@aooth/arbac-moost 0.1.66 → 0.1.68

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-B1f6ZI45.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-C5BrFNxg.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts

package/dist/index.d.mts

@@ -1,13 +1,22 @@
-import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-B1f6ZI45.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-C5BrFNxg.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { Mate, TMateParamMeta, TMoostMetadata } from "moost";
 import { ControlGate, TProjection } from "@aooth/arbac";
+import { TMetaResponse } from "@atscript/db";
 import { AsDbReadableController } from "@atscript/moost-db";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
-import { TMetaResponse } from "@atscript/db";
 //#region src/arbac.composables.d.ts
+/**
+ * The scopes cached for the current event (`undefined` before the authorize
+ * interceptor / `setScopes` ran). A direct slot read — no controller
+ * metadata resolution — for per-field hot paths like `hasField`; use
+ * {@link useArbac} for `evaluate` / `setScopes`.
+ *
+ * `TScope` is a caller-side type witness (see `evaluate` below).
+ */
+declare function getArbacScopes<TScope extends object>(ctx?: EventContext): TScope[] | undefined;
 interface ArbacBindings {
   getScopes: <TScope extends object>() => TScope[] | undefined;
   setScopes: <TScope extends object>(scope: TScope[] | undefined) => void;
@@ -129,11 +138,8 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
    */
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
   /**
-   * Scope-aware field-existence check — same contract as
-   * {@link AsArbacDbController.hasField} (BUG-3): a field outside the
-   * read-scope projection union answers `false`, so `validateInsights` rejects
-   * `$select` / filter / sort references to it with the identical
-   * `Unknown field "x"` 400 a nonexistent field gets.
+   * Scope-aware field visibility — same contract as
+   * {@link AsArbacDbController.hasField}.
    */
   protected hasField(path: string): boolean;
 }
@@ -159,7 +165,10 @@ declare function collectWithGrantNames(scopes: ArbacDbScope[]): ReadonlySet<stri
  * (or per `/meta` overlay) and threaded through the pruning walk.
  */
 interface MetaVisibility {
-  /** Constrained projection union (never the empty/universe projection). */
+  /**
+   * Projection union for this level's own fields. `{}` (the universe) means
+   * unrestricted — possible when only a `with` sub-scope restricts anything.
+   */
   allowed: TProjection;
   /**
    * Identifier fields reads ALWAYS return regardless of projection (the read
@@ -169,6 +178,25 @@ interface MetaVisibility {
   alwaysVisible: ReadonlySet<string>;
   /** Relation names granted via `with.<name>` (see {@link collectWithGrantNames}). */
   withGrants: ReadonlySet<string>;
+  /**
+   * Visibility of a `with`-granted relation's JOINED fields, built from the
+   * union of its `with.<name>` sub-scopes (with the related table's own
+   * identifiers always visible). A path `rel.x.y` is checked as `x.y`
+   * against it, recursively for nested relations. The scope-driven builders
+   * ({@link buildScopeVisibility}) always supply it; a hand-built visibility
+   * without it lets granted paths through unchecked (legacy behavior).
+   */
+  relation?: (name: string) => MetaVisibility | undefined;
+  /**
+   * Precompiled `isFieldAllowed(path, allowed)`. Supplied by
+   * {@link buildScopeVisibility}; a hand-built visibility falls back to
+   * `isFieldAllowed`.
+   */
+  isAllowed?: (path: string) => boolean;
+  /** The scopes this level was built from (set by {@link buildScopeVisibility}). */
+  scopes?: ArbacDbScope[];
+  /** The table this level describes, when known (set by {@link buildScopeVisibility}). */
+  table?: VisibilityTableSource;
   /**
    * Fields the principal's WRITE scopes allow (union of `allowedFields`, or
    * `"all"` for an unrestricted write grant). A field that is writable but not
@@ -187,10 +215,12 @@ interface MetaVisibility {
  */
 declare function collectWritableFields(scopes: ArbacDbScope[], unrestricted: boolean): ReadonlySet<string> | "all" | undefined;
 /**
- * Whether a flattened dot-path field exists for this principal. A path under
- * a `with`-granted relation passes unconditionally — the sub-scope governs
- * the joined content, and rejecting the path here would break the very `$with`
- * expansion the grant permits.
+ * Whether a flattened dot-path field exists for this principal. A
+ * `with`-granted relation itself is always visible (the grant implies it);
+ * a path UNDER it (`rel.x.y`) is checked as `x.y` against the relation's
+ * sub-scope visibility ({@link MetaVisibility.relation}) — so a field the
+ * sub-scope hides is as unknown in a `$with` sub-query as a top-level hidden
+ * column is in the main query (no filter/sort value oracle).
  */
 declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
 /**
@@ -201,8 +231,9 @@ declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
  *
  * - `fields` — the flat capability map (sortable/filterable flags).
  * - `type` — the serialized annotated type (what dynamic clients build
- *   tables/forms from); nested object props prune by dot-path, relation props
- *   survive whole when the relation itself is visible.
+ *   tables/forms from); nested object props prune by dot-path. A relation
+ *   prop visible through the projection survives whole; a `with`-granted
+ *   one is pruned by its sub-scope (recursively), matching `hasField`.
  * - `relations` — entries neither projected nor `with`-granted.
  * - `versionColumn` — dropped when the OCC column itself is hidden.
  *
@@ -210,19 +241,59 @@ declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
  * (`applyMetaOverlay` contract); every pruned branch is a fresh object.
  */
 declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility): TMetaResponse;
+/**
+ * The slice of an atscript-db readable (table / view) the visibility walk
+ * reads — a moost-db controller's `this.readable` satisfies it: identifiers
+ * (always visible), nav relations (to reach the joined table) and the
+ * flattened schema (to split `$select` parents by scope).
+ */
+interface VisibilityTableSource {
+  primaryKeys: readonly string[];
+  preferredId: readonly string[];
+  relations?: ReadonlyMap<string, unknown>;
+  /**
+   * The target table of nav relation `navField` (atscript-db's
+   * `readable.relatedTable`); absent / `undefined` → the joined table's
+   * identifiers are not exempted.
+   */
+  relatedTable?(navField: string): VisibilityTableSource | undefined;
+  /** Flattened schema (dot-paths) — used to split `$select` parents by scope. */
+  flatMap?: ReadonlyMap<string, unknown>;
+  /** Navigation field paths — their joined descendants are not own columns. */
+  navFields?: ReadonlySet<string>;
+}
+/**
+ * Build the {@link MetaVisibility} a set of read scopes implies — the single
+ * structure behind `hasField`, `/meta` pruning, `$select` value stripping
+ * and the `$with` overlay, so they cannot drift. Own fields: the projection
+ * union (`{}` when unrestricted), precompiled into `isAllowed`. A
+ * `with`-granted relation: a lazily built (memoized) child visibility over
+ * the union of its `with.<name>` sub-scopes — the same sub-scopes joined rows
+ * are stripped with — whose `alwaysVisible` is the related table's own PK /
+ * `preferredId` (reached through `table.relatedTable`; without it, no
+ * related identifier is exempt).
+ *
+ * @param alwaysVisible - identifiers exempt from the projection; defaults to
+ *   the table's PK + `preferredId`
+ */
+declare function buildScopeVisibility(scopes: ArbacDbScope[], table: VisibilityTableSource | undefined, alwaysVisible?: ReadonlySet<string>): MetaVisibility;
 /**
  * Shared body of both ARBAC controllers' `hasField` overrides (BUG-3 twin of
- * the `/meta` pruning): a field outside the read-scope projection union must
- * be indistinguishable from a field that does not exist. Returns `true` when
- * the scopes impose no projection restriction.
+ * the `/meta` pruning): a field outside the read-scope projection union —
+ * or, for a `rel.x` path under a `with`-granted relation, outside that
+ * relation's sub-scope union — must be indistinguishable from a field that
+ * does not exist. Returns `true` when there are no scopes (unscoped grant).
+ *
+ * @param source - the controller's `this.readable`; an identifier set (the
+ *   0.1.67 signature) still works, without related-table identifiers
  */
-declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, alwaysVisible: ReadonlySet<string>): boolean;
+declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, source: VisibilityTableSource | ReadonlySet<string>): boolean;
 /**
  * PK + `preferredId` for a controller's table/readable — the
- * {@link MetaVisibility.alwaysVisible} set both `applyMetaOverlay` and
- * `hasField` pass into the visibility checks.
+ * {@link MetaVisibility.alwaysVisible} set. Kept for compatibility: the
+ * controllers now pass `this.readable` and it is derived there.
  */
-declare function metaAlwaysVisibleFields(controller: object, source: {
+declare function metaAlwaysVisibleFields(_controller: object, source: {
   primaryKeys: readonly string[];
   preferredId: readonly string[];
 }): ReadonlySet<string>;
@@ -242,11 +313,14 @@ declare function metaAlwaysVisibleFields(controller: object, source: {
  * universe, no pruning (unchanged behavior for unscoped roles). No read op
  * allowed → the projection union is empty → no pruning: `crud` already
  * advertises no read surface, and write-only principals still need `type`
- * for their insert/update forms. `alwaysVisible` (PK + preferredId) is never
- * pruned — reads always return those fields (projection widening / id
- * addressing).
+ * for their insert/update forms. PK + `preferredId` are never pruned —
+ * reads always return those fields (projection widening / id addressing).
+ *
+ * @param source - the controller's `this.readable` (identifiers and related
+ *   tables are derived from it); an identifier set (the 0.1.67 signature)
+ *   still works, without related-table identifiers
  */
-declare function applyArbacMetaOverlay(meta: TMetaResponse, alwaysVisible: ReadonlySet<string>): Promise<TMetaResponse>;
+declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTableSource | ReadonlySet<string>): Promise<TMetaResponse>;
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.
@@ -275,4 +349,4 @@ declare function collectMethodNames(instance: object): string[];
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, type MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, type VisibilityTableSource, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, buildScopeVisibility, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/index.mjs

@@ -3,7 +3,8 @@ import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core"
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { current, key } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
-import { conjoinScopeFilters, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
+import { DENY_FILTER, conjoinScopeFilters, expandExcludeToLeaves, getProjectionMode, intersectControlsPolicy, intersectProjections, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
+import { findAncestorInSet } from "@atscript/db";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
 import { groupByFields } from "@uniqu/core";
 //#region src/attenuation.ts
@@ -15,17 +16,29 @@ import { groupByFields } from "@uniqu/core";
 *
 * Each side is first UNIONed with the existing additive helpers (today's
 * machinery), then the two RESULTS are CONJOINED with the dedicated combiners
-* ({@link conjoinScopeFilters} `$and`, {@link restrictProjection} field ∩,
+* ({@link conjoinScopeFilters} `$and`, {@link intersectProjections} field ∩,
 * {@link intersectControlsPolicy} deny-wins, `with` recursion) — never the
 * additive union helpers, which would silently widen.
 *
 * Returned as a single-element list so every downstream scope-application
 * site (which UNIONs the cached scope list per facet) sees the identity of a
 * one-element union — i.e. the conjunction — with no change to those sites.
+*
+* The projection conjunction is path-wise and never wider than either side
+* (`{a:1}` ∩ `{"a.b":1}` → `{"a.b":1}`). A nested exclusion under an
+* included parent (`{a:1}` ∩ `{"a.c":0}`) is subtracted exactly via
+* `childrenOf` (the table schema); without it the parent is dropped (fail
+* closed). When NO field survives (`{a:1}` ∩ `{a:0}`, disjoint whitelists),
+* the composite keeps the user's projection and gets a match-nothing filter —
+* an empty field set must never read as the unrestricted `{}`. `with`
+* sub-scopes are conjoined without a schema.
 */
-function conjoinArbacDbScopes(userScopes, credScopes) {
-	const filter = conjoinScopeFilters(mergeScopeFilters(userScopes.map((s) => s.filter ?? {})), mergeScopeFilters(credScopes.map((s) => s.filter ?? {})));
-	const projection = restrictProjection(unionProjections(...userScopes.map((s) => s.projection ?? {})), unionProjections(...credScopes.map((s) => s.projection ?? {})));
+function conjoinArbacDbScopes(userScopes, credScopes, childrenOf) {
+	const userProjection = unionProjections(...userScopes.map((s) => s.projection ?? {}));
+	const intersected = intersectProjections(userProjection, unionProjections(...credScopes.map((s) => s.projection ?? {})), childrenOf);
+	const projection = intersected ?? userProjection;
+	const credFilter = mergeScopeFilters(credScopes.map((s) => s.filter ?? {}));
+	const filter = conjoinScopeFilters(mergeScopeFilters(userScopes.map((s) => s.filter ?? {})), intersected ? credFilter : conjoinScopeFilters(credFilter, DENY_FILTER));
 	const controls = intersectControlsPolicy(unionControlsPolicy(userScopes), unionControlsPolicy(credScopes));
 	const allowedFields = intersectAllowedFields(userScopes, credScopes);
 	const set = combineSet(userScopes, credScopes);
@@ -98,6 +111,34 @@ function conjoinWith(userScopes, credScopes) {
 	return out;
 }
 //#endregion
+//#region src/db/field-children.ts
+const fieldChildrenCache = /* @__PURE__ */ new WeakMap();
+/**
+* The `TProjectionChildren` schema lookup for a table (its own `flatMap` paths —
+* navigation descendants excluded, they are joined rows, not columns);
+* `undefined` when the table exposes no flattened schema.
+*/
+function fieldChildrenOf(table) {
+	if (!table?.flatMap) return void 0;
+	let lookup = fieldChildrenCache.get(table);
+	if (!lookup) {
+		const nav = table.navFields ?? new Set(table.relations?.keys());
+		const byParent = /* @__PURE__ */ new Map();
+		for (const path of table.flatMap.keys()) {
+			const dot = path.lastIndexOf(".");
+			if (dot === -1) continue;
+			const parent = path.slice(0, dot);
+			if (nav.has(parent) || findAncestorInSet(parent, nav) !== void 0) continue;
+			const list = byParent.get(parent);
+			if (list) list.push(path);
+			else byParent.set(parent, [path]);
+		}
+		lookup = (path) => byParent.get(path) ?? [];
+		fieldChildrenCache.set(table, lookup);
+	}
+	return lookup;
+}
+//#endregion
 //#region src/moost-arbac.ts
 let MoostArbac = class MoostArbac extends Arbac$1 {};
 MoostArbac = __decorate([Injectable()], MoostArbac);
@@ -112,6 +153,18 @@ MoostArbac = __decorate([Injectable()], MoostArbac);
 */
 const arbacScopesKey = key("arbac.scopes");
 /**
+* The scopes cached for the current event (`undefined` before the authorize
+* interceptor / `setScopes` ran). A direct slot read — no controller
+* metadata resolution — for per-field hot paths like `hasField`; use
+* {@link useArbac} for `evaluate` / `setScopes`.
+*
+* `TScope` is a caller-side type witness (see `evaluate` below).
+*/
+function getArbacScopes(ctx) {
+	const c = ctx ?? current();
+	return c.has(arbacScopesKey) ? c.get(arbacScopesKey) : void 0;
+}
+/**
 * Composable for ARBAC utilities within Moost handlers and interceptors.
 *
 * Exposes scope read/write, lazy `evaluate`, and the resolved
@@ -129,7 +182,7 @@ const arbacScopesKey = key("arbac.scopes");
 const useArbac = (_ctx) => {
 	const ctx = _ctx ?? current();
 	const cc = useControllerContext(ctx);
-	const getScopes = () => ctx.has(arbacScopesKey) ? ctx.get(arbacScopesKey) : void 0;
+	const getScopes = () => getArbacScopes(ctx);
 	const setScopes = (scope) => {
 		ctx.set(arbacScopesKey, scope);
 	};
@@ -161,7 +214,7 @@ const useArbac = (_ctx) => {
 		});
 		if (result.allowed && result.credScopes !== void 0) return {
 			allowed: true,
-			scopes: conjoinArbacDbScopes(result.scopes ?? [], result.credScopes),
+			scopes: conjoinArbacDbScopes(result.scopes ?? [], result.credScopes, fieldChildrenOf(cc.getController()?.readable)),
 			userId
 		};
 		return {
@@ -267,11 +320,7 @@ function collectWithGrantNames(scopes) {
 /** Exact-or-ancestor membership: `credit.credentials.user` matches a `credit.credentials` grant. */
 function isPathWritable(path, writable) {
 	if (!writable) return false;
-	if (writable === "all") return true;
-	if (writable.has(path)) return true;
-	let pos = path.length;
-	while ((pos = path.lastIndexOf(".", pos - 1)) !== -1) if (writable.has(path.slice(0, pos))) return true;
-	return false;
+	return writable === "all" || hasSelfOrAncestor(writable, path);
 }
 /**
 * Union of write-scope `allowedFields`; `"all"` for field-unrestricted write
@@ -292,17 +341,23 @@ function collectWritableFields(scopes, unrestricted) {
 	return out.size > 0 ? out : void 0;
 }
 /**
-* Whether a flattened dot-path field exists for this principal. A path under
-* a `with`-granted relation passes unconditionally — the sub-scope governs
-* the joined content, and rejecting the path here would break the very `$with`
-* expansion the grant permits.
+* Whether a flattened dot-path field exists for this principal. A
+* `with`-granted relation itself is always visible (the grant implies it);
+* a path UNDER it (`rel.x.y`) is checked as `x.y` against the relation's
+* sub-scope visibility ({@link MetaVisibility.relation}) — so a field the
+* sub-scope hides is as unknown in a `$with` sub-query as a top-level hidden
+* column is in the main query (no filter/sort value oracle).
 */
 function isMetaFieldVisible(path, vis) {
 	if (vis.alwaysVisible.has(path)) return true;
 	const dot = path.indexOf(".");
 	const head = dot === -1 ? path : path.slice(0, dot);
-	if (vis.withGrants.has(head)) return true;
-	return isFieldAllowed(path, vis.allowed);
+	if (vis.withGrants.has(head)) {
+		if (dot === -1) return true;
+		const sub = vis.relation?.(head);
+		return sub ? isMetaFieldVisible(path.slice(dot + 1), sub) : true;
+	}
+	return vis.isAllowed ? vis.isAllowed(path) : isFieldAllowed(path, vis.allowed);
 }
 /**
 * Prune a `/meta` envelope down to the fields the principal's read scopes can
@@ -312,8 +367,9 @@ function isMetaFieldVisible(path, vis) {
 *
 * - `fields` — the flat capability map (sortable/filterable flags).
 * - `type` — the serialized annotated type (what dynamic clients build
-*   tables/forms from); nested object props prune by dot-path, relation props
-*   survive whole when the relation itself is visible.
+*   tables/forms from); nested object props prune by dot-path. A relation
+*   prop visible through the projection survives whole; a `with`-granted
+*   one is pruned by its sub-scope (recursively), matching `hasField`.
 * - `relations` — entries neither projected nor `with`-granted.
 * - `versionColumn` — dropped when the OCC column itself is hidden.
 *
@@ -342,12 +398,13 @@ function pruneMetaByVisibility(meta, vis) {
 }
 /**
 * Copy-on-prune walk over a serialized type node. `basePath` is the flattened
-* dot-path prefix ("" at the root). Top-level relation props (nav props named
-* in `meta.relations`) are kept or dropped WHOLE — their internal shape is the
-* joined model's business (content scoping happens per-request through the
-* `with` sub-scopes), while own-field subtrees prune recursively so an
-* include-mode union like `{ "password.hash": 1 }` keeps `password` with only
-* `hash` inside.
+* dot-path prefix ("" at the root). Relation props (nav props named in
+* `meta.relations` at the root, or carrying a `db.rel.*` annotation inside a
+* joined type) are dropped when invisible; a `with`-granted one is pruned by
+* its sub-scope visibility (the same one `hasField` checks `rel.x` paths
+* against), any other visible one survives whole. Own-field subtrees prune
+* recursively so an include-mode union like `{ "password.hash": 1 }` keeps
+* `password` with only `hash` inside.
 */
 function pruneSerializedType(node, basePath, vis, relationNames) {
 	const def = node.type;
@@ -355,8 +412,10 @@ function pruneSerializedType(node, basePath, vis, relationNames) {
 		const props = {};
 		for (const [name, prop] of Object.entries(def.props)) {
 			const path = basePath ? `${basePath}.${name}` : name;
-			if (basePath === "" && relationNames.has(name)) {
-				if (isMetaFieldVisible(name, vis)) props[name] = prop;
+			if (basePath === "" && (relationNames.has(name) || isNavProp(prop))) {
+				if (!isMetaFieldVisible(name, vis)) continue;
+				const sub = vis.withGrants.has(name) ? vis.relation?.(name) : void 0;
+				props[name] = sub ? pruneSerializedType(prop, "", sub, NO_NAMES) : prop;
 				continue;
 			}
 			if (!isMetaFieldVisible(path, vis)) {
@@ -395,52 +454,137 @@ function pruneSerializedType(node, basePath, vis, relationNames) {
 	};
 	return node;
 }
-const UNRESTRICTED_VISIBILITY = {
-	allowed: void 0,
-	withGrants: /* @__PURE__ */ new Set()
-};
+const NO_NAMES = /* @__PURE__ */ new Set();
+/** A nav prop inside a joined type: atscript-db stamps `db.rel.to` / `from` / `via`. */
+function isNavProp(prop) {
+	const meta = prop.metadata;
+	return !!meta && ("db.rel.to" in meta || "db.rel.from" in meta || "db.rel.via" in meta);
+}
+const identifierSetCache = /* @__PURE__ */ new WeakMap();
+/** PK + `preferredId` of a table — the identifiers reads always return. */
+function identifierSet(table) {
+	if (!table) return NO_NAMES;
+	let set = identifierSetCache.get(table);
+	if (!set) {
+		set = /* @__PURE__ */ new Set([...table.primaryKeys, ...table.preferredId]);
+		identifierSetCache.set(table, set);
+	}
+	return set;
+}
+/** Pick `scopes[i].with?.[name]`, dropping undefined (silence wins when empty). */
+function collectSubScopes(scopes, name) {
+	const out = [];
+	for (const s of scopes) {
+		const sub = s.with?.[name];
+		if (sub) out.push(sub);
+	}
+	return out;
+}
+/** `path` or one of its ancestors is in `set`. */
+function hasSelfOrAncestor(set, path) {
+	return set.has(path) || findAncestorInSet(path, set) !== void 0;
+}
+/**
+* Precompiled {@link isFieldAllowed} for one projection: `hasField` asks it
+* for every referenced path, so the mode and key sets are computed once.
+* Inclusion: the path, an ancestor, or a descendant is listed. Exclusion: no
+* listed key is the path or an ancestor.
+*/
+function compileProjection(projection) {
+	const keys = Object.keys(projection);
+	if (keys.length === 0) return () => true;
+	const listed = new Set(keys);
+	if (getProjectionMode(projection) === "exclude") return (path) => !hasSelfOrAncestor(listed, path);
+	const parents = /* @__PURE__ */ new Set();
+	for (const key of keys) {
+		let pos = key.length;
+		while ((pos = key.lastIndexOf(".", pos - 1)) !== -1) parents.add(key.slice(0, pos));
+	}
+	return (path) => parents.has(path) || hasSelfOrAncestor(listed, path);
+}
+/**
+* Build the {@link MetaVisibility} a set of read scopes implies — the single
+* structure behind `hasField`, `/meta` pruning, `$select` value stripping
+* and the `$with` overlay, so they cannot drift. Own fields: the projection
+* union (`{}` when unrestricted), precompiled into `isAllowed`. A
+* `with`-granted relation: a lazily built (memoized) child visibility over
+* the union of its `with.<name>` sub-scopes — the same sub-scopes joined rows
+* are stripped with — whose `alwaysVisible` is the related table's own PK /
+* `preferredId` (reached through `table.relatedTable`; without it, no
+* related identifier is exempt).
+*
+* @param alwaysVisible - identifiers exempt from the projection; defaults to
+*   the table's PK + `preferredId`
+*/
+function buildScopeVisibility(scopes, table, alwaysVisible = identifierSet(table)) {
+	const withGrants = collectWithGrantNames(scopes);
+	const allowed = unionScopeProjection(scopes) ?? {};
+	const children = /* @__PURE__ */ new Map();
+	return {
+		allowed,
+		alwaysVisible,
+		withGrants,
+		scopes,
+		table,
+		isAllowed: compileProjection(allowed),
+		relation(name) {
+			if (!withGrants.has(name)) return void 0;
+			let child = children.get(name);
+			if (!child) {
+				child = buildScopeVisibility(collectSubScopes(scopes, name), table?.relatedTable?.(name));
+				children.set(name, child);
+			}
+			return child;
+		}
+	};
+}
 const scopeVisibilityCache = /* @__PURE__ */ new WeakMap();
-function scopeVisibility(scopes) {
-	if (scopes.length === 0) return UNRESTRICTED_VISIBILITY;
-	let vis = scopeVisibilityCache.get(scopes);
+const NO_TABLE = {
+	primaryKeys: [],
+	preferredId: []
+};
+/** `source` is an identifier set (the 0.1.67 signatures), not a readable. */
+function isIdentifierSet(source) {
+	return !("primaryKeys" in source);
+}
+/**
+* The event-cached {@link MetaVisibility} for `scopes` over `source` (a
+* readable, or an `alwaysVisible` identifier set).
+*/
+function scopeVisibility(scopes, source = NO_TABLE) {
+	let perSource = scopeVisibilityCache.get(scopes);
+	if (!perSource) {
+		perSource = /* @__PURE__ */ new WeakMap();
+		scopeVisibilityCache.set(scopes, perSource);
+	}
+	let vis = perSource.get(source);
 	if (!vis) {
-		vis = {
-			allowed: unionScopeProjection(scopes),
-			withGrants: collectWithGrantNames(scopes)
-		};
-		scopeVisibilityCache.set(scopes, vis);
+		vis = isIdentifierSet(source) ? buildScopeVisibility(scopes, void 0, source) : buildScopeVisibility(scopes, source === NO_TABLE ? void 0 : source);
+		perSource.set(source, vis);
 	}
 	return vis;
 }
 /**
 * Shared body of both ARBAC controllers' `hasField` overrides (BUG-3 twin of
-* the `/meta` pruning): a field outside the read-scope projection union must
-* be indistinguishable from a field that does not exist. Returns `true` when
-* the scopes impose no projection restriction.
-*/
-function isScopedFieldVisible(scopes, path, alwaysVisible) {
-	const { allowed, withGrants } = scopeVisibility(scopes);
-	if (!allowed) return true;
-	return isMetaFieldVisible(path, {
-		allowed,
-		alwaysVisible,
-		withGrants
-	});
+* the `/meta` pruning): a field outside the read-scope projection union —
+* or, for a `rel.x` path under a `with`-granted relation, outside that
+* relation's sub-scope union — must be indistinguishable from a field that
+* does not exist. Returns `true` when there are no scopes (unscoped grant).
+*
+* @param source - the controller's `this.readable`; an identifier set (the
+*   0.1.67 signature) still works, without related-table identifiers
+*/
+function isScopedFieldVisible(scopes, path, source) {
+	if (scopes.length === 0) return true;
+	return isMetaFieldVisible(path, scopeVisibility(scopes, source));
 }
-const alwaysVisibleFieldsCache = /* @__PURE__ */ new WeakMap();
 /**
 * PK + `preferredId` for a controller's table/readable — the
-* {@link MetaVisibility.alwaysVisible} set both `applyMetaOverlay` and
-* `hasField` pass into the visibility checks.
+* {@link MetaVisibility.alwaysVisible} set. Kept for compatibility: the
+* controllers now pass `this.readable` and it is derived there.
 */
-function metaAlwaysVisibleFields(controller, source) {
-	const ctor = controller.constructor;
-	let set = alwaysVisibleFieldsCache.get(ctor);
-	if (!set) {
-		set = /* @__PURE__ */ new Set([...source.primaryKeys, ...source.preferredId]);
-		alwaysVisibleFieldsCache.set(ctor, set);
-	}
-	return set;
+function metaAlwaysVisibleFields(_controller, source) {
+	return identifierSet(source);
 }
 /**
 * The write CRUD ops. Everything else in `meta.crud` is row-returning read
@@ -471,11 +615,14 @@ const WRITE_CRUD_OPS = /* @__PURE__ */ new Set([
 * universe, no pruning (unchanged behavior for unscoped roles). No read op
 * allowed → the projection union is empty → no pruning: `crud` already
 * advertises no read surface, and write-only principals still need `type`
-* for their insert/update forms. `alwaysVisible` (PK + preferredId) is never
-* pruned — reads always return those fields (projection widening / id
-* addressing).
+* for their insert/update forms. PK + `preferredId` are never pruned —
+* reads always return those fields (projection widening / id addressing).
+*
+* @param source - the controller's `this.readable` (identifiers and related
+*   tables are derived from it); an identifier set (the 0.1.67 signature)
+*   still works, without related-table identifiers
 */
-async function applyArbacMetaOverlay(meta, alwaysVisible) {
+async function applyArbacMetaOverlay(meta, source) {
 	const arbac = useArbac();
 	const actionToMethodMeta = collectActionMetaByName();
 	const crudKeys = Object.keys(meta.crud);
@@ -508,12 +655,10 @@ async function applyArbacMetaOverlay(meta, alwaysVisible) {
 		if (!scopes || scopes.length === 0) readUnrestricted = true;
 		else readScopes.push(...scopes);
 	}
-	if (!readUnrestricted) {
-		const allowed = unionScopeProjection(readScopes);
-		if (allowed) overlaid = pruneMetaByVisibility(overlaid, {
-			allowed,
-			alwaysVisible,
-			withGrants: collectWithGrantNames(readScopes),
+	if (!readUnrestricted && readScopes.length > 0) {
+		const vis = isIdentifierSet(source) ? buildScopeVisibility(readScopes, void 0, source) : buildScopeVisibility(readScopes, source);
+		if (Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0) overlaid = pruneMetaByVisibility(overlaid, {
+			...vis,
 			writable: collectWritableFields(writeScopes, writeUnrestricted)
 		});
 	}
@@ -568,11 +713,13 @@ function collectMethodNames(instance) {
 }
 //#endregion
 //#region src/db/shared-read-helpers.ts
-/** Filter that matches no rows; used when ARBAC denies the request. */
-const DENY_FILTER = { $or: [] };
-/** Single point of access to the per-event scope cache. */
+/**
+* Single point of access to the per-event scope cache. Reads the slot
+* directly — `hasField` calls this per referenced path, and `useArbac()`
+* would resolve controller metadata on every call.
+*/
 function readCachedScopes() {
-	return useArbac().getScopes() ?? [];
+	return getArbacScopes() ?? [];
 }
 /**
 * Full body of `transformFilter` for both ARBAC DB controllers: evaluate
@@ -594,16 +741,34 @@ async function transformArbacFilter(filter) {
 	return conjoinScopeFilters(mergeScopeFilters((scopes ?? []).map((s) => s.filter ?? {})), filter) ?? {};
 }
 /**
-* Union the per-scope `projection` whitelists and restrict the user-supplied
-* projection to that union. Returns the original projection untouched when
-* no scope declares a projection (so caller sees the unrestricted shape).
-* Uses the same `unionScopeProjection` the field-visibility seams (`hasField`
-* / `/meta` pruning) use, so value stripping and name hiding cannot drift.
+* Restrict the user-supplied `$select` to the scopes' projection union.
+* Returns the original projection untouched when no scope declares a
+* projection (so caller sees the unrestricted shape). Reads the same cached
+* visibility (`vis.allowed`) `hasField` / `/meta` pruning use, so value
+* stripping and name hiding cannot drift.
+*
+* `projection` is the `$select` as moost-db parsed it: an inclusion is an
+* ARRAY of names, an exclusion an object — both are normalized first. A
+* requested parent (`$select=a`) narrows to what the scope shows: to the
+* whitelisted descendants (`a.b: 1`), or — for a hidden descendant
+* (`a.c: 0`) — to its visible children via `childrenOf` (without a schema
+* the parent is dropped). Never the whole object, and never the empty
+* (universe) projection: when nothing survives, the scope's own projection
+* applies (`restrictProjection`'s ceiling fallback).
+*
+* An exclusion result names nested-object parents by their leaves
+* (`{ a: 0 }` → `{ "a.b": 0, "a.c": 0 }`): flattening adapters invert an
+* exclusion against their leaf columns, so a parent key alone would strip
+* nothing (a scope `{ a: 0 }` would otherwise return all of `a`).
 */
-function applyArbacProjection(projection, scopes) {
-	const allowed = unionScopeProjection(scopes);
-	if (!allowed) return projection;
-	return restrictProjection(projection ?? {}, allowed);
+function applyArbacProjection(projection, scopes, readable) {
+	return restrictSelect(projection, scopeVisibility(scopes, readable));
+}
+/** {@link applyArbacProjection} over an already-built visibility level. */
+function restrictSelect(projection, vis) {
+	if (Object.keys(vis.allowed).length === 0) return projection;
+	const childrenOf = fieldChildrenOf(vis.table);
+	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
 }
 /**
 * Enforce the union of per-scope `controls` gates against the parsed
@@ -625,43 +790,43 @@ function applyArbacControls(controls, scopes) {
 * passes through unchanged. The outermost check skips the entire walk when no
 * scope declares `with` at all — this is the common case on every read.
 */
-function applyArbacRelationScopes(controls, scopes) {
+function applyArbacRelationScopes(controls, scopes, readable) {
 	if (scopes.length === 0) return;
+	if (!scopes.some((s) => s.with)) return;
+	applyRelationLevel(controls, scopeVisibility(scopes, readable));
+}
+/**
+* One `$with` level of {@link applyArbacRelationScopes}: each granted
+* relation's child visibility already carries its sub-scopes and target table.
+*/
+function applyRelationLevel(controls, vis) {
 	const withArr = controls.$with;
 	if (!Array.isArray(withArr) || withArr.length === 0) return;
-	if (!scopes.some((s) => s.with)) return;
 	for (const raw of withArr) {
 		if (!raw || typeof raw !== "object") continue;
 		const entry = raw;
 		if (typeof entry.name !== "string") continue;
-		const subScopes = collectSubScopes(scopes, entry.name);
-		if (subScopes.length === 0) continue;
+		const child = vis.relation?.(entry.name);
+		const subScopes = child?.scopes ?? [];
+		if (!child || subScopes.length === 0) continue;
 		const conjoined = conjoinScopeFilters(mergeScopeFilters(subScopes.map((s) => s.filter ?? {})), entry.filter);
 		if (conjoined) entry.filter = conjoined;
 		const entryControls = entry.controls ?? {};
-		const restricted = applyArbacProjection(normalizeSelect(entryControls.$select), subScopes);
+		const restricted = restrictSelect(entryControls.$select, child);
 		if (restricted !== void 0) {
 			entryControls.$select = restricted;
 			entry.controls = entryControls;
 		}
 		enforceControlsPolicy(unionControlsPolicy(subScopes), entryControls);
-		applyArbacRelationScopes(entryControls, subScopes);
+		if (subScopes.some((s) => s.with)) applyRelationLevel(entryControls, child);
 	}
 }
-/** Pick `scopes[i].with?.[name]`, dropping undefined. */
-function collectSubScopes(scopes, name) {
-	const out = [];
-	for (const s of scopes) {
-		const sub = s.with?.[name];
-		if (sub) out.push(sub);
-	}
-	return out;
-}
 /**
 * `$select` may be an array of field names (uniquery inclusion list) or a
-* `TProjection` object. `applyArbacProjection` / `restrictProjection` operate
-* on the object form, so normalize the array to `{ field: 1 }` first. Returns
-* undefined if the input is empty (caller treats as "no projection set").
+* `TProjection` object. `restrictProjection` operates on the object form
+* (it would read `["a"]` as an exclusion keyed `"0"`), so normalize the array
+* to `{ field: 1 }` first. Returns undefined if the input is empty (caller
+* treats as "no projection set").
 */
 function normalizeSelect(value) {
 	if (value === void 0 || value === null) return void 0;
@@ -679,7 +844,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return transformArbacFilter(filter);
 	}
 	transformProjection(projection) {
-		return applyArbacProjection(projection, readCachedScopes());
+		return applyArbacProjection(projection, readCachedScopes(), this.readable);
 	}
 	/**
 	* Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
@@ -717,9 +882,9 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	* controls of a request. Runs after the base validator (which checks the
 	* controls DTO shape) and BEFORE the query/aggregation pipeline executes.
 	*
-	* `transformFilter` runs first on every read endpoint and caches the
-	* evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-	* directly here without re-evaluating ARBAC.
+	* Reads the scopes the route-level authorize interceptor cached via
+	* `arbac.setScopes(...)` — validation runs before `transformFilter`, so
+	* this hook never re-evaluates ARBAC.
 	*
 	* On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
 	* `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
@@ -730,27 +895,24 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		if (baseErr) return baseErr;
 		const scopes = readCachedScopes();
 		applyArbacControls(controls, scopes);
-		applyArbacRelationScopes(controls, scopes);
+		applyArbacRelationScopes(controls, scopes, this.readable);
 	}
 	applyMetaOverlay(meta) {
-		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
+		return applyArbacMetaOverlay(meta, this.readable);
 	}
 	/**
-	* Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
-	* above): a field outside the read-scope projection union must be
-	* indistinguishable from a field that does not exist. The base controller's
-	* ONLY call site is `validateInsights`, which turns a `false` here into the
-	* same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
-	* `$select`, filter, and sort references to a hidden field cannot be used
-	* as an existence/value oracle. Identifier fields stay visible (reads
-	* always return them — see {@link MetaVisibility.alwaysVisible}), and paths
-	* under a `with`-granted relation pass through to the sub-scope's own
-	* enforcement. Scopes were cached by the route-level authorize interceptor
-	* before validation runs (`useArbac` setScopes), so the union reflects the
-	* exact action being executed.
+	* Scope-aware field visibility (BUG-3 twin of the `/meta` pruning above): a
+	* field outside the read-scope projection union answers `false`, which
+	* moost-db's visibility hook turns into the same `Unknown field "x"` 400 a
+	* nonexistent field gets at every gated query position — see the docs'
+	* "Column-scope security floor". Identifiers stay visible. A `rel.x` path
+	* under a `with`-granted relation (`$with=rel(x>1)`, `$with=rel($sort=x)`,
+	* `$with=rel($select=x)`) is checked as `x` against the union of the
+	* `with.rel` sub-scopes, recursively; the related table's own PK /
+	* `preferredId` stay visible.
 	*/
 	hasField(path) {
-		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));
+		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, this.readable);
 	}
 	async onWrite(action, data) {
 		const scopes = readCachedScopes();
@@ -765,7 +927,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		const scopeFilter = mergeScopeFilters(scopes.map((s) => s.filter ?? {}));
 		if (!scopeFilter) return;
 		const ids = Array.isArray(idOrIds) ? idOrIds : [idOrIds];
-		const idFilters = ids.map((id) => this.readable.resolveIdFilter(id));
+		const idFilters = ids.map((id) => this.readable.resolveIdFilter(id, this._idOpts));
 		if (idFilters.some((f) => !f)) throw new HttpError(404, "Not found");
 		const idFilter = idFilters.length === 1 ? idFilters[0] : { $or: idFilters };
 		if (await this.readable.count({ filter: { $and: [idFilter, scopeFilter] } }) < ids.length) throw new HttpError(404, "Not found");
@@ -914,14 +1076,14 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 		return transformArbacFilter(filter);
 	}
 	transformProjection(projection) {
-		return applyArbacProjection(projection, readCachedScopes());
+		return applyArbacProjection(projection, readCachedScopes(), this.readable);
 	}
 	validateControls(controls, type) {
 		const baseErr = super.validateControls(controls, type);
 		if (baseErr) return baseErr;
 		const scopes = readCachedScopes();
 		applyArbacControls(controls, scopes);
-		applyArbacRelationScopes(controls, scopes);
+		applyArbacRelationScopes(controls, scopes, this.readable);
 	}
 	/**
 	* Same ARBAC `/meta` overlay as the writable controller (actions/crud
@@ -929,19 +1091,16 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	* union) — view-style metas leak hidden field names identically.
 	*/
 	applyMetaOverlay(meta) {
-		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
+		return applyArbacMetaOverlay(meta, this.readable);
 	}
 	/**
-	* Scope-aware field-existence check — same contract as
-	* {@link AsArbacDbController.hasField} (BUG-3): a field outside the
-	* read-scope projection union answers `false`, so `validateInsights` rejects
-	* `$select` / filter / sort references to it with the identical
-	* `Unknown field "x"` 400 a nonexistent field gets.
+	* Scope-aware field visibility — same contract as
+	* {@link AsArbacDbController.hasField}.
 	*/
 	hasField(path) {
-		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));
+		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, this.readable);
 	}
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, buildScopeVisibility, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/{user.provider-B1f6ZI45.d.mts → user.provider-C5BrFNxg.d.mts}

@@ -1,8 +1,8 @@
 import { TClassConstructor } from "moost";
-import { ControlGate, TProjection, TScopeFilter } from "@aooth/arbac";
+import { ControlGate, TProjection, TProjectionChildren, TScopeFilter } from "@aooth/arbac";
+import { TMetaResponse } from "@atscript/db";
 import { AsDbController } from "@atscript/moost-db";
 import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType } from "@atscript/typescript/utils";
-import { TMetaResponse } from "@atscript/db";
 //#region src/db/scope-types.d.ts
 /**
  * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
@@ -152,9 +152,9 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    * controls of a request. Runs after the base validator (which checks the
    * controls DTO shape) and BEFORE the query/aggregation pipeline executes.
    *
-   * `transformFilter` runs first on every read endpoint and caches the
-   * evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-   * directly here without re-evaluating ARBAC.
+   * Reads the scopes the route-level authorize interceptor cached via
+   * `arbac.setScopes(...)` — validation runs before `transformFilter`, so
+   * this hook never re-evaluates ARBAC.
    *
    * On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
    * `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
@@ -163,18 +163,15 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
   protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
   /**
-   * Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
-   * above): a field outside the read-scope projection union must be
-   * indistinguishable from a field that does not exist. The base controller's
-   * ONLY call site is `validateInsights`, which turns a `false` here into the
-   * same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
-   * `$select`, filter, and sort references to a hidden field cannot be used
-   * as an existence/value oracle. Identifier fields stay visible (reads
-   * always return them — see {@link MetaVisibility.alwaysVisible}), and paths
-   * under a `with`-granted relation pass through to the sub-scope's own
-   * enforcement. Scopes were cached by the route-level authorize interceptor
-   * before validation runs (`useArbac` setScopes), so the union reflects the
-   * exact action being executed.
+   * Scope-aware field visibility (BUG-3 twin of the `/meta` pruning above): a
+   * field outside the read-scope projection union answers `false`, which
+   * moost-db's visibility hook turns into the same `Unknown field "x"` 400 a
+   * nonexistent field gets at every gated query position — see the docs'
+   * "Column-scope security floor". Identifiers stay visible. A `rel.x` path
+   * under a `with`-granted relation (`$with=rel(x>1)`, `$with=rel($sort=x)`,
+   * `$with=rel($select=x)`) is checked as `x` against the union of the
+   * `with.rel` sub-scopes, recursively; the related table's own PK /
+   * `preferredId` stay visible.
    */
   protected hasField(path: string): boolean;
   protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
@@ -262,15 +259,24 @@ interface AoothArbacClaims {
  *
  * Each side is first UNIONed with the existing additive helpers (today's
  * machinery), then the two RESULTS are CONJOINED with the dedicated combiners
- * ({@link conjoinScopeFilters} `$and`, {@link restrictProjection} field ∩,
+ * ({@link conjoinScopeFilters} `$and`, {@link intersectProjections} field ∩,
  * {@link intersectControlsPolicy} deny-wins, `with` recursion) — never the
  * additive union helpers, which would silently widen.
  *
  * Returned as a single-element list so every downstream scope-application
  * site (which UNIONs the cached scope list per facet) sees the identity of a
  * one-element union — i.e. the conjunction — with no change to those sites.
+ *
+ * The projection conjunction is path-wise and never wider than either side
+ * (`{a:1}` ∩ `{"a.b":1}` → `{"a.b":1}`). A nested exclusion under an
+ * included parent (`{a:1}` ∩ `{"a.c":0}`) is subtracted exactly via
+ * `childrenOf` (the table schema); without it the parent is dropped (fail
+ * closed). When NO field survives (`{a:1}` ∩ `{a:0}`, disjoint whitelists),
+ * the composite keeps the user's projection and gets a match-nothing filter —
+ * an empty field set must never read as the unrestricted `{}`. `with`
+ * sub-scopes are conjoined without a schema.
  */
-declare function conjoinArbacDbScopes(userScopes: ArbacDbScope[], credScopes: ArbacDbScope[]): ArbacDbScope[];
+declare function conjoinArbacDbScopes(userScopes: ArbacDbScope[], credScopes: ArbacDbScope[], childrenOf?: TProjectionChildren): ArbacDbScope[];
 //#endregion
 //#region src/user.provider.d.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,17 +60,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.9",
-    "@aooth/arbac": "0.1.66",
-    "@aooth/user": "0.1.66",
-    "@aooth/arbac-core": "0.1.66"
+    "@uniqu/core": "^0.1.10",
+    "@aooth/arbac": "0.1.68",
+    "@aooth/arbac-core": "0.1.68",
+    "@aooth/user": "0.1.68"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.93",
-    "@atscript/db": "^0.1.132",
-    "@atscript/db-sql-tools": "^0.1.132",
-    "@atscript/db-sqlite": "^0.1.132",
-    "@atscript/moost-db": "^0.1.132",
+    "@atscript/db": "^0.1.134",
+    "@atscript/db-sql-tools": "^0.1.134",
+    "@atscript/db-sqlite": "^0.1.134",
+    "@atscript/moost-db": "^0.1.134",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@types/better-sqlite3": "^7.6.13",
@@ -78,8 +78,8 @@
     "unplugin-atscript": "^0.1.93"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.132",
-    "@atscript/moost-db": "^0.1.132",
+    "@atscript/db": "^0.1.134",
+    "@atscript/moost-db": "^0.1.134",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@wooksjs/event-core": "^0.7.23",