@byline/auth 1.8.1 → 1.8.2

package/dist/abilities.d.ts

@@ -25,7 +25,7 @@
  * collection registrar in `@byline/core`. Future plugins (media,
  * uploads, settings) contribute their own groups.
  *
- * See docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §3.
+ * See docs/AUTHN-AUTHZ.md.
  */
 /**
  * A single registered ability.

package/dist/actor.js

@@ -23,12 +23,12 @@
  * The `Actor` union (`AdminAuth | UserAuth | null`) is the canonical shape
  * carried on `RequestContext`. A `null` actor represents an
  * unauthenticated request — only permitted on public read paths
- * (`readMode === 'published'`) once service-layer enforcement lands
- * (the outstanding item in AUTHN-AUTHZ-ANALYSIS.md).
+ * (`readMode === 'published'`); service-layer enforcement is now in
+ * place (`assertActorCanPerform`, `assertAdminActor`).
  *
  * Ability keys are flat dotted strings (e.g. `collections.pages.publish`,
- * `media.manage`). See AUTHN-AUTHZ-ANALYSIS.md §4 for the rationale and
- * §1 (Phase 1) for the registry that mints them.
+ * `media.manage`). See docs/AUTHN-AUTHZ.md for the rationale and the
+ * registry that mints them.
  */
 import { ERR_FORBIDDEN } from './errors.js';
 /**

package/dist/context.d.ts

@@ -11,10 +11,11 @@ import { type Actor } from './actor.js';
  * `document-lifecycle` service, `IDocumentQueries` method, `@byline/client`
  * entry point, and collection hook.
  *
- * The auth subsystem populates `actor`; downstream code reads it. Today
- * the threading is plumbing only — `actor.assertAbility(...)` is not yet
- * called at the `document-lifecycle` / `IDocumentQueries` boundary. See
- * the Phase status table in AUTHN-AUTHZ-ANALYSIS.md.
+ * The auth subsystem populates `actor`; downstream code reads it.
+ * Service-layer enforcement is live: `assertActorCanPerform` runs at
+ * every `document-lifecycle` write entry and on `@byline/client` reads;
+ * `assertAdminActor` runs inside every admin-management `*Command`.
+ * See docs/AUTHN-AUTHZ.md for the present-state reference.
  *
  * `RequestContext` is intentionally independent of the existing
  * `ReadContext` (populate / `afterRead` recursion guard) for now. Merging

package/dist/session-provider.d.ts

@@ -19,7 +19,7 @@
  * the admin UI render affordances appropriate to whatever provider is
  * wired up.
  *
- * See docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §7.
+ * See docs/AUTHN-AUTHZ.md.
  */
 import type { AdminAuth } from './actor.js';
 /**

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/auth",
   "private": false,
   "license": "MPL-2.0",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "engines": {
     "node": ">=20.9.0"
   },