Schema-local change selection and protection policy.

The two settings answer different questions:

• only and except select which field changes are worth reporting. An update touching only excluded fields records nothing at all.
• redact, hash, and omit withhold a value from the audit store. A withheld field cannot be reconstructed, so versions containing one are reported incomplete.

hash stores an unsalted SHA-256 fingerprint. It answers correlation questions — did this field change, did it revert, does it match another record — but it is not secrecy: a value drawn from a small or guessable set can be recovered by hashing candidates until one matches. Use redact or omit when the value itself must not be recoverable.

Excluding a field from diffs does not withhold it: a version still captures every persisted field, so time travel keeps working. Use omit to keep a value out of the store entirely.

Put the policy beside the schema it governs:

defmodule MyApp.Account do
  use Ecto.Schema
  use Chronicle.Schema,
    only: [:email, :password_hash, :session_token],
    redact: [:password_hash],
    hash: [:email],
    omit: [:session_token]

  schema "accounts" do
    field :email, :string
    field :password_hash, :string
    field :session_token, :string
  end
end

only: :all is the default. except removes fields from that set. A field may have only one protection strategy. Options must be literals so invalid policy shapes fail during compilation, and field names are checked against the Ecto schema once the module has compiled.