@byline/core 3.20.4 → 4.0.0

package/dist/services/richtext-populate.test.node.js

@@ -5,8 +5,11 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import { describe, expect, it } from 'vitest';
-import { collectRichTextLeaves, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
+import { AdminAuth, createRequestContext } from '@byline/auth';
+import { describe, expect, it, vi } from 'vitest';
+import { applyBeforeRead } from '../auth/apply-before-read.js';
+import { createReadContext, populateDocuments } from './populate.js';
+import { collectRichTextLeaves, createRichTextDocumentReader, populateRichTextFields, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
 // ---------------------------------------------------------------------------
 // Fixture — a synthetic collection that exercises every nesting type the
 // walker needs to handle: top-level, group, array, blocks (with two block
@@ -109,6 +112,524 @@ describe('collectRichTextLeaves', () => {
         expect(out).toEqual([]);
     });
 });
+describe('createRichTextDocumentReader', () => {
+    const target = {
+        path: 'media',
+        labels: { singular: 'Media', plural: 'Media' },
+        fields: [
+            { name: 'title', type: 'text', label: 'Title' },
+            { name: 'tenant', type: 'text', label: 'Tenant' },
+        ],
+        hooks: { beforeRead: () => ({ tenant: 'alice' }) },
+    };
+    function dbMock() {
+        const getCollectionByPath = vi.fn().mockResolvedValue({ id: 'media-id', path: 'media' });
+        const getDocumentsByDocumentIds = vi.fn().mockResolvedValue([]);
+        return {
+            db: {
+                queries: {
+                    collections: { getCollectionByPath },
+                    documents: { getDocumentsByDocumentIds },
+                },
+            },
+            getCollectionByPath,
+            getDocumentsByDocumentIds,
+        };
+    }
+    it('asserts target ability before adapter access', async () => {
+        const { db, getCollectionByPath, getDocumentsByDocumentIds } = dbMock();
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [target],
+            requestContext: createRequestContext({
+                actor: new AdminAuth({ id: 'denied', abilities: ['collections.posts.read'] }),
+                readMode: 'published',
+            }),
+            readContext: createReadContext(),
+            readMode: 'published',
+        });
+        await expect(read({ collectionPath: 'media', documentIds: ['m1'] })).rejects.toMatchObject({
+            code: 'ERR_FORBIDDEN',
+        });
+        expect(getCollectionByPath).not.toHaveBeenCalled();
+        expect(getDocumentsByDocumentIds).not.toHaveBeenCalled();
+    });
+    it('applies target beforeRead filters to the batch', async () => {
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [target],
+            requestContext: createRequestContext({
+                actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+                readMode: 'published',
+            }),
+            readContext: createReadContext(),
+            readMode: 'published',
+        });
+        await read({ collectionPath: 'media', documentIds: ['m1'] });
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledWith(expect.objectContaining({
+            collection_id: 'media-id',
+            document_ids: ['m1'],
+            readMode: 'published',
+            filters: [expect.objectContaining({ kind: 'field', fieldName: 'tenant', value: 'alice' })],
+        }));
+    });
+    it('isolates direct readers by default and shares compiled filters only with an explicit domain', async () => {
+        const beforeRead = vi.fn(() => ({ tenant: 'alice' }));
+        const scopedTarget = {
+            ...target,
+            hooks: { beforeRead },
+        };
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        const readContext = createReadContext();
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+            readMode: 'published',
+        });
+        const reader = (securityDomain) => createRichTextDocumentReader({
+            db,
+            collections: [scopedTarget],
+            requestContext,
+            readContext,
+            readMode: 'published',
+            securityDomain,
+        });
+        await reader()({ collectionPath: 'media', documentIds: ['implicit-a'] });
+        await reader()({ collectionPath: 'media', documentIds: ['implicit-b'] });
+        const sharedDomain = {};
+        await reader(sharedDomain)({ collectionPath: 'media', documentIds: ['explicit-a'] });
+        await reader(sharedDomain)({ collectionPath: 'media', documentIds: ['explicit-b'] });
+        const calls = getDocumentsByDocumentIds.mock.calls;
+        expect(calls[1]?.[0].filters).not.toBe(calls[0]?.[0].filters);
+        expect(calls[3]?.[0].filters).toBe(calls[2]?.[0].filters);
+        expect(beforeRead).toHaveBeenCalledTimes(3);
+    });
+    it('reuses compiled security filters across relation and rich-text target population', async () => {
+        const source = {
+            path: 'posts',
+            labels: { singular: 'Post', plural: 'Posts' },
+            fields: [
+                {
+                    name: 'media',
+                    type: 'relation',
+                    label: 'Media',
+                    targetCollection: 'media',
+                },
+            ],
+        };
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        const readContext = createReadContext();
+        const securityDomain = {};
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({
+                id: 'reader',
+                abilities: ['collections.posts.read', 'collections.media.read'],
+            }),
+            readMode: 'published',
+        });
+        await populateDocuments({
+            db,
+            collections: [source, target],
+            collectionId: 'posts',
+            documents: [
+                {
+                    document_id: 'p1',
+                    fields: {
+                        media: { targetCollectionId: 'media', targetDocumentId: 'm1' },
+                    },
+                },
+            ],
+            populate: true,
+            requestContext,
+            readContext,
+            readMode: 'published',
+            securityDomain,
+        });
+        const relationFilters = getDocumentsByDocumentIds.mock.calls[0]?.[0].filters;
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [source, target],
+            requestContext,
+            readContext,
+            readMode: 'published',
+            securityDomain,
+        });
+        await read({ collectionPath: 'media', documentIds: ['m2'] });
+        expect(getDocumentsByDocumentIds.mock.calls[1]?.[0].filters).toBe(relationFilters);
+    });
+    it('rejects relation populate reuse under another actor before adapter access', async () => {
+        const scopedTarget = {
+            ...target,
+            hooks: {
+                beforeRead: ({ requestContext }) => ({ tenant: requestContext.actor?.id }),
+            },
+        };
+        const source = {
+            path: 'posts',
+            labels: { singular: 'Post', plural: 'Posts' },
+            fields: [
+                {
+                    name: 'media',
+                    type: 'relation',
+                    label: 'Media',
+                    targetCollection: 'media',
+                },
+            ],
+        };
+        const { db, getCollectionByPath, getDocumentsByDocumentIds } = dbMock();
+        const readContext = createReadContext();
+        const requestId = 'shared-request';
+        const contextFor = (id) => createRequestContext({
+            actor: new AdminAuth({ id, abilities: ['collections.media.read'] }),
+            requestId,
+            readMode: 'published',
+        });
+        const populateFor = (id, requestContext) => populateDocuments({
+            db,
+            collections: [source, scopedTarget],
+            collectionId: 'posts',
+            documents: [
+                {
+                    document_id: `p-${id}`,
+                    fields: {
+                        media: { targetCollectionId: 'media', targetDocumentId: `m-${id}` },
+                    },
+                },
+            ],
+            populate: true,
+            requestContext,
+            readContext,
+            readMode: 'published',
+        });
+        await populateFor('alice', contextFor('alice'));
+        await expect(populateFor('bob', contextFor('bob'))).rejects.toThrow('cannot be reused across request authorities');
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledOnce();
+        expect(getCollectionByPath).not.toHaveBeenCalled();
+    });
+    it('rejects rich-text reader reuse under another actor before adapter access', async () => {
+        const scopedTarget = {
+            ...target,
+            hooks: {
+                beforeRead: ({ requestContext }) => ({ tenant: requestContext.actor?.id }),
+            },
+        };
+        const { db, getCollectionByPath, getDocumentsByDocumentIds } = dbMock();
+        const readContext = createReadContext();
+        const requestId = 'shared-request';
+        const readerFor = (id) => createRichTextDocumentReader({
+            db,
+            collections: [scopedTarget],
+            requestContext: createRequestContext({
+                actor: new AdminAuth({ id, abilities: ['collections.media.read'] }),
+                requestId,
+                readMode: 'published',
+            }),
+            readContext,
+            readMode: 'published',
+        });
+        await readerFor('alice')({ collectionPath: 'media', documentIds: ['m1'] });
+        await expect(readerFor('bob')({ collectionPath: 'media', documentIds: ['m2'] })).rejects.toThrow('cannot be reused across request authorities');
+        expect(getCollectionByPath).toHaveBeenCalledOnce();
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledOnce();
+    });
+    it('rejects malformed relation and rich-text predicates before adapter access', async () => {
+        const malformedTarget = {
+            ...target,
+            hooks: { beforeRead: () => ({ typoedTenant: 'alice' }) },
+        };
+        const source = {
+            path: 'posts',
+            labels: { singular: 'Post', plural: 'Posts' },
+            fields: [
+                {
+                    name: 'media',
+                    type: 'relation',
+                    label: 'Media',
+                    targetCollection: 'media',
+                },
+            ],
+        };
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+            readMode: 'published',
+        });
+        const relationDb = dbMock();
+        await expect(populateDocuments({
+            db: relationDb.db,
+            collections: [source, malformedTarget],
+            collectionId: 'posts',
+            documents: [
+                {
+                    document_id: 'p1',
+                    fields: {
+                        media: { targetCollectionId: 'media', targetDocumentId: 'm1' },
+                    },
+                },
+            ],
+            populate: true,
+            requestContext,
+            readContext: createReadContext(),
+            readMode: 'published',
+        })).rejects.toThrow('unknown field');
+        expect(relationDb.getCollectionByPath).not.toHaveBeenCalled();
+        expect(relationDb.getDocumentsByDocumentIds).not.toHaveBeenCalled();
+        const richTextDb = dbMock();
+        const read = createRichTextDocumentReader({
+            db: richTextDb.db,
+            collections: [malformedTarget],
+            requestContext,
+            readContext: createReadContext(),
+            readMode: 'published',
+        });
+        await expect(read({ collectionPath: 'media', documentIds: ['m1'] })).rejects.toThrow('unknown field');
+        expect(richTextDb.getCollectionByPath).not.toHaveBeenCalled();
+        expect(richTextDb.getDocumentsByDocumentIds).not.toHaveBeenCalled();
+    });
+    it('runs target rich-text population and actor-aware afterRead once per materialization', async () => {
+        const afterRead = vi.fn((ctx) => {
+            if (ctx.requestContext.actor?.id === 'reader')
+                delete ctx.doc.fields.secret;
+        });
+        const recursiveTarget = {
+            ...target,
+            fields: [
+                ...target.fields,
+                {
+                    name: 'body',
+                    type: 'richText',
+                    label: 'Body',
+                    populateRelationsOnRead: true,
+                },
+                { name: 'secret', type: 'text', label: 'Secret' },
+            ],
+            hooks: { ...target.hooks, afterRead },
+        };
+        const doc = {
+            document_version_id: 'v1',
+            document_id: 'm1',
+            fields: { title: 'Media', tenant: 'alice', body: {}, secret: 'hidden' },
+        };
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        getDocumentsByDocumentIds.mockResolvedValue([doc]);
+        const readContext = createReadContext();
+        const nestedResults = [];
+        const richTextPopulate = vi.fn(async (ctx) => {
+            nestedResults.push(await ctx.readDocuments({ collectionPath: 'media', documentIds: ['m1'] }));
+            ctx.value.refreshed = true;
+        });
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+            readMode: 'published',
+        });
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [recursiveTarget],
+            requestContext,
+            readContext,
+            readMode: 'published',
+            richTextPopulate,
+        });
+        const first = await read({ collectionPath: 'media', documentIds: ['m1'] });
+        const second = await read({ collectionPath: 'media', documentIds: ['m1'] });
+        expect(first[0]?.fields.body.refreshed).toBe(true);
+        expect(first[0]?.fields).not.toHaveProperty('secret');
+        expect(second[0]).toBe(first[0]);
+        expect(nestedResults).toEqual([[]]);
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledTimes(1);
+        expect(richTextPopulate).toHaveBeenCalledTimes(1);
+        expect(afterRead).toHaveBeenCalledWith(expect.objectContaining({ requestContext, readContext }));
+        expect(readContext.readCount).toBe(1);
+        expect(readContext.visited).toContain('media-id:m1');
+    });
+    it('shares active reader state with a beforeRead-scoped context', async () => {
+        const recursiveTarget = {
+            ...target,
+            fields: [
+                ...target.fields,
+                {
+                    name: 'body',
+                    type: 'richText',
+                    label: 'Body',
+                    populateRelationsOnRead: true,
+                },
+            ],
+            hooks: undefined,
+        };
+        let scopedContext;
+        const gate = {
+            path: 'gate',
+            labels: { singular: 'Gate', plural: 'Gates' },
+            fields: [],
+            hooks: {
+                beforeRead: ({ readContext }) => {
+                    scopedContext = readContext;
+                },
+            },
+        };
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+            readMode: 'published',
+        });
+        const readContext = createReadContext();
+        await applyBeforeRead({ definition: gate, requestContext, readContext });
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        getDocumentsByDocumentIds.mockImplementation(async () => [
+            {
+                document_version_id: 'v1',
+                document_id: 'm1',
+                fields: { title: 'Media', tenant: 'alice', body: {} },
+            },
+        ]);
+        let nestedResult;
+        let reentered = false;
+        let nestedRead;
+        const richTextPopulate = vi.fn(async () => {
+            if (reentered)
+                return;
+            reentered = true;
+            nestedResult = await nestedRead({ collectionPath: 'media', documentIds: ['m1'] });
+        });
+        if (!scopedContext)
+            throw new Error('beforeRead did not receive a scoped ReadContext');
+        nestedRead = createRichTextDocumentReader({
+            db,
+            collections: [recursiveTarget],
+            requestContext,
+            readContext: scopedContext,
+            readMode: 'published',
+            richTextPopulate,
+        });
+        const outerRead = createRichTextDocumentReader({
+            db,
+            collections: [recursiveTarget],
+            requestContext,
+            readContext,
+            readMode: 'published',
+            richTextPopulate,
+        });
+        const result = await outerRead({ collectionPath: 'media', documentIds: ['m1'] });
+        expect(result).toHaveLength(1);
+        expect(nestedResult).toEqual([]);
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledOnce();
+        expect(richTextPopulate).toHaveBeenCalledOnce();
+    });
+    it('reuses a later batch target completed recursively instead of processing stale batch data', async () => {
+        const afterRead = vi.fn((ctx) => {
+            delete ctx.doc.fields.secret;
+            ctx.doc.fields.redacted = true;
+        });
+        const batchTarget = {
+            ...target,
+            fields: [
+                ...target.fields,
+                {
+                    name: 'body',
+                    type: 'richText',
+                    label: 'Body',
+                    populateRelationsOnRead: true,
+                },
+                { name: 'secret', type: 'text', label: 'Secret' },
+            ],
+            hooks: { ...target.hooks, afterRead },
+        };
+        const outerA = {
+            document_version_id: 'v1',
+            document_id: 'm1',
+            fields: { title: 'A', tenant: 'alice', body: { link: 'm2' }, secret: 'a' },
+        };
+        const staleOuterB = {
+            document_version_id: 'v2',
+            document_id: 'm2',
+            fields: { title: 'stale B', tenant: 'alice', body: {}, secret: 'stale' },
+        };
+        const recursiveB = {
+            document_version_id: 'v2',
+            document_id: 'm2',
+            fields: { title: 'fresh B', tenant: 'alice', body: {}, secret: 'hidden' },
+        };
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        getDocumentsByDocumentIds.mockImplementation(async ({ document_ids }) => document_ids.length === 2 ? [outerA, staleOuterB] : [recursiveB]);
+        const richTextPopulate = vi.fn(async (ctx) => {
+            if (typeof ctx.value.link !== 'string')
+                return;
+            const linked = await ctx.readDocuments({
+                collectionPath: 'media',
+                documentIds: [ctx.value.link],
+            });
+            ctx.value.linkedTitle = linked[0]?.fields.title;
+        });
+        const readContext = createReadContext();
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [batchTarget],
+            requestContext: createRequestContext({
+                actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+                readMode: 'published',
+            }),
+            readContext,
+            readMode: 'published',
+            richTextPopulate,
+        });
+        const result = await read({ collectionPath: 'media', documentIds: ['m1', 'm2'] });
+        expect(result[0]?.fields.body.linkedTitle).toBe('fresh B');
+        expect(result[1]).toBe(recursiveB);
+        expect(result[1]).not.toBe(staleOuterB);
+        expect(result[1]?.fields).toMatchObject({ title: 'fresh B', redacted: true });
+        expect(result[1]?.fields).not.toHaveProperty('secret');
+        expect(getDocumentsByDocumentIds).toHaveBeenCalledTimes(2);
+        expect(richTextPopulate).toHaveBeenCalledTimes(2);
+        expect(afterRead).toHaveBeenCalledTimes(2);
+        expect(readContext.readCount).toBe(2);
+    });
+    it('enforces the shared read budget before returning target documents', async () => {
+        const { db, getDocumentsByDocumentIds } = dbMock();
+        getDocumentsByDocumentIds.mockResolvedValue([
+            { document_version_id: 'v1', document_id: 'm1', fields: { title: 'Media' } },
+        ]);
+        const read = createRichTextDocumentReader({
+            db,
+            collections: [target],
+            requestContext: createRequestContext({
+                actor: new AdminAuth({ id: 'reader', abilities: ['collections.media.read'] }),
+                readMode: 'published',
+            }),
+            readContext: createReadContext({ maxReads: 0 }),
+            readMode: 'published',
+        });
+        await expect(read({ collectionPath: 'media', documentIds: ['m1'] })).rejects.toMatchObject({
+            code: 'ERR_READ_BUDGET_EXCEEDED',
+        });
+    });
+});
+describe('populateRichTextFields auth context', () => {
+    it('passes the operation context and secure reader to the adapter', async () => {
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.posts.read'] }),
+            readMode: 'published',
+        });
+        const readContext = createReadContext();
+        const readDocuments = vi.fn();
+        const populate = vi.fn();
+        await populateRichTextFields({
+            fields: [
+                {
+                    name: 'body',
+                    type: 'richText',
+                    label: 'Body',
+                    populateRelationsOnRead: true,
+                },
+            ],
+            collectionPath: 'posts',
+            documents: [{ fields: { body: richTextValue('body') } }],
+            populate,
+            readContext,
+            requestContext,
+            readMode: 'published',
+            readDocuments,
+        });
+        expect(populate).toHaveBeenCalledWith(expect.objectContaining({ requestContext, readContext, readMode: 'published', readDocuments }));
+    });
+});
 // ---------------------------------------------------------------------------
 // resolvePopulateOnRead — default-derivation table
 // ---------------------------------------------------------------------------

package/dist/services/validate-search-config.d.ts

@@ -25,4 +25,4 @@ export interface SearchProviderPresence {
  * actually opts in. Installations that don't use search leave
  * `ServerConfig.search` unset and pass cleanly.
  */
-export declare function validateSearchConfig(collections: CollectionDefinition[], adapters: SearchProviderPresence): void;
+export declare function validateSearchConfig(collections: readonly CollectionDefinition[], adapters: SearchProviderPresence): void;

package/dist/storage/collection-fingerprint.js

@@ -33,6 +33,12 @@ function canonicalField(field) {
             base.targetCollection = field.targetCollection;
             if (field.displayField !== undefined)
                 base.displayField = field.displayField;
+            if (field.hasMany === true)
+                base.hasMany = true;
+            if (field.minItems !== undefined)
+                base.minItems = field.minItems;
+            if (field.maxItems !== undefined)
+                base.maxItems = field.maxItems;
             return base;
         case 'datetime':
             if (field.mode !== undefined)

package/dist/storage/collection-fingerprint.test.node.js

@@ -145,6 +145,27 @@ describe('fingerprintCollection', () => {
         rel.targetCollection = 'tags';
         expect(await fingerprintCollection(b)).not.toBe(a);
     });
+    it('changes when a relation becomes hasMany', async () => {
+        const a = await fingerprintCollection(baseCollection());
+        const b = baseCollection();
+        const rel = b.fields.find((f) => f.name === 'category');
+        rel.hasMany = true;
+        expect(await fingerprintCollection(b)).not.toBe(a);
+    });
+    it.each([
+        'minItems',
+        'maxItems',
+    ])('changes when relation %s changes', async (constraint) => {
+        const a = baseCollection();
+        const aRel = a.fields.find((f) => f.name === 'category');
+        aRel.hasMany = true;
+        aRel[constraint] = 1;
+        const b = baseCollection();
+        const bRel = b.fields.find((f) => f.name === 'category');
+        bRel.hasMany = true;
+        bRel[constraint] = 2;
+        expect(await fingerprintCollection(b)).not.toBe(await fingerprintCollection(a));
+    });
     it('changes when a block variant is renamed', async () => {
         const a = await fingerprintCollection(baseCollection());
         const b = baseCollection();

package/dist/utils/root-relative-redirect.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Normalize an untrusted redirect target to a same-origin, root-relative URL.
+ * Encoded path data is rejected rather than decoded so traversal and URL parser
+ * differences cannot change the destination after validation.
+ */
+export declare function normalizeRootRelativeRedirect(value: string): string | undefined;

package/dist/utils/root-relative-redirect.js

@@ -0,0 +1,37 @@
+/**
+ * Normalize an untrusted redirect target to a same-origin, root-relative URL.
+ * Encoded path data is rejected rather than decoded so traversal and URL parser
+ * differences cannot change the destination after validation.
+ */
+export function normalizeRootRelativeRedirect(value) {
+    if (value.length === 0 || value !== value.trim())
+        return undefined;
+    if (!value.startsWith('/') || value.startsWith('//') || value.includes('\\'))
+        return undefined;
+    if (hasUnsafeCodePoint(value))
+        return undefined;
+    const pathname = value.split(/[?#]/, 1)[0];
+    if (!pathname || pathname.includes('%'))
+        return undefined;
+    if (pathname.split('/').some((segment) => segment === '.' || segment === '..'))
+        return undefined;
+    let url;
+    try {
+        url = new URL(value, 'https://byline.invalid');
+    }
+    catch {
+        return undefined;
+    }
+    if (url.origin !== 'https://byline.invalid')
+        return undefined;
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+function hasUnsafeCodePoint(value) {
+    return Array.from(value).some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return (codePoint <= 0x1f ||
+            codePoint === 0x7f ||
+            (codePoint >= 0x80 && codePoint <= 0x9f) ||
+            (codePoint >= 0xd800 && codePoint <= 0xdfff));
+    });
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/core",
   "private": false,
   "license": "MPL-2.0",
-  "version": "3.20.4",
+  "version": "4.0.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -31,6 +31,11 @@
       "import": "./dist/index.js",
       "require": "./dist/index.js"
     },
+    "./codegen": {
+      "types": "./dist/codegen/index.d.ts",
+      "import": "./dist/codegen/index.js",
+      "require": "./dist/codegen/index.js"
+    },
     "./zod-schemas": {
       "types": "./dist/schemas/zod/index.d.ts",
       "import": "./dist/schemas/zod/index.js",
@@ -76,7 +81,7 @@
     "pino": "^10.3.1",
     "sharp": "^0.35.3",
     "zod": "^4.4.3",
-    "@byline/auth": "3.20.4"
+    "@byline/auth": "4.0.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.2",