@aooth/arbac-moost 0.1.19 → 0.1.20

package/dist/atscript/index.d.mts

@@ -1,6 +1,6 @@
-import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
 import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKPMp3G8.mjs";
-import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
+import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 
 //#region src/atscript/auto-provider.d.ts
 /**
@@ -141,6 +141,44 @@ declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, va
  */
 declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
 //#endregion
+//#region src/atscript/credential-metadata-spec.d.ts
+/**
+ * Resolved credential-METADATA column for a credential model, discovered from
+ * the `@aooth.auth.metadata` annotation (registered by `arbacPlugin`).
+ * Computed once per `TAtscriptAnnotatedType` and cached.
+ *
+ * - `metadataField` — the field annotated `@aooth.auth.metadata` **and**
+ *   carrying `@db.json`. `undefined` when no field is annotated, or when the
+ *   annotated field lacks `@db.json` (metadata persistence is then DISABLED —
+ *   see `warnings`). Pass it straight to `CredentialStoreAtscriptDb` as its
+ *   `metadataField` option — the store stays name-agnostic; this spec owns the
+ *   annotation semantics (same split as `getAoothUserHandleSpec` /
+ *   `UserStore.handleFields`).
+ * - `warnings` — non-fatal misconfig notes (an annotated field without
+ *   `@db.json` → metadata persistence disabled, not fatal). The wiring layer
+ *   should log these at boot. Ambiguity (more than one annotated field) is
+ *   fatal and throws.
+ *
+ * The `@db.json` gate mirrors the handle spec's unique-index posture: metadata
+ * is a structured object, and a non-json column would either reject the write
+ * or silently stringify it engine-dependently — so a missing `@db.json`
+ * disables rather than silently accepts. A model with no annotated field
+ * resolves to `undefined` with NO warning here (graceful degradation — the
+ * consumer may simply not persist metadata); the wiring layer decides whether
+ * that deserves a boot-time note.
+ */
+interface AoothCredentialMetadataSpec {
+  metadataField: string | undefined;
+  warnings: string[];
+}
+/**
+ * Walk a credential model's `@aooth.auth.metadata` annotation into a cached
+ * {@link AoothCredentialMetadataSpec}. Mirrors {@link getAoothUserHandleSpec}:
+ * structural, computed once, fail-loud on ambiguity, warn-and-disable on a
+ * misconfigured (non-`@db.json`) field.
+ */
+declare function getAoothCredentialMetadataSpec(credentialType: TAtscriptAnnotatedType): AoothCredentialMetadataSpec;
+//#endregion
 //#region src/atscript/handle-spec.d.ts
 /**
  * Resolved login/recovery HANDLE fields for a user credential model, discovered
@@ -180,4 +218,21 @@ interface AoothUserHandleSpec {
  */
 declare function getAoothUserHandleSpec(userType: TAtscriptAnnotatedType): AoothUserHandleSpec;
 //#endregion
-export { AoothArbacUserCredentials, type AoothUserHandleSpec, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };
+//#region src/atscript/models/user.as.d.ts
+/**
+ * Atscript interface **AoothArbacUserCredentials**
+ * @see {@link ./user.as:7:18}
+ */
+declare class AoothArbacUserCredentials extends AoothUserCredentials {
+  roles: string[];
+  static __is_atscript_annotated_type: true;
+  static type: TAtscriptTypeObject<keyof AoothArbacUserCredentials, AoothArbacUserCredentials>;
+  static metadata: TMetadataMap<AtscriptMetadata>;
+  static validator: (opts?: Partial<TValidatorOptions>) => Validator<typeof AoothArbacUserCredentials>;
+  /** @deprecated JSON Schema support is disabled. Calling this method will throw a runtime error. To enable, set `jsonSchema: 'lazy'` or `jsonSchema: 'bundle'` in tsPlugin options, or add `@emit.jsonSchema` annotation to individual interfaces. */
+  static toJsonSchema: () => any;
+  /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
+  static toExampleData?: () => any;
+}
+//#endregion
+export { AoothArbacUserCredentials, type AoothCredentialMetadataSpec, type AoothUserHandleSpec, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getAoothCredentialMetadataSpec, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -1,7 +1,8 @@
 import { r as __decorate, t as ArbacUserProvider } from "../user.provider-BiM5P8fl.mjs";
-import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
+import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
+import "@aooth/user/atscript-db/model.as";
 //#region src/atscript/role-list.ts
 /**
 * Collect unique, non-empty strings from an iterable of unknown values,
@@ -27,7 +28,7 @@ function __decorateMetadata(k, v) {
 }
 //#endregion
 //#region src/atscript/auto-provider.ts
-const specCache$2 = /* @__PURE__ */ new WeakMap();
+const specCache$3 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
 * documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
@@ -66,7 +67,7 @@ function resolveIdentifierField(type) {
 	return metaId;
 }
 function getArbacExtractSpec(type) {
-	const cached = specCache$2.get(type);
+	const cached = specCache$3.get(type);
 	if (cached !== void 0) return cached;
 	const spec = {
 		userIdField: void 0,
@@ -75,7 +76,7 @@ function getArbacExtractSpec(type) {
 	};
 	const def = type.type;
 	if (def.kind !== "object") {
-		specCache$2.set(type, spec);
+		specCache$3.set(type, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -106,7 +107,7 @@ function getArbacExtractSpec(type) {
 		};
 	}
 	spec.userIdField = resolveIdentifierField(type);
-	specCache$2.set(type, spec);
+	specCache$3.set(type, spec);
 	return spec;
 }
 /**
@@ -236,14 +237,14 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object, Object])], AtscriptArbacUserProvider);
 //#endregion
 //#region src/atscript/attenuation-extract.ts
-const specCache$1 = /* @__PURE__ */ new WeakMap();
+const specCache$2 = /* @__PURE__ */ new WeakMap();
 /**
 * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
 * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
 * structural, computed once, fail-loud on an ambiguous (multiple) role field.
 */
 function getArbacAttenuationSpec(credType) {
-	const cached = specCache$1.get(credType);
+	const cached = specCache$2.get(credType);
 	if (cached !== void 0) return cached;
 	const spec = {
 		roleField: void 0,
@@ -251,7 +252,7 @@ function getArbacAttenuationSpec(credType) {
 	};
 	const def = credType.type;
 	if (def.kind !== "object") {
-		specCache$1.set(credType, spec);
+		specCache$2.set(credType, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -266,7 +267,7 @@ function getArbacAttenuationSpec(credType) {
 	}
 	if (roleCandidates.length > 1) throw new Error(`getArbacAttenuationSpec: multiple @arbac.attenuate.role fields declared (${roleCandidates.join(", ")}). Exactly one assumed-role source is supported — drop @arbac.attenuate.role from all but the canonical field.`);
 	if (roleCandidates.length === 1) spec.roleField = roleCandidates[0];
-	specCache$1.set(credType, spec);
+	specCache$2.set(credType, spec);
 	return spec;
 }
 /**
@@ -330,6 +331,44 @@ function extractAttenuation(credType, record) {
 	return out;
 }
 //#endregion
+//#region src/atscript/credential-metadata-spec.ts
+const specCache$1 = /* @__PURE__ */ new WeakMap();
+/**
+* Walk a credential model's `@aooth.auth.metadata` annotation into a cached
+* {@link AoothCredentialMetadataSpec}. Mirrors {@link getAoothUserHandleSpec}:
+* structural, computed once, fail-loud on ambiguity, warn-and-disable on a
+* misconfigured (non-`@db.json`) field.
+*/
+function getAoothCredentialMetadataSpec(credentialType) {
+	const cached = specCache$1.get(credentialType);
+	if (cached !== void 0) return cached;
+	const spec = {
+		metadataField: void 0,
+		warnings: []
+	};
+	const def = credentialType.type;
+	if (def.kind !== "object") {
+		specCache$1.set(credentialType, spec);
+		return spec;
+	}
+	const candidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("aooth.auth.metadata")) candidates.push({
+			field: fieldName,
+			md
+		});
+	}
+	if (candidates.length > 1) throw new Error(`getAoothCredentialMetadataSpec: multiple @aooth.auth.metadata fields declared (${candidates.map((c) => c.field).join(", ")}). Exactly one credential-metadata column is supported — drop @aooth.auth.metadata from all but the canonical field.`);
+	if (candidates.length === 1) {
+		const { field, md } = candidates[0];
+		if (md.get("db.json")) spec.metadataField = field;
+		else spec.warnings.push(`@aooth.auth.metadata on field "${field}" has no @db.json — a structured metadata object needs a json column, so metadata persistence is DISABLED (the atscript-db credential store will not persist/read metadata). Add @db.json to the field to enable it.`);
+	}
+	specCache$1.set(credentialType, spec);
+	return spec;
+}
+//#endregion
 //#region src/atscript/handle-spec.ts
 const specCache = /* @__PURE__ */ new WeakMap();
 /** A `@db.index.unique` annotation is a non-empty `(string | true)[]`. */
@@ -393,4 +432,16 @@ function getAoothUserHandleSpec(userType) {
 	return spec;
 }
 //#endregion
-export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };
+//#region src/atscript/models/user.as
+var AoothArbacUserCredentials = class {
+	static __is_atscript_annotated_type = true;
+	static type = {};
+	static metadata = /* @__PURE__ */ new Map();
+	static id = "AoothArbacUserCredentials";
+	static toJsonSchema() {
+		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
+	}
+};
+defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).prop("verifiedEmail", defineAnnotatedType().designType("string").tags("string").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("seenDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
+//#endregion
+export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getAoothCredentialMetadataSpec, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/plugin.mjs

@@ -84,18 +84,25 @@ function arbacPlugin() {
 						})
 					}
 				},
-				aooth: { user: {
-					email: new AnnotationSpec({
-						description: "Marks this field as the EMAIL login/recovery handle. The framework resolves the field by this annotation (name-agnostic) for findByHandle / recovery / signup. The field MUST carry @db.index.unique (unique-when-present) — a handle must resolve to at most one row; without a unique index the email handle is DISABLED with a warning. At most one @aooth.user.email field per type — multiple declarations throw at boot.",
-						nodeType: ["prop"],
-						multiple: false
-					}),
-					phone: new AnnotationSpec({
-						description: "Marks this field as the PHONE login/recovery handle. Same resolution + unique-index contract as @aooth.user.email (disabled with a warning when the field lacks @db.index.unique). At most one @aooth.user.phone field per type — multiple throw at boot.",
+				aooth: {
+					user: {
+						email: new AnnotationSpec({
+							description: "Marks this field as the EMAIL login/recovery handle. The framework resolves the field by this annotation (name-agnostic) for findByHandle / recovery / signup. The field MUST carry @db.index.unique (unique-when-present) — a handle must resolve to at most one row; without a unique index the email handle is DISABLED with a warning. At most one @aooth.user.email field per type — multiple declarations throw at boot.",
+							nodeType: ["prop"],
+							multiple: false
+						}),
+						phone: new AnnotationSpec({
+							description: "Marks this field as the PHONE login/recovery handle. Same resolution + unique-index contract as @aooth.user.email (disabled with a warning when the field lacks @db.index.unique). At most one @aooth.user.phone field per type — multiple throw at boot.",
+							nodeType: ["prop"],
+							multiple: false
+						})
+					},
+					auth: { metadata: new AnnotationSpec({
+						description: "Marks the consumer's fully-typed credential-metadata column (@db.json) on their `extends AoothAuthCredential` model — the runtime/validation twin of the `CredentialMetadata` declaration merge. Resolved by `getAoothCredentialMetadataSpec` and threaded to `CredentialStoreAtscriptDb` as `metadataField`. The field MUST carry @db.json (a structured metadata object needs a json column — without it, metadata persistence is DISABLED with a warning). At most one @aooth.auth.metadata field per type — multiple declarations throw at boot. Absent → the atscript-db credential store persists no metadata (non-fatal, warned at boot by the wiring).",
 						nodeType: ["prop"],
 						multiple: false
-					})
-				} }
+					}) }
+				}
 			} };
 		}
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.19",
-    "@aooth/user": "0.1.19",
-    "@aooth/arbac-core": "0.1.19"
+    "@aooth/arbac": "0.1.20",
+    "@aooth/arbac-core": "0.1.20",
+    "@aooth/user": "0.1.20"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.75",
-    "@atscript/db": "^0.1.104",
-    "@atscript/db-sql-tools": "^0.1.104",
-    "@atscript/db-sqlite": "^0.1.104",
-    "@atscript/moost-db": "^0.1.104",
-    "@atscript/typescript": "^0.1.75",
-    "@moostjs/event-http": "^0.6.26",
+    "@atscript/core": "^0.1.76",
+    "@atscript/db": "^0.1.105",
+    "@atscript/db-sql-tools": "^0.1.105",
+    "@atscript/db-sqlite": "^0.1.105",
+    "@atscript/moost-db": "^0.1.105",
+    "@atscript/typescript": "^0.1.76",
+    "@moostjs/event-http": "^0.6.27",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.6",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.75"
+    "unplugin-atscript": "^0.1.76"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.104",
-    "@atscript/moost-db": "^0.1.104",
-    "@atscript/typescript": "^0.1.75",
-    "@moostjs/event-http": "^0.6.26",
+    "@atscript/db": "^0.1.105",
+    "@atscript/moost-db": "^0.1.105",
+    "@atscript/typescript": "^0.1.76",
+    "@moostjs/event-http": "^0.6.27",
     "@wooksjs/event-core": "^0.7.19",
     "@wooksjs/event-http": "^0.7.19",
-    "moost": "^0.6.26"
+    "moost": "^0.6.27"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {

package/dist/user-Dzu_08g0.mjs

@@ -1,15 +0,0 @@
-import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
-import "@aooth/user/atscript-db/model.as";
-//#region src/atscript/models/user.as
-var AoothArbacUserCredentials = class {
-	static __is_atscript_annotated_type = true;
-	static type = {};
-	static metadata = /* @__PURE__ */ new Map();
-	static id = "AoothArbacUserCredentials";
-	static toJsonSchema() {
-		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
-	}
-};
-defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
-//#endregion
-export { AoothArbacUserCredentials as t };