@byline/core 3.21.0 → 4.1.0

package/dist/services/field-upload.test.node.js

@@ -7,6 +7,7 @@
  */
 import { createSuperAdminContext } from '@byline/auth';
 import { describe, expect, it, vi } from 'vitest';
+import { commitHookAttachment, prepareHookAttachment } from '../config/attach-hooks.js';
 import { BylineError, ErrorCodes } from '../lib/errors.js';
 import { uploadField } from './field-upload.js';
 const uploadCollection = {
@@ -62,12 +63,23 @@ function createMockDb() {
                 setOrderKey: vi.fn(),
                 placeTreeNode: vi.fn(),
                 removeFromTree: vi.fn(),
+                promoteChildrenAndRemoveFromTree: vi.fn(async () => ({
+                    removed: {
+                        changed: false,
+                        before: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        after: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        beforeSiblingDocumentIds: [],
+                        beforeSubtreeDocumentIds: [],
+                    },
+                    promoted: [],
+                })),
             },
             counters: {
                 ensureCounterGroup: vi.fn(),
                 nextCounterValue: vi.fn(),
                 nextScopedCounterValue: vi.fn(),
             },
+            audit: { append: vi.fn(async () => ({ id: 'audit-1' })) },
         },
         queries: {
             collections: {
@@ -76,6 +88,7 @@ function createMockDb() {
                 getCollectionById: vi.fn(),
             },
             documents: {
+                getDocumentSystemFieldsForUpdate: vi.fn(async () => null),
                 getDocumentById: vi.fn(),
                 getCurrentVersionMetadata: vi.fn(),
                 getCurrentPath: vi.fn(),
@@ -96,7 +109,18 @@ function createMockDb() {
                 getTreeParent: vi.fn(),
                 getTreeSubtree: vi.fn(),
             },
+            audit: {
+                getDocumentAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+                findAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+            },
         },
+        withTransaction: async (fn) => fn(),
     };
     return { db, createDocumentVersion };
 }
@@ -162,6 +186,52 @@ function buildCtx(overrides) {
     return { ctx, createDocumentVersion, upload, del, imageProcessor };
 }
 describe('uploadField service', () => {
+    it('fires registry hooks for a nested array instance selected by its unique upload leaf', async () => {
+        const beforeStore = vi.fn();
+        const publicationFile = {
+            name: 'publicationFile',
+            type: 'file',
+            upload: { mimeTypes: ['application/pdf'] },
+        };
+        const definition = {
+            path: 'documents',
+            labels: { singular: 'Document', plural: 'Documents' },
+            fields: [
+                {
+                    name: 'files',
+                    type: 'array',
+                    fields: [{ name: 'filesGroup', type: 'group', fields: [publicationFile] }],
+                },
+            ],
+        };
+        commitHookAttachment(prepareHookAttachment({
+            collections: [definition],
+            hooks: {
+                uploads: {
+                    'documents.files.filesGroup.publicationFile': { beforeStore },
+                },
+            },
+        }));
+        const { ctx } = buildCtx({
+            definition,
+            collectionPath: 'documents',
+            fieldName: 'publicationFile',
+        });
+        await uploadField(ctx, {
+            buffer: Buffer.from('pdf'),
+            originalFilename: 'publication.pdf',
+            mimeType: 'application/pdf',
+            fileSize: 3,
+            fields: { runtimeFormPath: 'files[2].filesGroup.publicationFile' },
+            shouldCreateDocument: false,
+        });
+        expect(beforeStore).toHaveBeenCalledOnce();
+        expect(beforeStore).toHaveBeenCalledWith(expect.objectContaining({
+            fieldName: 'publicationFile',
+            field: publicationFile,
+            fields: { runtimeFormPath: 'files[2].filesGroup.publicationFile' },
+        }));
+    });
     it('uploads a file without creating a document when requested', async () => {
         const { ctx, createDocumentVersion, upload } = buildCtx();
         const result = await uploadField(ctx, {

package/dist/services/index.d.ts

@@ -1,4 +1,4 @@
-export { ERR_CONFLICT, ERR_INVALID_TRANSITION, ERR_NOT_FOUND, ERR_PATCH_FAILED, ERR_READ_BUDGET_EXCEEDED, ERR_VALIDATION, } from '../lib/errors.js';
+export { ERR_CONFLICT, ERR_INVALID_TRANSITION, ERR_NOT_FOUND, ERR_PATCH_FAILED, ERR_READ_BUDGET_EXCEEDED, ERR_READ_RECURSION, ERR_VALIDATION, } from '../lib/errors.js';
 export { normaliseDateFields } from '../utils/normalise-dates.js';
 export { type AssignCounterValuesInput, assignCounterValues } from './assign-counter-values.js';
 export { type BuildSearchDocumentOptions, buildSearchDocument, resolveSearchZones, type SearchSourceDocument, } from './build-search-document.js';
@@ -13,6 +13,6 @@ export { type CanonicalNumericFieldType, type CanonicalNumericValue, isCanonical
 export { type CycleRelationValue, createReadContext, type PopulatedRelationValue, type PopulateFieldOptions, type PopulateFieldSpec, type PopulateMap, type PopulateOptions, type PopulateSpec, populateDocuments, type ReadContext, resolveIdentityField, type UnresolvedRelationValue, } from './populate.js';
 export { buildRelationSummaryPopulateMap, type RelationTargetResolver, resolveRelationProjection, } from './relation-projection.js';
 export { type EmbedRichTextFieldsOptions, embedRichTextFields, resolveEmbedOnSave, } from './richtext-embed.js';
-export { collectRichTextLeaves, type PopulateRichTextFieldsOptions, populateRichTextFields, type RichTextAdapterPresence, type RichTextLeaf, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
+export { collectRichTextLeaves, createRichTextDocumentReader, type PopulateRichTextFieldsOptions, populateRichTextFields, type RichTextAdapterPresence, type RichTextLeaf, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
 export { type SearchProviderPresence, validateSearchConfig, } from './validate-search-config.js';
 export { type FieldLeaf, walkFieldTree } from './walk-field-tree.js';

package/dist/services/index.js

@@ -1,5 +1,5 @@
 // packages/core/src/services/index.ts
-export { ERR_CONFLICT, ERR_INVALID_TRANSITION, ERR_NOT_FOUND, ERR_PATCH_FAILED, ERR_READ_BUDGET_EXCEEDED, ERR_VALIDATION, } from '../lib/errors.js';
+export { ERR_CONFLICT, ERR_INVALID_TRANSITION, ERR_NOT_FOUND, ERR_PATCH_FAILED, ERR_READ_BUDGET_EXCEEDED, ERR_READ_RECURSION, ERR_VALIDATION, } from '../lib/errors.js';
 export { normaliseDateFields } from '../utils/normalise-dates.js';
 export { assignCounterValues } from './assign-counter-values.js';
 export { buildSearchDocument, resolveSearchZones, } from './build-search-document.js';
@@ -14,6 +14,6 @@ export { isCanonicalNumericValue, normalizeNumericFields, normalizeNumericValue,
 export { createReadContext, populateDocuments, resolveIdentityField, } from './populate.js';
 export { buildRelationSummaryPopulateMap, resolveRelationProjection, } from './relation-projection.js';
 export { embedRichTextFields, resolveEmbedOnSave, } from './richtext-embed.js';
-export { collectRichTextLeaves, populateRichTextFields, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
+export { collectRichTextLeaves, createRichTextDocumentReader, populateRichTextFields, resolvePopulateOnRead, validateRichTextFieldFlags, } from './richtext-populate.js';
 export { validateSearchConfig, } from './validate-search-config.js';
 export { walkFieldTree } from './walk-field-tree.js';

package/dist/services/populate.d.ts

@@ -128,7 +128,7 @@
  *     wins; otherwise selects union together, identity field is always
  *     added).
  */
-import type { RequestContext } from '@byline/auth';
+import { type RequestContext } from '@byline/auth';
 import type { CollectionDefinition, FieldSet, IDbAdapter, PopulateFieldSpec, PopulateSpec, ReadContext, ReadMode, RelatedDocumentValue, RelationField } from '../@types/index.js';
 export type { ReadContext } from '../@types/index.js';
 /** Build a fresh ReadContext. */
@@ -179,13 +179,17 @@ export interface PopulateOptions {
     /**
      * Request-scoped auth context. Required when any target collection in the
      * walk has a `beforeRead` hook configured. Each target's hook is invoked
-     * (and cached on `readContext.beforeReadCache`) before its batch fetch,
+     * (and cached in private authority-bound state) before its batch fetch,
      * and the resulting predicate is ANDed onto the fetch's WHERE. When
      * omitted — most synthetic / test call paths — `beforeRead` hooks are
      * skipped entirely; the production read paths all forward this through
-     * from `CollectionHandle`.
+     * from `CollectionHandle`. Low-level synthetic calls still receive an
+     * anonymous operation context in `afterRead`, so the hook contract never
+     * lacks identity state.
      */
     requestContext?: RequestContext;
+    /** Private cache domain explicitly shared by every read path in one client instance. */
+    securityDomain?: object;
     /**
      * Skip `beforeRead` hook resolution on every target collection. The
      * top-level read's `_bypassBeforeRead` flag rides through to populate

package/dist/services/populate.js

@@ -5,11 +5,135 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import { applyBeforeRead } from '../auth/apply-before-read.js';
+/**
+ * Relationship population service.
+ *
+ * `populateDocuments` walks a set of reconstructed documents, finds every
+ * relation leaf that matches a caller-supplied populate spec, batches
+ * fetches against each target collection (one DB round-trip per depth
+ * level per target collection), and replaces each leaf in place with the
+ * populated document. Missing targets become a `{ _resolved: false }`
+ * stub; already-visited targets become a `{ _cycle: true }` stub.
+ *
+ * Consumed by both `@byline/client` (external read API with `populate`
+ * and `depth` options) and the admin webapp's API-preview server fn.
+ *
+ * A request-scoped `ReadContext` is threaded through the walk. Its
+ * `visited` set and `readCount` budget guard against recursive reads —
+ * particularly the A→B→A failure mode that appears when future
+ * `afterRead` hooks invoke their own reads from within populated
+ * documents. The guard is in place from day one so that the hook work
+ * in Phase 4+ cannot reintroduce the problem.
+ *
+ * See docs/04-collections/02-relationships.md for the full design rationale.
+ *
+ * ---------------------------------------------------------------------
+ * DSL summary
+ * ---------------------------------------------------------------------
+ *
+ * The populate DSL has two independent axes:
+ *
+ *   1. **Scope** — which relations in the *source* document to walk.
+ *   2. **Projection** — which fields of each *target* document to load.
+ *
+ * The top-level `populate` value selects scope + (optionally) a uniform
+ * projection across the whole tree:
+ *
+ *   - `populate: true`                  → walk every relation leaf,
+ *                                         default projection at every
+ *                                         depth. See below for exactly
+ *                                         what the default projection
+ *                                         returns.
+ *   - `populate: '*'`                   → walk every relation leaf, full
+ *                                         document projection at every
+ *                                         depth. Symmetric with the
+ *                                         sub-spec shorthand and intended
+ *                                         for tools like the admin API
+ *                                         preview where the whole tree
+ *                                         should be visible.
+ *   - `populate: { name: … }`           → walk only the named relations.
+ *   - `populate: undefined`             → skip populate entirely (no-op).
+ *
+ * Default projection — exactly what comes back for `true` (and for any
+ * sub-spec whose `select` is omitted):
+ *
+ *   - **Document row metadata, always present** (lives on the
+ *     `document_versions` row, not in the `store_*` tables, so it is
+ *     returned regardless of the `fields` projection):
+ *       `document_version_id`, `document_id`, `collection_id`, `path`,
+ *       `status`, `created_at`, `updated_at`.
+ *   - **The `useAsTitle` field** (schema-declared identity field;
+ *     falls back to the first declared text field when `useAsTitle`
+ *     is not set on the `CollectionDefinition`). This is the one
+ *     entry added to the `fields` object.
+ *
+ * In effect "default projection" is "enough to identify and label the
+ * target" — document metadata for wiring, plus one user-defined field
+ * (typically `title`) for a human-readable label. Callers wanting more
+ * use `'*'` (full doc) or `{ select: [...] }` (explicit fields).
+ *
+ * Each matched leaf carries a `PopulateFieldSpec` that selects projection:
+ *
+ *   - `true`                            → default projection: the target's
+ *                                         identity field (`useAsTitle`,
+ *                                         falling back to the first text
+ *                                         field). Document metadata
+ *                                         (`document_id`, `collection_id`,
+ *                                         `path`, `status`, timestamps) is
+ *                                         always included for free — it
+ *                                         lives on the row, not in the
+ *                                         store_* tables.
+ *   - `'*'`                             → full document: every field of
+ *                                         the target is loaded.
+ *   - `{ select: [...] }`               → explicit field list, merged with
+ *                                         the identity field so downstream
+ *                                         UI always has a label to render.
+ *   - `{ populate: {...} }`             → nested populate for the next
+ *                                         depth level. Combinable with
+ *                                         `select`.
+ *
+ * Examples:
+ *
+ *   populate: true
+ *     → every relation, default projection at every depth level.
+ *
+ *   populate: '*'
+ *     → every relation, full projection at every depth level
+ *       (use for API previews / debug views that want the whole tree).
+ *
+ *   populate: { heroImage: true }
+ *     → only heroImage, default projection. If heroImage's own
+ *       relations exist, they populate at the next depth with `true`.
+ *
+ *   populate: { heroImage: '*' }
+ *     → only heroImage, full document. If heroImage's own relations
+ *       exist, they populate at the next depth with `'*'` (consistent
+ *       with how `true` propagates).
+ *
+ *   populate: { author: { select: ['name'] } }
+ *     → only author; fetch `name` + identity field.
+ *
+ *   populate: { author: { select: ['name'], populate: { employer: '*' } } }
+ *     → author with `name` at depth 1; employer fully populated at depth 2.
+ *
+ * Notes:
+ *
+ *   - `'*'` belongs on the sub-spec (or as the whole top-level spec),
+ *     not inside `select`. `select` is always an explicit field list.
+ *   - Projection defaults are transitive at every depth: `true` propagates
+ *     `true` into nested levels; `'*'` propagates `'*'`. Explicit
+ *     `{ populate: {...} }` maps take precedence when declared.
+ *   - Multiple leaves pointing at the same target document are batched
+ *     into a single fetch; their projection specs are merged (any `'*'`
+ *     wins; otherwise selects union together, identity field is always
+ *     added).
+ */
+import { createRequestContext } from '@byline/auth';
+import { compileBeforeReadFilters } from '../auth/apply-before-read.js';
+import { assertActorCanPerform } from '../auth/assert-actor-can-perform.js';
 import { ERR_READ_BUDGET_EXCEEDED } from '../lib/errors.js';
-import { parseWhere } from '../query/parse-where.js';
 import { applyAfterRead } from './document-read.js';
-import { populateRichTextFields } from './richtext-populate.js';
+import { createRichTextDocumentReader, populateRichTextFields } from './richtext-populate.js';
 import { walkFieldTree } from './walk-field-tree.js';
 // ---------------------------------------------------------------------------
 // ReadContext — recursion guard
@@ -20,8 +144,6 @@ const DEFAULT_MAX_DEPTH = 8;
 export function createReadContext(overrides) {
     return {
         visited: overrides?.visited ?? new Set(),
-        afterReadFired: overrides?.afterReadFired ?? new Set(),
-        beforeReadCache: overrides?.beforeReadCache ?? new Map(),
         readCount: overrides?.readCount ?? 0,
         maxReads: overrides?.maxReads ?? DEFAULT_MAX_READS,
         maxDepth: overrides?.maxDepth ?? DEFAULT_MAX_DEPTH,
@@ -36,6 +158,9 @@ export function createReadContext(overrides) {
  */
 export async function populateDocuments(opts) {
     const ctx = opts.readContext ?? createReadContext();
+    const securityDomain = opts.securityDomain ?? {};
+    const operationRequestContext = opts.requestContext ??
+        createRequestContext({ readMode: opts.readMode ?? 'any', locale: opts.locale });
     const populate = opts.populate;
     const requestedDepth = opts.depth ?? (populate !== undefined ? 1 : 0);
     const maxDepth = Math.max(0, Math.min(requestedDepth, ctx.maxDepth));
@@ -90,13 +215,19 @@ export async function populateDocuments(opts) {
         for (const [targetCollectionId, leaves] of byTarget) {
             const targetDef = await resolveCollectionDef(opts.db, opts.collections, targetCollectionId, defCache);
             const selectList = buildBatchSelect(leaves, targetDef);
+            // Production reads always carry an operation-scoped context. Assert the
+            // target collection before any adapter access; unresolved target schemas
+            // remain unresolved rather than bypassing the collection gate.
+            if (opts.requestContext && targetDef) {
+                assertActorCanPerform(opts.requestContext, targetDef.path, 'read');
+            }
             // Only fetch IDs we haven't materialised earlier in this request.
             const idsToFetch = Array.from(new Set(leaves
                 .filter((l) => !ctx.visited.has(visitedKey(targetCollectionId, l.value.targetDocumentId)))
                 .map((l) => l.value.targetDocumentId)));
             // Resolve the target collection's `beforeRead` predicate, if any.
-            // The cache on `ctx.beforeReadCache` ensures each (collectionPath,
-            // actor) tuple only runs through the hook once per request, even
+            // Private authority-bound state ensures each collection/mode tuple only
+            // runs through the hook once per request, even
             // across populate fanout where the same target collection may be
             // visited from multiple sources.
             const targetFilters = await resolveBeforeReadFiltersForTarget({
@@ -106,9 +237,10 @@ export async function populateDocuments(opts) {
                 readContext: ctx,
                 bypassBeforeRead: opts.bypassBeforeRead,
                 db: opts.db,
+                securityDomain,
             });
             let fetched = [];
-            if (idsToFetch.length > 0) {
+            if (idsToFetch.length > 0 && targetDef) {
                 fetched = await opts.db.queries.documents.getDocumentsByDocumentIds({
                     collection_id: targetCollectionId,
                     document_ids: idsToFetch,
@@ -186,16 +318,38 @@ export async function populateDocuments(opts) {
                     // so hook authors observe fully-populated rich-text content. The
                     // gate (per-field `populateRelationsOnRead`) lives inside the
                     // service; passing the function unconditionally is correct.
-                    if (opts.richTextPopulate) {
+                    if (opts.richTextPopulate && opts.requestContext) {
                         await populateRichTextFields({
                             fields: targetDef.fields,
                             collectionPath: targetDef.path,
                             documents: [d],
                             populate: opts.richTextPopulate,
                             readContext: ctx,
+                            requestContext: opts.requestContext,
+                            readMode: opts.readMode ?? 'any',
+                            readDocuments: createRichTextDocumentReader({
+                                db: opts.db,
+                                collections: opts.collections,
+                                requestContext: opts.requestContext,
+                                readContext: ctx,
+                                readMode: opts.readMode ?? 'any',
+                                locale: opts.locale,
+                                bypassBeforeRead: opts.bypassBeforeRead,
+                                richTextPopulate: opts.richTextPopulate,
+                                securityDomain,
+                            }),
                         });
                     }
-                    await applyAfterRead({ doc: d, definition: targetDef, readContext: ctx });
+                    await applyAfterRead({
+                        doc: d,
+                        definition: targetDef,
+                        readContext: ctx,
+                        requestContext: operationRequestContext,
+                        locale: opts.locale,
+                        readMode: opts.readMode,
+                        projection: selectList,
+                        materialization: 'relation-target',
+                    });
                 }
                 if (!targetDef || queuedForNext.has(key))
                     continue;
@@ -274,31 +428,29 @@ async function resolveCollectionDef(db, collections, id, cache) {
  * the EXISTS-loop entirely.
  */
 async function resolveBeforeReadFiltersForTarget(params) {
-    const { targetDef, collections, requestContext, readContext, bypassBeforeRead, db } = params;
+    const { targetDef, collections, requestContext, readContext, bypassBeforeRead, db, securityDomain, } = params;
     if (!targetDef || !requestContext || bypassBeforeRead)
         return undefined;
-    const predicate = await applyBeforeRead({
+    return compileBeforeReadFilters({
         definition: targetDef,
         requestContext,
         readContext,
-    });
-    if (predicate == null)
-        return undefined;
-    const parsed = await parseWhere(predicate, targetDef, {
-        collections,
-        resolveCollectionId: async (path) => {
-            // Match the target collection by path against the loaded collection
-            // list first (cheap, in-memory); fall back to a DB lookup for cases
-            // where a hook references a collection not loaded into the same
-            // populate context. This mirrors `CollectionHandle`'s parser ctx.
-            const local = collections.find((c) => c.path === path);
-            if (local?.id)
-                return local.id;
-            const row = await db.queries.collections.getCollectionByPath(path);
-            return row?.id ?? '';
+        securityDomain,
+        parseContext: {
+            collections,
+            resolveCollectionId: async (path) => {
+                // Match the target collection by path against the loaded collection
+                // list first (cheap, in-memory); fall back to a DB lookup for cases
+                // where a hook references a collection not loaded into the same
+                // populate context. This mirrors `CollectionHandle`'s parser ctx.
+                const local = collections.find((c) => c.path === path);
+                if (local?.id)
+                    return local.id;
+                const row = await db.queries.collections.getCollectionByPath(path);
+                return row?.id ?? '';
+            },
         },
     });
-    return parsed.filters.length > 0 ? parsed.filters : undefined;
 }
 /**
  * Collect every relation leaf whose name matches `populate`. Structure

package/dist/services/populate.test.node.js

@@ -5,6 +5,7 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
+import { AdminAuth, createRequestContext } from '@byline/auth';
 import { describe, expect, it, vi } from 'vitest';
 import { BylineError, ErrorCodes } from '../lib/errors.js';
 import { __internal, createReadContext, populateDocuments } from './populate.js';
@@ -150,12 +151,23 @@ function makeMockAdapter(store = {}, pathByCollectionId = {}) {
                 setOrderKey: vi.fn(),
                 placeTreeNode: vi.fn(),
                 removeFromTree: vi.fn(),
+                promoteChildrenAndRemoveFromTree: vi.fn(async () => ({
+                    removed: {
+                        changed: false,
+                        before: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        after: { placed: false, parentDocumentId: null, orderKey: null, index: null },
+                        beforeSiblingDocumentIds: [],
+                        beforeSubtreeDocumentIds: [],
+                    },
+                    promoted: [],
+                })),
             },
             counters: {
                 ensureCounterGroup: vi.fn(),
                 nextCounterValue: vi.fn(),
                 nextScopedCounterValue: vi.fn(),
             },
+            audit: { append: vi.fn(async () => ({ id: 'audit-1' })) },
         },
         queries: {
             collections: {
@@ -164,6 +176,7 @@ function makeMockAdapter(store = {}, pathByCollectionId = {}) {
                 getCollectionById,
             },
             documents: {
+                getDocumentSystemFieldsForUpdate: vi.fn(async () => null),
                 getDocumentById: vi.fn(),
                 getCurrentVersionMetadata: vi.fn(),
                 getCurrentPath: vi.fn(),
@@ -184,7 +197,18 @@ function makeMockAdapter(store = {}, pathByCollectionId = {}) {
                 getTreeParent: vi.fn(),
                 getTreeSubtree: vi.fn(),
             },
+            audit: {
+                getDocumentAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+                findAuditLog: vi.fn(async () => ({
+                    entries: [],
+                    meta: { total: 0, page: 1, pageSize: 20, totalPages: 0 },
+                })),
+            },
         },
+        withTransaction: async (fn) => fn(),
     };
     return { db, getDocumentsByDocumentIds, getCollectionById };
 }
@@ -353,6 +377,41 @@ describe('buildBatchSelect', () => {
 // populateDocuments — behaviour
 // ---------------------------------------------------------------------------
 describe('populateDocuments', () => {
+    it('isolates direct callers by default and shares compiled filters only with an explicit domain', async () => {
+        const beforeRead = vi.fn(() => ({ name: 'allowed' }));
+        const scopedAuthors = {
+            ...authorsCollection,
+            hooks: { beforeRead },
+        };
+        const { db, getDocumentsByDocumentIds } = makeMockAdapter();
+        const readContext = createReadContext();
+        const requestContext = createRequestContext({
+            actor: new AdminAuth({ id: 'reader', abilities: ['collections.authors.read'] }),
+        });
+        const populate = (suffix, securityDomain) => populateDocuments({
+            db,
+            collections: [postsCollection, scopedAuthors],
+            collectionId: 'posts',
+            documents: [
+                shapedDoc('posts', `p-${suffix}`, {
+                    author: relationRef('authors', `a-${suffix}`),
+                }),
+            ],
+            populate: true,
+            readContext,
+            requestContext,
+            securityDomain,
+        });
+        await populate('implicit-a');
+        await populate('implicit-b');
+        const sharedDomain = {};
+        await populate('explicit-a', sharedDomain);
+        await populate('explicit-b', sharedDomain);
+        const calls = getDocumentsByDocumentIds.mock.calls;
+        expect(calls[1]?.[0].filters).not.toBe(calls[0]?.[0].filters);
+        expect(calls[3]?.[0].filters).toBe(calls[2]?.[0].filters);
+        expect(beforeRead).toHaveBeenCalledTimes(3);
+    });
     it('is a no-op when populate is omitted', async () => {
         const { db, getDocumentsByDocumentIds } = makeMockAdapter();
         const doc = shapedDoc('posts', 'p1', { author: relationRef('authors', 'a1') });

package/dist/services/richtext-embed.d.ts

@@ -5,8 +5,42 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import type { FieldSet, RichTextEmbedFn, RichTextField } from '../@types/field-types.js';
-import type { ReadContext } from '../@types/index.js';
+/**
+ * Richtext embed service — walks an outgoing document, finds every
+ * rich-text leaf (including those nested inside `group` / `array` /
+ * `blocks` structures), gates each leaf by its `embedRelationsOnSave`
+ * flag, and dispatches to the registered richtext embed adapter so
+ * link envelopes (and any future write-time embeds) can be refreshed
+ * before the value is flattened and persisted.
+ *
+ * Mirror of `richtext-populate.ts`. Slots into the document-lifecycle
+ * write path:
+ *
+ *   beforeCreate / beforeUpdate
+ *     → assignCounterValues
+ *     → embedRichTextFields       (this module)
+ *     → createDocumentVersion
+ *     → afterCreate / afterUpdate
+ *
+ * Per-leaf errors are logged and swallowed — leaving the persisted state
+ * for that leaf as the editor submitted it. Aligns with the strategy's
+ * "branch C — hard error" non-destructive fail mode (see
+ * docs/RICHTEXT-LINK-REFACTOR-STRATEGY.md § 3.3).
+ *
+ * Multi-locale (`locale: 'all'`) writes: when a richText leaf's value is
+ * a `{ <locale>: lexicalJson }` map (the shape used by
+ * `restoreDocumentVersion` and `duplicateDocument`), the adapter's
+ * `getLexicalRoot` parses the object as a single tree, finds no `root`
+ * key and no `children` array, and yields nothing. So embed is a no-op
+ * on multi-locale writes — the persisted state carries forward exactly
+ * what the source had. Per-locale walking is a deliberate future
+ * refinement; today's behaviour matches the populate side (which only
+ * fires on locale-scoped reads) and the renderer's fallback chain
+ * handles stale embedded paths.
+ */
+import type { RequestContext } from '@byline/auth';
+import type { FieldSet, RichTextEmbedFn, RichTextField, RichTextReadDocumentsFn } from '../@types/field-types.js';
+import type { ReadContext, ReadMode } from '../@types/index.js';
 import type { BylineLogger } from '../lib/logger.js';
 /**
  * Resolve the effective `embedRelationsOnSave` for a richText field.
@@ -32,6 +66,9 @@ export interface EmbedRichTextFieldsOptions {
      * visited-set / read-budget machinery as the rest of the framework.
      */
     readContext: ReadContext;
+    requestContext: RequestContext;
+    readMode: ReadMode;
+    readDocuments: RichTextReadDocumentsFn;
     /** Structured logger — used for branch-C per-leaf error reporting. */
     logger: BylineLogger;
 }

package/dist/services/richtext-embed.js

@@ -5,39 +5,6 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-/**
- * Richtext embed service — walks an outgoing document, finds every
- * rich-text leaf (including those nested inside `group` / `array` /
- * `blocks` structures), gates each leaf by its `embedRelationsOnSave`
- * flag, and dispatches to the registered richtext embed adapter so
- * link envelopes (and any future write-time embeds) can be refreshed
- * before the value is flattened and persisted.
- *
- * Mirror of `richtext-populate.ts`. Slots into the document-lifecycle
- * write path:
- *
- *   beforeCreate / beforeUpdate
- *     → assignCounterValues
- *     → embedRichTextFields       (this module)
- *     → createDocumentVersion
- *     → afterCreate / afterUpdate
- *
- * Per-leaf errors are logged and swallowed — leaving the persisted state
- * for that leaf as the editor submitted it. Aligns with the strategy's
- * "branch C — hard error" non-destructive fail mode (see
- * docs/RICHTEXT-LINK-REFACTOR-STRATEGY.md § 3.3).
- *
- * Multi-locale (`locale: 'all'`) writes: when a richText leaf's value is
- * a `{ <locale>: lexicalJson }` map (the shape used by
- * `restoreDocumentVersion` and `duplicateDocument`), the adapter's
- * `getLexicalRoot` parses the object as a single tree, finds no `root`
- * key and no `children` array, and yields nothing. So embed is a no-op
- * on multi-locale writes — the persisted state carries forward exactly
- * what the source had. Per-locale walking is a deliberate future
- * refinement; today's behaviour matches the populate side (which only
- * fires on locale-scoped reads) and the renderer's fallback chain
- * handles stale embedded paths.
- */
 import { collectRichTextLeaves } from './richtext-populate.js';
 /**
  * Resolve the effective `embedRelationsOnSave` for a richText field.
@@ -58,7 +25,7 @@ export function resolveEmbedOnSave(field) {
  * downstream proceeds. Document-level errors propagate.
  */
 export async function embedRichTextFields(options) {
-    const { fields, collectionPath, data, embed, readContext, logger } = options;
+    const { fields, collectionPath, data, embed, readContext, requestContext, readMode, readDocuments, logger, } = options;
     for (const leaf of collectRichTextLeaves(fields, data)) {
         if (!resolveEmbedOnSave(leaf.field))
             continue;
@@ -68,6 +35,9 @@ export async function embedRichTextFields(options) {
                 fieldPath: leaf.fieldPath,
                 collectionPath,
                 readContext,
+                requestContext,
+                readMode,
+                readDocuments,
             });
         }
         catch (err) {