{"class":1343},"\u002F\u002F rejects: ClassifiedRevealError — storage:'never', nothing stored\n",[1163,2383,2384,2386,2388,2390,2392,2394,2396,2398,2400,2402,2404,2407,2409,2412],{"class":1165,"line":1245},[1163,2385,1596],{"class":1169},[1163,2387,1599],{"class":1177},[1163,2389,1124],{"class":1173},[1163,2391,1137],{"class":1268},[1163,2393,1271],{"class":1177},[1163,2395,1307],{"class":1173},[1163,2397,1611],{"class":1190},[1163,2399,1307],{"class":1173},[1163,2401,1207],{"class":1173},[1163,2403,1187],{"class":1173},[1163,2405,2406],{"class":1190},"nope",[1163,2408,1307],{"class":1173},[1163,2410,2411],{"class":1177},")         ",[1163,2413,2414],{"class":1343},"\u002F\u002F rejects: ClassifiedRevealError — field is not classified\n",[946,2416,2417,2418,2420,2421,2423,2424,2426,2427,2429],{},"When the ",[1038,2419,641],{"href":642}," service is enabled, each ",[970,2422,976],{}," records\nexactly one ",[970,2425,1137],{}," entry in the consent audit trail (and no extra ",[970,2428,1843],{}," entry), so\n\"who looked at the full card number, when, and why\" is answerable.",[1572,2431,2433],{"id":2432},"verify-without-reveal","Verify without reveal",[946,2435,2436,2437,2440,2441,2443],{},"Digest-only fields are a verdict-only oracle: you can ask \"is this candidate the stored\nvalue?\" but never \"what is the stored value?\". Digest-only storage requires an\nencrypted collection with ",[970,2438,2439],{},"perRecordKeys: true"," — the digest keys derive from the\nper-record key, so ",[1038,2442,685],{"href":686}," shreds them.",[1154,2445,2447],{"className":1156,"code":2446,"language":1158,"meta":1159,"style":1159},"const users = vault.collection('users', {\n  perRecordKeys: true,                      \u002F\u002F required for digest-only fields\n  classifiedFields: {\n    password: classified.password({ minLength: 12, rotateDays: 90, notLastN: 3 }),\n    petName: classified.secretAnswer(),\n    firstSchool: classified.secretAnswer(),\n  },\n})\n\nawait users.put('u1', {\n  password: 'correct-horse-battery',\n  petName: 'Rex',\n  firstSchool: 'Wat Suan Dok',\n})\n\nawait users.verify('u1', 'password', 'correct-horse-battery')   \u002F\u002F → { ok: true }\nawait users.verify('u1', 'password', 'wrong-guess-1234')        \u002F\u002F → { ok: false }\n",[970,2448,2449,2477,2493,2501,2553,2571,2588,2592,2598,2602,2626,2642,2658,2674,2680,2684,2723],{"__ignoreMap":1159},[1163,2450,2451,2453,2456,2458,2460,2462,2464,2466,2468,2471,2473,2475],{"class":1165,"line":1166},[1163,2452,1256],{"class":1255},[1163,2454,2455],{"class":1177}," users ",[1163,2457,1262],{"class":1173},[1163,2459,1407],{"class":1177},[1163,2461,1124],{"class":1173},[1163,2463,1412],{"class":1268},[1163,2465,1271],{"class":1177},[1163,2467,1307],{"class":1173},[1163,2469,2470],{"class":1190},"users",[1163,2472,1307],{"class":1173},[1163,2474,1207],{"class":1173},[1163,2476,1426],{"class":1173},[1163,2478,2479,2482,2484,2488,2490],{"class":1165,"line":1197},[1163,2480,2481],{"class":1280},"  perRecordKeys",[1163,2483,960],{"class":1173},[1163,2485,2487],{"class":2486},"sfNiH"," true",[1163,2489,1207],{"class":1173},[1163,2491,2492],{"class":1343},"                      \u002F\u002F required for digest-only fields\n",[1163,2494,2495,2497,2499],{"class":1165,"line":1224},[1163,2496,1432],{"class":1280},[1163,2498,960],{"class":1173},[1163,2500,1426],{"class":1173},[1163,2502,2503,2506,2508,2510,2512,2514,2516,2518,2521,2523,2527,2529,2532,2534,2537,2539,2542,2544,2547,2549,2551],{"class":1165,"line":1245},[1163,2504,2505],{"class":1280},"    password",[1163,2507,960],{"class":1173},[1163,2509,1204],{"class":1177},[1163,2511,1124],{"class":1173},[1163,2513,313],{"class":1268},[1163,2515,1271],{"class":1177},[1163,2517,1462],{"class":1173},[1163,2519,2520],{"class":1280}," minLength",[1163,2522,960],{"class":1173},[1163,2524,2526],{"class":2525},"sbssI"," 12",[1163,2528,1207],{"class":1173},[1163,2530,2531],{"class":1280}," rotateDays",[1163,2533,960],{"class":1173},[1163,2535,2536],{"class":2525}," 90",[1163,2538,1207],{"class":1173},[1163,2540,2541],{"class":1280}," notLastN",[1163,2543,960],{"class":1173},[1163,2545,2546],{"class":2525}," 3",[1163,2548,1181],{"class":1173},[1163,2550,1507],{"class":1177},[1163,2552,1291],{"class":1173},[1163,2554,2555,2558,2560,2562,2564,2567,2569],{"class":1165,"line":1252},[1163,2556,2557],{"class":1280},"    petName",[1163,2559,960],{"class":1173},[1163,2561,1204],{"class":1177},[1163,2563,1124],{"class":1173},[1163,2565,2566],{"class":1268},"secretAnswer",[1163,2568,1288],{"class":1177},[1163,2570,1291],{"class":1173},[1163,2572,2573,2576,2578,2580,2582,2584,2586],{"class":1165,"line":1277},[1163,2574,2575],{"class":1280},"    firstSchool",[1163,2577,960],{"class":1173},[1163,2579,1204],{"class":1177},[1163,2581,1124],{"class":1173},[1163,2583,2566],{"class":1268},[1163,2585,1288],{"class":1177},[1163,2587,1291],{"class":1173},[1163,2589,2590],{"class":1165,"line":1294},[1163,2591,1559],{"class":1173},[1163,2593,2594,2596],{"class":1165,"line":1312},[1163,2595,1350],{"class":1173},[1163,2597,1353],{"class":1177},[1163,2599,2600],{"class":1165,"line":1329},[1163,2601,1249],{"emptyLinePlaceholder":1248},[1163,2603,2604,2606,2609,2611,2613,2615,2617,2620,2622,2624],{"class":1165,"line":1347},[1163,2605,1596],{"class":1169},[1163,2607,2608],{"class":1177}," users",[1163,2610,1124],{"class":1173},[1163,2612,1604],{"class":1268},[1163,2614,1271],{"class":1177},[1163,2616,1307],{"class":1173},[1163,2618,2619],{"class":1190},"u1",[1163,2621,1307],{"class":1173},[1163,2623,1207],{"class":1173},[1163,2625,1426],{"class":1173},[1163,2627,2628,2631,2633,2635,2638,2640],{"class":1165,"line":1356},[1163,2629,2630],{"class":1280},"  password",[1163,2632,960],{"class":1173},[1163,2634,1187],{"class":1173},[1163,2636,2637],{"class":1190},"correct-horse-battery",[1163,2639,1307],{"class":1173},[1163,2641,1291],{"class":1173},[1163,2643,2644,2647,2649,2651,2654,2656],{"class":1165,"line":1361},[1163,2645,2646],{"class":1280},"  petName",[1163,2648,960],{"class":1173},[1163,2650,1187],{"class":1173},[1163,2652,2653],{"class":1190},"Rex",[1163,2655,1307],{"class":1173},[1163,2657,1291],{"class":1173},[1163,2659,2660,2663,2665,2667,2670,2672],{"class":1165,"line":1392},[1163,2661,2662],{"class":1280},"  firstSchool",[1163,2664,960],{"class":1173},[1163,2666,1187],{"class":1173},[1163,2668,2669],{"class":1190},"Wat Suan Dok",[1163,2671,1307],{"class":1173},[1163,2673,1291],{"class":1173},[1163,2675,2676,2678],{"class":1165,"line":1397},[1163,2677,1350],{"class":1173},[1163,2679,1353],{"class":1177},[1163,2681,2682],{"class":1165,"line":1429},[1163,2683,1249],{"emptyLinePlaceholder":1248},[1163,2685,2686,2688,2690,2692,2694,2696,2698,2700,2702,2704,2706,2708,2710,2712,2714,2716,2718,2720],{"class":1165,"line":1439},[1163,2687,1596],{"class":1169},[1163,2689,2608],{"class":1177},[1163,2691,1124],{"class":1173},[1163,2693,997],{"class":1268},[1163,2695,1271],{"class":1177},[1163,2697,1307],{"class":1173},[1163,2699,2619],{"class":1190},[1163,2701,1307],{"class":1173},[1163,2703,1207],{"class":1173},[1163,2705,1187],{"class":1173},[1163,2707,313],{"class":1190},[1163,2709,1307],{"class":1173},[1163,2711,1207],{"class":1173},[1163,2713,1187],{"class":1173},[1163,2715,2637],{"class":1190},[1163,2717,1307],{"class":1173},[1163,2719,2342],{"class":1177},[1163,2721,2722],{"class":1343},"\u002F\u002F → { ok: true }\n",[1163,2724,2725,2727,2729,2731,2733,2735,2737,2739,2741,2743,2745,2747,2749,2751,2753,2756,2758,2761],{"class":1165,"line":1445},[1163,2726,1596],{"class":1169},[1163,2728,2608],{"class":1177},[1163,2730,1124],{"class":1173},[1163,2732,997],{"class":1268},[1163,2734,1271],{"class":1177},[1163,2736,1307],{"class":1173},[1163,2738,2619],{"class":1190},[1163,2740,1307],{"class":1173},[1163,2742,1207],{"class":1173},[1163,2744,1187],{"class":1173},[1163,2746,313],{"class":1190},[1163,2748,1307],{"class":1173},[1163,2750,1207],{"class":1173},[1163,2752,1187],{"class":1173},[1163,2754,2755],{"class":1190},"wrong-guess-1234",[1163,2757,1307],{"class":1173},[1163,2759,2760],{"class":1177},")        ",[1163,2762,2763],{"class":1343},"\u002F\u002F → { ok: false }\n",[946,2765,2766,2767,2770,2771,2774,2775,2778,2779,2782,2783,1124],{},"The verdict is bare — a failure carries no detail an attacker could use. When the\npreset declares ",[970,2768,2769],{},"rotateDays",", an ",[970,2772,2773],{},"ok: true"," verdict past the deadline additionally\ncarries ",[970,2776,2777],{},"mustRotate: true"," (never computed for a failed verdict). With ",[970,2780,2781],{},"notLastN",",\nrewriting the field to one of its last N values throws ",[970,2784,2785],{},"ClassifiedRotationError",[946,2787,2788,2789,2791,2792,2794],{},"Secret answers normalize before digesting (casefold, trim, whitespace-collapse), and\n",[970,2790,1142],{}," runs a k-of-n challenge over all ",[970,2793,2566],{}," members in one call:",[1154,2796,2798],{"className":1156,"code":2797,"language":1158,"meta":1159,"style":1159},"await users.verifyGroup('u1', { petName: 'rex', firstSchool: 'nope' }, { min: 1 })\n\u002F\u002F → { passed: true }   ('rex' matches 'Rex' after normalization)\n\nawait users.verifyGroup('u1', { petName: 'rex', firstSchool: 'nope' }, { min: 2 })\n\u002F\u002F → { passed: false }\n",[970,2799,2800,2864,2869,2873,2932],{"__ignoreMap":1159},[1163,2801,2802,2804,2806,2808,2810,2812,2814,2816,2818,2820,2822,2825,2827,2829,2832,2834,2836,2839,2841,2843,2845,2847,2850,2852,2855,2857,2860,2862],{"class":1165,"line":1166},[1163,2803,1596],{"class":1169},[1163,2805,2608],{"class":1177},[1163,2807,1124],{"class":1173},[1163,2809,1142],{"class":1268},[1163,2811,1271],{"class":1177},[1163,2813,1307],{"class":1173},[1163,2815,2619],{"class":1190},[1163,2817,1307],{"class":1173},[1163,2819,1207],{"class":1173},[1163,2821,1174],{"class":1173},[1163,2823,2824],{"class":1280}," petName",[1163,2826,960],{"class":1173},[1163,2828,1187],{"class":1173},[1163,2830,2831],{"class":1190},"rex",[1163,2833,1307],{"class":1173},[1163,2835,1207],{"class":1173},[1163,2837,2838],{"class":1280}," firstSchool",[1163,2840,960],{"class":1173},[1163,2842,1187],{"class":1173},[1163,2844,2406],{"class":1190},[1163,2846,1307],{"class":1173},[1163,2848,2849],{"class":1173}," },",[1163,2851,1174],{"class":1173},[1163,2853,2854],{"class":1280}," min",[1163,2856,960],{"class":1173},[1163,2858,2859],{"class":2525}," 1",[1163,2861,1181],{"class":1173},[1163,2863,1353],{"class":1177},[1163,2865,2866],{"class":1165,"line":1197},[1163,2867,2868],{"class":1343},"\u002F\u002F → { passed: true }   ('rex' matches 'Rex' after normalization)\n",[1163,2870,2871],{"class":1165,"line":1224},[1163,2872,1249],{"emptyLinePlaceholder":1248},[1163,2874,2875,2877,2879,2881,2883,2885,2887,2889,2891,2893,2895,2897,2899,2901,2903,2905,2907,2909,2911,2913,2915,2917,2919,2921,2923,2925,2928,2930],{"class":1165,"line":1245},[1163,2876,1596],{"class":1169},[1163,2878,2608],{"class":1177},[1163,2880,1124],{"class":1173},[1163,2882,1142],{"class":1268},[1163,2884,1271],{"class":1177},[1163,2886,1307],{"class":1173},[1163,2888,2619],{"class":1190},[1163,2890,1307],{"class":1173},[1163,2892,1207],{"class":1173},[1163,2894,1174],{"class":1173},[1163,2896,2824],{"class":1280},[1163,2898,960],{"class":1173},[1163,2900,1187],{"class":1173},[1163,2902,2831],{"class":1190},[1163,2904,1307],{"class":1173},[1163,2906,1207],{"class":1173},[1163,2908,2838],{"class":1280},[1163,2910,960],{"class":1173},[1163,2912,1187],{"class":1173},[1163,2914,2406],{"class":1190},[1163,2916,1307],{"class":1173},[1163,2918,2849],{"class":1173},[1163,2920,1174],{"class":1173},[1163,2922,2854],{"class":1280},[1163,2924,960],{"class":1173},[1163,2926,2927],{"class":2525}," 2",[1163,2929,1181],{"class":1173},[1163,2931,1353],{"class":1177},[1163,2933,2934],{"class":1165,"line":1252},[1163,2935,2936],{"class":1343},"\u002F\u002F → { passed: false }\n",[946,2938,2939,2941,2942,2944],{},[970,2940,1001],{}," also works on ",[995,2943,972],{}," fields — it routes through a normalized\nplaintext comparison inside the hub, so you can confirm \"is this the email we have on\nfile?\" without revealing it.",[946,2946,2947,2948,2950,2951,2953,2954,2957,2958,2960,2961,2964],{},"With ",[1038,2949,641],{"href":642}," enabled, every ",[970,2952,1001],{}," and every ",[970,2955,2956],{},"verifyGroup()","\ncall records exactly one ",[970,2959,997],{}," audit entry — on success ",[950,2962,2963],{},"and"," failure, and one per\ngroup call, never one per member (attempt auditing without a member-count oracle).",[1572,2966,2968],{"id":2967},"find-by-digest-equatable-blind-index","Find by digest (equatable blind index)",[946,2970,2971,2972,2975,2976,2979,2980,2983,2984,2987,2988,2991,2992,2994,2995,960],{},"By default, equal digest-only values are ",[950,2973,2974],{},"not"," correlatable — each write is salted.\nA field can opt into an ",[950,2977,2978],{},"equatable blind index",": an extra store-visible tag\n(",[970,2981,2982],{},"_bidx",") that is equal exactly when the values are equal, which makes\n",[970,2985,2986],{},"findByDigest(field, candidate)"," possible — \"which records hold this secret?\" without\nstoring the secret. It is a double door: the field declares ",[970,2989,2990],{},"equatable: true"," ",[995,2993,2963],{}," the\ncollection must open ",[970,2996,1110],{},[1154,2998,3000],{"className":1156,"code":2999,"language":1158,"meta":1159,"style":1159},"const invites = vault.collection('invites', {\n  perRecordKeys: true,\n  acknowledgeEquatableRisk: true,           \u002F\u002F the collection-level door — see the warning below\n  classifiedFields: {\n    inviteCode: classified.password({ equatable: true }),\n  },\n})\n\nawait invites.put('r1', { inviteCode: 'invite-r1-secret-xyz' })\nawait invites.put('r2', { inviteCode: 'invite-r2-secret-abc' })\n\nawait invites.findByDigest('inviteCode', 'invite-r1-secret-xyz')  \u002F\u002F → ['r1']\nawait invites.findByDigest('inviteCode', 'not-a-real-code-00')    \u002F\u002F → []\n",[970,3001,3002,3030,3040,3054,3062,3092,3096,3102,3106,3146,3184,3188,3221],{"__ignoreMap":1159},[1163,3003,3004,3006,3009,3011,3013,3015,3017,3019,3021,3024,3026,3028],{"class":1165,"line":1166},[1163,3005,1256],{"class":1255},[1163,3007,3008],{"class":1177}," invites ",[1163,3010,1262],{"class":1173},[1163,3012,1407],{"class":1177},[1163,3014,1124],{"class":1173},[1163,3016,1412],{"class":1268},[1163,3018,1271],{"class":1177},[1163,3020,1307],{"class":1173},[1163,3022,3023],{"class":1190},"invites",[1163,3025,1307],{"class":1173},[1163,3027,1207],{"class":1173},[1163,3029,1426],{"class":1173},[1163,3031,3032,3034,3036,3038],{"class":1165,"line":1197},[1163,3033,2481],{"class":1280},[1163,3035,960],{"class":1173},[1163,3037,2487],{"class":2486},[1163,3039,1291],{"class":1173},[1163,3041,3042,3045,3047,3049,3051],{"class":1165,"line":1224},[1163,3043,3044],{"class":1280},"  acknowledgeEquatableRisk",[1163,3046,960],{"class":1173},[1163,3048,2487],{"class":2486},[1163,3050,1207],{"class":1173},[1163,3052,3053],{"class":1343},"           \u002F\u002F the collection-level door — see the warning below\n",[1163,3055,3056,3058,3060],{"class":1165,"line":1245},[1163,3057,1432],{"class":1280},[1163,3059,960],{"class":1173},[1163,3061,1426],{"class":1173},[1163,3063,3064,3067,3069,3071,3073,3075,3077,3079,3082,3084,3086,3088,3090],{"class":1165,"line":1252},[1163,3065,3066],{"class":1280},"    inviteCode",[1163,3068,960],{"class":1173},[1163,3070,1204],{"class":1177},[1163,3072,1124],{"class":1173},[1163,3074,313],{"class":1268},[1163,3076,1271],{"class":1177},[1163,3078,1462],{"class":1173},[1163,3080,3081],{"class":1280}," equatable",[1163,3083,960],{"class":1173},[1163,3085,2487],{"class":2486},[1163,3087,1181],{"class":1173},[1163,3089,1507],{"class":1177},[1163,3091,1291],{"class":1173},[1163,3093,3094],{"class":1165,"line":1277},[1163,3095,1559],{"class":1173},[1163,3097,3098,3100],{"class":1165,"line":1294},[1163,3099,1350],{"class":1173},[1163,3101,1353],{"class":1177},[1163,3103,3104],{"class":1165,"line":1312},[1163,3105,1249],{"emptyLinePlaceholder":1248},[1163,3107,3108,3110,3113,3115,3117,3119,3121,3124,3126,3128,3130,3133,3135,3137,3140,3142,3144],{"class":1165,"line":1329},[1163,3109,1596],{"class":1169},[1163,3111,3112],{"class":1177}," invites",[1163,3114,1124],{"class":1173},[1163,3116,1604],{"class":1268},[1163,3118,1271],{"class":1177},[1163,3120,1307],{"class":1173},[1163,3122,3123],{"class":1190},"r1",[1163,3125,1307],{"class":1173},[1163,3127,1207],{"class":1173},[1163,3129,1174],{"class":1173},[1163,3131,3132],{"class":1280}," inviteCode",[1163,3134,960],{"class":1173},[1163,3136,1187],{"class":1173},[1163,3138,3139],{"class":1190},"invite-r1-secret-xyz",[1163,3141,1307],{"class":1173},[1163,3143,1181],{"class":1173},[1163,3145,1353],{"class":1177},[1163,3147,3148,3150,3152,3154,3156,3158,3160,3163,3165,3167,3169,3171,3173,3175,3178,3180,3182],{"class":1165,"line":1347},[1163,3149,1596],{"class":1169},[1163,3151,3112],{"class":1177},[1163,3153,1124],{"class":1173},[1163,3155,1604],{"class":1268},[1163,3157,1271],{"class":1177},[1163,3159,1307],{"class":1173},[1163,3161,3162],{"class":1190},"r2",[1163,3164,1307],{"class":1173},[1163,3166,1207],{"class":1173},[1163,3168,1174],{"class":1173},[1163,3170,3132],{"class":1280},[1163,3172,960],{"class":1173},[1163,3174,1187],{"class":1173},[1163,3176,3177],{"class":1190},"invite-r2-secret-abc",[1163,3179,1307],{"class":1173},[1163,3181,1181],{"class":1173},[1163,3183,1353],{"class":1177},[1163,3185,3186],{"class":1165,"line":1356},[1163,3187,1249],{"emptyLinePlaceholder":1248},[1163,3189,3190,3192,3194,3196,3198,3200,3202,3205,3207,3209,3211,3213,3215,3218],{"class":1165,"line":1361},[1163,3191,1596],{"class":1169},[1163,3193,3112],{"class":1177},[1163,3195,1124],{"class":1173},[1163,3197,1083],{"class":1268},[1163,3199,1271],{"class":1177},[1163,3201,1307],{"class":1173},[1163,3203,3204],{"class":1190},"inviteCode",[1163,3206,1307],{"class":1173},[1163,3208,1207],{"class":1173},[1163,3210,1187],{"class":1173},[1163,3212,3139],{"class":1190},[1163,3214,1307],{"class":1173},[1163,3216,3217],{"class":1177},")  ",[1163,3219,3220],{"class":1343},"\u002F\u002F → ['r1']\n",[1163,3222,3223,3225,3227,3229,3231,3233,3235,3237,3239,3241,3243,3246,3248,3251],{"class":1165,"line":1392},[1163,3224,1596],{"class":1169},[1163,3226,3112],{"class":1177},[1163,3228,1124],{"class":1173},[1163,3230,1083],{"class":1268},[1163,3232,1271],{"class":1177},[1163,3234,1307],{"class":1173},[1163,3236,3204],{"class":1190},[1163,3238,1307],{"class":1173},[1163,3240,1207],{"class":1173},[1163,3242,1187],{"class":1173},[1163,3244,3245],{"class":1190},"not-a-real-code-00",[1163,3247,1307],{"class":1173},[1163,3249,3250],{"class":1177},")    ",[1163,3252,3253],{"class":1343},"\u002F\u002F → []\n",[946,3255,3256,3257,3259,3260,3263],{},"Every hit is confirmed by a real digest verification before it is returned, so a forged\nor copied tag on another record never matches. After a value rotates, only the current\nvalue is findable. With ",[1038,3258,641],{"href":642}," enabled, one ",[970,3261,3262],{},"find"," sweep entry is\nrecorded per call — never one per hit.",[3265,3266,3269],"callout",{"color":3267,"icon":3268},"warning","i-lucide-shield-alert",[946,3270,3271,3274,3275,3278,3279,3282,3283,3286],{},[950,3272,3273],{},"The equatable trade, stated plainly."," Equal values produce equal store-visible tags:\nanyone with store access learns ",[995,3276,3277],{},"which records share the secret and how many share each\nvalue"," — never the value itself. A holder of the collection's data-encryption key can\nadditionally test candidate values offline at PBKDF2-SHA256 speed (600K iterations,\nGPU-friendly): for low-entropy secrets like PINs or secret answers, recovering the\nequality partition is a matter of hours, not years. The iteration count raises the\nprice; it does not make a low-entropy field safe — the real control is the door itself.\nDo not enable ",[970,3280,3281],{},"equatable"," on low-entropy fields unless a learnable partition is\nacceptable. Backups taken before a ",[970,3284,3285],{},"forget()"," retain the tags.",[1572,3288,3290,3291,3294],{"id":3289},"forget-sealed-slots-and-the-scopedpurge-knob","Forget — sealed slots and the ",[970,3292,3293],{},"scopedPurge"," knob",[946,3296,3297,3298,3301,3302,3304,3305,3308,3309,3312],{},"A classified declaration is ",[950,3299,3300],{},"forgettable",", so ",[1038,3303,685],{"href":686}," erases a subject's\nclassified data along with the rest of the record: every sealed slot keyed to the shredded\nrecord's per-record key is dropped (",[970,3306,3307],{},"sealedFieldsShredded","), and a legacy slot it cannot shred is\nreported (",[970,3310,3311],{},"sealedResidue",") rather than silently kept. These counts are unchanged from before\nclassified became a via field-feature.",[946,3314,3315,3316,3319,3320,3323,3324,3327,3328,3330,3331,3338],{},"Separately, if a record's key was ever ",[1038,3317,3318],{"href":825},"sealed to a host"," — a\n",[970,3321,3322],{},"_sealed_cek"," host-delivery envelope that lets a granted ",[970,3325,3326],{},"at-*"," host recover the key — ",[970,3329,3285],{},"\npurges those envelopes too. ",[950,3332,3333,3334,3337],{},"By default this purge is unconditional: it runs on every\ncollection, including one that declares only ",[970,3335,3336],{},"sensitive: [...]"," and no classified field"," — because\nany collection can seal a key to a host, and narrowing the purge would silently leave some keys\nrecoverable.",[946,3340,3341,3343,3344,3347,3348,3350],{},[970,3342,3293],{}," opts into the narrower, cheaper behavior. A deployment where most collections never\nseal to a host pays for that broad prefix scan for nothing; set ",[970,3345,3346],{},"scopedPurge: true"," on the forget\ncascade to purge ",[970,3349,3322],{}," envelopes only for declaration-backed collections:",[1154,3352,3354],{"className":1156,"code":3353,"language":1158,"meta":1159,"style":1159},"import { withForget } from '@noy-db\u002Fhub\u002Fforget'\n\nconst db = await createNoydb({\n  store: toMemory(),\n  user: 'owner',\n  secret: 'correct horse battery staple',\n  classifiedStrategy: withClassified(),\n  forgetStrategy: withForget({\n    subjects: { contacts: 'subjectId', audit: 'subjectId' },\n    scopedPurge: true,\n  }),\n})\n",[970,3355,3356,3376,3380,3396,3408,3422,3436,3448,3461,3498,3509,3518],{"__ignoreMap":1159},[1163,3357,3358,3360,3362,3365,3367,3369,3371,3374],{"class":1165,"line":1166},[1163,3359,1170],{"class":1169},[1163,3361,1174],{"class":1173},[1163,3363,3364],{"class":1177}," withForget",[1163,3366,1181],{"class":1173},[1163,3368,1184],{"class":1169},[1163,3370,1187],{"class":1173},[1163,3372,3373],{"class":1190},"@noy-db\u002Fhub\u002Fforget",[1163,3375,1194],{"class":1173},[1163,3377,3378],{"class":1165,"line":1197},[1163,3379,1249],{"emptyLinePlaceholder":1248},[1163,3381,3382,3384,3386,3388,3390,3392,3394],{"class":1165,"line":1224},[1163,3383,1256],{"class":1255},[1163,3385,1259],{"class":1177},[1163,3387,1262],{"class":1173},[1163,3389,1265],{"class":1169},[1163,3391,1178],{"class":1268},[1163,3393,1271],{"class":1177},[1163,3395,1274],{"class":1173},[1163,3397,3398,3400,3402,3404,3406],{"class":1165,"line":1245},[1163,3399,1281],{"class":1280},[1163,3401,960],{"class":1173},[1163,3403,1231],{"class":1268},[1163,3405,1288],{"class":1177},[1163,3407,1291],{"class":1173},[1163,3409,3410,3412,3414,3416,3418,3420],{"class":1165,"line":1252},[1163,3411,1297],{"class":1280},[1163,3413,960],{"class":1173},[1163,3415,1187],{"class":1173},[1163,3417,1304],{"class":1190},[1163,3419,1307],{"class":1173},[1163,3421,1291],{"class":1173},[1163,3423,3424,3426,3428,3430,3432,3434],{"class":1165,"line":1277},[1163,3425,1315],{"class":1280},[1163,3427,960],{"class":1173},[1163,3429,1187],{"class":1173},[1163,3431,1322],{"class":1190},[1163,3433,1307],{"class":1173},[1163,3435,1291],{"class":1173},[1163,3437,3438,3440,3442,3444,3446],{"class":1165,"line":1294},[1163,3439,1332],{"class":1280},[1163,3441,960],{"class":1173},[1163,3443,1210],{"class":1268},[1163,3445,1288],{"class":1177},[1163,3447,1291],{"class":1173},[1163,3449,3450,3453,3455,3457,3459],{"class":1165,"line":1312},[1163,3451,3452],{"class":1280},"  forgetStrategy",[1163,3454,960],{"class":1173},[1163,3456,3364],{"class":1268},[1163,3458,1271],{"class":1177},[1163,3460,1274],{"class":1173},[1163,3462,3463,3466,3468,3470,3473,3475,3477,3480,3482,3484,3487,3489,3491,3493,3495],{"class":1165,"line":1329},[1163,3464,3465],{"class":1280},"    subjects",[1163,3467,960],{"class":1173},[1163,3469,1174],{"class":1173},[1163,3471,3472],{"class":1280}," contacts",[1163,3474,960],{"class":1173},[1163,3476,1187],{"class":1173},[1163,3478,3479],{"class":1190},"subjectId",[1163,3481,1307],{"class":1173},[1163,3483,1207],{"class":1173},[1163,3485,3486],{"class":1280}," audit",[1163,3488,960],{"class":1173},[1163,3490,1187],{"class":1173},[1163,3492,3479],{"class":1190},[1163,3494,1307],{"class":1173},[1163,3496,3497],{"class":1173}," },\n",[1163,3499,3500,3503,3505,3507],{"class":1165,"line":1347},[1163,3501,3502],{"class":1280},"    scopedPurge",[1163,3504,960],{"class":1173},[1163,3506,2487],{"class":2486},[1163,3508,1291],{"class":1173},[1163,3510,3511,3514,3516],{"class":1165,"line":1356},[1163,3512,3513],{"class":1173},"  }",[1163,3515,1507],{"class":1177},[1163,3517,1291],{"class":1173},[1163,3519,3520,3522],{"class":1165,"line":1361},[1163,3521,1350],{"class":1173},[1163,3523,1353],{"class":1177},[946,3525,3526,3527,3529,3530,3532,3533,3536,3537,3540],{},"Under ",[970,3528,3346],{},", a collection with a ",[970,3531,1096],{}," binding is ",[950,3534,3535],{},"declared"," and its\nenvelopes are purged as before; every other collection is ",[950,3538,3539],{},"undeclared"," — its envelopes are left\nin place and reported, never silently dropped:",[1154,3542,3544],{"className":1156,"code":3543,"language":1158,"meta":1159,"style":1159},"\u002F\u002F contacts declares classifiedFields; audit has only `sensitive: [...]`.\n\u002F\u002F Both had a key sealed to a host for subject-1.\nconst result = await vault.forget('subject-1')\n",[970,3545,3546,3551,3556],{"__ignoreMap":1159},[1163,3547,3548],{"class":1165,"line":1166},[1163,3549,3550],{"class":1343},"\u002F\u002F contacts declares classifiedFields; audit has only `sensitive: [...]`.\n",[1163,3552,3553],{"class":1165,"line":1197},[1163,3554,3555],{"class":1343},"\u002F\u002F Both had a key sealed to a host for subject-1.\n",[1163,3557,3558,3560,3563,3565,3567,3569,3571,3573,3575,3577,3580,3582],{"class":1165,"line":1224},[1163,3559,1256],{"class":1255},[1163,3561,3562],{"class":1177}," result ",[1163,3564,1262],{"class":1173},[1163,3566,1265],{"class":1169},[1163,3568,1407],{"class":1177},[1163,3570,1124],{"class":1173},[1163,3572,685],{"class":1268},[1163,3574,1271],{"class":1177},[1163,3576,1307],{"class":1173},[1163,3578,3579],{"class":1190},"subject-1",[1163,3581,1307],{"class":1173},[1163,3583,1353],{"class":1177},[1154,3585,3587],{"className":1856,"code":3586,"language":141,"meta":1159,"style":1159},"{\n  \"sealedCekEnvelopesPurged\": 1,\n  \"scopedPurgeResidue\": [\n    { \"reason\": \"skipped-undeclared-sealed-cek\", \"collection\": \"audit\", \"count\": 1 }\n  ]\n}\n",[970,3588,3589,3593,3608,3622,3677,3682],{"__ignoreMap":1159},[1163,3590,3591],{"class":1165,"line":1166},[1163,3592,1274],{"class":1173},[1163,3594,3595,3597,3600,3602,3604,3606],{"class":1165,"line":1197},[1163,3596,1868],{"class":1173},[1163,3598,3599],{"class":1255},"sealedCekEnvelopesPurged",[1163,3601,1874],{"class":1173},[1163,3603,960],{"class":1173},[1163,3605,2859],{"class":2525},[1163,3607,1291],{"class":1173},[1163,3609,3610,3612,3615,3617,3619],{"class":1165,"line":1224},[1163,3611,1868],{"class":1173},[1163,3613,3614],{"class":1255},"scopedPurgeResidue",[1163,3616,1874],{"class":1173},[1163,3618,960],{"class":1173},[1163,3620,3621],{"class":1173}," [\n",[1163,3623,3624,3627,3629,3633,3635,3637,3639,3642,3644,3646,3648,3650,3652,3654,3656,3659,3661,3663,3665,3668,3670,3672,3674],{"class":1165,"line":1245},[1163,3625,3626],{"class":1173},"    {",[1163,3628,1879],{"class":1173},[1163,3630,3632],{"class":3631},"sBMFI","reason",[1163,3634,1874],{"class":1173},[1163,3636,960],{"class":1173},[1163,3638,1879],{"class":1173},[1163,3640,3641],{"class":1190},"skipped-undeclared-sealed-cek",[1163,3643,1874],{"class":1173},[1163,3645,1207],{"class":1173},[1163,3647,1879],{"class":1173},[1163,3649,1412],{"class":3631},[1163,3651,1874],{"class":1173},[1163,3653,960],{"class":1173},[1163,3655,1879],{"class":1173},[1163,3657,3658],{"class":1190},"audit",[1163,3660,1874],{"class":1173},[1163,3662,1207],{"class":1173},[1163,3664,1879],{"class":1173},[1163,3666,3667],{"class":3631},"count",[1163,3669,1874],{"class":1173},[1163,3671,960],{"class":1173},[1163,3673,2859],{"class":2525},[1163,3675,3676],{"class":1173}," }\n",[1163,3678,3679],{"class":1165,"line":1252},[1163,3680,3681],{"class":1173},"  ]\n",[1163,3683,3684],{"class":1165,"line":1277},[1163,3685,2041],{"class":1173},[946,3687,3688,3690,3691,3693],{},[970,3689,3667],{}," is the number of envelopes left in place for that collection, aggregated across the whole\n",[970,3692,3285],{}," call. You are trading the default's completeness for cost: purge fewer prefixes, in\nexchange for reviewing the residue report for everything left out of scope.",[3265,3695,3696],{"color":3267,"icon":3268},[946,3697,3698,3704,3705,3707,3708,3710,3711,3713,3714,3716,3717,3719,3720,3722,3723,3726,3727,3730,3731,3733],{},[950,3699,3700,3701,3703],{},"A bare ",[970,3702,3336],{}," collection is undeclared here."," Sensitive fields without a\n",[970,3706,1096],{}," binding do not bring a collection into ",[970,3709,3293],{}," scope — after ",[970,3712,3285],{},"\nits ",[970,3715,3322],{}," envelope remains, and a host granted that key can still recover it until the\nenvelope is purged another way. Wrap the field in a ",[970,3718,1096],{}," binding to bring the\ncollection into scope, or leave ",[970,3721,3293],{}," off for collections that use only bare ",[970,3724,3725],{},"sensitive",".\nThe declaration signal is also ",[950,3728,3729],{},"session-local",": a declared collection never opened in the\ncurrent session before ",[970,3732,3285],{}," resolves as undeclared, so open your declared collections first.",[946,3735,3736,3738,3739,3742,3743,1124],{},[970,3737,3293],{}," is set once on the forget strategy at ",[970,3740,3741],{},"createNoydb()"," and applies identically to\nevery vault from that instance — the same per-instance granularity as ",[970,3744,3745],{},"subjects",[941,3747,3749],{"id":3748},"api-reference","API reference",[1572,3751,3753],{"id":3752},"withclassified",[970,3754,1148],{},[1154,3756,3758],{"className":1156,"code":3757,"language":1158,"meta":1159,"style":1159},"function withClassified(): ClassifiedStrategy\n",[970,3759,3760],{"__ignoreMap":1159},[1163,3761,3762,3765,3767,3770],{"class":1165,"line":1166},[1163,3763,3764],{"class":1255},"function",[1163,3766,1210],{"class":1268},[1163,3768,3769],{"class":1173},"():",[1163,3771,3772],{"class":3631}," ClassifiedStrategy\n",[946,3774,3775,3776,3778,3779,3782,3783,3785,3786,3785,3788,3785,3790,3792,3793,1124],{},"Enables the four read-egress operations on collections that declare ",[970,3777,1096],{},".\nPass it to ",[970,3780,3781],{},"createNoydb({ classifiedStrategy })",". Without it, the declaration\u002Fwrite\nside still runs, and ",[970,3784,1137],{}," \u002F ",[970,3787,997],{},[970,3789,1142],{},[970,3791,1083],{}," throw\n",[970,3794,1152],{},[1572,3796,3798,3799,1507],{"id":3797},"the-preset-catalog-classified","The preset catalog (",[970,3800,3801],{},"classified.*",[3803,3804,3805,3827],"table",{},[3806,3807,3808],"thead",{},[3809,3810,3811,3815,3818,3821,3824],"tr",{},[3812,3813,3814],"th",{},"Preset",[3812,3816,3817],{},"Storage",[3812,3819,3820],{},"List projection",[3812,3822,3823],{},"Riders",[3812,3825,3826],{},"Write validation",[3828,3829,3830,3849,3875,3896,3919,3946,3973,3997,4019],"tbody",{},[3809,3831,3832,3838,3841,3844,3846],{},[3833,3834,3835],"td",{},[970,3836,3837],{},"classified.creditCard({ pan, expiry?, cvc? })",[3833,3839,3840],{},"group",[3833,3842,3843],{},"—",[3833,3845,3843],{},[3833,3847,3848],{},"per member ↓",[3809,3850,3851,3854,3858,3864,3872],{},[3833,3852,3853],{},"— PAN member",[3833,3855,3856],{},[970,3857,972],{},[3833,3859,3860,3861],{},"mask ",[970,3862,3863],{},"'•••• ${last4}'",[3833,3865,3866,1021,3869],{},[970,3867,3868],{},"last4",[970,3870,3871],{},"bin",[3833,3873,3874],{},"Luhn check",[3809,3876,3877,3880,3884,3889,3891],{},[3833,3878,3879],{},"— expiry member",[3833,3881,3882],{},[970,3883,972],{},[3833,3885,3860,3886],{},[970,3887,3888],{},"'••\u002F••'",[3833,3890,3843],{},[3833,3892,3893],{},[970,3894,3895],{},"MM\u002FYY",[3809,3897,3898,3901,3905,3908,3910],{},[3833,3899,3900],{},"— CVC member",[3833,3902,3903],{},[970,3904,1009],{},[3833,3906,3907],{},"omit",[3833,3909,3843],{},[3833,3911,3912,3913,3915,3916],{},"none at ",[970,3914,1604],{}," — any presence throws ",[970,3917,3918],{},"ClassifiedNeverStoredError",[3809,3920,3921,3926,3930,3935,3940],{},[3833,3922,3923],{},[970,3924,3925],{},"classified.birthDate()",[3833,3927,3928],{},[970,3929,972],{},[3833,3931,3860,3932],{},[970,3933,3934],{},"'${yob}-••-••'",[3833,3936,3937],{},[970,3938,3939],{},"yob",[3833,3941,3942,3943],{},"valid ISO ",[970,3944,3945],{},"yyyy-mm-dd",[3809,3947,3948,3953,3957,3962,3967],{},[3833,3949,3950],{},[970,3951,3952],{},"classified.email()",[3833,3954,3955],{},[970,3956,972],{},[3833,3958,3860,3959],{},[970,3960,3961],{},"'•••@${domain}'",[3833,3963,3964],{},[970,3965,3966],{},"domain",[3833,3968,3969,3970],{},"contains ",[970,3971,3972],{},"@",[3809,3974,3975,3980,3984,3989,3994],{},[3833,3976,3977],{},[970,3978,3979],{},"classified.phone()",[3833,3981,3982],{},[970,3983,972],{},[3833,3985,3860,3986],{},[970,3987,3988],{},"'•••••${last2}'",[3833,3990,3991],{},[970,3992,3993],{},"last2",[3833,3995,3996],{},"≥ 5 digits",[3809,3998,3999,4004,4008,4010,4012],{},[3833,4000,4001],{},[970,4002,4003],{},"classified.password(opts?)",[3833,4005,4006],{},[970,4007,992],{},[3833,4009,3907],{},[3833,4011,3843],{},[3833,4013,4014,4015,4018],{},"NFC length ≥ ",[970,4016,4017],{},"minLength"," (default 10)",[3809,4020,4021,4026,4030,4032,4034],{},[3833,4022,4023],{},[970,4024,4025],{},"classified.secretAnswer(opts?)",[3833,4027,4028],{},[970,4029,992],{},[3833,4031,3907],{},[3833,4033,3843],{},[3833,4035,4036],{},"non-empty after normalization",[946,4038,4039,4042,4043,4046,4047,4050,4051,4053,4054,4057,4058,4061,4062,4065,4066,4042,4069,4065,4071,4073,4074,4076,4077,4079],{},[970,4040,4041],{},"classified.password"," options: ",[970,4044,4045],{},"minLength?"," (default 10), ",[970,4048,4049],{},"rotateDays?"," (decorate\n",[970,4052,2773],{}," verdicts with ",[970,4055,4056],{},"mustRotate"," after N days), ",[970,4059,4060],{},"notLastN?"," (0–8, refuse reuse of\nthe last N values on rotate; each remembered value costs one 600K PBKDF2 on write),\n",[970,4063,4064],{},"equatable?",". ",[970,4067,4068],{},"classified.secretAnswer",[970,4070,4064],{},[970,4072,2566],{}," members\nare groupable via ",[970,4075,1142],{}," and normalize casefold\u002Ftrim\u002Fwhitespace-collapse;\n",[970,4078,313],{}," normalizes NFC-strict.",[946,4081,4082,4083,4086,4087,4089,4090,1124],{},"Riders become plain companion fields named ",[970,4084,4085],{},"\u003Cfield>_\u003Crider>"," (e.g. ",[970,4088,1020],{},");\na collision with a declared or computed field throws ",[970,4091,4092],{},"ClassifiedConfigError",[1572,4094,4096,4097,1507],{"id":4095},"collection-operations-require-withclassified","Collection operations (require ",[970,4098,1148],{},[3803,4100,4101,4114],{},[3806,4102,4103],{},[3809,4104,4105,4108,4111],{},[3812,4106,4107],{},"Method",[3812,4109,4110],{},"Returns",[3812,4112,4113],{},"Purpose",[3828,4115,4116,4143,4167,4185],{},[3809,4117,4118,4123,4128],{},[3833,4119,4120],{},[970,4121,4122],{},"reveal(id, field)",[3833,4124,4125],{},[970,4126,4127],{},"Promise\u003Cunknown>",[3833,4129,4130,4131,4133,4134,1021,4136,4138,4139,4142],{},"Audited decrypt of one ",[970,4132,972],{}," field. Refuses ",[970,4135,1009],{},[970,4137,992],{},", unknown fields, missing records (",[970,4140,4141],{},"ClassifiedRevealError",").",[3809,4144,4145,4150,4155],{},[3833,4146,4147],{},[970,4148,4149],{},"verify(id, field, candidate)",[3833,4151,4152],{},[970,4153,4154],{},"Promise\u003CClassifiedVerdict>",[3833,4156,4157,4158,4161,4162,4164,4165,1124],{},"Verdict-only check: ",[970,4159,4160],{},"{ ok: boolean, mustRotate?: true }",". Digest compare for ",[970,4163,992],{},"; normalized in-hub plaintext compare for ",[970,4166,972],{},[3809,4168,4169,4174,4179],{},[3833,4170,4171],{},[970,4172,4173],{},"verifyGroup(id, answers, { min })",[3833,4175,4176],{},[970,4177,4178],{},"Promise\u003C{ passed: boolean }>",[3833,4180,4181,4182,4184],{},"k-of-n challenge over the collection's ",[970,4183,2566],{}," members.",[3809,4186,4187,4191,4196],{},[3833,4188,4189],{},[970,4190,2986],{},[3833,4192,4193],{},[970,4194,4195],{},"Promise\u003Creadonly string[]>",[3833,4197,4198,4199,4202,4203,4205,4206,4209,4210,4213],{},"Ids whose equatable digest-only field equals ",[970,4200,4201],{},"candidate",". Requires ",[970,4204,2990],{}," + ",[970,4207,4208],{},"acknowledgeEquatableRisk: true",". The three mis-declaration cases (not classified \u002F not digest-only \u002F not equatable) throw ",[970,4211,4212],{},"ClassifiedVerifyError"," with one identical message — no field-enumeration oracle.",[1572,4215,4217],{"id":4216},"collection-options","Collection options",[3803,4219,4220,4233],{},[3806,4221,4222],{},[3809,4223,4224,4227,4230],{},[3812,4225,4226],{},"Option",[3812,4228,4229],{},"Type",[3812,4231,4232],{},"Meaning",[3828,4234,4235,4249,4273],{},[3809,4236,4237,4241,4246],{},[3833,4238,4239],{},[970,4240,1096],{},[3833,4242,4243],{},[970,4244,4245],{},"Record\u003Cstring, ClassifiedEntry>",[3833,4247,4248],{},"Field name → spec, or any key → group (groups claim their member field names).",[3809,4250,4251,4256,4261],{},[3833,4252,4253],{},[970,4254,4255],{},"perRecordKeys",[3833,4257,4258],{},[970,4259,4260],{},"boolean",[3833,4262,4263,4264,4267,4268,4270,4271,2443],{},"Required ",[970,4265,4266],{},"true"," when any field is ",[970,4269,992],{}," — digest keys derive from the per-record key so ",[970,4272,3285],{},[3809,4274,4275,4279,4283],{},[3833,4276,4277],{},[970,4278,1110],{},[3833,4280,4281],{},[970,4282,4260],{},[3833,4284,4285,4286,4288,4289,4291],{},"Collection-level door for ",[970,4287,3281],{}," fields. ",[970,4290,4266],{}," with zero equatable members is a harmless no-op.",[1572,4293,4295],{"id":4294},"errors","Errors",[3803,4297,4298,4308],{},[3806,4299,4300],{},[3809,4301,4302,4305],{},[3812,4303,4304],{},"Error",[3812,4306,4307],{},"Thrown when",[3828,4309,4310,4321,4342,4352,4366,4377,4393],{},[3809,4311,4312,4316],{},[3833,4313,4314],{},[970,4315,1152],{},[3833,4317,4318,4319,1124],{},"A read-egress op is called without ",[970,4320,1148],{},[3809,4322,4323,4327],{},[3833,4324,4325],{},[970,4326,4092],{},[3833,4328,4329,4330,4332,4333,1021,4335,4337,4338,4341],{},"Invalid declaration: duplicate field claim, rider collision, ",[970,4331,992],{}," without encryption or ",[970,4334,4255],{},[970,4336,3281],{}," on a non-digest field or without the door, combining with CRDT\u002Fconflict resolvers, overlap with ",[970,4339,4340],{},"sensitive[]",", indexed\u002Fembedded digest fields.",[3809,4343,4344,4349],{},[3833,4345,4346],{},[970,4347,4348],{},"ClassifiedValidationError",[3833,4350,4351],{},"A write value fails its preset validator.",[3809,4353,4354,4358],{},[3833,4355,4356],{},[970,4357,3918],{},[3833,4359,4360,4361,4363,4364,1124],{},"A ",[970,4362,1585],{}," field is present on ",[970,4365,1581],{},[3809,4367,4368,4372],{},[3833,4369,4370],{},[970,4371,4141],{},[3833,4373,4374,4376],{},[970,4375,976],{}," on a non-recoverable\u002Funknown field, a missing record, or a never-written field.",[3809,4378,4379,4383],{},[3833,4380,4381],{},[970,4382,4212],{},[3833,4384,4385,4387,4388,4387,4390,4392],{},[970,4386,997],{},"\u002F",[970,4389,1142],{},[970,4391,1083],{}," caller bugs (unknown field, wrong storage form, no groupable members).",[3809,4394,4395,4399],{},[3833,4396,4397],{},[970,4398,2785],{},[3833,4400,4401,4402,4404],{},"A digest-only rewrite reuses one of the last ",[970,4403,2781],{}," values.",[946,4406,4407,4408,4410,4411,4413,4414,4416],{},"All are exported from ",[970,4409,1219],{},", except ",[970,4412,1152],{},",\nwhich is exported from ",[970,4415,1191],{}," (it belongs to the kernel's strategy seam, not to\nthe opt-in module).",[1572,4418,4420],{"id":4419},"advanced-exports","Advanced exports",[946,4422,4423],{},"For building custom specs and tooling on top of the same machinery:",[3803,4425,4426,4435],{},[3806,4427,4428],{},[3809,4429,4430,4433],{},[3812,4431,4432],{},"Export",[3812,4434,4113],{},[3828,4436,4437,4454,4473,4499,4516,4526,4539],{},[3809,4438,4439,4451],{},[3833,4440,4441,1021,4444,1021,4447,4450],{},[970,4442,4443],{},"ClassifiedFieldSpec",[970,4445,4446],{},"ClassifiedGroup",[970,4448,4449],{},"ClassifiedEntry"," (types)",[3833,4452,4453],{},"The descriptor shapes behind the presets — a raw spec object works anywhere a preset does.",[3809,4455,4456,4470],{},[3833,4457,4458,1021,4461,1021,4464,1021,4467,4450],{},[970,4459,4460],{},"ClassifiedStorage",[970,4462,4463],{},"ClassifiedList",[970,4465,4466],{},"ClassifiedRider",[970,4468,4469],{},"ClassifiedVerdict",[3833,4471,4472],{},"The storage-form, list-projection, rider, and verdict vocabularies.",[3809,4474,4475,4490],{},[3833,4476,4477,1021,4480,1021,4483,4486,4487],{},[970,4478,4479],{},"ClassifiedStrategy",[970,4481,4482],{},"ClassifiedRevealCtx",[970,4484,4485],{},"ClassifiedVerifyCtx"," (types), ",[970,4488,4489],{},"NO_CLASSIFIED",[3833,4491,4492,4493,4495,4496,4498],{},"The strategy seam ",[970,4494,1148],{}," implements; ",[970,4497,4489],{}," is the throwing default.",[3809,4500,4501,4510],{},[3833,4502,4503,1021,4506,4509],{},[970,4504,4505],{},"resolveClassifiedFields(collection, config)",[970,4507,4508],{},"ResolvedClassified"," (type)",[3833,4511,4512,4513,4515],{},"Flattens a ",[970,4514,1096],{}," config into a per-field map + rider computed entries.",[3809,4517,4518,4523],{},[3833,4519,4520],{},[970,4521,4522],{},"enforceClassifiedWrite(record, byField, collection)",[3833,4524,4525],{},"The pure write-time gate (never-rejection + validators).",[3809,4527,4528,4536],{},[3833,4529,4530,1021,4533],{},[970,4531,4532],{},"isClassifiedFieldSpec(x)",[970,4534,4535],{},"isClassifiedGroup(x)",[3833,4537,4538],{},"Type guards for descriptor values.",[3809,4540,4541,4546],{},[3833,4542,4543],{},[970,4544,4545],{},"luhnCheck(value)",[3833,4547,4548,4549,4551],{},"The card-number checksum used by the ",[970,4550,1457],{}," preset.",[941,4553,4555],{"id":4554},"limits-gotchas","Limits & gotchas",[962,4557,4558,4570,4582,4588,4609,4627,4639,4656,4671,4681,4693],{},[965,4559,4560,4563,4564,4566,4567,4569],{},[950,4561,4562],{},"Digest operations are deliberately slow."," Every digest write, ",[970,4565,997],{},", and\n",[970,4568,1083],{}," target derivation runs a 600K-iteration PBKDF2 — that is the\nbrute-force price tag, by design. Budget for it in hot login paths.",[965,4571,4572,4577,4578,4581],{},[950,4573,4574,4576],{},[970,4575,1083],{}," scans the collection",": one 600K digest derivation for the\ncandidate (always exactly one, even on an empty collection — so timing cannot\ndistinguish \"no records\" from \"no match\"), one envelope read per record (exactly\n",[970,4579,4580],{},"list + N get"," store calls), and a confirming digest verification per hit —\nO(collection size), not an index lookup in the SQL sense.",[965,4583,4584,4587],{},[950,4585,4586],{},"No built-in rate limiter."," For low-entropy secrets (PINs, secret answers) the\nenumeration math is on you — add application-side attempt limiting.",[965,4589,4590,4593,4594,4596,4597,4599,4600,4602,4603,4605,4606,4608],{},[950,4591,4592],{},"Storage forms are mutually exclusive per field"," — a field is ",[970,4595,992],{}," OR\n",[970,4598,972],{}," OR ",[970,4601,1009],{},", exactly one; a ",[970,4604,992],{}," field additionally cannot\nappear in the collection's ",[970,4607,4340],{}," list (the overlap would silently downgrade\nit to recoverable sealing, so it is refused).",[965,4610,4611,4623,4624,4626],{},[950,4612,4613,4615,4616,4618,4619,4622],{},[970,4614,972],{}," and ",[970,4617,992],{}," fields cannot combine with CRDT modes or a\n",[970,4620,4621],{},"conflictPolicy"," resolver"," — merge paths bypass write enforcement, so the\ncombination is refused at declaration (",[970,4625,1009],{},"-only declarations are exempt).",[965,4628,4629,4632,4633,4636,4637,1124],{},[950,4630,4631],{},"Digest-only fields cannot be indexed, text-indexed, embedded, deterministic, or a\nforget-subject key",", and require an encrypted collection (",[970,4634,4635],{},"encrypt: false"," is\nrefused) with ",[970,4638,2439],{},[965,4640,4641,4648,4649,4652,4653,4655],{},[950,4642,4643,4615,4645,4647],{},[970,4644,972],{},[970,4646,992],{}," declarations are fixed at first open."," A\ncollection first opened without them cannot gain them later — the sealing and digest\nwrite paths are frozen at construction, so a late declaration would persist values\nunprotected while ",[970,4650,4651],{},"describe()"," advertises protection; it is refused instead.\n",[970,4654,1009],{},"-only declarations can reconcile onto an existing collection. A\nre-declaration that changes a field's storage form is always refused.",[965,4657,4658,4661,4662,4664,4665,4667,4668,4670],{},[950,4659,4660],{},"List masking is opt-in at the render layer."," Kernel reads return sealed handles +\nriders; run ",[970,4663,2060],{}," (or consume ",[970,4666,4651],{},"'s ",[970,4669,633],{}," block) to\nget the declared mask\u002Fomit\u002Frider view.",[965,4672,4673,4680],{},[950,4674,4675,4676,4679],{},"Writing ",[970,4677,4678],{},"null"," to a digest-only field clears it"," (an explicit clear, not a\nvalidation error).",[965,4682,4683,4692],{},[950,4684,4685,4686,4688,4689,4691],{},"Pre-",[970,4687,3285],{}," backups retain equatable ",[970,4690,2982],{}," tags"," — the partition of a\nforgotten record's secret can survive in old backups.",[965,4694,4695,4700,4701,4704,4705,4707,4708,4387,4711,4714,4715,4718,4719,4387,4722,4387,4725,4728,4729,4731,4732,4735,4736,4739,4740,4743],{},[950,4696,4697,4698],{},"Export output changed in ",[970,4699,1035],{}," for the default (non-",[970,4702,4703],{},"redact","-option) path of the\n",[970,4706,2067],{}," exporters: ",[970,4709,4710],{},"vault.exportStream()",[970,4712,4713],{},"exportJSON()"," now redact a classified field to the\nplain string ",[970,4716,4717],{},"'[sealed]'"," on the record itself, so ",[970,4720,4721],{},"@noy-db\u002Fas-csv",[970,4723,4724],{},"as-sql",[970,4726,4727],{},"as-xml"," emit a\nbare ",[970,4730,1900],{}," cell \u002F ",[970,4733,4734],{},"text"," column where they previously emitted JSON-stringified sealed\nhandles (",[970,4737,4738],{},"\"\"\"[sealed]\"\"\""," in CSV, a ",[970,4741,4742],{},"jsonb"," column). The new bytes are the intended ones —\nthe old output was an accidental echo of a live, revealable handle reaching the export stream.",[941,4745,4747],{"id":4746},"see-also","See also",[962,4749,4750,4755,4760,4772,4779,4790,4795,4801,4811],{},[965,4751,4752,4754],{},[1038,4753,896],{"href":897}," — the field-feature surface and the posture\u002Ftaint machinery classified plugs into",[965,4756,4757,4759],{},[1038,4758,637],{"href":638}," — how a derived field inherits a classified source's posture",[965,4761,4762,4764,4765,3785,4767,3785,4769,4771],{},[1038,4763,641],{"href":642}," — the audit trail that ",[970,4766,1137],{},[970,4768,997],{},[970,4770,3262],{}," operations feed",[965,4773,4774,4776,4777],{},[1038,4775,685],{"href":686}," — per-record key shredding, the reason digest-only requires ",[970,4778,4255],{},[965,4780,4781,4786,4787,4789],{},[1038,4782,4783,4784],{"href":678},"Field metadata — ",[970,4785,2056],{}," — where the serialized ",[970,4788,633],{}," projection contract surfaces",[965,4791,4792,4794],{},[1038,4793,697],{"href":698}," — pairs with classified for versioned, audited records",[965,4796,4797,4800],{},[1038,4798,4799],{"href":66},"Core 02 — Enclave"," — the envelope model classified fields build on",[965,4802,4803,4806,4807],{},[1038,4804,4805],{"href":598},"Services overview"," · ",[1038,4808,4810],{"href":4809},"\u002Forientation","Orientation map",[965,4812,4813,4814,1124],{},"Proven by showcase ",[1038,4815,4819],{"href":4816,"rel":4817},"https:\u002F\u002Fgithub.com\u002Fnoy-db\u002Fdocs\u002Fblob\u002Fmain\u002Fshowcases\u002Fsrc\u002F128-with-classified.showcase.test.ts",[4818],"nofollow",[970,4820,4821],{},"128-with-classified",[4823,4824,4825],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":1159,"searchDepth":1224,"depth":1224,"links":4827},[4828,4829,4830,4831,4832,4840,4850,4851],{"id":943,"depth":1197,"text":944},{"id":1061,"depth":1197,"text":1062},{"id":1086,"depth":1197,"text":1087},{"id":1127,"depth":1197,"text":1128},{"id":1569,"depth":1197,"text":1570,"children":4833},[4834,4835,4836,4837,4838],{"id":1574,"depth":1224,"text":1575},{"id":2302,"depth":1224,"text":2303},{"id":2432,"depth":1224,"text":2433},{"id":2967,"depth":1224,"text":2968},{"id":3289,"depth":1224,"text":4839},"Forget — sealed slots and the scopedPurge knob",{"id":3748,"depth":1197,"text":3749,"children":4841},[4842,4843,4845,4847,4848,4849],{"id":3752,"depth":1224,"text":1148},{"id":3797,"depth":1224,"text":4844},"The preset catalog (classified.*)",{"id":4095,"depth":1224,"text":4846},"Collection operations (require withClassified())",{"id":4216,"depth":1224,"text":4217},{"id":4294,"depth":1224,"text":4295},{"id":4419,"depth":1224,"text":4420},{"id":4554,"depth":1197,"text":4555},{"id":4746,"depth":1197,"text":4747},null,"Classified fields: declare sensitive fields once with a preset — sealed or digested storage, safe projections, audited reveal, and verify-without-reveal.","md",{},"service",{"title":633,"description":4853},"stable","important","F8SA0JYJJrKjj92ONaO2bCmfZQ8kDuFHDlhrNVgQ4sc",{"data":4862,"body":4863},{},{"type":4864,"children":4865},"root",[4866],{"type":4867,"tag":946,"props":4868,"children":4869},"element",{},[4870],{"type":4867,"tag":970,"props":4871,"children":4873},{"className":4872},[],[4874],{"type":4734,"value":4875},"with-shape",{"data":4877,"body":4878},{},{"type":4864,"children":4879},[4880],{"type":4867,"tag":946,"props":4881,"children":4882},{},[4883],{"type":4734,"value":4884},"D — Data Shape",{"data":4886,"body":4887},{},{"type":4864,"children":4888},[4889],{"type":4867,"tag":946,"props":4890,"children":4891},{},[4892],{"type":4867,"tag":970,"props":4893,"children":4895},{"className":4894},[],[4896],{"type":4734,"value":1219},{"data":4898,"body":4899},{},{"type":4864,"children":4900},[4901],{"type":4867,"tag":946,"props":4902,"children":4903},{},[4904],{"type":4867,"tag":970,"props":4905,"children":4907},{"className":4906},[],[4908],{"type":4734,"value":1148},{"data":4910,"body":4911},{},{"type":4864,"children":4912},[4913],{"type":4867,"tag":946,"props":4914,"children":4915},{},[4916],{"type":4734,"value":4917},"~1,150 (off-bundle when not opted in)",1791896573384]