@aooth/arbac-moost 0.1.6 → 0.1.8

package/dist/atscript/index.d.mts

@@ -1,5 +1,5 @@
-import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
-import { t as ArbacUserProvider } from "../user.provider-JpI5dD6Z.mjs";
+import { t as AoothArbacUserCredentials } from "../user-B5vN7nVU.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKPMp3G8.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/atscript/auto-provider.d.ts
@@ -88,4 +88,57 @@ declare abstract class AtscriptArbacUserProvider<T extends object = object> exte
   private fetchRecord;
 }
 //#endregion
-export { AoothArbacUserCredentials, type ArbacUserTable, AtscriptArbacUserProvider };
+//#region src/atscript/attenuation-extract.d.ts
+/**
+ * Spec computed once per credential `TAtscriptAnnotatedType` — which typed root
+ * fields carry the restrict-only ARBAC attenuation:
+ *
+ * - `roleField` — the single `@arbac.attenuate.role`-annotated prop (holds the
+ *   assumed-role SUBSET, `string[]`). More than one throws at spec time.
+ * - `attrFields` — every `@arbac.attenuate.attr "userAttr"` prop, paired with
+ *   the target user-attribute key it narrows (the annotation argument).
+ */
+interface ArbacAttenuationSpec {
+  roleField: string | undefined;
+  attrFields: Array<{
+    field: string;
+    userAttr: string;
+  }>;
+}
+/**
+ * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
+ * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
+ * structural, computed once, fail-loud on an ambiguous (multiple) role field.
+ */
+declare function getArbacAttenuationSpec(credType: TAtscriptAnnotatedType): ArbacAttenuationSpec;
+/**
+ * Boot-time cross-model check: every `@arbac.attenuate.attr "userAttr"` target
+ * must name a real key in the user model's `@arbac.attribute` keyspace
+ * (`validUserAttrs`), else a typo silently no-ops the narrowing. Throws on the
+ * first miss. Call once at provider construction; safe and cheap (the spec is
+ * cached). Soundness does NOT depend on this — the scope conjunction clips
+ * regardless — but it turns a silent misconfig into a loud boot failure.
+ */
+declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, validUserAttrs: Iterable<string>): void;
+/**
+ * Build the restrict-only {@link AoothArbacClaims} for a credential `record`
+ * (its typed root fields — e.g. the auth context, which carries the credential
+ * payload flat) by reading the fields the credential model annotates. Designed
+ * to back a consumer's `ArbacUserProvider.getAttenuation()` override while
+ * arbac-moost stays auth-agnostic (the consumer supplies the record).
+ *
+ * Returns:
+ * - `undefined` when the model declares NO attenuation fields, OR a normal
+ *   (non-attenuated) token carries none of them set → full user authority.
+ * - `{ roles, attrs }` otherwise. The narrowing is then clipped by the engine's
+ *   scope conjunction, so it can never widen beyond the user.
+ *
+ * Fail-closed: when the assumed-role field IS set but holds a malformed value
+ * (no usable role strings), {@link parseRoles} yields `[]` — deny-all — never
+ * full authority. Absent (`undefined`/`null`) = the field was not set, so roles
+ * are omitted (attrs-only narrowing), which is the distinct "no role narrowing"
+ * case, not a malformed one.
+ */
+declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
+//#endregion
+export { AoothArbacUserCredentials, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -1,14 +1,33 @@
-import { r as __decorate, t as ArbacUserProvider } from "../user.provider-CGWueNjx.mjs";
-import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
+import { r as __decorate, t as ArbacUserProvider } from "../user.provider-BiM5P8fl.mjs";
+import { t as AoothArbacUserCredentials } from "../user-B5vN7nVU.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
-//#region \0@oxc-project+runtime@0.129.0/helpers/decorateMetadata.js
+//#region src/atscript/role-list.ts
+/**
+* Collect unique, non-empty strings from an iterable of unknown values,
+* preserving first-seen order and dropping anything that is not a non-empty
+* string. Shared by the user-side role extraction
+* (`AtscriptArbacUserProvider.extractRoles`) and the credential-side
+* attenuation role parse (`extractAttenuation`) so both apply identical
+* dedup / drop-empty rules.
+*/
+function uniqueStrings(values) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const v of values) if (typeof v === "string" && v !== "" && !seen.has(v)) {
+		seen.add(v);
+		out.push(v);
+	}
+	return out;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.133.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
 //#region src/atscript/auto-provider.ts
-const specCache = /* @__PURE__ */ new WeakMap();
+const specCache$1 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
 * documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
@@ -47,7 +66,7 @@ function resolveIdentifierField(type) {
 	return metaId;
 }
 function getArbacExtractSpec(type) {
-	const cached = specCache.get(type);
+	const cached = specCache$1.get(type);
 	if (cached !== void 0) return cached;
 	const spec = {
 		userIdField: void 0,
@@ -56,7 +75,7 @@ function getArbacExtractSpec(type) {
 	};
 	const def = type.type;
 	if (def.kind !== "object") {
-		specCache.set(type, spec);
+		specCache$1.set(type, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -87,7 +106,7 @@ function getArbacExtractSpec(type) {
 		};
 	}
 	spec.userIdField = resolveIdentifierField(type);
-	specCache.set(type, spec);
+	specCache$1.set(type, spec);
 	return spec;
 }
 /**
@@ -127,6 +146,8 @@ const useFetchCache = defineWook((ctx) => {
 	return cache;
 });
 let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUserProvider {
+	userType;
+	table;
 	spec;
 	projection;
 	withClause;
@@ -167,22 +188,10 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 		if (!roleField) return [];
 		const raw = record[roleField.name];
 		if (raw === void 0 || raw === null) return [];
-		const seen = /* @__PURE__ */ new Set();
-		const out = [];
-		const push = (val) => {
-			if (typeof val === "string" && val !== "" && !seen.has(val)) {
-				seen.add(val);
-				out.push(val);
-			}
-		};
-		if (roleField.shape === "inline") if (Array.isArray(raw)) for (const item of raw) push(item);
-		else push(raw);
-		else {
-			if (!Array.isArray(raw)) return out;
-			const idField = roleField.roleTargetIdField;
-			for (const item of raw) if (item && typeof item === "object") push(item[idField]);
-		}
-		return out;
+		if (roleField.shape === "inline") return uniqueStrings(Array.isArray(raw) ? raw : [raw]);
+		if (!Array.isArray(raw)) return [];
+		const idField = roleField.roleTargetIdField;
+		return uniqueStrings(raw.map((item) => item && typeof item === "object" ? item[idField] : void 0));
 	}
 	/**
 	* Override seam: `@arbac.attribute` fields keyed by prop name. Undefined
@@ -226,4 +235,99 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 };
 AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object, Object])], AtscriptArbacUserProvider);
 //#endregion
-export { AoothArbacUserCredentials, AtscriptArbacUserProvider };
+//#region src/atscript/attenuation-extract.ts
+const specCache = /* @__PURE__ */ new WeakMap();
+/**
+* Walk a credential model's `@arbac.attenuate.*` annotations into a cached
+* {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
+* structural, computed once, fail-loud on an ambiguous (multiple) role field.
+*/
+function getArbacAttenuationSpec(credType) {
+	const cached = specCache.get(credType);
+	if (cached !== void 0) return cached;
+	const spec = {
+		roleField: void 0,
+		attrFields: []
+	};
+	const def = credType.type;
+	if (def.kind !== "object") {
+		specCache.set(credType, spec);
+		return spec;
+	}
+	const roleCandidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("arbac.attenuate.role")) roleCandidates.push(fieldName);
+		const userAttr = md.get("arbac.attenuate.attr");
+		if (typeof userAttr === "string" && userAttr !== "") spec.attrFields.push({
+			field: fieldName,
+			userAttr
+		});
+	}
+	if (roleCandidates.length > 1) throw new Error(`getArbacAttenuationSpec: multiple @arbac.attenuate.role fields declared (${roleCandidates.join(", ")}). Exactly one assumed-role source is supported — drop @arbac.attenuate.role from all but the canonical field.`);
+	if (roleCandidates.length === 1) spec.roleField = roleCandidates[0];
+	specCache.set(credType, spec);
+	return spec;
+}
+/**
+* Boot-time cross-model check: every `@arbac.attenuate.attr "userAttr"` target
+* must name a real key in the user model's `@arbac.attribute` keyspace
+* (`validUserAttrs`), else a typo silently no-ops the narrowing. Throws on the
+* first miss. Call once at provider construction; safe and cheap (the spec is
+* cached). Soundness does NOT depend on this — the scope conjunction clips
+* regardless — but it turns a silent misconfig into a loud boot failure.
+*/
+function validateAttenuationTargets(credType, validUserAttrs) {
+	const spec = getArbacAttenuationSpec(credType);
+	const valid = new Set(validUserAttrs);
+	for (const { field, userAttr } of spec.attrFields) if (!valid.has(userAttr)) throw new Error(`validateAttenuationTargets: @arbac.attenuate.attr "${userAttr}" on field "${field}" targets a user attribute that does not exist in the user model's @arbac.attribute keyspace (${[...valid].join(", ") || "<none>"}). Fix the annotation argument.`);
+}
+/** Lenient role parse: accept `string | string[]`, drop empty/non-string, dedupe. */
+function parseRoles(raw) {
+	return uniqueStrings(Array.isArray(raw) ? raw : [raw]);
+}
+/**
+* Build the restrict-only {@link AoothArbacClaims} for a credential `record`
+* (its typed root fields — e.g. the auth context, which carries the credential
+* payload flat) by reading the fields the credential model annotates. Designed
+* to back a consumer's `ArbacUserProvider.getAttenuation()` override while
+* arbac-moost stays auth-agnostic (the consumer supplies the record).
+*
+* Returns:
+* - `undefined` when the model declares NO attenuation fields, OR a normal
+*   (non-attenuated) token carries none of them set → full user authority.
+* - `{ roles, attrs }` otherwise. The narrowing is then clipped by the engine's
+*   scope conjunction, so it can never widen beyond the user.
+*
+* Fail-closed: when the assumed-role field IS set but holds a malformed value
+* (no usable role strings), {@link parseRoles} yields `[]` — deny-all — never
+* full authority. Absent (`undefined`/`null`) = the field was not set, so roles
+* are omitted (attrs-only narrowing), which is the distinct "no role narrowing"
+* case, not a malformed one.
+*/
+function extractAttenuation(credType, record) {
+	const spec = getArbacAttenuationSpec(credType);
+	if (spec.roleField === void 0 && spec.attrFields.length === 0) return void 0;
+	if (!record) return void 0;
+	const rec = record;
+	let roles;
+	if (spec.roleField !== void 0) {
+		const raw = rec[spec.roleField];
+		if (raw !== void 0 && raw !== null) roles = parseRoles(raw);
+	}
+	let attrs;
+	for (const { field, userAttr } of spec.attrFields) {
+		const value = rec[field];
+		if (value !== void 0 && value !== null) {
+			attrs ??= {};
+			attrs[userAttr] = value;
+		}
+	}
+	if (roles === void 0 && attrs === void 0) return void 0;
+	const out = {};
+	if (roles !== void 0) out.roles = roles;
+	if (attrs !== void 0) out.attrs = attrs;
+	return out;
+}
+//#endregion
+export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/index.d.mts

@@ -1,12 +1,11 @@
-import { n as ArbacUserProviderToken, t as ArbacUserProvider } from "./user.provider-JpI5dD6Z.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-CKPMp3G8.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { Mate, TMateParamMeta, TMoostMetadata } from "moost";
-import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFilter } from "@aooth/arbac";
-import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
-import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType } from "@atscript/typescript/utils";
-import { TMetaResponse } from "@atscript/db";
+import { ControlGate, TProjection } from "@aooth/arbac";
+import { AsDbReadableController } from "@atscript/moost-db";
+import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/arbac.composables.d.ts
 interface ArbacBindings {
@@ -112,217 +111,6 @@ type ArbacMate = Mate<TMoostMetadata & {
  */
 declare function getArbacMate(): ArbacMate;
 //#endregion
-//#region src/db/scope-types.d.ts
-/**
- * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
- * `Comment[]` → `Comment`, `Task` → `Task`. Used to recurse `with.<K>` into
- * the joined model's own type so per-relation scopes get typed against the
- * RIGHT entity (not the array wrapper).
- */
-type NavTarget<U> = U extends readonly (infer V)[] ? V : U;
-/**
- * True only when `T` is `unknown` (or `any`). `unknown extends T` holds for
- * both. Callers use this to pick the legacy untyped shape when no model is
- * annotated.
- */
-type IsUnknown<T> = unknown extends T ? true : false;
-/**
- * Permissive own-field key set. With a typed `T`, autocompletes against
- * `keyof OwnPropsOf<T>` while still accepting dotted-path projections like
- * `mfa.value` via the `(string & {})` escape hatch. With `T = unknown`,
- * `OwnPropsOf<unknown>` collapses to `unknown` so `keyof` is `never` →
- * falls back to plain `string`.
- */
-type OwnFieldKey<T> = keyof OwnPropsOf<T> extends never ? string : (keyof OwnPropsOf<T> & string) | (string & {});
-/**
- * Same idiom for nav relation names. `NavPropsOf<unknown>` is
- * `Record<string, never>`, so its `keyof` is `string` — the typed branch
- * still resolves to plain `string` (the `(string & {})` escape collapses
- * with `string`).
- */
-type NavRelationKey<T> = keyof NavPropsOf<T> extends never ? string : (keyof NavPropsOf<T> & string) | (string & {});
-/**
- * Typed projection keyed by own-field paths (with dotted-path escape).
- * Falls back to the legacy `TProjection = Record<string, 0 | 1>` for
- * untyped scopes so existing callers that pass the result straight to
- * `unionProjections` / `restrictProjection` keep compiling.
- */
-type ProjectionOf<T> = IsUnknown<T> extends true ? TProjection : Partial<Record<OwnFieldKey<T>, 0 | 1>>;
-/**
- * Typed control gates: `$with` against nav names, `$select` against own
- * fields, other `$`-prefixed controls passthrough. Falls back to the
- * legacy untyped `Record<string, ControlGate>` for `T = unknown` so
- * internal helpers (`unionControlsPolicy`) and existing untyped call
- * sites keep compiling.
- */
-type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate$1> : {
-  $with?: Array<NavRelationKey<T>> | boolean;
-  $select?: Array<OwnFieldKey<T>> | boolean;
-  $groupBy?: ControlGate$1;
-  $having?: ControlGate$1;
-  [key: `$${string}`]: ControlGate$1 | Array<string> | undefined;
-};
-//#endregion
-//#region src/db/as-arbac-db-controller.d.ts
-/**
- * Contract returned by an ARBAC role's scope predicate on a DB-backed resource.
- *
- * Apps can extend this interface with their own fields via TypeScript
- * declaration merging — both at role-definition time (returned from
- * `role.allow(...)`) and at consumption time (custom controller overrides
- * reading `scopes[i].myCustomField` get full type safety):
- *
- * @example
- * ```ts
- * declare module '@aooth/arbac-moost' {
- *   interface ArbacDbScope {
- *     tenantId?: string
- *   }
- * }
- * ```
- */
-interface ArbacDbScope<T = unknown> {
-  filter?: TScopeFilter;
-  projection?: ProjectionOf<T>;
-  set?: Partial<Record<OwnFieldKey<T>, unknown>>;
-  allowedFields?: Array<OwnFieldKey<T>>;
-  /**
-   * Per-control gates for Uniquery URL controls (`$with`, `$groupBy`, `$having`, …).
-   * Evaluated by {@link AsArbacDbController.validateControls} before query execution;
-   * a violation throws `HttpError(403)`.
-   *
-   * Per-key semantics ({@link ControlGate}):
-   *   - absent / `true` — allowed.
-   *   - `false` — denied entirely.
-   *   - `readonly string[]` — whitelist (e.g. `{ $with: ['comments'] }` allows
-   *     `?$with=comments`, rejects `?$with=tasks`). Supported only for `$with`
-   *     (relation names) and `$groupBy` (column names) in v1.
-   *
-   * Across roles, gates union additively (silence wins) via {@link unionControlsPolicy}.
-   *
-   * @example `{ controls: { $with: false } }` — disable $with for this role.
-   * @example `{ controls: { $with: ['comments', 'owner'] } }` — restrict relations.
-   */
-  controls?: ControlsOf<T>;
-  /**
-   * Per-relation sub-scopes applied when the request expands a relation via
-   * `?$with=<name>`. Recursive — each sub-scope has the same shape and can
-   * declare its own `with` for nested expansions (e.g. tasks → comments → task).
-   *
-   * **Authority model**: the PARENT scope owns the policy for joined rows.
-   * arbac-moost does NOT re-evaluate ARBAC against the joined resource's own
-   * scopes — that would be a confusing indirection and a perf hit. Whatever
-   * the parent declares here is what surfaces from the expansion.
-   *
-   * **Union across roles**: when multiple roles allow the same parent table,
-   * their `with[name]` sub-scopes are unioned at every nested level using the
-   * existing `unionProjections` / `mergeScopeFilters` / `unionControlsPolicy`
-   * primitives (additive: broader access wins, same rules as the parent).
-   *
-   * **Silence wins**: if no role declares `with.<name>`, expansion is
-   * unrestricted (matches `controls.$with` whitelist semantics; the gate
-   * still applies if declared).
-   */
-  with?: WithOf<T>;
-}
-/**
- * Per-relation sub-scope map. For `T = unknown` falls back to the legacy
- * untyped `Record<string, ArbacDbScope>`. With a typed `T`, each known
- * relation key gets its scope typed against the joined model (via
- * `NavTarget` to unwrap arrays), while arbitrary `(string & {})` keys
- * keep the untyped escape hatch. Lives here (not in `scope-types.ts`)
- * because it must reference `ArbacDbScope` recursively.
- */
-type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavRelationKey<T>]?: K extends keyof NavPropsOf<T> ? ArbacDbScope<NavTarget<NavPropsOf<T>[K]>> : ArbacDbScope };
-declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbController<T> {
-  protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
-  protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;
-  /**
-   * Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
-   * bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
-   * no try/catch, so a malformed `?status=...` (e.g. unquoted single quote at a
-   * non-string position) surfaces as a server error — misleading, since the
-   * server is fine and the client sent bad input.
-   *
-   * Narrow targeting: only `SyntaxError` raised from inside the parser is
-   * remapped. Other errors (e.g. a programmer-introduced TypeError in a future
-   * override) still bubble as 500. SQL-injection-shaped payloads remain safely
-   * handled either way — see SEC-17 for the parameterisation invariant; this
-   * override is an orthogonal robustness pin around the parse step.
-   */
-  protected parseQueryString(url: string): ReturnType<AsDbController<T>["parseQueryString"]>;
-  /**
-   * Same parser-error → 400 remap as {@link parseQueryString}, applied to the
-   * `/one` and `/one?…` code paths which use `parseControlsOnlyFromUrl`.
-   */
-  protected parseControlsOnlyFromUrl(url: string): ReturnType<AsDbController<T>["parseControlsOnlyFromUrl"]>;
-  /**
-   * Enforce per-role `ArbacDbScope.controls` gates against the parsed Uniquery
-   * controls of a request. Runs after the base validator (which checks the
-   * controls DTO shape) and BEFORE the query/aggregation pipeline executes.
-   *
-   * `transformFilter` runs first on every read endpoint and caches the
-   * evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-   * directly here without re-evaluating ARBAC.
-   *
-   * On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
-   * `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
-   * thrown error bubbles to moost which translates it to a 403 response.
-   */
-  protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
-  protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
-  protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
-  protected onRemove(id: unknown): Promise<unknown>;
-  private assertInScope;
-  private identifierFields;
-}
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Enforce a per-control policy against a parsed Uniquery `controls` map.
- *
- * Throws `HttpError(403)` on the first violation. Pure (no DI) so it is
- * trivially unit-testable; `validateControls` wires it up to the controller's
- * cached scopes.
- *
- * Semantics per gate (see {@link ControlGate}):
- *   - `true` (or absent — dropped by `unionControlsPolicy`): allow.
- *   - `false`: deny if the control is used at all.
- *   - `readonly string[]`: allow only the listed values; reject any other.
- *
- * "Used" means the control key is present AND non-empty (an empty array is
- * treated as not used, matching how the parser leaves missing controls).
- */
-declare function enforceControlsPolicy(policy: Record<string, ControlGate$1>, controls: Record<string, unknown>): void;
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Extract the set of "named values" from a Uniquery control payload, for
- * use against a whitelist gate.
- *
- * Currently supported (matches `WHITELISTABLE_CONTROLS` in `unionControlsPolicy`):
- *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
- *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
- *     Bare strings are tolerated for forward compatibility.
- *   - `$groupBy` — array of column names (strings). Returned as-is.
- *
- * For unknown controls we return an empty array; the caller then enforces
- * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
- * gate, which throws if a non-whitelistable control receives a string[]).
- */
-declare function extractUsedControlValues(key: string, value: unknown): string[];
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Apply the union of `allowedFields` whitelists (with `preserveFields`
- * always preserved) and overlay each scope's `set` overrides. Returns a
- * shallow copy; original `data` is not mutated.
- */
-declare function applyAllowedFieldsAndSet(data: unknown, scopes: ArbacDbScope[], preserveFields?: readonly string[]): unknown;
-//#endregion
 //#region src/db/as-arbac-db-readable-controller.d.ts
 /**
  * Read-only mirror of {@link AsArbacDbController} for view-style controllers
@@ -350,4 +138,4 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };

package/dist/index.mjs

@@ -1,10 +1,102 @@
-import { n as ArbacUserProviderToken, r as __decorate, t as ArbacUserProvider } from "./user.provider-CGWueNjx.mjs";
+import { n as ArbacUserProviderToken, r as __decorate, t as ArbacUserProvider } from "./user.provider-BiM5P8fl.mjs";
 import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core";
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { current, key } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getInstanceOwnMethods, getMoostMate, useControllerContext, useLogger } from "moost";
-import { mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
+import { conjoinScopeFilters, intersectControlsPolicy, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
+//#region src/attenuation.ts
+/**
+* Conjoin the full-authority scopes (`userScopes`, the ceiling) and the
+* credential's narrowed scopes (`credScopes`) into ONE composite
+* `ArbacDbScope`. A row/field/control is admitted only if BOTH passes admit
+* it — the normative restrict-only clip that closes the attr-widen hole.
+*
+* Each side is first UNIONed with the existing additive helpers (today's
+* machinery), then the two RESULTS are CONJOINED with the dedicated combiners
+* ({@link conjoinScopeFilters} `$and`, {@link restrictProjection} field ∩,
+* {@link intersectControlsPolicy} deny-wins, `with` recursion) — never the
+* additive union helpers, which would silently widen.
+*
+* Returned as a single-element list so every downstream scope-application
+* site (which UNIONs the cached scope list per facet) sees the identity of a
+* one-element union — i.e. the conjunction — with no change to those sites.
+*/
+function conjoinArbacDbScopes(userScopes, credScopes) {
+	const filter = conjoinScopeFilters(mergeScopeFilters(userScopes.map((s) => s.filter ?? {})), mergeScopeFilters(credScopes.map((s) => s.filter ?? {})));
+	const projection = restrictProjection(unionProjections(...userScopes.map((s) => s.projection ?? {})), unionProjections(...credScopes.map((s) => s.projection ?? {})));
+	const controls = intersectControlsPolicy(unionControlsPolicy(userScopes), unionControlsPolicy(credScopes));
+	const allowedFields = intersectAllowedFields(userScopes, credScopes);
+	const set = combineSet(userScopes, credScopes);
+	const withMap = conjoinWith(userScopes, credScopes);
+	const s = {};
+	if (filter && Object.keys(filter).length > 0) s.filter = filter;
+	if (Object.keys(projection).length > 0) s.projection = projection;
+	if (Object.keys(controls).length > 0) s.controls = controls;
+	if (allowedFields) s.allowedFields = allowedFields;
+	if (set) s.set = set;
+	if (withMap) s.with = withMap;
+	return [s];
+}
+/**
+* Intersect the two sides' `allowedFields` write-whitelists (the credential
+* may write FEWER fields). A side with no whitelist is unrestricted (all
+* fields), so the other side wins; both restricting → set intersection.
+*/
+function intersectAllowedFields(userScopes, credScopes) {
+	const u = unionAllowedFields(userScopes);
+	const c = unionAllowedFields(credScopes);
+	if (u === void 0) return c;
+	if (c === void 0) return u;
+	const cset = new Set(c);
+	return [...new Set(u)].filter((f) => cset.has(f)).toSorted();
+}
+function unionAllowedFields(scopes) {
+	let set;
+	for (const s of scopes) if (Array.isArray(s.allowedFields)) {
+		set ??= /* @__PURE__ */ new Set();
+		for (const f of s.allowedFields) set.add(f);
+	}
+	return set ? [...set] : void 0;
+}
+/**
+* Combine the two sides' `set` overlays. `set` forces field values on writes;
+* both sides' forced constraints apply, and on a key conflict the USER's value
+* wins so the credential can only ADD constraints, never override the owner's.
+*/
+function combineSet(userScopes, credScopes) {
+	const u = unionSet(userScopes);
+	const c = unionSet(credScopes);
+	if (!u && !c) return void 0;
+	return {
+		...c,
+		...u
+	};
+}
+function unionSet(scopes) {
+	let out;
+	for (const s of scopes) if (s.set) {
+		out ??= {};
+		Object.assign(out, s.set);
+	}
+	return out;
+}
+/**
+* Recurse the conjunction into joined-resource sub-scopes. A relation declared
+* on only one side is conjoined against the other side's silence (unrestricted
+* = identity), so a credential can narrow a relation the user left open but
+* never widen one the user restricted.
+*/
+function conjoinWith(userScopes, credScopes) {
+	const relNames = /* @__PURE__ */ new Set();
+	for (const s of userScopes) if (s.with) for (const k of Object.keys(s.with)) relNames.add(k);
+	for (const s of credScopes) if (s.with) for (const k of Object.keys(s.with)) relNames.add(k);
+	if (relNames.size === 0) return void 0;
+	const out = {};
+	for (const rel of relNames) out[rel] = conjoinArbacDbScopes(userScopes.map((s) => s.with?.[rel]).filter(Boolean), credScopes.map((s) => s.with?.[rel]).filter(Boolean))[0];
+	return out;
+}
+//#endregion
 //#region src/moost-arbac.ts
 let MoostArbac = class MoostArbac extends Arbac$1 {};
 MoostArbac = __decorate([Injectable()], MoostArbac);
@@ -52,15 +144,28 @@ const useArbac = (_ctx) => {
 		if (!effectiveAction) throw new Error("useArbac().evaluate(): `action` is required — could not be resolved from controller/method metadata. Pass it explicitly.");
 		const [user, arbac] = await Promise.all([cc.instantiate(ArbacUserProviderToken), cc.instantiate(MoostArbac)]);
 		const userId = await user.getUserId();
+		const att = user.getAttenuation ? await user.getAttenuation() : void 0;
+		const attenuate = att && (att.roles !== void 0 || att.attrs !== void 0) ? {
+			roles: att.roles,
+			attrs: att.attrs
+		} : void 0;
+		const result = await arbac.evaluate({
+			resource: effectiveResource,
+			action: effectiveAction
+		}, {
+			id: userId,
+			roles: await user.getRoles(userId),
+			attrs: (id) => user.getAttrs(id),
+			attenuate
+		});
+		if (result.allowed && result.credScopes !== void 0) return {
+			allowed: true,
+			scopes: conjoinArbacDbScopes(result.scopes ?? [], result.credScopes),
+			userId
+		};
 		return {
-			...await arbac.evaluate({
-				resource: effectiveResource,
-				action: effectiveAction
-			}, {
-				id: userId,
-				roles: await user.getRoles(userId),
-				attrs: (id) => user.getAttrs(id)
-			}),
+			allowed: result.allowed,
+			scopes: result.scopes,
 			userId
 		};
 	};
@@ -516,4 +621,4 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };
+export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };

package/dist/plugin.d.mts

@@ -16,6 +16,19 @@ import { TAtscriptPlugin } from "@atscript/core";
  *   (1) `@arbac.userId`, (2) the single field of the `@db.table.preferredId.uniqueIndex`
  *   group, (3) `@meta.id` — first match wins.
  *
+ * Credential-side (restrict-only attenuation — a credential authorizes for
+ * strictly LESS than its owning user; soundness is the engine's scope
+ * conjunction, these only mark WHERE the narrowing inputs live):
+ *
+ * - `@arbac.attenuate.role` — marks the ONE credential field holding the
+ *   assumed-role SUBSET (`string[]`). Intersected with the user's roles
+ *   (fail-closed: a claimed role the user lacks is dropped). Exactly one per
+ *   type — multiple declarations throw at boot.
+ * - `@arbac.attenuate.attr "userAttrName"` — marks a credential field whose
+ *   value narrows the named USER attribute. The string argument is the target
+ *   key in the user model's `@arbac.attribute` keyspace (validated to exist at
+ *   boot). Multiple fields may each carry it, targeting different attrs.
+ *
  * Install in `atscript.config.ts`:
  *
  * ```ts

package/dist/plugin.mjs

@@ -15,6 +15,19 @@ import { AnnotationSpec } from "@atscript/core";
 *   (1) `@arbac.userId`, (2) the single field of the `@db.table.preferredId.uniqueIndex`
 *   group, (3) `@meta.id` — first match wins.
 *
+* Credential-side (restrict-only attenuation — a credential authorizes for
+* strictly LESS than its owning user; soundness is the engine's scope
+* conjunction, these only mark WHERE the narrowing inputs live):
+*
+* - `@arbac.attenuate.role` — marks the ONE credential field holding the
+*   assumed-role SUBSET (`string[]`). Intersected with the user's roles
+*   (fail-closed: a claimed role the user lacks is dropped). Exactly one per
+*   type — multiple declarations throw at boot.
+* - `@arbac.attenuate.attr "userAttrName"` — marks a credential field whose
+*   value narrows the named USER attribute. The string argument is the target
+*   key in the user model's `@arbac.attribute` keyspace (validated to exist at
+*   boot). Multiple fields may each carry it, targeting different attrs.
+*
 * Install in `atscript.config.ts`:
 *
 * ```ts
@@ -41,7 +54,24 @@ function arbacPlugin() {
 					description: "Overrides which field provides the user identifier for ARBAC. Resolution chain: @arbac.userId → @db.table.preferredId.uniqueIndex field → @meta.id.",
 					nodeType: ["prop"],
 					multiple: false
-				})
+				}),
+				attenuate: {
+					role: new AnnotationSpec({
+						description: "Marks the credential field holding the assumed-role SUBSET (string[]) for restrict-only ARBAC attenuation. Intersected with the user's roles (fail-closed). Exactly one @arbac.attenuate.role field per type — multiple declarations throw at boot.",
+						nodeType: ["prop"],
+						multiple: false
+					}),
+					attr: new AnnotationSpec({
+						description: "Marks a credential field whose value narrows the named USER attribute for restrict-only ARBAC attenuation. The argument is the target key in the user model's @arbac.attribute keyspace (validated to exist at boot). Multiple fields may each carry it, targeting different attrs.",
+						nodeType: ["prop"],
+						multiple: false,
+						argument: {
+							name: "userAttr",
+							type: "string",
+							description: "Target user-attribute key (a field annotated @arbac.attribute on the user model)."
+						}
+					})
+				}
 			} } };
 		}
 	};

package/dist/user-B5vN7nVU.mjs

@@ -0,0 +1,15 @@
+import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
+import "@aooth/user/atscript-db/model.as";
+//#region src/atscript/models/user.as
+var AoothArbacUserCredentials = class {
+	static __is_atscript_annotated_type = true;
+	static type = {};
+	static metadata = /* @__PURE__ */ new Map();
+	static id = "AoothArbacUserCredentials";
+	static toJsonSchema() {
+		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
+	}
+};
+defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("email", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "email_idx", true).optional().$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
+//#endregion
+export { AoothArbacUserCredentials as t };

package/dist/{user.provider-CGWueNjx.mjs → user.provider-BiM5P8fl.mjs}

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.129.0/helpers/decorate.js
+//#region \0@oxc-project+runtime@0.133.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

package/dist/user.provider-CKPMp3G8.d.mts

@@ -0,0 +1,314 @@
+import { TClassConstructor } from "moost";
+import { ControlGate, TProjection, TScopeFilter } from "@aooth/arbac";
+import { AsDbController } from "@atscript/moost-db";
+import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType } from "@atscript/typescript/utils";
+import { TMetaResponse } from "@atscript/db";
+
+//#region src/db/scope-types.d.ts
+/**
+ * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
+ * `Comment[]` → `Comment`, `Task` → `Task`. Used to recurse `with.<K>` into
+ * the joined model's own type so per-relation scopes get typed against the
+ * RIGHT entity (not the array wrapper).
+ */
+type NavTarget<U> = U extends readonly (infer V)[] ? V : U;
+/**
+ * True only when `T` is `unknown` (or `any`). `unknown extends T` holds for
+ * both. Callers use this to pick the legacy untyped shape when no model is
+ * annotated.
+ */
+type IsUnknown<T> = unknown extends T ? true : false;
+/**
+ * Permissive own-field key set. With a typed `T`, autocompletes against
+ * `keyof OwnPropsOf<T>` while still accepting dotted-path projections like
+ * `mfa.value` via the `(string & {})` escape hatch. With `T = unknown`,
+ * `OwnPropsOf<unknown>` collapses to `unknown` so `keyof` is `never` →
+ * falls back to plain `string`.
+ */
+type OwnFieldKey<T> = keyof OwnPropsOf<T> extends never ? string : (keyof OwnPropsOf<T> & string) | (string & {});
+/**
+ * Same idiom for nav relation names. `NavPropsOf<unknown>` is
+ * `Record<string, never>`, so its `keyof` is `string` — the typed branch
+ * still resolves to plain `string` (the `(string & {})` escape collapses
+ * with `string`).
+ */
+type NavRelationKey<T> = keyof NavPropsOf<T> extends never ? string : (keyof NavPropsOf<T> & string) | (string & {});
+/**
+ * Typed projection keyed by own-field paths (with dotted-path escape).
+ * Falls back to the legacy `TProjection = Record<string, 0 | 1>` for
+ * untyped scopes so existing callers that pass the result straight to
+ * `unionProjections` / `restrictProjection` keep compiling.
+ */
+type ProjectionOf<T> = IsUnknown<T> extends true ? TProjection : Partial<Record<OwnFieldKey<T>, 0 | 1>>;
+/**
+ * Typed control gates: `$with` against nav names, `$select` against own
+ * fields, other `$`-prefixed controls passthrough. Falls back to the
+ * legacy untyped `Record<string, ControlGate>` for `T = unknown` so
+ * internal helpers (`unionControlsPolicy`) and existing untyped call
+ * sites keep compiling.
+ */
+type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate> : {
+  $with?: Array<NavRelationKey<T>> | boolean;
+  $select?: Array<OwnFieldKey<T>> | boolean;
+  $groupBy?: ControlGate;
+  $having?: ControlGate;
+  [key: `$${string}`]: ControlGate | Array<string> | undefined;
+};
+//#endregion
+//#region src/db/as-arbac-db-controller.d.ts
+/**
+ * Contract returned by an ARBAC role's scope predicate on a DB-backed resource.
+ *
+ * Apps can extend this interface with their own fields via TypeScript
+ * declaration merging — both at role-definition time (returned from
+ * `role.allow(...)`) and at consumption time (custom controller overrides
+ * reading `scopes[i].myCustomField` get full type safety):
+ *
+ * @example
+ * ```ts
+ * declare module '@aooth/arbac-moost' {
+ *   interface ArbacDbScope {
+ *     tenantId?: string
+ *   }
+ * }
+ * ```
+ */
+interface ArbacDbScope<T = unknown> {
+  filter?: TScopeFilter;
+  projection?: ProjectionOf<T>;
+  set?: Partial<Record<OwnFieldKey<T>, unknown>>;
+  allowedFields?: Array<OwnFieldKey<T>>;
+  /**
+   * Per-control gates for Uniquery URL controls (`$with`, `$groupBy`, `$having`, …).
+   * Evaluated by {@link AsArbacDbController.validateControls} before query execution;
+   * a violation throws `HttpError(403)`.
+   *
+   * Per-key semantics ({@link ControlGate}):
+   *   - absent / `true` — allowed.
+   *   - `false` — denied entirely.
+   *   - `readonly string[]` — whitelist (e.g. `{ $with: ['comments'] }` allows
+   *     `?$with=comments`, rejects `?$with=tasks`). Supported only for `$with`
+   *     (relation names) and `$groupBy` (column names) in v1.
+   *
+   * Across roles, gates union additively (silence wins) via {@link unionControlsPolicy}.
+   *
+   * @example `{ controls: { $with: false } }` — disable $with for this role.
+   * @example `{ controls: { $with: ['comments', 'owner'] } }` — restrict relations.
+   */
+  controls?: ControlsOf<T>;
+  /**
+   * Per-relation sub-scopes applied when the request expands a relation via
+   * `?$with=<name>`. Recursive — each sub-scope has the same shape and can
+   * declare its own `with` for nested expansions (e.g. tasks → comments → task).
+   *
+   * **Authority model**: the PARENT scope owns the policy for joined rows.
+   * arbac-moost does NOT re-evaluate ARBAC against the joined resource's own
+   * scopes — that would be a confusing indirection and a perf hit. Whatever
+   * the parent declares here is what surfaces from the expansion.
+   *
+   * **Union across roles**: when multiple roles allow the same parent table,
+   * their `with[name]` sub-scopes are unioned at every nested level using the
+   * existing `unionProjections` / `mergeScopeFilters` / `unionControlsPolicy`
+   * primitives (additive: broader access wins, same rules as the parent).
+   *
+   * **Silence wins**: if no role declares `with.<name>`, expansion is
+   * unrestricted (matches `controls.$with` whitelist semantics; the gate
+   * still applies if declared).
+   */
+  with?: WithOf<T>;
+}
+/**
+ * Per-relation sub-scope map. For `T = unknown` falls back to the legacy
+ * untyped `Record<string, ArbacDbScope>`. With a typed `T`, each known
+ * relation key gets its scope typed against the joined model (via
+ * `NavTarget` to unwrap arrays), while arbitrary `(string & {})` keys
+ * keep the untyped escape hatch. Lives here (not in `scope-types.ts`)
+ * because it must reference `ArbacDbScope` recursively.
+ */
+type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavRelationKey<T>]?: K extends keyof NavPropsOf<T> ? ArbacDbScope<NavTarget<NavPropsOf<T>[K]>> : ArbacDbScope };
+declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbController<T> {
+  protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
+  protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;
+  /**
+   * Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
+   * bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
+   * no try/catch, so a malformed `?status=...` (e.g. unquoted single quote at a
+   * non-string position) surfaces as a server error — misleading, since the
+   * server is fine and the client sent bad input.
+   *
+   * Narrow targeting: only `SyntaxError` raised from inside the parser is
+   * remapped. Other errors (e.g. a programmer-introduced TypeError in a future
+   * override) still bubble as 500. SQL-injection-shaped payloads remain safely
+   * handled either way — see SEC-17 for the parameterisation invariant; this
+   * override is an orthogonal robustness pin around the parse step.
+   */
+  protected parseQueryString(url: string): ReturnType<AsDbController<T>["parseQueryString"]>;
+  /**
+   * Same parser-error → 400 remap as {@link parseQueryString}, applied to the
+   * `/one` and `/one?…` code paths which use `parseControlsOnlyFromUrl`.
+   */
+  protected parseControlsOnlyFromUrl(url: string): ReturnType<AsDbController<T>["parseControlsOnlyFromUrl"]>;
+  /**
+   * Enforce per-role `ArbacDbScope.controls` gates against the parsed Uniquery
+   * controls of a request. Runs after the base validator (which checks the
+   * controls DTO shape) and BEFORE the query/aggregation pipeline executes.
+   *
+   * `transformFilter` runs first on every read endpoint and caches the
+   * evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
+   * directly here without re-evaluating ARBAC.
+   *
+   * On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
+   * `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
+   * thrown error bubbles to moost which translates it to a 403 response.
+   */
+  protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
+  protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
+  protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
+  protected onRemove(id: unknown): Promise<unknown>;
+  private assertInScope;
+  private identifierFields;
+}
+/**
+ * Test-friendly internal helper — exported for unit tests and helper
+ * composition; regular consumers should not call this directly.
+ *
+ * Enforce a per-control policy against a parsed Uniquery `controls` map.
+ *
+ * Throws `HttpError(403)` on the first violation. Pure (no DI) so it is
+ * trivially unit-testable; `validateControls` wires it up to the controller's
+ * cached scopes.
+ *
+ * Semantics per gate (see {@link ControlGate}):
+ *   - `true` (or absent — dropped by `unionControlsPolicy`): allow.
+ *   - `false`: deny if the control is used at all.
+ *   - `readonly string[]`: allow only the listed values; reject any other.
+ *
+ * "Used" means the control key is present AND non-empty (an empty array is
+ * treated as not used, matching how the parser leaves missing controls).
+ */
+declare function enforceControlsPolicy(policy: Record<string, ControlGate>, controls: Record<string, unknown>): void;
+/**
+ * Test-friendly internal helper — exported for unit tests and helper
+ * composition; regular consumers should not call this directly.
+ *
+ * Extract the set of "named values" from a Uniquery control payload, for
+ * use against a whitelist gate.
+ *
+ * Currently supported (matches `WHITELISTABLE_CONTROLS` in `unionControlsPolicy`):
+ *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
+ *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
+ *     Bare strings are tolerated for forward compatibility.
+ *   - `$groupBy` — array of column names (strings). Returned as-is.
+ *
+ * For unknown controls we return an empty array; the caller then enforces
+ * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
+ * gate, which throws if a non-whitelistable control receives a string[]).
+ */
+declare function extractUsedControlValues(key: string, value: unknown): string[];
+/**
+ * Test-friendly internal helper — exported for unit tests and helper
+ * composition; regular consumers should not call this directly.
+ *
+ * Apply the union of `allowedFields` whitelists (with `preserveFields`
+ * always preserved) and overlay each scope's `set` overrides. Returns a
+ * shallow copy; original `data` is not mutated.
+ */
+declare function applyAllowedFieldsAndSet(data: unknown, scopes: ArbacDbScope[], preserveFields?: readonly string[]): unknown;
+//#endregion
+//#region src/attenuation.d.ts
+/**
+ * The restrict-only ARBAC attenuation carried by a credential — its assumed
+ * role SUBSET and narrowing attribute overrides. Sourced into evaluation via
+ * the optional `ArbacUserProvider.getAttenuation()` hook (typically built by
+ * walking the credential model's `@arbac.attenuate.*`-annotated typed root
+ * fields with {@link extractAttenuation}), it NARROWS (never expands) the
+ * principal — see the engine's `evaluate({ attenuate })` for the restrict-only
+ * outcome-intersection.
+ *
+ * - `roles` — assume a SUBSET of the user's roles. `[]` = no roles (deny-all,
+ *   fail-closed); an OMITTED key = keep all the user's roles (attrs-only
+ *   narrowing); a role the user lacks is dropped by the intersection.
+ * - `attrs` — extra/overriding inputs to scope predicates, keyed by the target
+ *   user-attribute name, intended to narrow scopes. They are merged LOCALLY
+ *   into the credential pass only and clipped by the scope conjunction, so they
+ *   can never widen beyond the user.
+ */
+interface AoothArbacClaims {
+  roles?: string[];
+  attrs?: Record<string, unknown>;
+}
+/**
+ * Conjoin the full-authority scopes (`userScopes`, the ceiling) and the
+ * credential's narrowed scopes (`credScopes`) into ONE composite
+ * `ArbacDbScope`. A row/field/control is admitted only if BOTH passes admit
+ * it — the normative restrict-only clip that closes the attr-widen hole.
+ *
+ * Each side is first UNIONed with the existing additive helpers (today's
+ * machinery), then the two RESULTS are CONJOINED with the dedicated combiners
+ * ({@link conjoinScopeFilters} `$and`, {@link restrictProjection} field ∩,
+ * {@link intersectControlsPolicy} deny-wins, `with` recursion) — never the
+ * additive union helpers, which would silently widen.
+ *
+ * Returned as a single-element list so every downstream scope-application
+ * site (which UNIONs the cached scope list per facet) sees the identity of a
+ * one-element union — i.e. the conjunction — with no change to those sites.
+ */
+declare function conjoinArbacDbScopes(userScopes: ArbacDbScope[], credScopes: ArbacDbScope[]): ArbacDbScope[];
+//#endregion
+//#region src/user.provider.d.ts
+/**
+ * Abstract base class for providing user data required for ARBAC evaluations.
+ *
+ * Consumers must extend this class and implement the three abstract methods
+ * to plug their own authentication/identity layer into the ARBAC authorize
+ * interceptor. The subclass must re-apply `@Injectable()` (moost does not
+ * inherit decorator metadata) and be registered via Moost's
+ * `setReplaceRegistry` (or `@Replace`) so DI resolves the concrete provider.
+ *
+ * @template TUserAttrs - The type representing user attributes relevant to access control.
+ */
+declare abstract class ArbacUserProvider<TUserAttrs extends object = object> {
+  /**
+   * Retrieves the unique identifier of the current user.
+   */
+  abstract getUserId(): string | Promise<string>;
+  /**
+   * Retrieves the roles assigned to a user based on their ID.
+   *
+   * @param id - The user ID.
+   */
+  abstract getRoles(id: string): string[] | Promise<string[]>;
+  /**
+   * Retrieves the attributes associated with a user based on their ID.
+   *
+   * @param id - The user ID.
+   */
+  abstract getAttrs(id: string): TUserAttrs | Promise<TUserAttrs>;
+  /**
+   * OPTIONAL: source the credential's restrict-only ARBAC attenuation for the
+   * current request. When it returns claims, `useArbac().evaluate()` runs the
+   * engine's dual-pass outcome-intersection so the credential can do/see/affect
+   * strictly LESS than its owning user; returning `undefined` (the default —
+   * this method is unimplemented on the base/atscript providers) means "no
+   * narrowing", i.e. the credential authorizes with the user's full authority.
+   *
+   * `arbac-moost` is auth-agnostic, so the base class does NOT read the auth
+   * layer. A consumer wires it up by overriding this to read the credential's
+   * typed root fields and return their attenuation — typically
+   * `extractAttenuation(CredentialModel, useAuth().getAuthContext())`, which
+   * walks the model's `@arbac.attenuate.*`-annotated fields (from
+   * `@aooth/arbac-moost/atscript`). The restrict-only intersection happens in
+   * the engine regardless, so an app cannot get the safety wrong here.
+   */
+  getAttenuation?(): AoothArbacClaims | undefined | Promise<AoothArbacClaims | undefined>;
+}
+/**
+ * DI token form of {@link ArbacUserProvider}. The class itself is `abstract`,
+ * so it does not satisfy moost's `TClassConstructor` (`new (...) => T`)
+ * structurally; this re-typed alias is the supported way to pass the base
+ * class to `cc.instantiate(...)`, `createReplaceRegistry(...)`, `@Replace(...)`,
+ * etc. Runtime resolves to the concrete subclass registered via DI.
+ */
+declare const ArbacUserProviderToken: TClassConstructor<ArbacUserProvider>;
+//#endregion
+export { ArbacDbScope as a, enforceControlsPolicy as c, NavRelationKey as d, NavTarget as f, conjoinArbacDbScopes as i, extractUsedControlValues as l, ProjectionOf as m, ArbacUserProviderToken as n, AsArbacDbController as o, OwnFieldKey as p, AoothArbacClaims as r, applyAllowedFieldsAndSet as s, ArbacUserProvider as t, ControlsOf as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -42,8 +42,14 @@
       "types": "./dist/atscript/index.d.mts",
       "import": "./dist/atscript/index.mjs"
     },
-    "./atscript/models": "./src/atscript/models/user.as",
-    "./atscript/models.as": "./src/atscript/models/user.as",
+    "./atscript/models": {
+      "types": "./src/atscript/models/user.as.d.ts",
+      "default": "./src/atscript/models/user.as"
+    },
+    "./atscript/models.as": {
+      "types": "./src/atscript/models/user.as.d.ts",
+      "default": "./src/atscript/models/user.as"
+    },
     "./plugin": {
       "types": "./dist/plugin.d.mts",
       "import": "./dist/plugin.mjs"
@@ -54,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.6",
-    "@aooth/arbac-core": "0.1.6",
-    "@aooth/user": "0.1.6"
+    "@aooth/arbac": "0.1.8",
+    "@aooth/arbac-core": "0.1.8",
+    "@aooth/user": "0.1.8"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.64",
-    "@atscript/db": "^0.1.90",
-    "@atscript/db-sql-tools": "^0.1.90",
-    "@atscript/db-sqlite": "^0.1.90",
-    "@atscript/moost-db": "^0.1.90",
-    "@atscript/typescript": "^0.1.64",
-    "@moostjs/event-http": "^0.6.17",
+    "@atscript/core": "^0.1.69",
+    "@atscript/db": "^0.1.96",
+    "@atscript/db-sql-tools": "^0.1.96",
+    "@atscript/db-sqlite": "^0.1.96",
+    "@atscript/moost-db": "^0.1.96",
+    "@atscript/typescript": "^0.1.69",
+    "@moostjs/event-http": "^0.6.23",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.6",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.64"
+    "unplugin-atscript": "^0.1.69"
   },
   "peerDependencies": {
-    "@atscript/db": ">=0.1.79",
-    "@atscript/moost-db": ">=0.1.79",
-    "@atscript/typescript": ">=0.1.56",
-    "@moostjs/event-http": ">=0.6.10",
-    "@wooksjs/event-core": ">=0.7.12",
-    "@wooksjs/event-http": ">=0.7.12",
-    "moost": ">=0.6.10"
+    "@atscript/db": "^0.1.96",
+    "@atscript/moost-db": "^0.1.96",
+    "@atscript/typescript": "^0.1.69",
+    "@moostjs/event-http": "^0.6.23",
+    "@wooksjs/event-core": "^0.7.17",
+    "@wooksjs/event-http": "^0.7.17",
+    "moost": "^0.6.23"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {

package/dist/user-ChbLPYhG.mjs

@@ -1,15 +0,0 @@
-import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
-import "@aooth/user/atscript-db/model.as";
-//#region src/atscript/models/user.as
-var AoothArbacUserCredentials = class {
-	static __is_atscript_annotated_type = true;
-	static type = {};
-	static metadata = /* @__PURE__ */ new Map();
-	static id = "AoothArbacUserCredentials";
-	static toJsonSchema() {
-		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
-	}
-};
-defineAnnotatedType("object", AoothArbacUserCredentials).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("backupCodes", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
-//#endregion
-export { AoothArbacUserCredentials as t };

package/dist/user.provider-JpI5dD6Z.d.mts

@@ -1,42 +0,0 @@
-import { TClassConstructor } from "moost";
-
-//#region src/user.provider.d.ts
-/**
- * Abstract base class for providing user data required for ARBAC evaluations.
- *
- * Consumers must extend this class and implement the three abstract methods
- * to plug their own authentication/identity layer into the ARBAC authorize
- * interceptor. The subclass must re-apply `@Injectable()` (moost does not
- * inherit decorator metadata) and be registered via Moost's
- * `setReplaceRegistry` (or `@Replace`) so DI resolves the concrete provider.
- *
- * @template TUserAttrs - The type representing user attributes relevant to access control.
- */
-declare abstract class ArbacUserProvider<TUserAttrs extends object = object> {
-  /**
-   * Retrieves the unique identifier of the current user.
-   */
-  abstract getUserId(): string | Promise<string>;
-  /**
-   * Retrieves the roles assigned to a user based on their ID.
-   *
-   * @param id - The user ID.
-   */
-  abstract getRoles(id: string): string[] | Promise<string[]>;
-  /**
-   * Retrieves the attributes associated with a user based on their ID.
-   *
-   * @param id - The user ID.
-   */
-  abstract getAttrs(id: string): TUserAttrs | Promise<TUserAttrs>;
-}
-/**
- * DI token form of {@link ArbacUserProvider}. The class itself is `abstract`,
- * so it does not satisfy moost's `TClassConstructor` (`new (...) => T`)
- * structurally; this re-typed alias is the supported way to pass the base
- * class to `cc.instantiate(...)`, `createReplaceRegistry(...)`, `@Replace(...)`,
- * etc. Runtime resolves to the concrete subclass registered via DI.
- */
-declare const ArbacUserProviderToken: TClassConstructor<ArbacUserProvider>;
-//#endregion
-export { ArbacUserProviderToken as n, ArbacUserProvider as t };