@revealui/core 0.2.1 → 0.3.0

package/dist/client/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/ui/index.tsx"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAGD,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,cAAc,CAqB9C,CAAA;AAGD,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAOhD,CAAA;AAGD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAGD,wBAAgB,aAAa,CAAC,CAAC,GAAG,OAAO,EACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,oBAAoB,GAC9F,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CA2C/B;AAGD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAClC,OAAO,EAAE,eAAe,GACvB;IACD,KAAK,EAAE,CAAC,GAAG,SAAS,CAAA;IACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAA;IAC5B,IAAI,EAAE,MAAM,CAAA;CACb,CAYA;AAGD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAA;IAC3D,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAA;IACpC,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAmBxC,CAAA;AAGD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA6BlD,CAAA;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAoB5C,CAAA;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAoB5C,CAAA;AAGD,UAAU,gBAAgB;IACxB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACvC;AASD,wBAAgB,QAAQ,qBAGvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,kBAAkB,CA8BtD,CAAA;AAGD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAC7E;AAED,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAqDpD,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/ui/index.tsx"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,cAAc,CAqB9C,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAOhD,CAAC;AAGF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAGD,wBAAgB,aAAa,CAAC,CAAC,GAAG,OAAO,EACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,oBAAoB,GAC9F,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CA2C/B;AAGD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAClC,OAAO,EAAE,eAAe,GACvB;IACD,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC;IACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd,CAYA;AAGD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;IAC5D,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACrC,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAmBxC,CAAC;AAGF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CA6BlD,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAoB5C,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAoB5C,CAAC;AAGF,UAAU,gBAAgB;IACxB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AASD,wBAAgB,QAAQ,qBAGvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,kBAAkB,CA8BtD,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAqDpD,CAAC"}

package/dist/client/ui/index.js

@@ -86,7 +86,7 @@ const ModalContext = React.createContext({
     isModalOpen: () => false,
 });
 export function useModal() {
-    const context = React.useContext(ModalContext);
+    const context = React.use(ModalContext);
     return context;
 }
 export const ModalProvider = ({ children }) => {

package/dist/collections/CollectionOperations.d.ts

@@ -4,15 +4,12 @@
  * Handles CRUD operations for collections with relationship population,
  * hooks, and query building.
  */
-import type { DatabaseResult, PopulateType, RevealCollectionConfig, RevealCreateOptions, RevealDeleteOptions, RevealDocument, RevealFindOptions, RevealPaginatedResult, RevealRequest, RevealUpdateOptions } from '../types/index.js';
+import type { BatchCreateOptions, BatchDeleteOptions, BatchResult, BatchUpdateOptions, CollectionStorageDescriptor, PopulateType, QueryableDatabaseAdapter, RevealCollectionConfig, RevealCreateOptions, RevealDeleteOptions, RevealDocument, RevealFindOptions, RevealPaginatedResult, RevealRequest, RevealUpdateOptions } from '../types/index.js';
 export declare class RevealUICollection {
     config: RevealCollectionConfig;
-    db: {
-        query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-    } | null;
-    constructor(config: RevealCollectionConfig, db: {
-        query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-    } | null);
+    storage: CollectionStorageDescriptor | null;
+    db: QueryableDatabaseAdapter | null;
+    constructor(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, storage?: CollectionStorageDescriptor | null);
     find(options: RevealFindOptions): Promise<RevealPaginatedResult>;
     findByID(options: {
         id: string | number;
@@ -23,5 +20,8 @@ export declare class RevealUICollection {
     create(options: RevealCreateOptions): Promise<RevealDocument>;
     update(options: RevealUpdateOptions): Promise<RevealDocument>;
     delete(options: RevealDeleteOptions): Promise<RevealDocument>;
+    createMany(options: BatchCreateOptions): Promise<BatchResult<RevealDocument>>;
+    updateMany(options: BatchUpdateOptions): Promise<BatchResult<RevealDocument>>;
+    deleteMany(options: BatchDeleteOptions): Promise<BatchResult<RevealDocument>>;
 }
 //# sourceMappingURL=CollectionOperations.d.ts.map

package/dist/collections/CollectionOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CollectionOperations.d.ts","sourceRoot":"","sources":["../../src/collections/CollectionOperations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACpB,MAAM,mBAAmB,CAAA;AAO1B,qBAAa,kBAAkB;IAC7B,MAAM,EAAE,sBAAsB,CAAA;IAC9B,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;KACtE,GAAG,IAAI,CAAA;gBAGN,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;KACtE,GAAG,IAAI;IAMJ,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhE,QAAQ,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,GAAG,CAAC,EAAE,aAAa,CAAA;QACnB,QAAQ,CAAC,EAAE,YAAY,CAAA;KACxB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI5B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;CAGpE"}
+{"version":3,"file":"CollectionOperations.d.ts","sourceRoot":"","sources":["../../src/collections/CollectionOperations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAU3B,qBAAa,kBAAkB;IAC7B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5C,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAAC;gBAGlC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,GAAE,2BAA2B,GAAG,IAAW;IAO9C,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhE,QAAQ,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,aAAa,CAAC;QACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;KACzB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI5B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;CAGpF"}

package/dist/collections/CollectionOperations.js

@@ -5,16 +5,21 @@
  * hooks, and query building.
  */
 import { create } from './operations/create.js';
+import { createMany } from './operations/createMany.js';
 import { deleteDocument } from './operations/delete.js';
+import { deleteMany } from './operations/deleteMany.js';
 import { find } from './operations/find.js';
 import { findByID } from './operations/findById.js';
 import { update } from './operations/update.js';
+import { updateMany } from './operations/updateMany.js';
 export class RevealUICollection {
     config;
+    storage;
     db;
-    constructor(config, db) {
+    constructor(config, db, storage = null) {
         this.config = config;
         this.db = db;
+        this.storage = storage;
     }
     async find(options) {
         return find(this.config, this.db, options);
@@ -31,4 +36,13 @@ export class RevealUICollection {
     async delete(options) {
         return deleteDocument(this.config, this.db, options);
     }
+    async createMany(options) {
+        return createMany(this.config, this.db, options);
+    }
+    async updateMany(options) {
+        return updateMany(this.config, this.db, options);
+    }
+    async deleteMany(options) {
+        return deleteMany(this.config, this.db, options);
+    }
 }

package/dist/collections/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/collections/hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAE1B;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,WAAW,CAAC,EAAE,cAAc,EAC5B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,cAAc,CAAC,CA2CzB"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/collections/hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,WAAW,CAAC,EAAE,cAAc,EAC5B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,cAAc,CAAC,CA2CzB"}

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/collections/operations/create.d.ts

@@ -3,8 +3,6 @@
  *
  * Creates a new document with validation, password hashing, and JSON field handling.
  */
-import type { DatabaseResult, RevealCollectionConfig, RevealCreateOptions, RevealDocument } from '../../types/index.js';
-export declare function create(config: RevealCollectionConfig, db: {
-    query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-} | null, options: RevealCreateOptions): Promise<RevealDocument>;
+import type { QueryableDatabaseAdapter, RevealCollectionConfig, RevealCreateOptions, RevealDocument } from '../../types/index.js';
+export declare function create(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: RevealCreateOptions): Promise<RevealDocument>;
 //# sourceMappingURL=create.d.ts.map

package/dist/collections/operations/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAEf,MAAM,sBAAsB,CAAA;AAM7B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CACtE,GAAG,IAAI,EACR,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAmHzB"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAO9B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAoHzB"}

package/dist/collections/operations/create.js

@@ -8,11 +8,12 @@ import { collectJsonFields, serializeValueForDatabase } from '../../utils/json-p
 import { flattenFields, isJsonFieldType } from '../../utils/type-guards.js';
 import { runBeforeFieldHooks } from './fieldHooks.js';
 import { findByID } from './findById.js';
+import { insertDocumentQuery } from './sqlAdapter.js';
 export async function create(config, db, options) {
     const { data } = options;
     // Run beforeValidate field hooks first so they can generate values (e.g. slug from title)
     // before the required-field check below throws for missing values.
-    await runBeforeFieldHooks(config, data, 'create', 'beforeValidate');
+    await runBeforeFieldHooks(config, data, 'create', 'beforeValidate', undefined, options.req);
     // Validate required fields and field types
     if (config.fields) {
         for (const field of config.fields) {
@@ -45,13 +46,15 @@ export async function create(config, db, options) {
         }
     }
     // Run beforeChange field hooks after validation but before the DB write.
-    await runBeforeFieldHooks(config, data, 'create', 'beforeChange');
+    await runBeforeFieldHooks(config, data, 'create', 'beforeChange', undefined, options.req);
     // Hash password if present and not already hashed (doesn't start with $2a$ or $2b$)
     if (data.password && typeof data.password === 'string' && !data.password.startsWith('$2')) {
-        const saltRounds = 10;
+        const saltRounds = 12;
         data.password = await bcrypt.hash(data.password, saltRounds);
     }
     if (db?.query) {
+        // Dynamic collection storage is quarantined in sqlAdapter.ts until this
+        // layer is redesigned around typed tables that Drizzle can model directly.
         const tableName = config.slug;
         // Generate ID if not provided - always ensure it's a string
         const id = String(typeof data.id === 'string' || typeof data.id === 'number'
@@ -72,7 +75,6 @@ export async function create(config, db, options) {
         if (hasJsonFields) {
             columns.push('_json');
         }
-        const placeholders = columns.map((_, i) => `$${i + 2}`).join(', ');
         const values = columns.map((key) => {
             if (key === '_json') {
                 // Serialize JSON fields object to JSON string
@@ -81,7 +83,7 @@ export async function create(config, db, options) {
             // Serialize non-primitive values to JSON strings for SQLite compatibility
             return serializeValueForDatabase(data[key]);
         });
-        const query = `INSERT INTO "${tableName}" (id, ${columns.map((c) => `"${c}"`).join(', ')}) VALUES ($1, ${placeholders})`;
+        const query = insertDocumentQuery(tableName, columns);
         await db.query(query, [id, ...values]);
         // For SQLite with WAL mode, writes are immediately visible to readers on the same connection
         // Return the created document by fetching it from the database

package/dist/collections/operations/createMany.d.ts

@@ -0,0 +1,12 @@
+/**
+ * createMany Operation
+ *
+ * Creates multiple documents in a single transaction. All-or-nothing: if any
+ * document fails, the entire batch is rolled back. Partial results are never
+ * committed to the database.
+ *
+ * Documents without a db adapter fall back to in-memory objects (no transaction).
+ */
+import type { BatchCreateOptions, BatchResult, QueryableDatabaseAdapter, RevealCollectionConfig, RevealDocument } from '../../types/index.js';
+export declare function createMany(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: BatchCreateOptions): Promise<BatchResult<RevealDocument>>;
+//# sourceMappingURL=createMany.d.ts.map

package/dist/collections/operations/createMany.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMany.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/createMany.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACf,MAAM,sBAAsB,CAAC;AAG9B,wBAAsB,UAAU,CAC9B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAiCtC"}

package/dist/collections/operations/createMany.js

@@ -0,0 +1,43 @@
+/**
+ * createMany Operation
+ *
+ * Creates multiple documents in a single transaction. All-or-nothing: if any
+ * document fails, the entire batch is rolled back. Partial results are never
+ * committed to the database.
+ *
+ * Documents without a db adapter fall back to in-memory objects (no transaction).
+ */
+import { create } from './create.js';
+export async function createMany(config, db, options) {
+    const results = [];
+    const errors = [];
+    if (!db?.query || options.data.length === 0) {
+        // No DB or empty batch: run each create independently (no transaction available).
+        for (const [i, data] of options.data.entries()) {
+            try {
+                const doc = await create(config, db, { data, req: options.req });
+                results.push(doc);
+            }
+            catch (error) {
+                errors.push({ index: i, error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        return { results, errors };
+    }
+    // Wrap all inserts in a transaction: stop on first error, rollback on failure.
+    await db.query('BEGIN');
+    try {
+        for (const data of options.data) {
+            const doc = await create(config, db, { data, req: options.req });
+            results.push(doc);
+        }
+        await db.query('COMMIT');
+    }
+    catch (error) {
+        await db.query('ROLLBACK');
+        const index = results.length; // Index of the failing item
+        errors.push({ index, error: error instanceof Error ? error.message : String(error) });
+        return { results: [], errors };
+    }
+    return { results, errors };
+}

package/dist/collections/operations/delete.d.ts

@@ -1,7 +1,7 @@
 /**
  * Delete Operation
  *
- * Deletes a document by ID.
+ * Deletes a document by ID with access control enforcement.
  */
 import type { DatabaseResult, RevealCollectionConfig, RevealDeleteOptions, RevealDocument } from '../../types/index.js';
 export declare function deleteDocument(config: RevealCollectionConfig, db: {

package/dist/collections/operations/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAE7B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CACtE,GAAG,IAAI,EACR,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAYzB"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAoC9B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACvE,GAAG,IAAI,EACR,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAoBzB"}

package/dist/collections/operations/delete.js

@@ -1,15 +1,44 @@
 /**
  * Delete Operation
  *
- * Deletes a document by ID.
+ * Deletes a document by ID with access control enforcement.
  */
+import { deleteByIdQuery } from './sqlAdapter.js';
+/**
+ * Evaluate a collection's access.delete function.
+ * Returns true (allow) or false (deny).
+ */
+async function evaluateDeleteAccess(config, options) {
+    if (options.overrideAccess)
+        return true;
+    const accessConfig = config.access;
+    const deleteAccess = accessConfig?.delete;
+    // No access rule defined = allow all (backward compatible)
+    if (!deleteAccess)
+        return true;
+    const req = options.req;
+    if (!req)
+        return false; // No request context = deny (safe default)
+    const result = await deleteAccess({ req, id: options.id });
+    if (result === false)
+        return false;
+    // Any truthy result (true, WhereClause) = allowed for single-document operations
+    return !!result;
+}
 export async function deleteDocument(config, db, options) {
     const { id } = options;
+    // --- Access control enforcement ---
+    const allowed = await evaluateDeleteAccess(config, options);
+    if (!allowed) {
+        throw new Error('Access denied: insufficient permissions to delete this document');
+    }
     if (db?.query) {
+        // Dynamic collection storage is quarantined in sqlAdapter.ts until this
+        // layer is redesigned around typed tables that Drizzle can model directly.
         const tableName = config.slug;
         // Ensure id is a string for consistent comparison
         const idString = String(id);
-        const query = `DELETE FROM "${tableName}" WHERE id = $1`;
+        const query = deleteByIdQuery(tableName);
         await db.query(query, [idString]);
     }
     return { id };

package/dist/collections/operations/deleteMany.d.ts

@@ -0,0 +1,11 @@
+/**
+ * deleteMany Operation
+ *
+ * Deletes multiple documents in a single transaction. All-or-nothing: if any
+ * delete fails (including access denial), the entire batch is rolled back.
+ *
+ * Documents without a db adapter fall back to in-memory stubs (no transaction).
+ */
+import type { BatchDeleteOptions, BatchResult, QueryableDatabaseAdapter, RevealCollectionConfig, RevealDocument } from '../../types/index.js';
+export declare function deleteMany(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: BatchDeleteOptions): Promise<BatchResult<RevealDocument>>;
+//# sourceMappingURL=deleteMany.d.ts.map

package/dist/collections/operations/deleteMany.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deleteMany.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/deleteMany.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACf,MAAM,sBAAsB,CAAC;AAG9B,wBAAsB,UAAU,CAC9B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAyCtC"}

package/dist/collections/operations/deleteMany.js

@@ -0,0 +1,50 @@
+/**
+ * deleteMany Operation
+ *
+ * Deletes multiple documents in a single transaction. All-or-nothing: if any
+ * delete fails (including access denial), the entire batch is rolled back.
+ *
+ * Documents without a db adapter fall back to in-memory stubs (no transaction).
+ */
+import { deleteDocument } from './delete.js';
+export async function deleteMany(config, db, options) {
+    const results = [];
+    const errors = [];
+    if (!db?.query || options.ids.length === 0) {
+        // No DB or empty batch: run each delete independently (no transaction available).
+        for (const [i, id] of options.ids.entries()) {
+            try {
+                const doc = await deleteDocument(config, db, {
+                    id,
+                    req: options.req,
+                    overrideAccess: options.overrideAccess,
+                });
+                results.push(doc);
+            }
+            catch (error) {
+                errors.push({ index: i, error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        return { results, errors };
+    }
+    // Wrap all deletes in a transaction: stop on first error, rollback on failure.
+    await db.query('BEGIN');
+    try {
+        for (const id of options.ids) {
+            const doc = await deleteDocument(config, db, {
+                id,
+                req: options.req,
+                overrideAccess: options.overrideAccess,
+            });
+            results.push(doc);
+        }
+        await db.query('COMMIT');
+    }
+    catch (error) {
+        await db.query('ROLLBACK');
+        const index = results.length; // Index of the failing item
+        errors.push({ index, error: error instanceof Error ? error.message : String(error) });
+        return { results: [], errors };
+    }
+    return { results, errors };
+}

package/dist/collections/operations/fieldHooks.d.ts

@@ -5,7 +5,7 @@
  * Mutates the data object in-place, mirroring the password-hashing pattern already used
  * by create.ts and update.ts.
  */
-import type { RevealCollectionConfig, RevealDocument } from '../../types/index.js';
+import type { RevealCollectionConfig, RevealDocument, RevealRequest } from '../../types/index.js';
 /**
  * Executes all hooks of `hookType` for every field in the collection that has them.
  *
@@ -17,5 +17,5 @@ import type { RevealCollectionConfig, RevealDocument } from '../../types/index.j
  *      (e.g. slug auto-generation from title) that satisfy required constraints.
  *   2. `beforeChange`   — after validation, before the DB write.
  */
-export declare function runBeforeFieldHooks(config: RevealCollectionConfig, data: Record<string, unknown>, operation: 'create' | 'update', hookType: 'beforeValidate' | 'beforeChange', originalDoc?: RevealDocument): Promise<void>;
+export declare function runBeforeFieldHooks(config: RevealCollectionConfig, data: Record<string, unknown>, operation: 'create' | 'update', hookType: 'beforeValidate' | 'beforeChange', originalDoc?: RevealDocument, req?: RevealRequest): Promise<void>;
 //# sourceMappingURL=fieldHooks.d.ts.map

package/dist/collections/operations/fieldHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fieldHooks.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/fieldHooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAA;AAGjG;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,QAAQ,EAAE,gBAAgB,GAAG,cAAc,EAC3C,WAAW,CAAC,EAAE,cAAc,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Cf"}
+{"version":3,"file":"fieldHooks.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/fieldHooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGlG;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,QAAQ,EAAE,gBAAgB,GAAG,cAAc,EAC3C,WAAW,CAAC,EAAE,cAAc,EAC5B,GAAG,CAAC,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Cf"}

package/dist/collections/operations/fieldHooks.js

@@ -17,7 +17,7 @@ import { flattenFields } from '../../utils/type-guards.js';
  *      (e.g. slug auto-generation from title) that satisfy required constraints.
  *   2. `beforeChange`   — after validation, before the DB write.
  */
-export async function runBeforeFieldHooks(config, data, operation, hookType, originalDoc) {
+export async function runBeforeFieldHooks(config, data, operation, hookType, originalDoc, req) {
     const fields = flattenFields(config.fields || []);
     for (const field of fields) {
         if (!field.name)
@@ -28,13 +28,13 @@ export async function runBeforeFieldHooks(config, data, operation, hookType, ori
         let value = data[field.name];
         for (const hook of hooks) {
             // Hooks in this codebase receive the contract-defined FieldBeforeChangeHookArgs.
-            // req is required by the type but none of the existing write hooks use it;
-            // cast an empty object to avoid threading req through the entire operation chain.
+            // Thread req from the caller when available; fall back to an empty object
+            // for backward compatibility with call sites that don't provide it yet.
             value = await hook({
                 value,
                 data,
                 siblingData: data,
-                req: {},
+                req: req ?? {},
                 operation,
                 originalDoc,
                 context: {},

package/dist/collections/operations/find.d.ts

@@ -3,8 +3,6 @@
  *
  * Finds multiple documents with pagination, filtering, sorting, and relationship population.
  */
-import type { DatabaseResult, RevealCollectionConfig, RevealFindOptions, RevealPaginatedResult } from '../../types/index.js';
-export declare function find(config: RevealCollectionConfig, db: {
-    query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-} | null, options: RevealFindOptions): Promise<RevealPaginatedResult>;
+import type { QueryableDatabaseAdapter, RevealCollectionConfig, RevealFindOptions, RevealPaginatedResult } from '../../types/index.js';
+export declare function find(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: RevealFindOptions): Promise<RevealPaginatedResult>;
 //# sourceMappingURL=find.d.ts.map

package/dist/collections/operations/find.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/find.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAG7B,wBAAsB,IAAI,CACxB,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CACtE,GAAG,IAAI,EACR,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAyIhC"}
+{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/find.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAEV,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EAItB,MAAM,sBAAsB,CAAC;AAiC9B,wBAAsB,IAAI,CACxB,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAgPhC"}

package/dist/collections/operations/find.js

@@ -6,29 +6,138 @@
 import { afterRead } from '../../fields/hooks/afterRead/index.js';
 import { buildWhereClause } from '../../queries/queryBuilder.js';
 import { deserializeJsonFields } from '../../utils/json-parsing.js';
+import { countDocumentsQuery, escapeIdentifier, listDocumentsQuery } from './sqlAdapter.js';
+/**
+ * Evaluate a collection's access.read function.
+ * Returns true (allow all), false (deny all), or a WhereClause to merge into the query.
+ */
+async function evaluateReadAccess(config, options) {
+    // If overrideAccess is explicitly set, skip access checks (caller already validated permission)
+    if (options.overrideAccess)
+        return true;
+    const accessConfig = config
+        .access;
+    const readAccess = accessConfig?.read;
+    // No access rule defined = allow all (backward compatible)
+    if (!readAccess)
+        return true;
+    const req = options.req;
+    if (!req)
+        return false; // No request context = deny (safe default)
+    const result = await readAccess({ req });
+    if (typeof result === 'boolean')
+        return result;
+    // WhereClause returned = row-level filtering (e.g. { author: { equals: user.id } })
+    return result;
+}
 export async function find(config, db, options) {
     const { where, limit = 10, page = 1, sort, depth = 0, req, populate: populateOption } = options;
     // Validate depth
     if (depth < 0 || depth > 3) {
         throw new Error(`Depth must be between 0 and 3, got ${depth}`);
     }
+    // --- Access control enforcement ---
+    const accessResult = await evaluateReadAccess(config, options);
+    if (accessResult === false) {
+        // Deny: return empty result set (same shape as a normal response)
+        return {
+            docs: [],
+            totalDocs: 0,
+            limit,
+            totalPages: 0,
+            page,
+            pagingCounter: 0,
+            hasPrevPage: false,
+            hasNextPage: false,
+            prevPage: null,
+            nextPage: null,
+        };
+    }
+    // Merge access-control WhereClause with user-provided where filter
+    const mergedWhere = accessResult === true ? where : where ? { and: [where, accessResult] } : accessResult;
+    // Replace where in options for downstream use.
+    // When access returned a WhereClause (not just boolean true), set overrideAccess: true
+    // to prevent infinite recursion if collectionStorage.find re-invokes this function.
+    const accessOptions = accessResult === true
+        ? { ...options, where: mergedWhere }
+        : { ...options, where: mergedWhere, overrideAccess: true };
+    if (db?.collectionStorage?.find) {
+        const result = await db.collectionStorage.find(config, accessOptions);
+        if (result !== undefined) {
+            if (req && depth > 0) {
+                const sanitizedConfig = {
+                    ...config,
+                    fields: config.fields,
+                    flattenedFields: config.fields,
+                    endpoints: config.endpoints === false ? undefined : config.endpoints,
+                };
+                const docs = await Promise.all(result.docs.map(async (doc) => {
+                    return await afterRead({
+                        collection: sanitizedConfig,
+                        context: req.context || {},
+                        currentDepth: 1,
+                        depth,
+                        doc,
+                        draft: false,
+                        fallbackLocale: req.fallbackLocale || 'en',
+                        findMany: true,
+                        flattenLocales: true,
+                        global: null,
+                        locale: req.locale || 'en',
+                        overrideAccess: false,
+                        populate: populateOption,
+                        req,
+                        select: undefined,
+                        showHiddenFields: false,
+                    });
+                }));
+                return {
+                    ...result,
+                    docs,
+                };
+            }
+            return result;
+        }
+    }
     // Build query based on database adapter
     if (db?.query) {
+        // Dynamic collection storage is quarantined in sqlAdapter.ts until this
+        // layer is redesigned around typed tables that Drizzle can model directly.
         const offset = (page - 1) * limit;
         const tableName = config.slug;
-        // Build WHERE clause using query builder
+        // Build WHERE clause using query builder (uses access-merged where)
         const params = [];
-        const whereClause = buildWhereClause(where, params, {
+        const whereClause = buildWhereClause(mergedWhere, params, {
             parameterStyle: 'postgres',
             includeWhereKeyword: false,
             quoteFields: true,
         });
-        // Build ORDER BY clause
+        // Build ORDER BY clause with field name validation
         let orderByClause = '';
         if (sort) {
+            // Build allowlist from collection fields + common system columns
+            const allowedFields = new Set([
+                'id',
+                'createdAt',
+                'updatedAt',
+                'created_at',
+                'updated_at',
+                '_json',
+            ]);
+            if (config.fields) {
+                for (const field of config.fields) {
+                    if (field.name)
+                        allowedFields.add(field.name);
+                }
+            }
             const sortConditions = [];
             Object.entries(sort).forEach(([key, direction]) => {
-                sortConditions.push(`"${key}" ${direction === '-1' ? 'DESC' : 'ASC'}`);
+                if (!allowedFields.has(key)) {
+                    throw new Error(`Invalid sort field: "${key}". Must be a defined field on the "${tableName}" collection.`);
+                }
+                // Escape embedded double quotes in identifier to prevent SQL injection
+                const escaped = escapeIdentifier(key);
+                sortConditions.push(`"${escaped}" ${direction === '-1' ? 'DESC' : 'ASC'}`);
             });
             orderByClause = sortConditions.length > 0 ? `ORDER BY ${sortConditions.join(', ')}` : '';
         }
@@ -38,9 +147,7 @@ export async function find(config, db, options) {
         if (whereClause?.trim().toUpperCase().startsWith('WHERE')) {
             throw new Error(`WHERE clause unexpectedly starts with "WHERE" keyword. This indicates a bug in buildWhereClause. Clause: ${whereClause}`);
         }
-        const countQuery = whereClause
-            ? `SELECT COUNT(*) as total FROM "${tableName}" WHERE ${whereClause}`
-            : `SELECT COUNT(*) as total FROM "${tableName}"`;
+        const countQuery = countDocumentsQuery(tableName, whereClause);
         const countResult = await db.query(countQuery, params);
         const totalDocs = Number(countResult.rows[0]?.total) || 0;
         // Execute data query (PostgreSQL uses $1, $2 for parameters)
@@ -59,7 +166,7 @@ export async function find(config, db, options) {
         }
         const limitParam = params.length + 1;
         const offsetParam = params.length + 2;
-        const dataQuery = `SELECT * FROM "${tableName}" ${whereClause ? `WHERE ${whereClause}` : ''} ${orderByClause} LIMIT $${limitParam} OFFSET $${offsetParam}`;
+        const dataQuery = listDocumentsQuery(tableName, whereClause, orderByClause, limitParam, offsetParam);
         const docsResult = await db.query(dataQuery, [...params, limit, offset]);
         let docs = docsResult.rows.map((row) => {
             return deserializeJsonFields(row, tableName);

package/dist/collections/operations/findById.d.ts

@@ -3,13 +3,12 @@
  *
  * Finds a single document by ID with optional relationship population.
  */
-import type { DatabaseResult, PopulateType, RevealCollectionConfig, RevealDocument, RevealRequest } from '../../types/index.js';
-export declare function findByID(config: RevealCollectionConfig, db: {
-    query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-} | null, options: {
+import type { PopulateType, QueryableDatabaseAdapter, RevealCollectionConfig, RevealDocument, RevealRequest } from '../../types/index.js';
+export declare function findByID(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: {
     id: string | number;
     depth?: number;
     req?: RevealRequest;
     populate?: PopulateType;
+    overrideAccess?: boolean;
 }): Promise<RevealDocument | null>;
 //# sourceMappingURL=findById.d.ts.map