@byline/core 0.9.3

package/dist/auth/assert-actor-can-perform.test.node.js

@@ -0,0 +1,119 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { AdminAuth, AuthError, AuthErrorCodes, createRequestContext, createSuperAdminContext, } from '@byline/auth';
+import { describe, expect, it } from 'vitest';
+import { assertActorCanPerform } from './assert-actor-can-perform.js';
+describe('assertActorCanPerform', () => {
+    describe('missing context', () => {
+        it('throws ERR_UNAUTHENTICATED when context is undefined', () => {
+            try {
+                assertActorCanPerform(undefined, 'pages', 'read');
+                expect.fail('expected ERR_UNAUTHENTICATED');
+            }
+            catch (err) {
+                expect(err).toBeInstanceOf(AuthError);
+                expect(err.code).toBe(AuthErrorCodes.UNAUTHENTICATED);
+            }
+        });
+    });
+    describe('null actor (anonymous)', () => {
+        it('permits read with readMode: published', () => {
+            const ctx = createRequestContext({ actor: null, readMode: 'published' });
+            expect(() => assertActorCanPerform(ctx, 'pages', 'read')).not.toThrow();
+        });
+        it('rejects read with readMode: any', () => {
+            const ctx = createRequestContext({ actor: null, readMode: 'any' });
+            try {
+                assertActorCanPerform(ctx, 'pages', 'read');
+                expect.fail('expected ERR_UNAUTHENTICATED');
+            }
+            catch (err) {
+                expect(err.code).toBe(AuthErrorCodes.UNAUTHENTICATED);
+                expect(err.message).toMatch(/readMode.*published/);
+            }
+        });
+        it('rejects read when readMode is unset', () => {
+            const ctx = createRequestContext({ actor: null });
+            try {
+                assertActorCanPerform(ctx, 'pages', 'read');
+                expect.fail('expected ERR_UNAUTHENTICATED');
+            }
+            catch (err) {
+                expect(err.code).toBe(AuthErrorCodes.UNAUTHENTICATED);
+            }
+        });
+        it('rejects every non-read verb regardless of readMode', () => {
+            const ctx = createRequestContext({ actor: null, readMode: 'published' });
+            for (const verb of ['create', 'update', 'delete', 'publish', 'changeStatus']) {
+                try {
+                    assertActorCanPerform(ctx, 'pages', verb);
+                    expect.fail(`expected ERR_UNAUTHENTICATED for ${verb}`);
+                }
+                catch (err) {
+                    expect(err.code).toBe(AuthErrorCodes.UNAUTHENTICATED);
+                }
+            }
+        });
+    });
+    describe('actor with abilities', () => {
+        it('permits the verb when the specific ability is held', () => {
+            const actor = new AdminAuth({
+                id: 'editor-1',
+                abilities: ['collections.pages.update'],
+            });
+            const ctx = createRequestContext({ actor });
+            expect(() => assertActorCanPerform(ctx, 'pages', 'update')).not.toThrow();
+        });
+        it('throws ERR_FORBIDDEN when the specific ability is missing', () => {
+            const actor = new AdminAuth({
+                id: 'editor-1',
+                abilities: ['collections.pages.read'],
+            });
+            const ctx = createRequestContext({ actor });
+            try {
+                assertActorCanPerform(ctx, 'pages', 'publish');
+                expect.fail('expected ERR_FORBIDDEN');
+            }
+            catch (err) {
+                expect(err.code).toBe(AuthErrorCodes.FORBIDDEN);
+                expect(err.message).toContain('collections.pages.publish');
+            }
+        });
+        it('checks the ability against the specific collectionPath', () => {
+            const actor = new AdminAuth({
+                id: 'editor-1',
+                abilities: ['collections.pages.update'], // has update for 'pages' only
+            });
+            const ctx = createRequestContext({ actor });
+            expect(() => assertActorCanPerform(ctx, 'pages', 'update')).not.toThrow();
+            try {
+                assertActorCanPerform(ctx, 'news', 'update');
+                expect.fail('expected ERR_FORBIDDEN — wrong collection');
+            }
+            catch (err) {
+                expect(err.code).toBe(AuthErrorCodes.FORBIDDEN);
+                expect(err.message).toContain('collections.news.update');
+            }
+        });
+    });
+    describe('super-admin', () => {
+        it('passes every verb on every collection without explicit abilities', () => {
+            const ctx = createSuperAdminContext();
+            const verbs = ['read', 'create', 'update', 'delete', 'publish', 'changeStatus'];
+            for (const verb of verbs) {
+                expect(() => assertActorCanPerform(ctx, 'any-collection', verb)).not.toThrow();
+            }
+        });
+        it('passes even when readMode would normally reject a null actor', () => {
+            // Super-admin doesn't care about readMode at this layer.
+            const ctx = createSuperAdminContext();
+            expect(() => assertActorCanPerform(ctx, 'pages', 'read')).not.toThrow();
+        });
+    });
+});
+//# sourceMappingURL=assert-actor-can-perform.test.node.js.map

package/dist/auth/assert-actor-can-perform.test.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-actor-can-perform.test.node.js","sourceRoot":"","sources":["../../src/auth/assert-actor-can-perform.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAErE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC9D,IAAI,CAAC;gBACH,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;gBACjD,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;gBACrC,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;YACtE,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QACzE,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YAClE,IAAI,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;gBACpE,MAAM,CAAE,GAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;YACnE,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC3C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;YACtE,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAU,EAAE,CAAC;gBACtF,IAAI,CAAC;oBACH,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oBACzC,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAA;gBACzD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;gBAC1B,EAAE,EAAE,UAAU;gBACd,SAAS,EAAE,CAAC,0BAA0B,CAAC;aACxC,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC3E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;gBAC1B,EAAE,EAAE,UAAU;gBACd,SAAS,EAAE,CAAC,wBAAwB,CAAC;aACtC,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3C,IAAI,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;gBAC9C,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;gBAC9D,MAAM,CAAE,GAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;YAC3E,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC;gBAC1B,EAAE,EAAE,UAAU;gBACd,SAAS,EAAE,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;aACxE,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;YACzE,IAAI,CAAC;gBACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAC5C,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAE,GAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;gBAC9D,MAAM,CAAE,GAAiB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;YACzE,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAA;YACrC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAU,CAAA;YACxF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;YAChF,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,yDAAyD;YACzD,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAA;YACrC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export { applyBeforeRead } from './apply-before-read.js';
+export { assertActorCanPerform } from './assert-actor-can-perform.js';
+export { COLLECTION_ABILITY_VERBS, type CollectionAbilityVerb, collectionAbilityKey, registerCollectionAbilities, } from './register-collection-abilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EACL,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export { applyBeforeRead } from './apply-before-read.js';
+export { assertActorCanPerform } from './assert-actor-can-perform.js';
+export { COLLECTION_ABILITY_VERBS, collectionAbilityKey, registerCollectionAbilities, } from './register-collection-abilities.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,EACL,wBAAwB,EAExB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAA"}

package/dist/auth/register-collection-abilities.d.ts

@@ -0,0 +1,40 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { AbilityRegistry } from '@byline/auth';
+import type { CollectionDefinition } from '../@types/index.js';
+/**
+ * Auto-register the CRUD + workflow abilities contributed by a collection.
+ *
+ * Every registered collection contributes exactly six abilities, all in
+ * the `collections.<path>` group:
+ *
+ *   - `collections.<path>.read`          — enumerate / fetch documents
+ *   - `collections.<path>.create`        — create new documents
+ *   - `collections.<path>.update`        — modify existing documents
+ *   - `collections.<path>.delete`        — delete documents (soft or hard)
+ *   - `collections.<path>.publish`       — transition a document into the
+ *                                          `published` status
+ *   - `collections.<path>.changeStatus`  — any other workflow transition
+ *                                          (draft → custom state, etc.)
+ *
+ * Registration is unconditional: every collection in Byline has a workflow
+ * (the default `draft → published → archived` one when not explicitly
+ * configured), so `publish` and `changeStatus` always apply. Keeping the
+ * six-ability contract uniform makes the role editor UI predictable and
+ * avoids hidden conditional logic downstream.
+ *
+ * Called from `initBylineCore()` for each declared collection. See
+ * docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §3 and Phase 1.
+ */
+export declare function registerCollectionAbilities(registry: AbilityRegistry, definition: CollectionDefinition): void;
+/** The ability suffixes that every collection contributes. Exposed for contract tests. */
+export declare const COLLECTION_ABILITY_VERBS: readonly ["read", "create", "update", "delete", "publish", "changeStatus"];
+export type CollectionAbilityVerb = (typeof COLLECTION_ABILITY_VERBS)[number];
+/** Compute the full ability key for a collection path and verb. */
+export declare function collectionAbilityKey(path: string, verb: CollectionAbilityVerb): string;
+//# sourceMappingURL=register-collection-abilities.d.ts.map

package/dist/auth/register-collection-abilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-collection-abilities.d.ts","sourceRoot":"","sources":["../../src/auth/register-collection-abilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,oBAAoB,GAC/B,IAAI,CA0CN;AAED,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,4EAO3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAEtF"}

package/dist/auth/register-collection-abilities.js

@@ -0,0 +1,87 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Auto-register the CRUD + workflow abilities contributed by a collection.
+ *
+ * Every registered collection contributes exactly six abilities, all in
+ * the `collections.<path>` group:
+ *
+ *   - `collections.<path>.read`          — enumerate / fetch documents
+ *   - `collections.<path>.create`        — create new documents
+ *   - `collections.<path>.update`        — modify existing documents
+ *   - `collections.<path>.delete`        — delete documents (soft or hard)
+ *   - `collections.<path>.publish`       — transition a document into the
+ *                                          `published` status
+ *   - `collections.<path>.changeStatus`  — any other workflow transition
+ *                                          (draft → custom state, etc.)
+ *
+ * Registration is unconditional: every collection in Byline has a workflow
+ * (the default `draft → published → archived` one when not explicitly
+ * configured), so `publish` and `changeStatus` always apply. Keeping the
+ * six-ability contract uniform makes the role editor UI predictable and
+ * avoids hidden conditional logic downstream.
+ *
+ * Called from `initBylineCore()` for each declared collection. See
+ * docs/analysis/AUTHN-AUTHZ-ANALYSIS.md §3 and Phase 1.
+ */
+export function registerCollectionAbilities(registry, definition) {
+    const path = definition.path;
+    const group = `collections.${path}`;
+    const base = `collections.${path}`;
+    const { singular, plural } = definition.labels;
+    registry.register({
+        key: `${base}.read`,
+        label: `Read ${plural}`,
+        group,
+        source: 'collection',
+    });
+    registry.register({
+        key: `${base}.create`,
+        label: `Create ${singular}`,
+        group,
+        source: 'collection',
+    });
+    registry.register({
+        key: `${base}.update`,
+        label: `Update ${singular}`,
+        group,
+        source: 'collection',
+    });
+    registry.register({
+        key: `${base}.delete`,
+        label: `Delete ${singular}`,
+        group,
+        source: 'collection',
+    });
+    registry.register({
+        key: `${base}.publish`,
+        label: `Publish ${plural}`,
+        group,
+        source: 'collection',
+    });
+    registry.register({
+        key: `${base}.changeStatus`,
+        label: `Change status of ${plural}`,
+        group,
+        source: 'collection',
+    });
+}
+/** The ability suffixes that every collection contributes. Exposed for contract tests. */
+export const COLLECTION_ABILITY_VERBS = [
+    'read',
+    'create',
+    'update',
+    'delete',
+    'publish',
+    'changeStatus',
+];
+/** Compute the full ability key for a collection path and verb. */
+export function collectionAbilityKey(path, verb) {
+    return `collections.${path}.${verb}`;
+}
+//# sourceMappingURL=register-collection-abilities.js.map

package/dist/auth/register-collection-abilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-collection-abilities.js","sourceRoot":"","sources":["../../src/auth/register-collection-abilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAyB,EACzB,UAAgC;IAEhC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC5B,MAAM,KAAK,GAAG,eAAe,IAAI,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,eAAe,IAAI,EAAE,CAAA;IAClC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAA;IAE9C,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,OAAO;QACnB,KAAK,EAAE,QAAQ,MAAM,EAAE;QACvB,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,SAAS;QACrB,KAAK,EAAE,UAAU,QAAQ,EAAE;QAC3B,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,SAAS;QACrB,KAAK,EAAE,UAAU,QAAQ,EAAE;QAC3B,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,SAAS;QACrB,KAAK,EAAE,UAAU,QAAQ,EAAE;QAC3B,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,UAAU;QACtB,KAAK,EAAE,WAAW,MAAM,EAAE;QAC1B,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;IACF,QAAQ,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,GAAG,IAAI,eAAe;QAC3B,KAAK,EAAE,oBAAoB,MAAM,EAAE;QACnC,KAAK;QACL,MAAM,EAAE,YAAY;KACrB,CAAC,CAAA;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,cAAc;CACN,CAAA;AAIV,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAA2B;IAC5E,OAAO,eAAe,IAAI,IAAI,IAAI,EAAE,CAAA;AACtC,CAAC"}

package/dist/auth/register-collection-abilities.test.node.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};
+//# sourceMappingURL=register-collection-abilities.test.node.d.ts.map

package/dist/auth/register-collection-abilities.test.node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-collection-abilities.test.node.d.ts","sourceRoot":"","sources":["../../src/auth/register-collection-abilities.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/auth/register-collection-abilities.test.node.js

@@ -0,0 +1,124 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import { AbilityRegistry } from '@byline/auth';
+import { describe, expect, it } from 'vitest';
+import { COLLECTION_ABILITY_VERBS, collectionAbilityKey, registerCollectionAbilities, } from './register-collection-abilities.js';
+function pageCollection() {
+    return {
+        path: 'pages',
+        labels: { singular: 'Page', plural: 'Pages' },
+        fields: [{ name: 'title', type: 'text' }],
+    };
+}
+function newsCollection() {
+    return {
+        path: 'news',
+        labels: { singular: 'News Item', plural: 'News' },
+        fields: [{ name: 'title', type: 'text' }],
+        workflow: {
+            statuses: [
+                { name: 'draft' },
+                { name: 'in_review' },
+                { name: 'published' },
+                { name: 'archived' },
+            ],
+        },
+    };
+}
+describe('registerCollectionAbilities', () => {
+    it('registers exactly the six CRUD + workflow abilities for a collection', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        const keys = registry.list().map((d) => d.key);
+        expect(keys).toEqual([
+            'collections.pages.read',
+            'collections.pages.create',
+            'collections.pages.update',
+            'collections.pages.delete',
+            'collections.pages.publish',
+            'collections.pages.changeStatus',
+        ]);
+    });
+    it('places every ability under the same `collections.<path>` group', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        const buckets = registry.byGroup();
+        expect(buckets.size).toBe(1);
+        expect(buckets.get('collections.pages')?.length).toBe(6);
+    });
+    it('derives labels from the collection singular/plural labels', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        expect(registry.get('collections.pages.read')?.label).toBe('Read Pages');
+        expect(registry.get('collections.pages.create')?.label).toBe('Create Page');
+        expect(registry.get('collections.pages.update')?.label).toBe('Update Page');
+        expect(registry.get('collections.pages.delete')?.label).toBe('Delete Page');
+        expect(registry.get('collections.pages.publish')?.label).toBe('Publish Pages');
+        expect(registry.get('collections.pages.changeStatus')?.label).toBe('Change status of Pages');
+    });
+    it('tags every ability with source: "collection"', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        for (const descriptor of registry.list()) {
+            expect(descriptor.source).toBe('collection');
+        }
+    });
+    it('registers the same six-ability shape regardless of workflow complexity', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, newsCollection());
+        expect(registry.list().map((d) => d.key)).toEqual([
+            'collections.news.read',
+            'collections.news.create',
+            'collections.news.update',
+            'collections.news.delete',
+            'collections.news.publish',
+            'collections.news.changeStatus',
+        ]);
+    });
+    it('is idempotent — calling twice leaves the registry with the same six entries', () => {
+        const registry = new AbilityRegistry();
+        const collection = pageCollection();
+        registerCollectionAbilities(registry, collection);
+        registerCollectionAbilities(registry, collection);
+        expect(registry.size).toBe(6);
+    });
+    it('keeps multiple collections isolated in distinct groups', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        registerCollectionAbilities(registry, newsCollection());
+        const buckets = registry.byGroup();
+        expect(buckets.size).toBe(2);
+        expect(buckets.get('collections.pages')?.length).toBe(6);
+        expect(buckets.get('collections.news')?.length).toBe(6);
+        expect(registry.size).toBe(12);
+    });
+});
+describe('COLLECTION_ABILITY_VERBS / collectionAbilityKey', () => {
+    it('COLLECTION_ABILITY_VERBS exposes the canonical verb list in registration order', () => {
+        expect(COLLECTION_ABILITY_VERBS).toEqual([
+            'read',
+            'create',
+            'update',
+            'delete',
+            'publish',
+            'changeStatus',
+        ]);
+    });
+    it('collectionAbilityKey composes a flat dotted key', () => {
+        expect(collectionAbilityKey('pages', 'publish')).toBe('collections.pages.publish');
+        expect(collectionAbilityKey('news', 'changeStatus')).toBe('collections.news.changeStatus');
+    });
+    it('matches the keys produced by registerCollectionAbilities', () => {
+        const registry = new AbilityRegistry();
+        registerCollectionAbilities(registry, pageCollection());
+        for (const verb of COLLECTION_ABILITY_VERBS) {
+            expect(registry.has(collectionAbilityKey('pages', verb))).toBe(true);
+        }
+    });
+});
+//# sourceMappingURL=register-collection-abilities.test.node.js.map

package/dist/auth/register-collection-abilities.test.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-collection-abilities.test.node.js","sourceRoot":"","sources":["../../src/auth/register-collection-abilities.test.node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAA;AAG3C,SAAS,cAAc;IACrB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAC7C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,cAAc;IACrB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;QACjD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzC,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,OAAO,EAAE;gBACjB,EAAE,IAAI,EAAE,WAAW,EAAE;gBACrB,EAAE,IAAI,EAAE,WAAW,EAAE;gBACrB,EAAE,IAAI,EAAE,UAAU,EAAE;aACrB;SACF;KACF,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QAEvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YACnB,wBAAwB;YACxB,0BAA0B;YAC1B,0BAA0B;YAC1B,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC9E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,uBAAuB;YACvB,yBAAyB;YACzB,yBAAyB;YACzB,yBAAyB;YACzB,0BAA0B;YAC1B,+BAA+B;SAChC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAA;QACnC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACjD,2BAA2B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACjD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC;YACvC,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,SAAS;YACT,cAAc;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAClF,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,2BAA2B,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QACvD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtE,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/config/config.d.ts

@@ -0,0 +1,10 @@
+import type { ClientConfig, CollectionAdminConfig, CollectionDefinition, ServerConfig } from '../@types/index.js';
+export declare const getCollectionDefinition: (path: string) => CollectionDefinition | null;
+export declare const getCollectionAdminConfig: (slug: string) => CollectionAdminConfig | null;
+export declare function defineClientConfig(config: ClientConfig): void;
+export declare function defineServerConfig(config: ServerConfig): void;
+export declare function getClientConfig(): ClientConfig;
+export declare function getServerConfig(): ServerConfig;
+export declare function defineBylineCore(core: unknown): void;
+export declare function getBylineCoreUnsafe(): unknown;
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAmC1B,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,oBAAoB,GAAG,IAS7E,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,IAI/E,CAAA;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,QAItD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,QAGtD;AAED,wBAAgB,eAAe,IAAI,YAAY,CAqB9C;AAED,wBAAgB,eAAe,IAAI,YAAY,CAW9C;AAYD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAEpD;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAW7C"}

package/dist/config/config.js

@@ -0,0 +1,108 @@
+import { validateAdminConfigs } from './validate-admin-configs.js';
+import { validateCollections } from './validate-collections.js';
+// ---------------------------------------------------------------------------
+// Global config storage
+// ---------------------------------------------------------------------------
+// Store config instances on `globalThis` so that every copy of this module
+// (which can happen in Vite SSR when workspace-linked packages are resolved
+// through different module graphs) shares the same state.
+// ---------------------------------------------------------------------------
+const BYLINE_SERVER_CONFIG = Symbol.for('__byline_server_config__');
+const BYLINE_CLIENT_CONFIG = Symbol.for('__byline_client_config__');
+const BYLINE_CORE = Symbol.for('__byline_core__');
+function getServerConfigInstance() {
+    return globalThis[BYLINE_SERVER_CONFIG] ?? null;
+}
+function setServerConfigInstance(config) {
+    ;
+    globalThis[BYLINE_SERVER_CONFIG] = config;
+}
+function getClientConfigInstance() {
+    return globalThis[BYLINE_CLIENT_CONFIG] ?? null;
+}
+function setClientConfigInstance(config) {
+    ;
+    globalThis[BYLINE_CLIENT_CONFIG] = config;
+}
+function getBylineCoreInstance() {
+    return globalThis[BYLINE_CORE] ?? null;
+}
+function setBylineCoreInstance(core) {
+    ;
+    globalThis[BYLINE_CORE] = core;
+}
+export const getCollectionDefinition = (path) => {
+    const config = getClientConfigInstance() ?? getServerConfigInstance();
+    if (config == null) {
+        throw new Error('Byline has not been configured yet. Please call defineClientConfig or defineServerConfig in your admin/server config first.');
+    }
+    return config.collections.find((collection) => collection.path === path) ?? null;
+};
+export const getCollectionAdminConfig = (slug) => {
+    const clientConfig = getClientConfigInstance();
+    if (clientConfig == null)
+        return null;
+    return clientConfig.admin?.find((admin) => admin.slug === slug) ?? null;
+};
+export function defineClientConfig(config) {
+    validateCollections(config.collections);
+    validateAdminConfigs(config.admin, config.collections);
+    setClientConfigInstance(config);
+}
+export function defineServerConfig(config) {
+    validateCollections(config.collections);
+    setServerConfigInstance(config);
+}
+export function getClientConfig() {
+    const clientConfig = getClientConfigInstance();
+    if (clientConfig != null) {
+        return clientConfig;
+    }
+    // During SSR the client entry has not run yet, but the server config
+    // carries the same collection definitions.  Return a compatible object
+    // so route loaders and components work in both contexts.
+    const serverConfig = getServerConfigInstance();
+    if (serverConfig != null) {
+        return {
+            serverURL: serverConfig.serverURL,
+            i18n: serverConfig.i18n,
+            routes: serverConfig.routes,
+            collections: serverConfig.collections,
+            admin: [],
+        };
+    }
+    throw new Error('Byline has not been configured yet. Please call defineClientConfig in byline.config.ts first.');
+}
+export function getServerConfig() {
+    if (typeof globalThis !== 'undefined' && 'window' in globalThis) {
+        throw new Error('getServerConfig cannot be called on the client.');
+    }
+    const serverConfig = getServerConfigInstance();
+    if (serverConfig == null) {
+        throw new Error('Byline has not been configured yet. Please call defineServerConfig in byline.config.ts first.');
+    }
+    return serverConfig;
+}
+// ---------------------------------------------------------------------------
+// BylineCore singleton — the composed runtime returned by `initBylineCore`.
+// Server-side packages that need post-init state (the abilities registry,
+// the resolved admin store) read it here rather than importing the host's
+// host server config module directly. Stored as `unknown` to avoid a
+// circular type dependency between `config.ts` and `core.ts`; consumers
+// import the typed `getBylineCore<TAdminStore>()` re-export from
+// `core.ts`.
+// ---------------------------------------------------------------------------
+export function defineBylineCore(core) {
+    setBylineCoreInstance(core);
+}
+export function getBylineCoreUnsafe() {
+    if (typeof globalThis !== 'undefined' && 'window' in globalThis) {
+        throw new Error('getBylineCore cannot be called on the client.');
+    }
+    const core = getBylineCoreInstance();
+    if (core == null) {
+        throw new Error('BylineCore has not been initialised yet. Please call initBylineCore() in your server config first.');
+    }
+    return core;
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAQ/D,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;AACnE,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;AACnE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;AAEjD,SAAS,uBAAuB;IAC9B,OAAQ,UAAkB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAA;AAC1D,CAAC;AACD,SAAS,uBAAuB,CAAC,MAAoB;IACnD,CAAC;IAAC,UAAkB,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAA;AACrD,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAQ,UAAkB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAA;AAC1D,CAAC;AACD,SAAS,uBAAuB,CAAC,MAAoB;IACnD,CAAC;IAAC,UAAkB,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAA;AACrD,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAQ,UAAkB,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACjD,CAAC;AACD,SAAS,qBAAqB,CAAC,IAAa;IAC1C,CAAC;IAAC,UAAkB,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAA+B,EAAE;IACnF,MAAM,MAAM,GAAG,uBAAuB,EAAE,IAAI,uBAAuB,EAAE,CAAA;IACrE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,6HAA6H,CAC9H,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAAgC,EAAE;IACrF,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAA;IAC9C,IAAI,YAAY,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;IACtD,uBAAuB,CAAC,MAAM,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvC,uBAAuB,CAAC,MAAM,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAA;IAC9C,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAA;IAC9C,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,KAAK,EAAE,EAAE;SACM,CAAA;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAA;IAC9C,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,iEAAiE;AACjE,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,qBAAqB,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,UAAU,KAAK,WAAW,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAA;IACpC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/config/routes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { RoutesConfig } from '../@types/site-config.js';
+/**
+ * Merge a user-supplied (potentially partial) routes config with the
+ * built-in defaults. Empty / unset keys fall back to `'/admin'` and
+ * `'/api'`. Returns a fully-populated `RoutesConfig` so consumers don't
+ * need null checks at every call site.
+ */
+export declare function resolveRoutes(routes?: Partial<RoutesConfig>): RoutesConfig;
+//# sourceMappingURL=routes.d.ts.map

package/dist/config/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/config/routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAS3D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAK1E"}

package/dist/config/routes.js

@@ -0,0 +1,26 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Default route segments. Installations override either key on the
+ * config object; callers read the merged shape via `resolveRoutes()`. */
+const DEFAULT_ROUTES = {
+    admin: '/admin',
+    api: '/api',
+};
+/**
+ * Merge a user-supplied (potentially partial) routes config with the
+ * built-in defaults. Empty / unset keys fall back to `'/admin'` and
+ * `'/api'`. Returns a fully-populated `RoutesConfig` so consumers don't
+ * need null checks at every call site.
+ */
+export function resolveRoutes(routes) {
+    return {
+        admin: routes?.admin ?? DEFAULT_ROUTES.admin,
+        api: routes?.api ?? DEFAULT_ROUTES.api,
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/config/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/config/routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;yEACyE;AACzE,MAAM,cAAc,GAAiB;IACnC,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,MAAM;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,OAAO;QACL,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,KAAK;QAC5C,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,cAAc,CAAC,GAAG;KACvC,CAAA;AACH,CAAC"}