@noy-db/hub 0.3.0-pre.4 → 0.3.0-pre.6

package/dist/{chunk-ZPHDGUZZ.js → chunk-D6ADQ4QL.js}

@@ -1,3 +1,6 @@
+import {
+  loadVaultPolicy
+} from "./chunk-T45LAT2Y.js";
 import {
   jsonSchemaToFields
 } from "./chunk-TQ3REHVF.js";
@@ -6,20 +9,17 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-P27Z66EB.js";
-import {
-  loadVaultPolicy
-} from "./chunk-T45LAT2Y.js";
+} from "./chunk-4I4UNXHM.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
   linkCollectionName,
   linkRowKey
-} from "./chunk-P3NGV5RV.js";
+} from "./chunk-V76PHWLE.js";
 import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-ULIHDPKL.js";
+  hashFields,
+  validateSatelliteDeclaration
+} from "./chunk-5JQMX2EH.js";
 import {
   loadFence
 } from "./chunk-YFF2RP3X.js";
@@ -29,7 +29,20 @@ import {
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-GOUNIHFA.js";
+} from "./chunk-CYWF3JJE.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-55LSDABW.js";
+import {
+  isBaseLive,
+  liveBaseIdSet
+} from "./chunk-GYGLAVCX.js";
+import {
+  CustodyApi,
+  NO_CARGO,
+  NO_CUSTODY
+} from "./chunk-GGFT2XFF.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -37,50 +50,45 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-P3V7JTB6.js";
+} from "./chunk-NL4HVTNO.js";
 import {
   NO_ATTESTATION
-} from "./chunk-Z7KI4WHR.js";
+} from "./chunk-LFGJG4XZ.js";
 import {
   NO_CLASSIFIED,
   enforceClassifiedWrite,
   resolveClassifiedFields
-} from "./chunk-AF5ZRTZ4.js";
+} from "./chunk-47C4CI7R.js";
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-VMJ5URU7.js";
+} from "./chunk-7A7LTSJR.js";
 import {
   NO_PORTABILITY
-} from "./chunk-N5YVZHCB.js";
-import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY
-} from "./chunk-7J7JRYXW.js";
+} from "./chunk-II6DLDZM.js";
 import {
   runDrainBarrier
-} from "./chunk-3Y4QLJ6K.js";
+} from "./chunk-EU7HDMT3.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-GZZL5R73.js";
+} from "./chunk-OCVO2V63.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-T65UZXR6.js";
+} from "./chunk-FCOZ7DEC.js";
 import {
   OverlayedCollection
-} from "./chunk-ZROMNP7Q.js";
+} from "./chunk-MOQ5M46U.js";
 import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-5MRE3C4Q.js";
+} from "./chunk-PLQCXH75.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-QNTEDPWP.js";
+} from "./chunk-6PALJTC2.js";
 import {
   IMPLICIT_LAZY,
   Lru,
@@ -93,7 +101,7 @@ import {
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-SEQ2JI3Y.js";
+} from "./chunk-WQAT24C2.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -104,7 +112,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-K5P46KB3.js";
+} from "./chunk-UZZFV3O3.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -114,7 +122,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-LPRPVCNY.js";
+} from "./chunk-3UUXDQPM.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -126,20 +134,21 @@ import {
   ensureCollectionDEK,
   hasAccess,
   hasWritePermission,
+  isSecretBearingReservedCollection,
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-VAWY44JW.js";
+} from "./chunk-WAL4MRBK.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-TB5RNNJ4.js";
+} from "./chunk-C6A2DPRE.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex
-} from "./chunk-M66NAZA4.js";
+} from "./chunk-TWJVOYU2.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -148,10 +157,10 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-O2DB4C3M.js";
+} from "./chunk-SXLMLECV.js";
 import {
   NO_SEALED_RECORD
-} from "./chunk-G7RDYYTE.js";
+} from "./chunk-XW5LZYV4.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
@@ -161,7 +170,7 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-OVO2RZAE.js";
+} from "./chunk-7AGLCOYE.js";
 import {
   buildTombstone,
   isTombstone
@@ -171,25 +180,25 @@ import {
 } from "./chunk-LN22XH4B.js";
 import {
   encrypt
-} from "./chunk-TLJOJBZD.js";
+} from "./chunk-5HZULLHE.js";
 import {
   NO_AGGREGATE,
   Query,
   ScanBuilder
-} from "./chunk-GBTUANXF.js";
+} from "./chunk-6Z435B6N.js";
 import {
   canonicalGroupKey
-} from "./chunk-P5WXDYMD.js";
+} from "./chunk-5GQE5IDB.js";
 import {
   moneyRuntime,
   readPath
-} from "./chunk-ZKF6HH7V.js";
+} from "./chunk-6P5AJ2ZS.js";
 import {
   getAtPath,
   resolvePolicy,
   setAtPathInPlace,
   stripI18nFilled
-} from "./chunk-4K3MQ5S3.js";
+} from "./chunk-BASCPHNM.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -216,6 +225,7 @@ import {
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError,
   ReservedCollectionNameError,
+  SatelliteConfigError,
   SchemaFenceError,
   StaticDictReadonlyError,
   StoreCapabilityError,
@@ -226,7 +236,7 @@ import {
   UnknownDictCodeError,
   UnsupportedIndexOptionError,
   ValidationError
-} from "./chunk-U23JUUPX.js";
+} from "./chunk-OJ64XMPJ.js";
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
@@ -1059,7 +1069,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
+      ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1349,7 +1359,7 @@ function resolveCollectionConfig(opts) {
 // src/with-formula/computed/lazy.ts
 var fn = null;
 async function loadEvalComputedFields() {
-  fn ??= (await import("./computed-BMMEFRFJ.js")).evalComputedFields;
+  fn ??= (await import("./computed-6FOFXQPE.js")).evalComputedFields;
   return fn;
 }
 
@@ -2187,7 +2197,7 @@ var Collection = class {
     }
     await this.onAccess?.("find", "*");
     if (hits.length === 0) return [];
-    const { verifyDigestField } = await import("./verify-YB5LQHNA.js");
+    const { verifyDigestField } = await import("./verify-CAYGXYNO.js");
     const policy = {
       normalize: spec.verifyNormalize ?? "password",
       notLastN: spec.notLastN ?? 0,
@@ -2363,7 +2373,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-COBBJORL.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2926,7 +2936,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-XWPD5PIM.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2935,7 +2945,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-7Q62KVI3.js");
+          staleHelpers = await import("./stale-COBBJORL.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3120,7 +3130,7 @@ var Collection = class {
         continue;
       }
       if (DerivationExecutor === null) {
-        ({ DerivationExecutor } = await import("./executor-CBTNU5VZ.js"));
+        ({ DerivationExecutor } = await import("./executor-EUPYHCLU.js"));
       }
       for (const run of runs) {
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -3139,7 +3149,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-SSEW7BQB.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3492,7 +3502,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-WS22Q5WH.js");
+          helpers = await import("./fanout-sidecar-SSEW7BQB.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3526,7 +3536,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-FGISLQIN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-XWPD5PIM.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3535,7 +3545,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-7Q62KVI3.js");
+          staleHelpers = await import("./stale-COBBJORL.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3558,7 +3568,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-7Q62KVI3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-COBBJORL.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4192,6 +4202,15 @@ var Collection = class {
   _invalidateCekCacheEntry(id) {
     this.cekCache?.remove(id);
   }
+  /** @internal Satellite fan-out revert cleanup (spec #591): drop the sync dirty entry ('revert' is
+   *  onDirty-channel-only) and re-announce the RESTORED state as a plain put/delete — `subscribe()`
+   *  only understands those two actions, and the restored record may exist again. */
+  async _compensateRevertedWrite(id) {
+    await this._invalidateCacheEntry(id);
+    await this.onDirty?.(this.name, id, "revert", 0);
+    const restored = await this.get(id);
+    this.emitter.emit("change", { vault: this.vault, collection: this.name, id, action: restored !== null ? "put" : "delete" });
+  }
   async _invalidateCacheEntry(id) {
     if (this.lazy && this.lru) {
       this.lru.remove(id);
@@ -4703,14 +4722,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./config-drift-KGM7ZRW4.js");
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-SWZNEH5H.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-KGM7ZRW4.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-SWZNEH5H.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5757,7 +5776,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-UQEIYQAM.js").then(
+  const load = () => engine ??= import("./link-set-HJOC7GB7.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -5771,6 +5790,423 @@ function makeLazyLinkSetHandle(d) {
   };
 }
 
+// src/with-shape/satellites/registry.ts
+var SatelliteRegistry = class {
+  byBase = /* @__PURE__ */ new Map();
+  bySat = /* @__PURE__ */ new Map();
+  byJoin = /* @__PURE__ */ new Map();
+  poisoned = /* @__PURE__ */ new Map();
+  locks = /* @__PURE__ */ new Map();
+  register(spec) {
+    if (this.byBase.has(spec.base)) {
+      throw new SatelliteConfigError(`R-S1: base "${spec.base}" already has satellite "${this.byBase.get(spec.base).satellite}" \u2014 v1 allows exactly one satellite per base.`);
+    }
+    if (this.byBase.has(spec.satellite)) {
+      throw new SatelliteConfigError(`R-S3: "${spec.satellite}" is itself registered as a base (of "${this.byBase.get(spec.satellite).satellite}") \u2014 no satellite-of-satellite chains.`);
+    }
+    const taken = (n) => this.byBase.has(n) || this.bySat.has(n) || this.byJoin.has(n);
+    if (spec.joined !== void 0 && taken(spec.joined)) {
+      throw new SatelliteConfigError(`R-S5: joined name "${spec.joined}" collides with an existing pair member or joined name.`);
+    }
+    this.byBase.set(spec.base, spec);
+    this.bySat.set(spec.satellite, spec);
+    if (spec.joined !== void 0) this.byJoin.set(spec.joined, spec);
+  }
+  satelliteOf(base) {
+    return this.byBase.get(base) ?? null;
+  }
+  bySatellite(name) {
+    return this.bySat.get(name) ?? null;
+  }
+  byJoined(name) {
+    return this.byJoin.get(name) ?? null;
+  }
+  isPairMember(name) {
+    return this.byBase.has(name) || this.bySat.has(name);
+  }
+  allSpecs() {
+    return [...this.byBase.values()];
+  }
+  expandNames(names) {
+    const out = new Set(names);
+    for (const n of names) {
+      const asBase = this.byBase.get(n);
+      if (asBase) out.add(asBase.satellite);
+      const asSat = this.bySat.get(n);
+      if (asSat) out.add(asSat.base);
+    }
+    return [...out];
+  }
+  poison(satellite, reason) {
+    this.poisoned.set(satellite, reason);
+  }
+  assertNotPoisoned(satellite) {
+    const reason = this.poisoned.get(satellite);
+    if (reason !== void 0) throw new SatelliteConfigError(reason);
+  }
+  /** Per-base async mutex: chains sections on a stored promise tail. */
+  async withPairLock(base, fn2) {
+    const tail = this.locks.get(base) ?? Promise.resolve();
+    let release;
+    const gate = new Promise((res) => {
+      release = res;
+    });
+    this.locks.set(base, tail.then(() => gate));
+    await tail;
+    try {
+      return await fn2();
+    } finally {
+      release();
+    }
+  }
+};
+
+// src/with-shape/satellites/declare.ts
+function declareSatellite(ctx, collectionName, options, existingRegistry) {
+  if (existingRegistry !== null) {
+    const existing = existingRegistry.bySatellite(collectionName);
+    if (existing) {
+      const same = existing.base === options.satelliteOf && hashFields(existing.fields) === hashFields(options.fields ?? []) && (existing.joined ?? null) === (options.joined ?? null);
+      if (!same) {
+        throw new SatelliteConfigError(`R-S9: "${collectionName}" re-declared divergently within this session (base/fields/joined mismatch).`);
+      }
+      return existingRegistry;
+    }
+  }
+  const spec = validateSatelliteDeclaration({
+    satellite: collectionName,
+    satelliteOf: options.satelliteOf,
+    fields: options.fields,
+    joined: options.joined,
+    baseIsSatellite: (existingRegistry?.bySatellite(options.satelliteOf) ?? null) !== null,
+    // R-S8 direction (i): refuse if EITHER this declaration sets crdt, OR the
+    // base was already constructed with crdt mode before this pairing.
+    crdtMode: options.crdt !== void 0 || ctx.getBaseCrdt(options.satelliteOf) !== void 0,
+    joinedCollidesWithCollection: options.joined !== void 0 && ctx.collectionExists(options.joined)
+  });
+  if (ctx.forgetSubjects[spec.base] !== void 0 && options.perRecordKeys !== true) {
+    throw new SatelliteConfigError(`R-S7: satellite "${collectionName}" of forget-covered base "${spec.base}" must declare perRecordKeys.`);
+  }
+  let reg = existingRegistry;
+  if (reg === null) {
+    const created = new SatelliteRegistry();
+    ctx.registerPoisonHook((e) => {
+      if (e.vault === ctx.vaultName) created.assertNotPoisoned(e.collection);
+    });
+    ctx.forEachSyncEngine((e) => e.setPairExpander((names) => created.expandNames(names)));
+    reg = created;
+  }
+  reg.register(spec);
+  ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
+  const registry = reg;
+  const baseSchema = ctx.getBaseSchema(spec.base);
+  void import("./post-register-BIXGCZ2M.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  });
+  return reg;
+}
+
+// src/with-shape/satellites/raw-target.ts
+var RAW_TARGET = /* @__PURE__ */ Symbol("noydb.satellite.rawTarget");
+
+// src/with-shape/satellites/fanout.ts
+function unwrap(handle) {
+  return handle[RAW_TARGET] ?? handle;
+}
+async function revertAndCompensate(deps, executed) {
+  for (const leg of [...executed].reverse()) {
+    try {
+      if (leg.prior !== null) await deps.adapter.put(deps.vaultName, leg.coll, leg.id, leg.prior);
+      else await deps.adapter.delete(deps.vaultName, leg.coll, leg.id);
+      await leg.handle._compensateRevertedWrite(leg.id);
+    } catch {
+    }
+  }
+}
+async function joinedPut(deps, id, record) {
+  deps.registry.assertNotPoisoned(deps.spec.satellite);
+  const base = unwrap(deps.base());
+  const satellite = unwrap(deps.satellite());
+  const satFields = new Set(deps.spec.fields);
+  const baseRec = {};
+  const satRec = {};
+  for (const [k, v] of Object.entries(record)) (satFields.has(k) ? satRec : baseRec)[k] = v;
+  await base.validateInput(baseRec);
+  await satellite.validateInput(satRec);
+  return deps.registry.withPairLock(deps.spec.base, async () => {
+    const executed = [];
+    const run = async (handle, coll, rec) => {
+      executed.push({ coll, id, prior: await deps.adapter.get(deps.vaultName, coll, id), handle });
+      await handle.put(id, rec);
+    };
+    try {
+      await run(base, deps.spec.base, baseRec);
+      await run(satellite, deps.spec.satellite, satRec);
+    } catch (err) {
+      await revertAndCompensate(deps, executed);
+      throw err;
+    }
+  });
+}
+async function pairDelete(deps, id) {
+  const base = unwrap(deps.base());
+  const satellite = unwrap(deps.satellite());
+  return deps.registry.withPairLock(deps.spec.base, async () => {
+    const executed = [];
+    const run = async (handle, coll) => {
+      executed.push({ coll, id, prior: await deps.adapter.get(deps.vaultName, coll, id), handle });
+      await handle.delete(id);
+    };
+    try {
+      await run(satellite, deps.spec.satellite);
+      await run(base, deps.spec.base);
+    } catch (err) {
+      await revertAndCompensate(deps, executed);
+      throw err;
+    }
+  });
+}
+
+// src/with-shape/satellites/proxy.ts
+async function listWithIds(target) {
+  const records = await target.list();
+  const ids = [...target.cache.keys()];
+  const out = [];
+  for (let i = 0; i < records.length; i++) {
+    const id = ids[i];
+    if (id !== void 0) out.push([id, records[i]]);
+  }
+  return out;
+}
+async function filterLiveHits(hits, adapter, vaultName, base) {
+  const live = await Promise.all(hits.map((h) => isBaseLive(adapter, vaultName, base, h.id)));
+  return hits.filter((_, i) => live[i]);
+}
+function makeSatelliteProxy(target, spec, registry) {
+  const adapter = target.adapter;
+  const vaultName = target.vault;
+  const queryNotExistenceFiltered = () => {
+    throw new SatelliteConfigError(
+      `satellite "${spec.satellite}": query() is not existence-filtered. Query's terminal methods (toArray/first/count) read the in-memory cache synchronously, while existence authority (\xA7 Convergence & existence authority, rule 1) requires an async, undecrypted check against live base state \u2014 the two shapes don't compose without either breaking query()'s synchronous contract or accepting a check that misses out-of-band base mutations. Use list() (or get()) for existence-safe reads on satellite collections.`
+    );
+  };
+  const getOne = async (id) => {
+    if (!await isBaseLive(adapter, vaultName, spec.base, id)) return null;
+    return target.get(id);
+  };
+  const putOne = async (id, record) => {
+    return registry.withPairLock(spec.base, async () => {
+      registry.assertNotPoisoned(spec.satellite);
+      if (!await isBaseLive(adapter, vaultName, spec.base, id)) {
+        throw new SatelliteConfigError(
+          `R-S6: satellite "${spec.satellite}" put for "${id}" with no live base record in "${spec.base}" \u2014 create the base first (or write through the joined handle).`
+        );
+      }
+      return target.put(id, record);
+    });
+  };
+  const overrides = {
+    get: getOne,
+    async list() {
+      const live = await liveBaseIdSet(adapter, vaultName, spec.base);
+      const pairs = await listWithIds(target);
+      return pairs.filter(([id]) => live.has(id)).map(([, record]) => record);
+    },
+    query: queryNotExistenceFiltered,
+    put: putOne,
+    // #591 review I1: the real `getMany` loops `this.get(id)` bound to the raw
+    // target, never this proxy's existence-filtered `get` — same Map<id, T|null>
+    // shape, built from the overridden single-get instead.
+    async getMany(ids) {
+      const result = /* @__PURE__ */ new Map();
+      for (const id of ids) result.set(id, await getOne(id));
+      return result;
+    },
+    // #591 review I1: the real `putMany` (non-atomic) loops `this.put(id, record)`
+    // bound to the raw target, bypassing R-S6/pair-lock/poison per item; looping
+    // through the overridden single-put here restores that per-item enforcement
+    // while preserving the real putMany's { ok, success, failures } shape — a
+    // refused item becomes a failure entry, not a thrown error. Atomic mode is a
+    // single transaction by design (looping per-item `put` would break its
+    // all-or-nothing revert guarantee), so instead the WHOLE call is refused
+    // with R-S6 up front, under the pair lock + poison check, if any id lacks a
+    // live base — only then does it delegate to the real atomic executor.
+    async putMany(entries, options) {
+      if (options?.atomic) {
+        return registry.withPairLock(spec.base, async () => {
+          registry.assertNotPoisoned(spec.satellite);
+          for (const [id] of entries) {
+            if (!await isBaseLive(adapter, vaultName, spec.base, id)) {
+              throw new SatelliteConfigError(
+                `R-S6: satellite "${spec.satellite}" putMany(atomic) refused \u2014 "${id}" has no live base record in "${spec.base}".`
+              );
+            }
+          }
+          return target.putMany(entries, options);
+        });
+      }
+      const success = [];
+      const failures = [];
+      for (const [id, record] of entries) {
+        try {
+          await putOne(id, record);
+          success.push(id);
+        } catch (error) {
+          failures.push({ id, error });
+        }
+      }
+      return { ok: failures.length === 0, success, failures };
+    },
+    // No `deleteMany` override: the real `deleteMany` loops the raw
+    // `this.delete(id)` too, but this proxy never overrides single `delete`
+    // (satellite delete is legal, unguarded — see makeBaseProxy for the leg
+    // that DOES need fan-out) — there is nothing for a bulk delete to bypass.
+    // #591 Task 9: search/retrieve/similarTo answer from the search facade's
+    // own cache/index (never the get/list overrides above), so they need
+    // their own existence post-filter — every retrieval surface the facade
+    // exposes is covered here.
+    async search(field, query, opts) {
+      const hits = await target.search(field, query, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    async retrieve(query, opts) {
+      const hits = await target.retrieve(query, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    async similarTo(vector, opts) {
+      const hits = await target.similarTo(vector, opts);
+      return filterLiveHits(hits, adapter, vaultName, spec.base);
+    },
+    // #591 Task 9 review fix: findByDet/queryByDet scan envelopes straight
+    // off the adapter (kernel/enclave/record-keys/deterministic.ts) and
+    // return BARE records (no id), so a post-filter can't correlate a match
+    // back to its base row. Instead the scan itself is scoped: re-run the
+    // same det functions over the collection's own DeterministicContext
+    // (`detContext()` is private like `adapter`/`cache` above) with its
+    // `adapter.list` narrowed to live-base ids — a dead-base match is then
+    // never visited, so findByDet correctly continues to a later live match
+    // rather than short-circuiting on a ghost.
+    async findByDet(field, value) {
+      return findByDet(liveScopedDetContext(), field, value);
+    },
+    async queryByDet(field, value) {
+      return queryByDet(liveScopedDetContext(), field, value);
+    }
+  };
+  const liveScopedDetContext = () => {
+    const ctx = target.detContext();
+    const raw = ctx.adapter;
+    return {
+      ...ctx,
+      adapter: {
+        ...raw,
+        get: raw.get.bind(raw),
+        async list(v, c) {
+          const ids = await raw.list(v, c);
+          const live = await Promise.all(ids.map((id) => isBaseLive(adapter, vaultName, spec.base, id)));
+          return ids.filter((_, i) => live[i]);
+        }
+      }
+    };
+  };
+  return new Proxy(target, {
+    get(t, prop, _recv) {
+      if (prop === RAW_TARGET) return t;
+      if (typeof prop === "string" && prop in overrides) return overrides[prop];
+      const v = Reflect.get(t, prop, t);
+      return typeof v === "function" ? v.bind(t) : v;
+    }
+  });
+}
+function makeBaseProxy(target, spec, registry, satellite) {
+  const adapter = target.adapter;
+  const vaultName = target.vault;
+  const deleteOne = async (id) => {
+    return pairDelete({ spec, base: () => target, satellite, adapter, vaultName, registry }, id);
+  };
+  const overrides = {
+    delete: deleteOne,
+    async deleteMany(ids) {
+      const success = [];
+      const failures = [];
+      for (const id of ids) {
+        try {
+          await deleteOne(id);
+          success.push(id);
+        } catch (error) {
+          failures.push({ id, error });
+        }
+      }
+      return { ok: failures.length === 0, success, failures };
+    }
+  };
+  return new Proxy(target, {
+    get(t, prop, _recv) {
+      if (prop === RAW_TARGET) return t;
+      if (typeof prop === "string" && prop in overrides) return overrides[prop];
+      const v = Reflect.get(t, prop, t);
+      return typeof v === "function" ? v.bind(t) : v;
+    }
+  });
+}
+
+// src/with-shape/satellites/joined.ts
+function makeJoinedHandle(spec, deps) {
+  const base = () => deps.base();
+  const satellite = () => deps.satellite();
+  const adapter = deps.adapter;
+  const nullSat = () => Object.fromEntries(spec.fields.map((f) => [f, null]));
+  const merge = (b, s) => ({ ...nullSat(), ...s ?? {}, ...b });
+  return {
+    async get(id) {
+      if (!await isBaseLive(adapter, deps.vaultName, spec.base, id)) return null;
+      const b = await base().get(id);
+      if (b === null) return null;
+      const s = await satellite().get(id);
+      return merge(b, s);
+    },
+    async put(id, record) {
+      await joinedPut(deps, id, record);
+    },
+    async delete(id) {
+      await pairDelete(deps, id);
+    },
+    async list() {
+      const live = await liveBaseIdSet(adapter, deps.vaultName, spec.base);
+      const pairs = await listWithIds(base());
+      const out = [];
+      for (const [id, b] of pairs) {
+        if (!live.has(id)) continue;
+        out.push(merge(b, await satellite().get(id)));
+      }
+      return out;
+    },
+    async describe() {
+      const [b, s] = await Promise.all([base().describe({}), satellite().describe({})]);
+      return {
+        collection: spec.joined ?? `${spec.base}+${spec.satellite}`,
+        fields: [...b.fields, ...s.fields],
+        meta: { label: spec.joined ?? spec.base }
+      };
+    }
+  };
+}
+
+// src/with-shape/satellites/forget.ts
+function expandRefsWithSatellites(refs, registry) {
+  if (registry === null) return refs;
+  const out = [];
+  let anySat = false;
+  for (const ref2 of refs) {
+    const spec = registry.satelliteOf(ref2.collection);
+    if (spec) {
+      anySat = true;
+      out.push({ collection: spec.satellite, id: ref2.id, satelliteOf: ref2.collection });
+    }
+    out.push(ref2);
+  }
+  return anySat ? out : refs;
+}
+
 // src/with-shape/schema-update/gate.ts
 var SchemaUpdateGate = class {
   #decision;
@@ -6109,6 +6545,8 @@ var Vault = class {
    */
   reloadKeyring;
   collectionCache = /* @__PURE__ */ new Map();
+  satelliteRegistry = null;
+  // spec #591, archetype-③
   /** Vault-level schema cutover fence/controller. */
   schemaFence;
   /** Per-client heartbeat/watcher; started lazily on cutover registration. */
@@ -6397,6 +6835,32 @@ var Vault = class {
     if (isLinkCollectionName(collectionName)) {
       throw new ReservedCollectionNameError(collectionName);
     }
+    if (isSecretBearingReservedCollection(collectionName)) {
+      throw new ReservedCollectionNameError(collectionName);
+    }
+    if (this.satelliteRegistry?.byJoined(collectionName)) {
+      throw new SatelliteConfigError(`"${collectionName}" is a joined handle \u2014 use vault.joined('${collectionName}'), not vault.collection().`);
+    }
+    if (options?.crdt !== void 0 && this.satelliteRegistry?.isPairMember(collectionName)) {
+      throw new SatelliteConfigError("R-S8: crdtMode is refused on either member of a satellite pair in v1 (revert cannot compensate a merge).");
+    }
+    if (options?.satelliteOf !== void 0) {
+      this.satelliteRegistry = declareSatellite({
+        adapter: this.adapter,
+        vaultName: this.name,
+        forgetSubjects: this.forgetStrategy.subjects,
+        getDEK: this.getDEK,
+        getBaseSchema: (base) => this.collectionCache.get(base)?.getSchema(),
+        getBaseCrdt: (base) => this.collectionCache.get(base)?.getConfig()?.crdt,
+        collectionExists: (name) => this.collectionCache.has(name),
+        registerPoisonHook: (hook) => {
+          this.noydb._writeHooks.onBeforeWrite(hook);
+        },
+        forEachSyncEngine: (fn2) => {
+          this.noydb._forEachSyncEngine(this.name, fn2);
+        }
+      }, collectionName, { ...options, satelliteOf: options.satelliteOf }, this.satelliteRegistry);
+    }
     let coll = this.collectionCache.get(collectionName);
     if (coll && options?.moneyFields) {
       coll._applyMoneyFields(options.moneyFields);
@@ -6457,7 +6921,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-K6DDSIXN.js");
+          const { persistSchemaIfNeeded } = await import("./register-OVONZ2MJ.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -6636,7 +7100,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-K6DDSIXN.js")).persistSchemaIfNeeded({
+            await (await import("./register-OVONZ2MJ.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -6652,8 +7116,27 @@ var Vault = class {
         this._pendingSchemaWrites.push(work);
       }
     }
+    if (this.satelliteRegistry) {
+      const spec = this.satelliteRegistry.bySatellite(collectionName);
+      if (spec) return makeSatelliteProxy(coll, spec, this.satelliteRegistry);
+      const baseSpec = this.satelliteRegistry.satelliteOf(collectionName);
+      if (baseSpec) return makeBaseProxy(coll, baseSpec, this.satelliteRegistry, () => this.collection(baseSpec.satellite));
+    }
     return coll;
   }
+  /** Full-record handle for a satellite pair registered with `joined:` (spec #591). Narrow type — not a Collection. */
+  joined(name) {
+    const spec = this.satelliteRegistry?.byJoined(name);
+    if (!spec) throw new SatelliteConfigError(`No joined handle "${name}" is registered \u2014 declare it via collection(satellite, { joined: '${name}' }).`);
+    return makeJoinedHandle(spec, {
+      spec,
+      base: () => this.collection(spec.base),
+      satellite: () => this.collection(spec.satellite),
+      adapter: this.adapter,
+      vaultName: this.name,
+      registry: this.satelliteRegistry
+    });
+  }
   /**
    * Await all background persisted-schema writes triggered by
    * `collection({ persistJsonSchema: true })` calls on this vault.
@@ -7460,6 +7943,7 @@ var Vault = class {
       throw new ForgetStrategyNotConfiguredError();
     }
     const refs = await lookupSubject(this.adapter, this.name, this.getDEK, this.encrypted, subjectId);
+    const allRefs = expandRefsWithSatellites(refs, this.satelliteRegistry);
     let recordsShredded = 0;
     let historyVersionsShredded = 0;
     const collections = /* @__PURE__ */ new Set();
@@ -7475,9 +7959,10 @@ var Vault = class {
     const indexResidue = [];
     const blobsEnabled = this.blobStrategy !== void 0;
     const actor = this.keyring.userId;
-    for (const ref2 of refs) {
+    for (const ref2 of allRefs) {
       const coll = this.collection(ref2.collection);
-      const perRecordKeys = this.forgetStrategy.subjects[ref2.collection] !== void 0;
+      const satelliteOf = ref2.satelliteOf;
+      const perRecordKeys = this.forgetStrategy.subjects[satelliteOf ?? ref2.collection] !== void 0;
       const live = await this.adapter.get(this.name, ref2.collection, ref2.id);
       if (perRecordKeys && live && live._data && !hasPerRecordKey(live)) {
         unmigratedRecords.push(`${ref2.collection}:${ref2.id}`);
@@ -7509,7 +7994,17 @@ var Vault = class {
       } catch {
         sealedCekResidue.push(`${ref2.collection}:${ref2.id}`);
       }
-      const shred = await coll._writeTombstone(ref2.id, actor);
+      let shred;
+      try {
+        shred = await coll._writeTombstone(ref2.id, actor);
+      } catch (cause) {
+        if (satelliteOf === void 0) throw cause;
+        throw new SatelliteConfigError(
+          // R-S4: abort the whole forget rather than leave the heavy side un-erased
+          `R-S4: forget could not fan out to satellite "${ref2.collection}" \u2014 aborting rather than leaving the heavy side`,
+          { cause }
+        );
+      }
       if (shred !== null) {
         recordsShredded++;
         collections.add(ref2.collection);
@@ -7719,7 +8214,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-IMNMHWTM.js"),
+      import("./registry-D5J7SVJ2.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -7750,7 +8245,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-K6VUQXKV.js");
+    const { MaterializedViewRegistry } = await import("./registry-AIEYUOSG.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -7774,7 +8269,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-ZVO3T4M5.js");
+    const { OverlayedViewRegistry } = await import("./registry-HSNQ4NBP.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -7821,13 +8316,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-FGISLQIN.js");
+    const { MaterializedViewExecutor } = await import("./executor-XWPD5PIM.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-7Q62KVI3.js");
+    const { clearMVStale } = await import("./stale-COBBJORL.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -7843,7 +8338,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-CBTNU5VZ.js");
+    const { DerivationExecutor } = await import("./executor-EUPYHCLU.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.derivationFacade ?? new (await import("./read-only-facade-5ADRJVTM.js")).ReadOnlyVaultFacade(this, "derivation") };
@@ -7868,7 +8363,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WS22Q5WH.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-SSEW7BQB.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8090,7 +8585,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-AUY42TGU.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8112,7 +8607,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-BQNIEHZE.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-AUY42TGU.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8328,7 +8823,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-5C3GPKT2.js");
+    const { dumpVaultSchema } = await import("./walk-CVNXFUEF.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -8463,7 +8958,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-6UBQ4IUY.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -8478,7 +8973,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-MOB27UUN.js");
+    const { dumpVault } = await import("./backup-Y3RMFGVX.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -8530,7 +9025,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-MOB27UUN.js");
+    const { loadVault } = await import("./backup-Y3RMFGVX.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -8562,7 +9057,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-MOB27UUN.js");
+    const { verifyBackupIntegrity } = await import("./backup-Y3RMFGVX.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -8780,7 +9275,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-MOB27UUN.js");
+    const { exportVaultJSON } = await import("./backup-Y3RMFGVX.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10652,7 +11147,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-DJHNSTIR.js");
+      const { GuardExecutor } = await import("./executor-KZ4B3PRT.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -10817,7 +11312,8 @@ var Noydb = class {
       onDirty: targets.length > 0 ? async (coll, id, action, version) => {
         for (const [key, engine] of this.syncEngines) {
           if (key === name || key.startsWith(`${name}::`)) {
-            void engine.trackChange(coll, id, action, version);
+            if (action === "revert") void engine.removeDirty(coll, id);
+            else void engine.trackChange(coll, id, action, version);
           }
         }
       } : void 0,
@@ -11483,6 +11979,9 @@ var Noydb = class {
     }
     return engine;
   }
+  _forEachSyncEngine(vault, fn2) {
+    for (const [key, engine] of this.syncEngines) if (key === vault || key.startsWith(`${vault}::`)) fn2(engine);
+  }
   // ─── Events ────────────────────────────────────────────────────
   on(event, handler) {
     this.emitter.on(event, handler);
@@ -11905,7 +12404,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-MRN5YYZZ.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-6UBQ4IUY.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -11934,7 +12433,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-MRN5YYZZ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-6UBQ4IUY.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12125,9 +12624,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JOXUNSKP.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-OQ65LUSK.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-YIKUH4AD.js");
+    const policyModule = await import("./policy-3ZKSGSRK.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12162,4 +12661,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-ZPHDGUZZ.js.map
+//# sourceMappingURL=chunk-D6ADQ4QL.js.map