@byline/core 0.9.3

package/dist/@types/store-types.d.ts

@@ -0,0 +1,134 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export interface BaseStore {
+    field_path: string;
+    field_name: string;
+    locale: string;
+    parent_path?: string;
+}
+export interface TextStore extends BaseStore {
+    field_type: 'text' | 'select' | 'textArea';
+    value: string;
+}
+export interface NumericStore extends BaseStore {
+    field_type: 'float' | 'integer' | 'decimal';
+    number_type: 'float' | 'integer' | 'decimal';
+    value_float?: number;
+    value_integer?: number;
+    value_decimal?: string;
+}
+export interface BooleanStore extends BaseStore {
+    field_type: 'boolean' | 'checkbox';
+    value: boolean;
+}
+export interface DateTimeStore extends BaseStore {
+    field_type: 'datetime' | 'date' | 'time';
+    date_type: 'datetime' | 'date' | 'time';
+    value_time?: string;
+    value_date?: Date;
+    value_timestamp_tz?: Date;
+}
+/**
+ * One generated image variant persisted alongside the original file
+ * inside `store_file.variants` (jsonb). Mirrors `PersistedVariant` on
+ * the field-data side; kept in sync because flatten/restore copies
+ * directly between them.
+ */
+export interface FileStoreVariant {
+    name: string;
+    storage_path: string;
+    storage_url?: string;
+    width?: number;
+    height?: number;
+    format?: string;
+}
+export interface FileStore extends BaseStore {
+    field_type: 'file' | 'image';
+    file_id: string;
+    filename: string;
+    original_filename: string;
+    mime_type: string;
+    file_size: number;
+    storage_provider: string;
+    storage_path: string;
+    storage_url?: string;
+    file_hash?: string;
+    image_width?: number;
+    image_height?: number;
+    image_format?: string;
+    processing_status?: string;
+    thumbnail_generated?: boolean;
+    /** Image variants persisted as jsonb. Absent for non-image / no-sizes uploads. */
+    variants?: FileStoreVariant[];
+}
+export interface RelationStore extends BaseStore {
+    field_type: 'relation';
+    target_document_id: string;
+    target_collection_id: string;
+    relationship_type?: string;
+    cascade_delete?: boolean;
+}
+export interface RichTextStore extends BaseStore {
+    field_type: 'richText';
+    value: any;
+}
+export interface JsonStore extends BaseStore {
+    field_type: 'json' | 'object';
+    value: any;
+    json_schema?: string;
+    object_keys?: string[];
+}
+export type FlattenedStore = TextStore | RichTextStore | NumericStore | BooleanStore | DateTimeStore | FileStore | RelationStore | JsonStore;
+export declare function isFileStore(fieldValue: FlattenedStore): fieldValue is FileStore;
+export declare function isRelationStore(fieldValue: FlattenedStore): fieldValue is RelationStore;
+export declare function isJsonStore(fieldValue: FlattenedStore): fieldValue is JsonStore;
+export declare function isNumericStore(fieldValue: FlattenedStore): fieldValue is NumericStore;
+export declare function isDateTimeStore(fieldValue: FlattenedStore): fieldValue is DateTimeStore;
+export interface UnionRowValue {
+    id: string;
+    document_version_id: string;
+    collection_id: string;
+    field_type: string;
+    field_path: string;
+    field_name: string;
+    locale: string;
+    parent_path: string | null;
+    text_value: string | null;
+    boolean_value: boolean | null;
+    json_value: any | null;
+    date_type: string | null;
+    value_date: Date | null;
+    value_time: string | null;
+    value_timestamp_tz: Date | null;
+    file_id: string | null;
+    filename: string | null;
+    original_filename: string | null;
+    mime_type: string | null;
+    file_size: number | null;
+    storage_provider: string | null;
+    storage_path: string | null;
+    storage_url: string | null;
+    file_hash: string | null;
+    image_width: number | null;
+    image_height: number | null;
+    image_format: string | null;
+    processing_status: string | null;
+    thumbnail_generated: boolean | null;
+    variants: FileStoreVariant[] | null;
+    target_document_id: string | null;
+    target_collection_id: string | null;
+    relationship_type: string | null;
+    cascade_delete: boolean | null;
+    json_schema: string | null;
+    object_keys: string[] | null;
+    number_type: string | null;
+    value_integer: number | null;
+    value_decimal: string | null;
+    value_float: number | null;
+}
+//# sourceMappingURL=store-types.d.ts.map

package/dist/@types/store-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-types.d.ts","sourceRoot":"","sources":["../../src/@types/store-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,UAAU,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;IAC3C,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,UAAU,EAAE,SAAS,GAAG,UAAU,CAAA;IAClC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;IACxC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;IACvC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,IAAI,CAAA;IACjB,kBAAkB,CAAC,EAAE,IAAI,CAAA;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB,EAAE,MAAM,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,aAAc,SAAQ,SAAS;IAC9C,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,GAAG,CAAA;CACX;AAED,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAA;IAC7B,KAAK,EAAE,GAAG,CAAA;IACV,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAGD,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,SAAS,GACT,aAAa,GACb,SAAS,CAAA;AAGb,wBAAgB,WAAW,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,IAAI,SAAS,CAE/E;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,IAAI,aAAa,CAEvF;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,IAAI,SAAS,CAE/E;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,IAAI,YAAY,CAErF;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,IAAI,aAAa,CAEvF;AAGD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,mBAAmB,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAG1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,GAAG,GAAG,IAAI,CAAA;IAGtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAA;IAG/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAA;IAGnC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,cAAc,EAAE,OAAO,GAAG,IAAI,CAAA;IAG9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAG5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B"}

package/dist/@types/store-types.js

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+// Type guards for runtime checking
+export function isFileStore(fieldValue) {
+    return fieldValue.field_type === 'file' || fieldValue.field_type === 'image';
+}
+export function isRelationStore(fieldValue) {
+    return fieldValue.field_type === 'relation';
+}
+export function isJsonStore(fieldValue) {
+    return fieldValue.field_type === 'json' || fieldValue.field_type === 'object';
+}
+export function isNumericStore(fieldValue) {
+    return ['float', 'integer', 'decimal'].includes(fieldValue.field_type);
+}
+export function isDateTimeStore(fieldValue) {
+    return ['datetime', 'date', 'time'].includes(fieldValue.field_type);
+}
+//# sourceMappingURL=store-types.js.map

package/dist/@types/store-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-types.js","sourceRoot":"","sources":["../../src/@types/store-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqGH,mCAAmC;AACnC,MAAM,UAAU,WAAW,CAAC,UAA0B;IACpD,OAAO,UAAU,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,KAAK,OAAO,CAAA;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAA0B;IACxD,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAA0B;IACpD,OAAO,UAAU,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA0B;IACvD,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAA0B;IACxD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AACrE,CAAC"}

package/dist/@types/type-utils.d.ts

@@ -0,0 +1,17 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export type MaybePromise<T> = T | Promise<T>;
+export type NonEmptyArray<T> = [T, ...T[]];
+export type Prettify<T> = {
+    [K in keyof T]: T[K];
+} & {};
+export type DeepMutable<T> = T extends ReadonlyArray<infer U> ? Array<DeepMutable<U>> : T extends object ? {
+    -readonly [K in keyof T]: DeepMutable<T[K]>;
+} : T;
+export type ValueUnion<T extends Record<string, any>> = T[keyof T];
+//# sourceMappingURL=type-utils.d.ts.map

package/dist/@types/type-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-utils.d.ts","sourceRoot":"","sources":["../../src/@types/type-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAG5C,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;AAG1C,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACrB,GAAG,EAAE,CAAA;AAGN,MAAM,MAAM,WAAW,CAAC,CAAC,IACvB,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,CAAC,GAC5B,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,CAAC,SAAS,MAAM,GACd;IAAE,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC/C,CAAC,CAAA;AAKT,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA"}

package/dist/@types/type-utils.js

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=type-utils.js.map

package/dist/@types/type-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-utils.js","sourceRoot":"","sources":["../../src/@types/type-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/auth/apply-before-read.d.ts

@@ -0,0 +1,36 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { RequestContext } from '@byline/auth';
+import type { CollectionDefinition } from '../@types/collection-types.js';
+import type { ReadContext } from '../@types/db-types.js';
+import type { QueryPredicate } from '../@types/query-predicate.js';
+/**
+ * Resolve the per-collection `beforeRead` hook predicate for the current
+ * request, with caching across populate fanout.
+ *
+ * Behaviour:
+ *   - Cache hit on `readContext.beforeReadCache` (keyed by collection
+ *     path) returns the cached value immediately. The actor is invariant
+ *     for the lifetime of one `ReadContext`, so a single key per
+ *     collection is sufficient.
+ *   - Each configured hook function runs in declaration order. Predicates
+ *     returned by multiple hooks are combined with implicit AND. Hooks
+ *     that return `void` / `undefined` are skipped.
+ *   - The result is stored in the cache (including `null` for "ran with
+ *     no scoping") so subsequent batches in the same request reuse it.
+ *
+ * Returns `null` when no hook is configured, or every hook returned
+ * void. Callers (`CollectionHandle`, `populateDocuments`) treat `null`
+ * the same as "no scoping" — they pass nothing extra to the adapter.
+ */
+export declare function applyBeforeRead(params: {
+    definition: CollectionDefinition;
+    requestContext: RequestContext;
+    readContext: ReadContext;
+}): Promise<QueryPredicate | null>;
+//# sourceMappingURL=apply-before-read.d.ts.map

package/dist/auth/apply-before-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-before-read.d.ts","sourceRoot":"","sources":["../../src/auth/apply-before-read.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,KAAK,EAGV,oBAAoB,EACrB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,UAAU,EAAE,oBAAoB,CAAA;IAChC,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,EAAE,WAAW,CAAA;CACzB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAqCjC"}

package/dist/auth/apply-before-read.js

@@ -0,0 +1,68 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Resolve the per-collection `beforeRead` hook predicate for the current
+ * request, with caching across populate fanout.
+ *
+ * Behaviour:
+ *   - Cache hit on `readContext.beforeReadCache` (keyed by collection
+ *     path) returns the cached value immediately. The actor is invariant
+ *     for the lifetime of one `ReadContext`, so a single key per
+ *     collection is sufficient.
+ *   - Each configured hook function runs in declaration order. Predicates
+ *     returned by multiple hooks are combined with implicit AND. Hooks
+ *     that return `void` / `undefined` are skipped.
+ *   - The result is stored in the cache (including `null` for "ran with
+ *     no scoping") so subsequent batches in the same request reuse it.
+ *
+ * Returns `null` when no hook is configured, or every hook returned
+ * void. Callers (`CollectionHandle`, `populateDocuments`) treat `null`
+ * the same as "no scoping" — they pass nothing extra to the adapter.
+ */
+export async function applyBeforeRead(params) {
+    const { definition, requestContext, readContext } = params;
+    const collectionPath = definition.path;
+    if (readContext.beforeReadCache.has(collectionPath)) {
+        return readContext.beforeReadCache.get(collectionPath) ?? null;
+    }
+    const hooks = normalizeBeforeReadHook(definition.hooks?.beforeRead);
+    if (hooks.length === 0) {
+        readContext.beforeReadCache.set(collectionPath, null);
+        return null;
+    }
+    const predicates = [];
+    for (const hook of hooks) {
+        const result = await hook({
+            collectionPath,
+            requestContext,
+            readContext,
+        });
+        if (result != null) {
+            predicates.push(result);
+        }
+    }
+    let combined;
+    if (predicates.length === 0) {
+        combined = null;
+    }
+    else if (predicates.length === 1) {
+        combined = predicates[0];
+    }
+    else {
+        combined = { $and: predicates };
+    }
+    readContext.beforeReadCache.set(collectionPath, combined);
+    return combined;
+}
+/** Normalise a `beforeRead` slot (single function or array) into a flat array. */
+function normalizeBeforeReadHook(slot) {
+    if (!slot)
+        return [];
+    return Array.isArray(slot) ? slot : [slot];
+}
+//# sourceMappingURL=apply-before-read.js.map

package/dist/auth/apply-before-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-before-read.js","sourceRoot":"","sources":["../../src/auth/apply-before-read.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAIrC;IACC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,CAAA;IAC1D,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAA;IAEtC,IAAI,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,OAAO,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,UAAU,GAAqB,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,cAAc;YACd,cAAc;YACd,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,IAAI,QAA+B,CAAA;IACnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAE,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IACjC,CAAC;IAED,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IACzD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,IAAoC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAC5C,CAAC"}

package/dist/auth/apply-before-read.test.node.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=apply-before-read.test.node.d.ts.map

package/dist/auth/apply-before-read.test.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-before-read.test.node.d.ts","sourceRoot":"","sources":["../../src/auth/apply-before-read.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/auth/apply-before-read.test.node.js

@@ -0,0 +1,144 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { createRequestContext } from '@byline/auth';
+import { describe, expect, it } from 'vitest';
+import { defineCollection, defineWorkflow, } from '../@types/collection-types.js';
+import { createReadContext } from '../services/populate.js';
+import { applyBeforeRead } from './apply-before-read.js';
+const baseCollection = (hook) => defineCollection({
+    path: 'posts',
+    labels: { singular: 'Post', plural: 'Posts' },
+    workflow: defineWorkflow({
+        draft: { label: 'Draft', verb: 'Revert to Draft' },
+        published: { label: 'Published', verb: 'Publish' },
+    }),
+    fields: [{ name: 'title', type: 'text', label: 'Title' }],
+    ...(hook ? { hooks: { beforeRead: hook } } : {}),
+});
+describe('applyBeforeRead', () => {
+    it('returns null when the collection has no beforeRead hook', async () => {
+        const result = await applyBeforeRead({
+            definition: baseCollection(),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toBeNull();
+    });
+    it('returns the predicate from a single hook', async () => {
+        const hook = () => ({ status: 'published' });
+        const result = await applyBeforeRead({
+            definition: baseCollection(hook),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toEqual({ status: 'published' });
+    });
+    it('returns null when the hook returns void', async () => {
+        const hook = () => undefined;
+        const result = await applyBeforeRead({
+            definition: baseCollection(hook),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toBeNull();
+    });
+    it('combines multiple hook predicates with implicit AND', async () => {
+        const a = () => ({ tenantId: 't-1' });
+        const b = () => ({ status: 'published' });
+        const result = await applyBeforeRead({
+            definition: baseCollection([a, b]),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toEqual({
+            $and: [{ tenantId: 't-1' }, { status: 'published' }],
+        });
+    });
+    it('skips void-returning hooks when combining', async () => {
+        const a = () => ({ tenantId: 't-1' });
+        const b = () => undefined;
+        const c = () => ({ status: 'published' });
+        const result = await applyBeforeRead({
+            definition: baseCollection([a, b, c]),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toEqual({
+            $and: [{ tenantId: 't-1' }, { status: 'published' }],
+        });
+    });
+    it('caches the predicate on ReadContext (hook runs once per request)', async () => {
+        let callCount = 0;
+        const hook = () => {
+            callCount += 1;
+            return { tenantId: 't-1' };
+        };
+        const def = baseCollection(hook);
+        const readContext = createReadContext();
+        const requestContext = createRequestContext();
+        await applyBeforeRead({ definition: def, requestContext, readContext });
+        await applyBeforeRead({ definition: def, requestContext, readContext });
+        await applyBeforeRead({ definition: def, requestContext, readContext });
+        expect(callCount).toBe(1);
+    });
+    it('caches a void result so subsequent calls do not re-run the hook', async () => {
+        let callCount = 0;
+        const hook = () => {
+            callCount += 1;
+            return undefined;
+        };
+        const def = baseCollection(hook);
+        const readContext = createReadContext();
+        const requestContext = createRequestContext();
+        const first = await applyBeforeRead({ definition: def, requestContext, readContext });
+        const second = await applyBeforeRead({ definition: def, requestContext, readContext });
+        expect(first).toBeNull();
+        expect(second).toBeNull();
+        expect(callCount).toBe(1);
+    });
+    it('runs the hook again on a fresh ReadContext', async () => {
+        let callCount = 0;
+        const hook = () => {
+            callCount += 1;
+            return { tenantId: 't-1' };
+        };
+        const def = baseCollection(hook);
+        const requestContext = createRequestContext();
+        await applyBeforeRead({ definition: def, requestContext, readContext: createReadContext() });
+        await applyBeforeRead({ definition: def, requestContext, readContext: createReadContext() });
+        expect(callCount).toBe(2);
+    });
+    it('passes collectionPath, requestContext, and readContext through to the hook', async () => {
+        let received;
+        const hook = (ctx) => {
+            received = ctx;
+        };
+        const def = baseCollection(hook);
+        const requestContext = createRequestContext();
+        const readContext = createReadContext();
+        await applyBeforeRead({ definition: def, requestContext, readContext });
+        expect(received).toMatchObject({
+            collectionPath: 'posts',
+            requestContext,
+            readContext,
+        });
+    });
+    it('supports an async hook', async () => {
+        const hook = async () => {
+            await Promise.resolve();
+            return { tenantId: 't-1' };
+        };
+        const result = await applyBeforeRead({
+            definition: baseCollection(hook),
+            requestContext: createRequestContext(),
+            readContext: createReadContext(),
+        });
+        expect(result).toEqual({ tenantId: 't-1' });
+    });
+});
+//# sourceMappingURL=apply-before-read.test.node.js.map

package/dist/auth/apply-before-read.test.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-before-read.test.node.js","sourceRoot":"","sources":["../../src/auth/apply-before-read.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAGL,gBAAgB,EAChB,cAAc,GACf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,MAAM,cAAc,GAAG,CAAC,IAA4C,EAAwB,EAAE,CAC5F,gBAAgB,CAAC;IACf,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAC7C,QAAQ,EAAE,cAAc,CAAC;QACvB,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE;QAClD,SAAS,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;KACnD,CAAC;IACF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACjD,CAAC,CAAA;AAEJ,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,EAAE;YAC5B,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,IAAI,GAAqB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC;YAChC,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAqB,GAAG,EAAE,CAAC,SAAS,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC;YAChC,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,GAAqB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,MAAM,CAAC,GAAqB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAqB,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,MAAM,CAAC,GAAqB,GAAG,EAAE,CAAC,SAAS,CAAA;QAC3C,MAAM,CAAC,GAAqB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrC,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,MAAM,IAAI,GAAqB,GAAG,EAAE;YAClC,SAAS,IAAI,CAAC,CAAA;YACd,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAA;QACvC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;QAE7C,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACvE,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACvE,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACvE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,MAAM,IAAI,GAAqB,GAAG,EAAE;YAClC,SAAS,IAAI,CAAC,CAAA;YACd,OAAO,SAAS,CAAA;QAClB,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAA;QACvC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;QAE7C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACrF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACtF,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAA;QACxB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzB,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,MAAM,IAAI,GAAqB,GAAG,EAAE;YAClC,SAAS,IAAI,CAAC,CAAA;YACd,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;QAE7C,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC5F,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,IAAI,QAAiB,CAAA;QACrB,MAAM,IAAI,GAAqB,CAAC,GAAG,EAAE,EAAE;YACrC,QAAQ,GAAG,GAAG,CAAA;QAChB,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;QAC7C,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAA;QACvC,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;QACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,cAAc,EAAE,OAAO;YACvB,cAAc;YACd,WAAW;SACZ,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAqB,KAAK,IAAI,EAAE;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC;YAChC,cAAc,EAAE,oBAAoB,EAAE;YACtC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/assert-actor-can-perform.d.ts

@@ -0,0 +1,39 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { type RequestContext } from '@byline/auth';
+import { type CollectionAbilityVerb } from './register-collection-abilities.js';
+/**
+ * Central enforcement helper. Called from the service layer — at the top
+ * of each `document-lifecycle` function and at the top of each
+ * `@byline/client.CollectionHandle` read method — before any DB work.
+ *
+ * Policy, in order:
+ *
+ *   1. **No `RequestContext`** → `ERR_UNAUTHENTICATED`. Every enforced
+ *      call site must supply a context. Tests, seeds, and migration
+ *      scripts pass `createSuperAdminContext()` from `@byline/auth` for
+ *      this.
+ *
+ *   2. **`actor === null` (public / anonymous reader)**:
+ *        - Only permitted on `verb === 'read'`.
+ *        - Only when `readMode === 'published'` (the `@byline/client`
+ *          default for unauthenticated consumers).
+ *        - Any other combination → `ERR_UNAUTHENTICATED`.
+ *
+ *   3. **Actor present** → `actor.assertAbility('collections.<path>.<verb>')`.
+ *      `AdminAuth` with `isSuperAdmin: true` short-circuits the check
+ *      internally; any other actor must hold the specific ability.
+ *
+ * Direct adapter calls (`db.commands.*` / `db.queries.*`) intentionally
+ * bypass this helper — the same escape hatch that skips collection
+ * hooks. Seeds, migrations, and internal tooling live there.
+ *
+ * See docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §8.
+ */
+export declare function assertActorCanPerform(context: RequestContext | undefined, collectionPath: string, verb: CollectionAbilityVerb): void;
+//# sourceMappingURL=assert-actor-can-perform.d.ts.map

package/dist/auth/assert-actor-can-perform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-actor-can-perform.d.ts","sourceRoot":"","sources":["../../src/auth/assert-actor-can-perform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,oCAAoC,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CA8BN"}

package/dist/auth/assert-actor-can-perform.js

@@ -0,0 +1,64 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { ERR_UNAUTHENTICATED } from '@byline/auth';
+import { collectionAbilityKey, } from './register-collection-abilities.js';
+/**
+ * Central enforcement helper. Called from the service layer — at the top
+ * of each `document-lifecycle` function and at the top of each
+ * `@byline/client.CollectionHandle` read method — before any DB work.
+ *
+ * Policy, in order:
+ *
+ *   1. **No `RequestContext`** → `ERR_UNAUTHENTICATED`. Every enforced
+ *      call site must supply a context. Tests, seeds, and migration
+ *      scripts pass `createSuperAdminContext()` from `@byline/auth` for
+ *      this.
+ *
+ *   2. **`actor === null` (public / anonymous reader)**:
+ *        - Only permitted on `verb === 'read'`.
+ *        - Only when `readMode === 'published'` (the `@byline/client`
+ *          default for unauthenticated consumers).
+ *        - Any other combination → `ERR_UNAUTHENTICATED`.
+ *
+ *   3. **Actor present** → `actor.assertAbility('collections.<path>.<verb>')`.
+ *      `AdminAuth` with `isSuperAdmin: true` short-circuits the check
+ *      internally; any other actor must hold the specific ability.
+ *
+ * Direct adapter calls (`db.commands.*` / `db.queries.*`) intentionally
+ * bypass this helper — the same escape hatch that skips collection
+ * hooks. Seeds, migrations, and internal tooling live there.
+ *
+ * See docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §8.
+ */
+export function assertActorCanPerform(context, collectionPath, verb) {
+    if (!context) {
+        throw ERR_UNAUTHENTICATED({
+            message: `missing requestContext on ${verb} '${collectionPath}'. Pass createSuperAdminContext() ` +
+                `from @byline/auth for scripts/tests, or construct a request-scoped context from your ` +
+                `session provider in the admin webapp.`,
+        });
+    }
+    const { actor, readMode } = context;
+    if (actor == null) {
+        if (verb !== 'read') {
+            throw ERR_UNAUTHENTICATED({
+                message: `anonymous request cannot ${verb} '${collectionPath}': no actor in context`,
+            });
+        }
+        if (readMode !== 'published') {
+            throw ERR_UNAUTHENTICATED({
+                message: `anonymous read of '${collectionPath}' requires readMode: 'published' ` +
+                    `(got readMode: ${readMode == null ? '<unset>' : `'${readMode}'`})`,
+            });
+        }
+        // Anonymous read of published content — permitted.
+        return;
+    }
+    actor.assertAbility(collectionAbilityKey(collectionPath, verb));
+}
+//# sourceMappingURL=assert-actor-can-perform.js.map

package/dist/auth/assert-actor-can-perform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-actor-can-perform.js","sourceRoot":"","sources":["../../src/auth/assert-actor-can-perform.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,cAAc,CAAA;AAEvE,OAAO,EAEL,oBAAoB,GACrB,MAAM,oCAAoC,CAAA;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmC,EACnC,cAAsB,EACtB,IAA2B;IAE3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC;YACxB,OAAO,EACL,6BAA6B,IAAI,KAAK,cAAc,oCAAoC;gBACxF,uFAAuF;gBACvF,uCAAuC;SAC1C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAEnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,mBAAmB,CAAC;gBACxB,OAAO,EAAE,4BAA4B,IAAI,KAAK,cAAc,wBAAwB;aACrF,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,mBAAmB,CAAC;gBACxB,OAAO,EACL,sBAAsB,cAAc,mCAAmC;oBACvE,kBAAkB,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,GAAG;aACtE,CAAC,CAAA;QACJ,CAAC;QACD,mDAAmD;QACnD,OAAM;IACR,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC"}

package/dist/auth/assert-actor-can-perform.test.node.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=assert-actor-can-perform.test.node.d.ts.map

package/dist/auth/assert-actor-can-perform.test.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-actor-can-perform.test.node.d.ts","sourceRoot":"","sources":["../../src/auth/assert-actor-can-perform.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}