@noy-db/hub 0.2.0-pre.17 → 0.2.0-pre.18

package/dist/derivations/index.d.cts

@@ -1,13 +1,13 @@
-export { w as withDerivation } from '../with-derivation-Bozs8DmD.cjs';
-import { aK as DerivationStrategy, aL as DerivationContext } from '../types-CrSpRDuG.cjs';
-export { aM as ArrayOutputSpec, aN as DerivationRegistry, aO as DerivationStrategyHandle, aP as DerivedFromMeta, aQ as OutputSpec, aR as RecordOutputSpec } from '../types-CrSpRDuG.cjs';
-export { h as DerivationCapExceededError, i as DerivationCycleError, j as DerivationDepthError, k as DerivationOutputShapeError, l as DerivationOutputUnknownError } from '../errors-Dz64FA65.cjs';
+export { w as withDerivation, a as withRollup } from '../with-rollup-Bopu5UDZ.cjs';
+import { aK as DerivationStrategy, aL as DerivationContext } from '../types-BpLPqyaO.cjs';
+export { aM as ArrayOutputSpec, aN as DerivationRegistry, aO as DerivationStrategyHandle, aP as DerivedFromMeta, aQ as OutputSpec, aR as RecordOutputSpec } from '../types-BpLPqyaO.cjs';
+export { i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError } from '../errors-DUTlAt3Y.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
-import '../strategy-CLC1j79g.cjs';
+import '../strategy-nuyN8K5N.cjs';
 import '../strategy-BSxFXGzb.cjs';
 import '../index-C-SSRIxP.cjs';
-import '../index-u-kWzSrL.cjs';
+import '../index-C6lgoUhK.cjs';
 import '@noy-db/attestation';
 
 interface RunResult {

package/dist/derivations/index.d.ts

@@ -1,13 +1,13 @@
-export { w as withDerivation } from '../with-derivation-BZ2y4bzF.js';
-import { aK as DerivationStrategy, aL as DerivationContext } from '../types-CljIHm_J.js';
-export { aM as ArrayOutputSpec, aN as DerivationRegistry, aO as DerivationStrategyHandle, aP as DerivedFromMeta, aQ as OutputSpec, aR as RecordOutputSpec } from '../types-CljIHm_J.js';
-export { h as DerivationCapExceededError, i as DerivationCycleError, j as DerivationDepthError, k as DerivationOutputShapeError, l as DerivationOutputUnknownError } from '../errors-Dz64FA65.js';
+export { w as withDerivation, a as withRollup } from '../with-rollup-DrlGkxiE.js';
+import { aK as DerivationStrategy, aL as DerivationContext } from '../types-Diqc2caK.js';
+export { aM as ArrayOutputSpec, aN as DerivationRegistry, aO as DerivationStrategyHandle, aP as DerivedFromMeta, aQ as OutputSpec, aR as RecordOutputSpec } from '../types-Diqc2caK.js';
+export { i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError } from '../errors-DUTlAt3Y.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
-import '../strategy-4M9jo172.js';
+import '../strategy-Diwh5lzS.js';
 import '../strategy-BSxFXGzb.js';
 import '../index-C-SSRIxP.js';
-import '../index-DpU6KWof.js';
+import '../index-DP1JTWHZ.js';
 import '@noy-db/attestation';
 
 interface RunResult {

package/dist/derivations/index.js

@@ -1,19 +1,20 @@
 import {
-  withDerivation
-} from "../chunk-PDULVIBY.js";
+  withDerivation,
+  withRollup
+} from "../chunk-YWYW2YNO.js";
 import {
   DerivationRegistry
-} from "../chunk-GP3SDSH2.js";
+} from "../chunk-KQ523X3A.js";
 import {
   DerivationExecutor
-} from "../chunk-XJV6OB4D.js";
+} from "../chunk-33DAO2XG.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-ZEGSDPB7.js";
+} from "../chunk-HMFC6M2G.js";
 export {
   DerivationCapExceededError,
   DerivationCycleError,
@@ -22,6 +23,7 @@ export {
   DerivationOutputShapeError,
   DerivationOutputUnknownError,
   DerivationRegistry,
-  withDerivation
+  withDerivation,
+  withRollup
 };
 //# sourceMappingURL=index.js.map

package/dist/{dev-unlock-iXbYFAWl.d.cts → dev-unlock-3_2b_vo6.d.cts}

@@ -1,4 +1,4 @@
-import { a$ as Role, b0 as UnlockedKeyring } from './types-CrSpRDuG.cjs';
+import { a$ as Role, b0 as UnlockedKeyring } from './types-BpLPqyaO.cjs';
 
 /**
  * Session tokens —

package/dist/{dev-unlock-CI1ijTML.d.ts → dev-unlock-BMvwPr_E.d.ts}

@@ -1,4 +1,4 @@
-import { a$ as Role, b0 as UnlockedKeyring } from './types-CljIHm_J.js';
+import { a$ as Role, b0 as UnlockedKeyring } from './types-Diqc2caK.js';
 
 /**
  * Session tokens —

package/dist/{errors-Dz64FA65.d.ts → errors-DUTlAt3Y.d.cts}

@@ -398,6 +398,21 @@ declare class FieldFrozenError extends NoydbError {
     readonly fields: readonly string[];
     constructor(collection: string, id: string, fields: readonly string[]);
 }
+/**
+ * Thrown by a `transitionGuard` when a write moves a state field along an
+ * arc that the declared transition graph does not allow — either an
+ * update `from → to` that is not a listed edge, or an insert whose
+ * initial state is not in the allowed `initial` set (reported with
+ * `from: '(none)'`). Override via an amendment transaction by an
+ * authorized role, like any guard.
+ */
+declare class IllegalTransitionError extends NoydbError {
+    readonly collection: string;
+    readonly id: string;
+    readonly from: string;
+    readonly to: string;
+    constructor(collection: string, id: string, from: string, to: string);
+}
 /**
  * Thrown by an amendment invariant when the proposed change-set violates
  * the declared business rule (e.g. disbursement total not preserved).
@@ -1416,4 +1431,4 @@ declare class RecordCekNotFoundError extends NoydbError {
     constructor(collection: string, id: string);
 }
 
-export { ForgetStrategyNotConfiguredError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, MaterializedViewSourceUnknownError as C, DictKeyInUseError as D, MaterializedViewTooLargeError as E, FieldFrozenError as F, AlreadyElevatedError as G, ConflictError as H, InvariantError as I, CrossJoinSourceUnknownError as J, CrossJoinTooLargeError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, DanglingReferenceError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, DecryptionError as V, DelegationTargetMissingError as W, DirectoryDisabledError as X, ElevationExpiredError as Y, ExportCapabilityError as Z, FilenameSanitizationError as _, DictKeyMissingError as a, GroupCardinalityError as a0, ImportCapabilityError as a1, IndexRequiredError as a2, IndexWriteFailureError as a3, InvalidKeyError as a4, JoinTooLargeError as a5, KeyringCorruptError as a6, KeyringExpiredError as a7, LedgerContentionError as a8, MigrationRequiredError as a9, UniqueConstraintError as aA, UnknownShardError as aB, UnsupportedIndexOptionError as aC, ValidationError as aD, VaultTemplateNotFoundError as aE, NetworkError as aa, NoAccessError as ab, NonAdditiveSchemaChangeError as ac, NotFoundError as ad, NumberingUncertaintyError as ae, PathEscapeError as af, PeriodClosedError as ag, PermissionDeniedError as ah, PrivilegeEscalationError as ai, QuiesceTimeoutError as aj, ReadOnlyAtInstantError as ak, ReadOnlyError as al, ReadOnlyFrameError as am, RecordCekNotFoundError as an, ReservedVaultNameError as ao, SchemaFenceError as ap, SchemaLockedError as aq, SchemaUpdateError as ar, SchemaValidationError as as, SequenceContentionError as at, SequenceOfflineError as au, ShardProvisioningError as av, StoreCapabilityError as aw, TamperedError as ax, TierDemoteDeniedError as ay, TierNotGrantedError as az, StaticDictReadonlyError as b, SessionExpiredError as c, SessionNotFoundError as d, SessionPolicyError as e, RecordLockedError as f, SnapshotNotFoundError as g, DerivationCapExceededError as h, DerivationCycleError as i, DerivationDepthError as j, DerivationOutputShapeError as k, DerivationOutputUnknownError as l, OverlayCollectionUnavailableError as m, OverlayIdMismatchError as n, OverlayNameCollisionError as o, SealedRecordExpiredError as p, SealedRecordMismatchError as q, AttestationError as r, AdoptionStateError as s, BackupLedgerError as t, BundleIntegrityError as u, BundleSealMismatchError as v, BundleVersionConflictError as w, TransferSealError as x, MaterializedViewConfigError as y, MaterializedViewCycleError as z };
+export { FilenameSanitizationError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, MaterializedViewCycleError as C, DictKeyInUseError as D, MaterializedViewSourceUnknownError as E, FieldFrozenError as F, MaterializedViewTooLargeError as G, AlreadyElevatedError as H, IllegalTransitionError as I, ConflictError as J, CrossJoinSourceUnknownError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, CrossJoinTooLargeError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, DanglingReferenceError as V, DecryptionError as W, DelegationTargetMissingError as X, DirectoryDisabledError as Y, ElevationExpiredError as Z, ExportCapabilityError as _, DictKeyMissingError as a, ForgetStrategyNotConfiguredError as a0, GroupCardinalityError as a1, ImportCapabilityError as a2, IndexRequiredError as a3, IndexWriteFailureError as a4, InvalidKeyError as a5, JoinTooLargeError as a6, KeyringCorruptError as a7, KeyringExpiredError as a8, LedgerContentionError as a9, TierNotGrantedError as aA, UniqueConstraintError as aB, UnknownShardError as aC, UnsupportedIndexOptionError as aD, ValidationError as aE, VaultTemplateNotFoundError as aF, MigrationRequiredError as aa, NetworkError as ab, NoAccessError as ac, NonAdditiveSchemaChangeError as ad, NotFoundError as ae, NumberingUncertaintyError as af, PathEscapeError as ag, PeriodClosedError as ah, PermissionDeniedError as ai, PrivilegeEscalationError as aj, QuiesceTimeoutError as ak, ReadOnlyAtInstantError as al, ReadOnlyError as am, ReadOnlyFrameError as an, RecordCekNotFoundError as ao, ReservedVaultNameError as ap, SchemaFenceError as aq, SchemaLockedError as ar, SchemaUpdateError as as, SchemaValidationError as at, SequenceContentionError as au, SequenceOfflineError as av, ShardProvisioningError as aw, StoreCapabilityError as ax, TamperedError as ay, TierDemoteDeniedError as az, StaticDictReadonlyError as b, SessionExpiredError as c, SessionNotFoundError as d, SessionPolicyError as e, InvariantError as f, RecordLockedError as g, SnapshotNotFoundError as h, DerivationCapExceededError as i, DerivationCycleError as j, DerivationDepthError as k, DerivationOutputShapeError as l, DerivationOutputUnknownError as m, OverlayCollectionUnavailableError as n, OverlayIdMismatchError as o, OverlayNameCollisionError as p, SealedRecordExpiredError as q, SealedRecordMismatchError as r, AttestationError as s, AdoptionStateError as t, BackupLedgerError as u, BundleIntegrityError as v, BundleSealMismatchError as w, BundleVersionConflictError as x, TransferSealError as y, MaterializedViewConfigError as z };

package/dist/{errors-Dz64FA65.d.cts → errors-DUTlAt3Y.d.ts}

@@ -398,6 +398,21 @@ declare class FieldFrozenError extends NoydbError {
     readonly fields: readonly string[];
     constructor(collection: string, id: string, fields: readonly string[]);
 }
+/**
+ * Thrown by a `transitionGuard` when a write moves a state field along an
+ * arc that the declared transition graph does not allow — either an
+ * update `from → to` that is not a listed edge, or an insert whose
+ * initial state is not in the allowed `initial` set (reported with
+ * `from: '(none)'`). Override via an amendment transaction by an
+ * authorized role, like any guard.
+ */
+declare class IllegalTransitionError extends NoydbError {
+    readonly collection: string;
+    readonly id: string;
+    readonly from: string;
+    readonly to: string;
+    constructor(collection: string, id: string, from: string, to: string);
+}
 /**
  * Thrown by an amendment invariant when the proposed change-set violates
  * the declared business rule (e.g. disbursement total not preserved).
@@ -1416,4 +1431,4 @@ declare class RecordCekNotFoundError extends NoydbError {
     constructor(collection: string, id: string);
 }
 
-export { ForgetStrategyNotConfiguredError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, MaterializedViewSourceUnknownError as C, DictKeyInUseError as D, MaterializedViewTooLargeError as E, FieldFrozenError as F, AlreadyElevatedError as G, ConflictError as H, InvariantError as I, CrossJoinSourceUnknownError as J, CrossJoinTooLargeError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, DanglingReferenceError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, DecryptionError as V, DelegationTargetMissingError as W, DirectoryDisabledError as X, ElevationExpiredError as Y, ExportCapabilityError as Z, FilenameSanitizationError as _, DictKeyMissingError as a, GroupCardinalityError as a0, ImportCapabilityError as a1, IndexRequiredError as a2, IndexWriteFailureError as a3, InvalidKeyError as a4, JoinTooLargeError as a5, KeyringCorruptError as a6, KeyringExpiredError as a7, LedgerContentionError as a8, MigrationRequiredError as a9, UniqueConstraintError as aA, UnknownShardError as aB, UnsupportedIndexOptionError as aC, ValidationError as aD, VaultTemplateNotFoundError as aE, NetworkError as aa, NoAccessError as ab, NonAdditiveSchemaChangeError as ac, NotFoundError as ad, NumberingUncertaintyError as ae, PathEscapeError as af, PeriodClosedError as ag, PermissionDeniedError as ah, PrivilegeEscalationError as ai, QuiesceTimeoutError as aj, ReadOnlyAtInstantError as ak, ReadOnlyError as al, ReadOnlyFrameError as am, RecordCekNotFoundError as an, ReservedVaultNameError as ao, SchemaFenceError as ap, SchemaLockedError as aq, SchemaUpdateError as ar, SchemaValidationError as as, SequenceContentionError as at, SequenceOfflineError as au, ShardProvisioningError as av, StoreCapabilityError as aw, TamperedError as ax, TierDemoteDeniedError as ay, TierNotGrantedError as az, StaticDictReadonlyError as b, SessionExpiredError as c, SessionNotFoundError as d, SessionPolicyError as e, RecordLockedError as f, SnapshotNotFoundError as g, DerivationCapExceededError as h, DerivationCycleError as i, DerivationDepthError as j, DerivationOutputShapeError as k, DerivationOutputUnknownError as l, OverlayCollectionUnavailableError as m, OverlayIdMismatchError as n, OverlayNameCollisionError as o, SealedRecordExpiredError as p, SealedRecordMismatchError as q, AttestationError as r, AdoptionStateError as s, BackupLedgerError as t, BundleIntegrityError as u, BundleSealMismatchError as v, BundleVersionConflictError as w, TransferSealError as x, MaterializedViewConfigError as y, MaterializedViewCycleError as z };
+export { FilenameSanitizationError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, MaterializedViewCycleError as C, DictKeyInUseError as D, MaterializedViewSourceUnknownError as E, FieldFrozenError as F, MaterializedViewTooLargeError as G, AlreadyElevatedError as H, IllegalTransitionError as I, ConflictError as J, CrossJoinSourceUnknownError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, CrossJoinTooLargeError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, DanglingReferenceError as V, DecryptionError as W, DelegationTargetMissingError as X, DirectoryDisabledError as Y, ElevationExpiredError as Z, ExportCapabilityError as _, DictKeyMissingError as a, ForgetStrategyNotConfiguredError as a0, GroupCardinalityError as a1, ImportCapabilityError as a2, IndexRequiredError as a3, IndexWriteFailureError as a4, InvalidKeyError as a5, JoinTooLargeError as a6, KeyringCorruptError as a7, KeyringExpiredError as a8, LedgerContentionError as a9, TierNotGrantedError as aA, UniqueConstraintError as aB, UnknownShardError as aC, UnsupportedIndexOptionError as aD, ValidationError as aE, VaultTemplateNotFoundError as aF, MigrationRequiredError as aa, NetworkError as ab, NoAccessError as ac, NonAdditiveSchemaChangeError as ad, NotFoundError as ae, NumberingUncertaintyError as af, PathEscapeError as ag, PeriodClosedError as ah, PermissionDeniedError as ai, PrivilegeEscalationError as aj, QuiesceTimeoutError as ak, ReadOnlyAtInstantError as al, ReadOnlyError as am, ReadOnlyFrameError as an, RecordCekNotFoundError as ao, ReservedVaultNameError as ap, SchemaFenceError as aq, SchemaLockedError as ar, SchemaUpdateError as as, SchemaValidationError as at, SequenceContentionError as au, SequenceOfflineError as av, ShardProvisioningError as aw, StoreCapabilityError as ax, TamperedError as ay, TierDemoteDeniedError as az, StaticDictReadonlyError as b, SessionExpiredError as c, SessionNotFoundError as d, SessionPolicyError as e, InvariantError as f, RecordLockedError as g, SnapshotNotFoundError as h, DerivationCapExceededError as i, DerivationCycleError as j, DerivationDepthError as k, DerivationOutputShapeError as l, DerivationOutputUnknownError as m, OverlayCollectionUnavailableError as n, OverlayIdMismatchError as o, OverlayNameCollisionError as p, SealedRecordExpiredError as q, SealedRecordMismatchError as r, AttestationError as s, AdoptionStateError as t, BackupLedgerError as u, BundleIntegrityError as v, BundleSealMismatchError as w, BundleVersionConflictError as x, TransferSealError as y, MaterializedViewConfigError as z };

package/dist/executor-IZ2NVXCY.js

@@ -0,0 +1,11 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-Y5XVB75E.js";
+import "./chunk-5KKNBDCT.js";
+import "./chunk-32XVU2LT.js";
+import "./chunk-RZWQNMMP.js";
+import "./chunk-HMFC6M2G.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-IZ2NVXCY.js.map

package/dist/executor-THSEYEJG.js

@@ -0,0 +1,8 @@
+import {
+  GuardExecutor
+} from "./chunk-AB7JF2KF.js";
+import "./chunk-HMFC6M2G.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-THSEYEJG.js.map

package/dist/executor-WLFDUTOM.js

@@ -0,0 +1,8 @@
+import {
+  DerivationExecutor
+} from "./chunk-33DAO2XG.js";
+import "./chunk-HMFC6M2G.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-WLFDUTOM.js.map

package/dist/{fanout-sidecar-FIJJ46YG.js → fanout-sidecar-JGHXAJO5.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-SISBMAPO.js";
+} from "./chunk-LGPSCKWZ.js";
 
 // src/derivations/fanout-sidecar.ts
 function recordId(source, sourceId, outputKey) {
@@ -48,4 +48,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-FIJJ46YG.js.map
+//# sourceMappingURL=fanout-sidecar-JGHXAJO5.js.map

package/dist/forget/index.js

@@ -2,10 +2,10 @@ import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION,
   withForgetCascade
-} from "../chunk-I5IUYN7B.js";
-import "../chunk-SISBMAPO.js";
-import "../chunk-UNTGHX5A.js";
-import "../chunk-ZEGSDPB7.js";
+} from "../chunk-C2OYWD5S.js";
+import "../chunk-LGPSCKWZ.js";
+import "../chunk-QJKZ5WUP.js";
+import "../chunk-HMFC6M2G.js";
 export {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION,

package/dist/guards/index.cjs

@@ -24,10 +24,12 @@ __export(guards_exports, {
   FieldFrozenError: () => FieldFrozenError,
   GuardExecutor: () => GuardExecutor,
   GuardRegistry: () => GuardRegistry,
+  IllegalTransitionError: () => IllegalTransitionError,
   InvariantError: () => InvariantError,
   ReadOnlyVaultFacade: () => ReadOnlyVaultFacade,
   RecordLockedError: () => RecordLockedError,
   immutableGuard: () => immutableGuard,
+  transitionGuard: () => transitionGuard,
   withGuard: () => withGuard
 });
 module.exports = __toCommonJS(guards_exports);
@@ -72,6 +74,23 @@ var FieldFrozenError = class extends NoydbError {
     this.fields = fields;
   }
 };
+var IllegalTransitionError = class extends NoydbError {
+  collection;
+  id;
+  from;
+  to;
+  constructor(collection, id, from, to) {
+    super(
+      "ILLEGAL_TRANSITION",
+      `Cannot transition ${collection}/${id} from "${from}" to "${to}" \u2014 not a declared arc. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
+    );
+    this.name = "IllegalTransitionError";
+    this.collection = collection;
+    this.id = id;
+    this.from = from;
+    this.to = to;
+  }
+};
 var InvariantError = class extends NoydbError {
   constructor(message) {
     super("INVARIANT_VIOLATED", message);
@@ -156,6 +175,59 @@ function immutableGuard(config) {
   return withGuard(spec);
 }
 
+// src/guards/transition-guard.ts
+function recordId2(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function stateOf(record, field) {
+  const v = record[field];
+  return typeof v === "string" ? v : String(v);
+}
+function transitionGuard(config) {
+  const { collection, field, transitions, initial, amendmentRoles, amendmentInvariant } = config;
+  const allowIdempotent = config.allowIdempotent ?? true;
+  if (!field) {
+    throw new ValidationError("transitionGuard: `field` is required");
+  }
+  if (transitions === void 0 || typeof transitions !== "object") {
+    throw new ValidationError("transitionGuard: `transitions` must be a state\u2192states map");
+  }
+  const spec = {
+    collection,
+    check: (incoming, ctx) => {
+      const rec = incoming;
+      const to = stateOf(rec, field);
+      if (ctx.existing === null) {
+        if (initial !== void 0 && !initial.includes(to)) {
+          throw new IllegalTransitionError(collection, recordId2(rec), "(none)", to);
+        }
+        return;
+      }
+      const from = stateOf(ctx.existing, field);
+      if (from === to) {
+        if (allowIdempotent) return;
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+      const allowed = transitions[from] ?? [];
+      if (!allowed.includes(to)) {
+        throw new IllegalTransitionError(collection, recordId2(rec), from, to);
+      }
+    },
+    // The authorized override: inside an amendment transaction the check
+    // is skipped and the change is ledgered. By default no extra invariant
+    // — the amendment itself is the sanctioned exception. Callers may
+    // supply `amendmentInvariant` to keep a constraint inviolable even
+    // under amendment; a throw reverts the amendment as `InvariantError`.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: amendmentInvariant ?? (() => {
+      })
+    }
+  };
+  return withGuard(spec);
+}
+
 // src/guards/registry.ts
 var GuardRegistry = class {
   _byCollection = /* @__PURE__ */ new Map();
@@ -351,14 +423,17 @@ function deepEqual(a, b) {
 // src/guards/read-only-facade.ts
 var ReadOnlyVaultFacade = class {
   _vault;
-  constructor(vault) {
+  _layer;
+  constructor(vault, layer = "read") {
     this._vault = vault;
+    this._layer = layer;
   }
   collection(name) {
     const c = this._vault.collection(name);
+    const layer = this._layer;
     return {
-      get: (id) => c.get(id),
-      list: () => c.list(),
+      get: (id) => c.get(id, { _layer: layer }),
+      list: () => c.list({ _layer: layer }),
       query: () => c.query()
     };
   }
@@ -369,10 +444,12 @@ var ReadOnlyVaultFacade = class {
   FieldFrozenError,
   GuardExecutor,
   GuardRegistry,
+  IllegalTransitionError,
   InvariantError,
   ReadOnlyVaultFacade,
   RecordLockedError,
   immutableGuard,
+  transitionGuard,
   withGuard
 });
 //# sourceMappingURL=index.cjs.map