@aooth/arbac-moost 0.1.7 → 0.1.9

package/dist/atscript/index.d.mts

@@ -1,5 +1,5 @@
-import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
-import { t as ArbacUserProvider } from "../user.provider-JpI5dD6Z.mjs";
+import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKPMp3G8.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/atscript/auto-provider.d.ts
@@ -88,4 +88,96 @@ declare abstract class AtscriptArbacUserProvider<T extends object = object> exte
   private fetchRecord;
 }
 //#endregion
-export { AoothArbacUserCredentials, type ArbacUserTable, AtscriptArbacUserProvider };
+//#region src/atscript/attenuation-extract.d.ts
+/**
+ * Spec computed once per credential `TAtscriptAnnotatedType` — which typed root
+ * fields carry the restrict-only ARBAC attenuation:
+ *
+ * - `roleField` — the single `@arbac.attenuate.role`-annotated prop (holds the
+ *   assumed-role SUBSET, `string[]`). More than one throws at spec time.
+ * - `attrFields` — every `@arbac.attenuate.attr "userAttr"` prop, paired with
+ *   the target user-attribute key it narrows (the annotation argument).
+ */
+interface ArbacAttenuationSpec {
+  roleField: string | undefined;
+  attrFields: Array<{
+    field: string;
+    userAttr: string;
+  }>;
+}
+/**
+ * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
+ * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
+ * structural, computed once, fail-loud on an ambiguous (multiple) role field.
+ */
+declare function getArbacAttenuationSpec(credType: TAtscriptAnnotatedType): ArbacAttenuationSpec;
+/**
+ * Boot-time cross-model check: every `@arbac.attenuate.attr "userAttr"` target
+ * must name a real key in the user model's `@arbac.attribute` keyspace
+ * (`validUserAttrs`), else a typo silently no-ops the narrowing. Throws on the
+ * first miss. Call once at provider construction; safe and cheap (the spec is
+ * cached). Soundness does NOT depend on this — the scope conjunction clips
+ * regardless — but it turns a silent misconfig into a loud boot failure.
+ */
+declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, validUserAttrs: Iterable<string>): void;
+/**
+ * Build the restrict-only {@link AoothArbacClaims} for a credential `record`
+ * (its typed root fields — e.g. the auth context, which carries the credential
+ * payload flat) by reading the fields the credential model annotates. Designed
+ * to back a consumer's `ArbacUserProvider.getAttenuation()` override while
+ * arbac-moost stays auth-agnostic (the consumer supplies the record).
+ *
+ * Returns:
+ * - `undefined` when the model declares NO attenuation fields, OR a normal
+ *   (non-attenuated) token carries none of them set → full user authority.
+ * - `{ roles, attrs }` otherwise. The narrowing is then clipped by the engine's
+ *   scope conjunction, so it can never widen beyond the user.
+ *
+ * Fail-closed: when the assumed-role field IS set but holds a malformed value
+ * (no usable role strings), {@link parseRoles} yields `[]` — deny-all — never
+ * full authority. Absent (`undefined`/`null`) = the field was not set, so roles
+ * are omitted (attrs-only narrowing), which is the distinct "no role narrowing"
+ * case, not a malformed one.
+ */
+declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
+//#endregion
+//#region src/atscript/handle-spec.d.ts
+/**
+ * Resolved login/recovery HANDLE fields for a user credential model, discovered
+ * from the `@aooth.user.*` annotations (registered by `arbacPlugin`). Computed
+ * once per `TAtscriptAnnotatedType` and cached.
+ *
+ * - `emailField` — the field annotated `@aooth.user.email` **and** carrying a
+ *   `@db.index.unique` index. `undefined` when no field is annotated, or when
+ *   the annotated field lacks a unique index (the handle is then DISABLED — see
+ *   `warnings`).
+ * - `phoneField` — same, for `@aooth.user.phone`.
+ * - `handleFields` — the enabled handle field names in resolution order (email,
+ *   then phone; disabled handles omitted). Pass this straight to a `UserStore`
+ *   (`UsersStoreAtscriptDb` / `UserStoreMemory`) as its `handleFields` — the
+ *   store stays name-agnostic; this spec owns the email/phone semantics.
+ * - `warnings` — non-fatal misconfig notes (an annotated field with no unique
+ *   index → that handle is disabled, not fatal). The wiring layer should log
+ *   these at boot. Ambiguity (more than one field per role) is fatal and throws.
+ *
+ * A handle MUST be unique-when-present because `findByHandle` resolves a handle
+ * to AT MOST one row; a non-unique handle would resolve to an arbitrary one of
+ * several rows (an account-takeover footgun). That is why the unique index is
+ * the gate, and why a missing index disables rather than silently accepts.
+ */
+interface AoothUserHandleSpec {
+  emailField: string | undefined;
+  phoneField: string | undefined;
+  handleFields: string[];
+  warnings: string[];
+}
+/**
+ * Walk a user model's `@aooth.user.*` annotations into a cached
+ * {@link AoothUserHandleSpec}. Mirrors {@link getArbacAttenuationSpec}:
+ * structural, computed once, fail-loud on ambiguity. A model with no
+ * `@aooth.user.*` field resolves to all-`undefined` handles (email/phone login
+ * is simply unavailable — graceful degradation, not an error).
+ */
+declare function getAoothUserHandleSpec(userType: TAtscriptAnnotatedType): AoothUserHandleSpec;
+//#endregion
+export { AoothArbacUserCredentials, type AoothUserHandleSpec, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -1,14 +1,33 @@
-import { r as __decorate, t as ArbacUserProvider } from "../user.provider-CGWueNjx.mjs";
-import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
+import { r as __decorate, t as ArbacUserProvider } from "../user.provider-BiM5P8fl.mjs";
+import { t as AoothArbacUserCredentials } from "../user-Dzu_08g0.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
-//#region \0@oxc-project+runtime@0.129.0/helpers/decorateMetadata.js
+//#region src/atscript/role-list.ts
+/**
+* Collect unique, non-empty strings from an iterable of unknown values,
+* preserving first-seen order and dropping anything that is not a non-empty
+* string. Shared by the user-side role extraction
+* (`AtscriptArbacUserProvider.extractRoles`) and the credential-side
+* attenuation role parse (`extractAttenuation`) so both apply identical
+* dedup / drop-empty rules.
+*/
+function uniqueStrings(values) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const v of values) if (typeof v === "string" && v !== "" && !seen.has(v)) {
+		seen.add(v);
+		out.push(v);
+	}
+	return out;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.133.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
 //#region src/atscript/auto-provider.ts
-const specCache = /* @__PURE__ */ new WeakMap();
+const specCache$2 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
 * documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
@@ -47,7 +66,7 @@ function resolveIdentifierField(type) {
 	return metaId;
 }
 function getArbacExtractSpec(type) {
-	const cached = specCache.get(type);
+	const cached = specCache$2.get(type);
 	if (cached !== void 0) return cached;
 	const spec = {
 		userIdField: void 0,
@@ -56,7 +75,7 @@ function getArbacExtractSpec(type) {
 	};
 	const def = type.type;
 	if (def.kind !== "object") {
-		specCache.set(type, spec);
+		specCache$2.set(type, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -87,7 +106,7 @@ function getArbacExtractSpec(type) {
 		};
 	}
 	spec.userIdField = resolveIdentifierField(type);
-	specCache.set(type, spec);
+	specCache$2.set(type, spec);
 	return spec;
 }
 /**
@@ -127,6 +146,8 @@ const useFetchCache = defineWook((ctx) => {
 	return cache;
 });
 let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUserProvider {
+	userType;
+	table;
 	spec;
 	projection;
 	withClause;
@@ -167,22 +188,10 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 		if (!roleField) return [];
 		const raw = record[roleField.name];
 		if (raw === void 0 || raw === null) return [];
-		const seen = /* @__PURE__ */ new Set();
-		const out = [];
-		const push = (val) => {
-			if (typeof val === "string" && val !== "" && !seen.has(val)) {
-				seen.add(val);
-				out.push(val);
-			}
-		};
-		if (roleField.shape === "inline") if (Array.isArray(raw)) for (const item of raw) push(item);
-		else push(raw);
-		else {
-			if (!Array.isArray(raw)) return out;
-			const idField = roleField.roleTargetIdField;
-			for (const item of raw) if (item && typeof item === "object") push(item[idField]);
-		}
-		return out;
+		if (roleField.shape === "inline") return uniqueStrings(Array.isArray(raw) ? raw : [raw]);
+		if (!Array.isArray(raw)) return [];
+		const idField = roleField.roleTargetIdField;
+		return uniqueStrings(raw.map((item) => item && typeof item === "object" ? item[idField] : void 0));
 	}
 	/**
 	* Override seam: `@arbac.attribute` fields keyed by prop name. Undefined
@@ -226,4 +235,162 @@ let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUse
 };
 AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object, Object])], AtscriptArbacUserProvider);
 //#endregion
-export { AoothArbacUserCredentials, AtscriptArbacUserProvider };
+//#region src/atscript/attenuation-extract.ts
+const specCache$1 = /* @__PURE__ */ new WeakMap();
+/**
+* Walk a credential model's `@arbac.attenuate.*` annotations into a cached
+* {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
+* structural, computed once, fail-loud on an ambiguous (multiple) role field.
+*/
+function getArbacAttenuationSpec(credType) {
+	const cached = specCache$1.get(credType);
+	if (cached !== void 0) return cached;
+	const spec = {
+		roleField: void 0,
+		attrFields: []
+	};
+	const def = credType.type;
+	if (def.kind !== "object") {
+		specCache$1.set(credType, spec);
+		return spec;
+	}
+	const roleCandidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("arbac.attenuate.role")) roleCandidates.push(fieldName);
+		const userAttr = md.get("arbac.attenuate.attr");
+		if (typeof userAttr === "string" && userAttr !== "") spec.attrFields.push({
+			field: fieldName,
+			userAttr
+		});
+	}
+	if (roleCandidates.length > 1) throw new Error(`getArbacAttenuationSpec: multiple @arbac.attenuate.role fields declared (${roleCandidates.join(", ")}). Exactly one assumed-role source is supported — drop @arbac.attenuate.role from all but the canonical field.`);
+	if (roleCandidates.length === 1) spec.roleField = roleCandidates[0];
+	specCache$1.set(credType, spec);
+	return spec;
+}
+/**
+* Boot-time cross-model check: every `@arbac.attenuate.attr "userAttr"` target
+* must name a real key in the user model's `@arbac.attribute` keyspace
+* (`validUserAttrs`), else a typo silently no-ops the narrowing. Throws on the
+* first miss. Call once at provider construction; safe and cheap (the spec is
+* cached). Soundness does NOT depend on this — the scope conjunction clips
+* regardless — but it turns a silent misconfig into a loud boot failure.
+*/
+function validateAttenuationTargets(credType, validUserAttrs) {
+	const spec = getArbacAttenuationSpec(credType);
+	const valid = new Set(validUserAttrs);
+	for (const { field, userAttr } of spec.attrFields) if (!valid.has(userAttr)) throw new Error(`validateAttenuationTargets: @arbac.attenuate.attr "${userAttr}" on field "${field}" targets a user attribute that does not exist in the user model's @arbac.attribute keyspace (${[...valid].join(", ") || "<none>"}). Fix the annotation argument.`);
+}
+/** Lenient role parse: accept `string | string[]`, drop empty/non-string, dedupe. */
+function parseRoles(raw) {
+	return uniqueStrings(Array.isArray(raw) ? raw : [raw]);
+}
+/**
+* Build the restrict-only {@link AoothArbacClaims} for a credential `record`
+* (its typed root fields — e.g. the auth context, which carries the credential
+* payload flat) by reading the fields the credential model annotates. Designed
+* to back a consumer's `ArbacUserProvider.getAttenuation()` override while
+* arbac-moost stays auth-agnostic (the consumer supplies the record).
+*
+* Returns:
+* - `undefined` when the model declares NO attenuation fields, OR a normal
+*   (non-attenuated) token carries none of them set → full user authority.
+* - `{ roles, attrs }` otherwise. The narrowing is then clipped by the engine's
+*   scope conjunction, so it can never widen beyond the user.
+*
+* Fail-closed: when the assumed-role field IS set but holds a malformed value
+* (no usable role strings), {@link parseRoles} yields `[]` — deny-all — never
+* full authority. Absent (`undefined`/`null`) = the field was not set, so roles
+* are omitted (attrs-only narrowing), which is the distinct "no role narrowing"
+* case, not a malformed one.
+*/
+function extractAttenuation(credType, record) {
+	const spec = getArbacAttenuationSpec(credType);
+	if (spec.roleField === void 0 && spec.attrFields.length === 0) return void 0;
+	if (!record) return void 0;
+	const rec = record;
+	let roles;
+	if (spec.roleField !== void 0) {
+		const raw = rec[spec.roleField];
+		if (raw !== void 0 && raw !== null) roles = parseRoles(raw);
+	}
+	let attrs;
+	for (const { field, userAttr } of spec.attrFields) {
+		const value = rec[field];
+		if (value !== void 0 && value !== null) {
+			attrs ??= {};
+			attrs[userAttr] = value;
+		}
+	}
+	if (roles === void 0 && attrs === void 0) return void 0;
+	const out = {};
+	if (roles !== void 0) out.roles = roles;
+	if (attrs !== void 0) out.attrs = attrs;
+	return out;
+}
+//#endregion
+//#region src/atscript/handle-spec.ts
+const specCache = /* @__PURE__ */ new WeakMap();
+/** A `@db.index.unique` annotation is a non-empty `(string | true)[]`. */
+function hasUniqueIndex(md) {
+	const unique = md.get("db.index.unique");
+	return Array.isArray(unique) && unique.length > 0;
+}
+/**
+* Resolve a single handle field for one role: fail loud on ambiguity (more than
+* one annotated field — there is no canonical choice), and warn-and-disable when
+* the sole annotated field lacks a unique index.
+*/
+function resolveHandleField(role, annotation, candidates, warnings) {
+	if (candidates.length === 0) return void 0;
+	if (candidates.length > 1) throw new Error(`getAoothUserHandleSpec: multiple ${annotation} fields declared (${candidates.map((c) => c.field).join(", ")}). Exactly one ${role} login handle is supported — drop ${annotation} from all but the canonical field.`);
+	const { field, md } = candidates[0];
+	if (!hasUniqueIndex(md)) {
+		warnings.push(`${annotation} on field "${field}" has no @db.index.unique — a login handle must resolve to at most one row, so the ${role} handle is DISABLED (login/recovery by ${role} unavailable). Add @db.index.unique to the field to enable it.`);
+		return;
+	}
+	return field;
+}
+/**
+* Walk a user model's `@aooth.user.*` annotations into a cached
+* {@link AoothUserHandleSpec}. Mirrors {@link getArbacAttenuationSpec}:
+* structural, computed once, fail-loud on ambiguity. A model with no
+* `@aooth.user.*` field resolves to all-`undefined` handles (email/phone login
+* is simply unavailable — graceful degradation, not an error).
+*/
+function getAoothUserHandleSpec(userType) {
+	const cached = specCache.get(userType);
+	if (cached !== void 0) return cached;
+	const spec = {
+		emailField: void 0,
+		phoneField: void 0,
+		handleFields: [],
+		warnings: []
+	};
+	const def = userType.type;
+	if (def.kind !== "object") {
+		specCache.set(userType, spec);
+		return spec;
+	}
+	const emailCandidates = [];
+	const phoneCandidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("aooth.user.email")) emailCandidates.push({
+			field: fieldName,
+			md
+		});
+		if (md.get("aooth.user.phone")) phoneCandidates.push({
+			field: fieldName,
+			md
+		});
+	}
+	spec.emailField = resolveHandleField("email", "@aooth.user.email", emailCandidates, spec.warnings);
+	spec.phoneField = resolveHandleField("phone", "@aooth.user.phone", phoneCandidates, spec.warnings);
+	spec.handleFields = [spec.emailField, spec.phoneField].filter((f) => f !== void 0);
+	specCache.set(userType, spec);
+	return spec;
+}
+//#endregion
+export { AoothArbacUserCredentials, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/index.d.mts

@@ -1,12 +1,11 @@
-import { n as ArbacUserProviderToken, t as ArbacUserProvider } from "./user.provider-JpI5dD6Z.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-CKPMp3G8.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { Mate, TMateParamMeta, TMoostMetadata } from "moost";
-import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFilter } from "@aooth/arbac";
-import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
-import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType } from "@atscript/typescript/utils";
-import { TMetaResponse } from "@atscript/db";
+import { ControlGate, TProjection } from "@aooth/arbac";
+import { AsDbReadableController } from "@atscript/moost-db";
+import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/arbac.composables.d.ts
 interface ArbacBindings {
@@ -112,217 +111,6 @@ type ArbacMate = Mate<TMoostMetadata & {
  */
 declare function getArbacMate(): ArbacMate;
 //#endregion
-//#region src/db/scope-types.d.ts
-/**
- * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
- * `Comment[]` → `Comment`, `Task` → `Task`. Used to recurse `with.<K>` into
- * the joined model's own type so per-relation scopes get typed against the
- * RIGHT entity (not the array wrapper).
- */
-type NavTarget<U> = U extends readonly (infer V)[] ? V : U;
-/**
- * True only when `T` is `unknown` (or `any`). `unknown extends T` holds for
- * both. Callers use this to pick the legacy untyped shape when no model is
- * annotated.
- */
-type IsUnknown<T> = unknown extends T ? true : false;
-/**
- * Permissive own-field key set. With a typed `T`, autocompletes against
- * `keyof OwnPropsOf<T>` while still accepting dotted-path projections like
- * `mfa.value` via the `(string & {})` escape hatch. With `T = unknown`,
- * `OwnPropsOf<unknown>` collapses to `unknown` so `keyof` is `never` →
- * falls back to plain `string`.
- */
-type OwnFieldKey<T> = keyof OwnPropsOf<T> extends never ? string : (keyof OwnPropsOf<T> & string) | (string & {});
-/**
- * Same idiom for nav relation names. `NavPropsOf<unknown>` is
- * `Record<string, never>`, so its `keyof` is `string` — the typed branch
- * still resolves to plain `string` (the `(string & {})` escape collapses
- * with `string`).
- */
-type NavRelationKey<T> = keyof NavPropsOf<T> extends never ? string : (keyof NavPropsOf<T> & string) | (string & {});
-/**
- * Typed projection keyed by own-field paths (with dotted-path escape).
- * Falls back to the legacy `TProjection = Record<string, 0 | 1>` for
- * untyped scopes so existing callers that pass the result straight to
- * `unionProjections` / `restrictProjection` keep compiling.
- */
-type ProjectionOf<T> = IsUnknown<T> extends true ? TProjection : Partial<Record<OwnFieldKey<T>, 0 | 1>>;
-/**
- * Typed control gates: `$with` against nav names, `$select` against own
- * fields, other `$`-prefixed controls passthrough. Falls back to the
- * legacy untyped `Record<string, ControlGate>` for `T = unknown` so
- * internal helpers (`unionControlsPolicy`) and existing untyped call
- * sites keep compiling.
- */
-type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate$1> : {
-  $with?: Array<NavRelationKey<T>> | boolean;
-  $select?: Array<OwnFieldKey<T>> | boolean;
-  $groupBy?: ControlGate$1;
-  $having?: ControlGate$1;
-  [key: `$${string}`]: ControlGate$1 | Array<string> | undefined;
-};
-//#endregion
-//#region src/db/as-arbac-db-controller.d.ts
-/**
- * Contract returned by an ARBAC role's scope predicate on a DB-backed resource.
- *
- * Apps can extend this interface with their own fields via TypeScript
- * declaration merging — both at role-definition time (returned from
- * `role.allow(...)`) and at consumption time (custom controller overrides
- * reading `scopes[i].myCustomField` get full type safety):
- *
- * @example
- * ```ts
- * declare module '@aooth/arbac-moost' {
- *   interface ArbacDbScope {
- *     tenantId?: string
- *   }
- * }
- * ```
- */
-interface ArbacDbScope<T = unknown> {
-  filter?: TScopeFilter;
-  projection?: ProjectionOf<T>;
-  set?: Partial<Record<OwnFieldKey<T>, unknown>>;
-  allowedFields?: Array<OwnFieldKey<T>>;
-  /**
-   * Per-control gates for Uniquery URL controls (`$with`, `$groupBy`, `$having`, …).
-   * Evaluated by {@link AsArbacDbController.validateControls} before query execution;
-   * a violation throws `HttpError(403)`.
-   *
-   * Per-key semantics ({@link ControlGate}):
-   *   - absent / `true` — allowed.
-   *   - `false` — denied entirely.
-   *   - `readonly string[]` — whitelist (e.g. `{ $with: ['comments'] }` allows
-   *     `?$with=comments`, rejects `?$with=tasks`). Supported only for `$with`
-   *     (relation names) and `$groupBy` (column names) in v1.
-   *
-   * Across roles, gates union additively (silence wins) via {@link unionControlsPolicy}.
-   *
-   * @example `{ controls: { $with: false } }` — disable $with for this role.
-   * @example `{ controls: { $with: ['comments', 'owner'] } }` — restrict relations.
-   */
-  controls?: ControlsOf<T>;
-  /**
-   * Per-relation sub-scopes applied when the request expands a relation via
-   * `?$with=<name>`. Recursive — each sub-scope has the same shape and can
-   * declare its own `with` for nested expansions (e.g. tasks → comments → task).
-   *
-   * **Authority model**: the PARENT scope owns the policy for joined rows.
-   * arbac-moost does NOT re-evaluate ARBAC against the joined resource's own
-   * scopes — that would be a confusing indirection and a perf hit. Whatever
-   * the parent declares here is what surfaces from the expansion.
-   *
-   * **Union across roles**: when multiple roles allow the same parent table,
-   * their `with[name]` sub-scopes are unioned at every nested level using the
-   * existing `unionProjections` / `mergeScopeFilters` / `unionControlsPolicy`
-   * primitives (additive: broader access wins, same rules as the parent).
-   *
-   * **Silence wins**: if no role declares `with.<name>`, expansion is
-   * unrestricted (matches `controls.$with` whitelist semantics; the gate
-   * still applies if declared).
-   */
-  with?: WithOf<T>;
-}
-/**
- * Per-relation sub-scope map. For `T = unknown` falls back to the legacy
- * untyped `Record<string, ArbacDbScope>`. With a typed `T`, each known
- * relation key gets its scope typed against the joined model (via
- * `NavTarget` to unwrap arrays), while arbitrary `(string & {})` keys
- * keep the untyped escape hatch. Lives here (not in `scope-types.ts`)
- * because it must reference `ArbacDbScope` recursively.
- */
-type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavRelationKey<T>]?: K extends keyof NavPropsOf<T> ? ArbacDbScope<NavTarget<NavPropsOf<T>[K]>> : ArbacDbScope };
-declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbController<T> {
-  protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
-  protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;
-  /**
-   * Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
-   * bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
-   * no try/catch, so a malformed `?status=...` (e.g. unquoted single quote at a
-   * non-string position) surfaces as a server error — misleading, since the
-   * server is fine and the client sent bad input.
-   *
-   * Narrow targeting: only `SyntaxError` raised from inside the parser is
-   * remapped. Other errors (e.g. a programmer-introduced TypeError in a future
-   * override) still bubble as 500. SQL-injection-shaped payloads remain safely
-   * handled either way — see SEC-17 for the parameterisation invariant; this
-   * override is an orthogonal robustness pin around the parse step.
-   */
-  protected parseQueryString(url: string): ReturnType<AsDbController<T>["parseQueryString"]>;
-  /**
-   * Same parser-error → 400 remap as {@link parseQueryString}, applied to the
-   * `/one` and `/one?…` code paths which use `parseControlsOnlyFromUrl`.
-   */
-  protected parseControlsOnlyFromUrl(url: string): ReturnType<AsDbController<T>["parseControlsOnlyFromUrl"]>;
-  /**
-   * Enforce per-role `ArbacDbScope.controls` gates against the parsed Uniquery
-   * controls of a request. Runs after the base validator (which checks the
-   * controls DTO shape) and BEFORE the query/aggregation pipeline executes.
-   *
-   * `transformFilter` runs first on every read endpoint and caches the
-   * evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-   * directly here without re-evaluating ARBAC.
-   *
-   * On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
-   * `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
-   * thrown error bubbles to moost which translates it to a 403 response.
-   */
-  protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
-  protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
-  protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
-  protected onRemove(id: unknown): Promise<unknown>;
-  private assertInScope;
-  private identifierFields;
-}
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Enforce a per-control policy against a parsed Uniquery `controls` map.
- *
- * Throws `HttpError(403)` on the first violation. Pure (no DI) so it is
- * trivially unit-testable; `validateControls` wires it up to the controller's
- * cached scopes.
- *
- * Semantics per gate (see {@link ControlGate}):
- *   - `true` (or absent — dropped by `unionControlsPolicy`): allow.
- *   - `false`: deny if the control is used at all.
- *   - `readonly string[]`: allow only the listed values; reject any other.
- *
- * "Used" means the control key is present AND non-empty (an empty array is
- * treated as not used, matching how the parser leaves missing controls).
- */
-declare function enforceControlsPolicy(policy: Record<string, ControlGate$1>, controls: Record<string, unknown>): void;
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Extract the set of "named values" from a Uniquery control payload, for
- * use against a whitelist gate.
- *
- * Currently supported (matches `WHITELISTABLE_CONTROLS` in `unionControlsPolicy`):
- *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
- *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
- *     Bare strings are tolerated for forward compatibility.
- *   - `$groupBy` — array of column names (strings). Returned as-is.
- *
- * For unknown controls we return an empty array; the caller then enforces
- * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
- * gate, which throws if a non-whitelistable control receives a string[]).
- */
-declare function extractUsedControlValues(key: string, value: unknown): string[];
-/**
- * Test-friendly internal helper — exported for unit tests and helper
- * composition; regular consumers should not call this directly.
- *
- * Apply the union of `allowedFields` whitelists (with `preserveFields`
- * always preserved) and overlay each scope's `set` overrides. Returns a
- * shallow copy; original `data` is not mutated.
- */
-declare function applyAllowedFieldsAndSet(data: unknown, scopes: ArbacDbScope[], preserveFields?: readonly string[]): unknown;
-//#endregion
 //#region src/db/as-arbac-db-readable-controller.d.ts
 /**
  * Read-only mirror of {@link AsArbacDbController} for view-style controllers
@@ -350,4 +138,4 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };