@aooth/arbac-moost 0.1.72 → 0.1.74

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-NMSzynGK.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKjmUhkx.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts
@@ -36,10 +36,8 @@ interface ArbacUserTable<T extends object> {
  * `@Injectable()` (SINGLETON) — moost@0.6.x's `Injectable` metadata is NOT
  * inherited from the base `ArbacUserProvider` by infact, so the decorator
  * must be re-applied here. SINGLETON is the right scope: there is no
- * per-instance state worth scoping per event, and FOR_EVENT trips a
- * scope-id mismatch when the interceptor resolves the provider in a
- * multi-adapter app (HTTP + WF). Per-event memoization is provided via
- * a wooks-slot cache keyed by `this` — see `useFetchCache` above.
+ * per-instance state worth scoping per event. Per-event memoization is
+ * provided via a wooks-slot cache keyed by `this` — see `useFetchCache` above.
  *
  * Consumers extend this class, implement `getUserId()` (typically reading
  * the JWT subject from the auth composable), inject their atscript-db

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-NMSzynGK.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-CKjmUhkx.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
+import { ControlGate, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
-import { ControlGate, TProjection, TScopeFieldRules, TScopeFilter } from "@aooth/arbac";
-import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions } from "@atscript/db";
-import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
+import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
+import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbActionScopeContext, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
 import { TAtscriptAnnotatedType, TAtscriptDataType } from "@atscript/typescript/utils";
 //#region src/db/visibility.d.ts
 /**
@@ -54,8 +54,6 @@ interface VisibilityTableSource {
    * @since 0.1.72
    */
   jsonParents?: ReadonlySet<string>;
-  /** Whether the adapter searches natively (`/meta` search-surface pruning). @since 0.1.72 */
-  isSearchable?(): boolean;
 }
 /** Relation name → the visibility its joined rows obey, or `null` when hidden. */
 type ArbacRelationResolution = ReadonlyMap<string, MetaVisibility | null>;
@@ -291,6 +289,7 @@ declare const ArbacResource: (name: string) => MethodDecorator & ClassDecorator
 declare const ArbacAction: (name: string) => MethodDecorator & ClassDecorator & ParameterDecorator & PropertyDecorator;
 //#endregion
 //#region src/db/as-arbac-db-readable-controller.d.ts
+type TSelect = UniqueryControls["$select"];
 /**
  * Read-only mirror of {@link AsArbacDbController} for view-style controllers
  * built on top of `@atscript/moost-db`'s {@link AsDbReadableController}.
@@ -303,9 +302,11 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
   /** Same contract as {@link AsArbacDbController.prepareRequest}. */
   protected prepareRequest(ctx: TDbRequestContext): Promise<void>;
   /** Same contract as {@link AsArbacDbController.transformFilter}. */
-  protected transformFilter(filter: Record<string, unknown> | undefined): Record<string, unknown>;
+  protected transformFilter(filter: Record<string, unknown> | undefined): FilterExpr | Promise<FilterExpr>;
+  /** Same contract as {@link AsArbacDbController.transformRelationFilter}. Since 0.1.74. */
+  protected transformRelationFilter(path: string, filter: FilterExpr): FilterExpr | Promise<FilterExpr>;
   /** Same contract as {@link AsArbacDbController.transformProjection}. */
-  protected transformProjection(projection?: TProjection): TProjection | undefined;
+  protected transformProjection(projection?: TSelect): TSelect | undefined | Promise<TSelect | undefined>;
   /** Same contract as {@link AsArbacDbController.validateControls}. */
   protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   /** Same contract as {@link AsArbacDbController.applyMetaOverlay}. */
@@ -313,7 +314,7 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
   /** Same contract as {@link AsArbacDbController.authorizeForm}. */
   protected authorizeForm(_name: string, actionNames: readonly string[]): Promise<boolean>;
   /** Same contract as {@link AsArbacDbController.actionRowScope}. */
-  protected actionRowScope(name: string): Promise<Record<string, unknown> | undefined>;
+  protected actionRowScope(name: string, _ctx?: TDbActionScopeContext): Promise<Record<string, unknown> | undefined>;
   /** Same contract as {@link AsArbacDbController.allowedActions}. */
   protected allowedActions(names: readonly string[]): Promise<string[]>;
   /** Same contract as {@link AsArbacDbController.[ARBAC_DELEGATED_AUTH]}. */
@@ -360,21 +361,16 @@ declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedTy
   private _arbacHost?;
   private get arbacHost();
   protected prepareRequest(_ctx: TDbRequestContext): Promise<void>;
-  protected transformFilter(filter: FilterExpr): FilterExpr;
-  protected transformProjection(select: ValueHelpSelect<DataType> | undefined): ValueHelpSelect<DataType> | undefined;
+  /** Same contract as {@link AsArbacDbController.transformFilter}. */
+  protected transformFilter(filter: FilterExpr): FilterExpr | Promise<FilterExpr>;
+  protected transformProjection(select: ValueHelpSelect<DataType> | undefined): ValueHelpSelect<DataType> | undefined | Promise<ValueHelpSelect<DataType> | undefined>;
   protected hasField(path: string): boolean;
   protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
-  runQuery(url: string): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | DataType[]>;
-  runPages(url: string): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | {
-    data: DataType[];
-    page: number;
-    itemsPerPage: number;
-    pages: number;
-    count: number;
-  }>;
-  runGetOne(id: string): Promise<DataType | import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody>>;
-  runGetOneComposite(query: Record<string, string>): Promise<DataType | import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody>>;
+  runQuery(url: string): ReturnType<AsValueHelpController<T, DataType>["runQuery"]>;
+  runPages(url: string): ReturnType<AsValueHelpController<T, DataType>["runPages"]>;
+  runGetOne(id: string): ReturnType<AsValueHelpController<T, DataType>["runGetOne"]>;
+  runGetOneComposite(query: Record<string, string>): ReturnType<AsValueHelpController<T, DataType>["runGetOneComposite"]>;
 }
 /**
  * ARBAC-scoped mirror of `@atscript/moost-db`'s
@@ -398,21 +394,16 @@ declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType =
   private _arbacHost?;
   private get arbacHost();
   protected prepareRequest(_ctx: TDbRequestContext): Promise<void>;
-  protected transformFilter(filter: FilterExpr): FilterExpr;
-  protected transformProjection(select: ValueHelpSelect<DataType> | undefined): ValueHelpSelect<DataType> | undefined;
+  /** Same contract as {@link AsArbacDbController.transformFilter}. */
+  protected transformFilter(filter: FilterExpr): FilterExpr | Promise<FilterExpr>;
+  protected transformProjection(select: ValueHelpSelect<DataType> | undefined): ValueHelpSelect<DataType> | undefined | Promise<ValueHelpSelect<DataType> | undefined>;
   protected hasField(path: string): boolean;
   protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
-  runQuery(url: string): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | DataType[]>;
-  runPages(url: string): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | {
-    data: DataType[];
-    page: number;
-    itemsPerPage: number;
-    pages: number;
-    count: number;
-  }>;
-  runGetOne(id: string): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | DataType>;
-  runGetOneComposite(query: Record<string, string>): Promise<import("@wooksjs/event-http").HttpError<import("@wooksjs/event-http").TWooksErrorBody> | DataType>;
+  runQuery(url: string): ReturnType<AsJsonValueHelpController<T, DataType>["runQuery"]>;
+  runPages(url: string): ReturnType<AsJsonValueHelpController<T, DataType>["runPages"]>;
+  runGetOne(id: string): ReturnType<AsJsonValueHelpController<T, DataType>["runGetOne"]>;
+  runGetOneComposite(query: Record<string, string>): ReturnType<AsJsonValueHelpController<T, DataType>["runGetOneComposite"]>;
 }
 //#endregion
 //#region src/db/relation-policy.d.ts
@@ -488,18 +479,17 @@ declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility,
  *    `crud` already advertises no read surface, and write-only principals
  *    still need `type` for their insert/update forms. PK + `preferredId` are
  *    never pruned.
- * 3. The search surface: `searchIndexes` reading a hidden field are dropped,
- *    `searchable` / `vectorSearchable` / `geoSearchable` recomputed, and the
- *    `query` / `pages` control lists lose the controls that became unusable
- *    (`crud.geo` goes when no geo index is left).
+ *
+ * The search surface (`searchIndexes`, `searchable`, `vectorSearchable`,
+ * `geoSearchable`) is narrowed by moost-db itself (≥ 0.1.147, under the
+ * overridden `hasField`), after this overlay.
  *
  * @param source - the controller's `this.readable` (identifiers, relations
  *   and schema rules are derived from it); an identifier set (the 0.1.67
  *   signature) still works, without them
- * @param indexes - the controller's `indexFieldPaths()`; defaults to calling
- *   it on the current controller when it has one
+ * @param _indexes - @deprecated ignored since 0.1.74 (moost-db prunes the search surface)
  */
-declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTableSource | ReadonlySet<string>, indexes?: readonly TDbIndexFieldPaths[]): Promise<TMetaResponse>;
+declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTableSource | ReadonlySet<string>, _indexes?: readonly TDbIndexFieldPaths[]): Promise<TMetaResponse>;
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.
@@ -566,7 +556,18 @@ declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, sour
  * action id / row is read): resolve the request's scopes
  * ({@link resolveRequestScopes} — 403 on denial, `arbacPublic` does not
  * bypass) and, on read endpoints, the `$with` relation policy for the
- * requested relations.
+ * requested relations — the `$with` entries and, since 0.1.74, the
+ * relations the client filter's relational predicates name (`ctx.filter`):
+ * a predicate on a relation is allowed exactly when `$with` of it is (same
+ * visibility, same `controls.$with` gates).
+ *
+ * Delegated endpoints (no grant of their own): `"availableActions"`
+ * (`GET /meta/actions…`) — some row-level action grant (or, on a
+ * `@DbActionsFrom` controller, none: its own part lists nothing);
+ * `"delegatedAction"` (`POST /delegated-actions/:name`, since 0.1.74) — the
+ * controller's READ grant, since the route only resolves which of the
+ * caller's readable rows match the query; the action itself is authorized
+ * by its source controller on every batch.
  *
  * @since 0.1.72
  */
@@ -593,12 +594,17 @@ declare function arbacAllowedActions(names: readonly string[]): Promise<string[]
  * `@DbAction` `name` may run on — the filter of the caller's grant on the
  * action ({@link actionArbacIds}: every handler method of the action, or a
  * class-level entry's fallback ids), including custom-field row filters and
- * credential attenuation. No grant → a match-nothing filter (fail closed);
- * an unrestricted grant → `undefined`. When the current request IS that
- * action (its resolved scopes are the same evaluation), the row overlay
+ * credential attenuation. Several grants union (`$or`); attenuation is
+ * already intersected into each. No grant → a match-nothing filter (fail
+ * closed); an unrestricted grant → `undefined`. When the current request IS
+ * that action (its resolved scopes are the same evaluation), the row overlay
  * already applies it → `undefined`. Equal filters are returned as ONE
  * object per request.
  *
+ * Candidate-free on purpose (evaluated once per action per event) — see
+ * `AsArbacDbController.actionRowScope` to bound an action by its candidate
+ * rows.
+ *
  * @since 0.1.72
  */
 declare function arbacActionRowScope(name: string): Promise<Record<string, unknown> | undefined>;
@@ -610,6 +616,20 @@ declare function arbacActionRowScope(name: string): Promise<Record<string, unkno
  * @since 0.1.72
  */
 declare function arbacRowFilter(filter: Record<string, unknown> | undefined): Record<string, unknown>;
+/**
+ * Body of the ARBAC DB controllers' `transformRelationFilter` (since 0.1.74):
+ * the operand of a CLIENT relational predicate at `path` (`ticket`,
+ * `ticket.team`, `tickets.issues` inside `$with=tickets(…)`) CONJOINED
+ * with the row filter of the related rows the caller may see there — the
+ * same policy `$with` of that relation applies: a declared `with.<rel>`
+ * sub-scope, else the caller's own read grant on the related table. So
+ * `$some` matches, and `$none` excludes, only on rows the caller could
+ * load. A relation the request did not resolve answers like an unknown
+ * field (400 — the request gate rejects it first).
+ *
+ * @since 0.1.74
+ */
+declare function arbacRelationFilter(path: string, filter: FilterExpr, readable: VisibilityTableSource): FilterExpr;
 //#endregion
 //#region src/db/shared-read-helpers.d.ts
 /**
@@ -848,4 +868,4 @@ declare class MoostArbac<TUserAttrs extends object, TScope extends object> exten
   getScopeFields(): TScopeFieldRules<TScope>;
 }
 //#endregion
-export { ARBAC_DELEGATED_AUTH, type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, type ArbacDbScopeHelpers, ArbacDelegatedAuth, ArbacEvaluateOptions, type ArbacGuardedTable, type ArbacRelationResolution, ArbacResource, type ArbacScopedTable, ArbacUserProvider, ArbacUserProviderToken, type ArbacWriteTable, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, type ConjoinArbacDbScopesOptions, type ControlGate, type ControlsOf, type MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type RefForeignKey, type RefTableSource, type ScopeVisibilityOptions, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, type VisibilityTableSource, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, type ArbacDbScopeHelpers, ArbacDelegatedAuth, ArbacEvaluateOptions, type ArbacGuardedTable, type ArbacRelationResolution, ArbacResource, type ArbacScopedTable, ArbacUserProvider, ArbacUserProviderToken, type ArbacWriteTable, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, type ConjoinArbacDbScopesOptions, type ControlGate, type ControlsOf, type MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type RefForeignKey, type RefTableSource, type ScopeVisibilityOptions, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, type VisibilityTableSource, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };

package/dist/index.mjs

@@ -1,11 +1,11 @@
 import { i as __decorate, n as ArbacUserProvider, r as ArbacUserProviderToken, t as __decorateMetadata } from "./decorateMetadata-CU_mqYGT.mjs";
 import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core";
+import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilters, conjoinScopeFilters, conjoinScopeFilters as conjoinScopeFilters$1, conjoinScopes, effectiveScope, expandExcludeToLeaves, getProjectionMode, intersectEnabled, isFieldAllowed, needsInheritedConjunction, normalizeScopes, restrictProjection, stableKey, unionOutcomes } from "@aooth/arbac";
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { cached, cachedBy, current, eventTypeKey, key, tryGetCurrent } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
-import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilters, conjoinScopeFilters, conjoinScopes, effectiveScope, expandExcludeToLeaves, getProjectionMode, intersectEnabled, isFieldAllowed, needsInheritedConjunction, normalizeScopes, restrictProjection, stableKey, unionOutcomes } from "@aooth/arbac";
-import { computeInsights, findAncestorInSet, getPath, isPlainObject } from "@atscript/db";
-import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, discoverRowLevelActions, getDbEndpoint, resolveTerminalRef } from "@atscript/moost-db";
+import { computeInsights, containsRelationFilter, findAncestorInSet, getPath, hasRelationOp, isPlainObject, isRelationOp } from "@atscript/db";
+import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, badRequest, discoverRowLevelActions, getDbEndpoint, hasActionDelegations, resolveTerminalRef } from "@atscript/moost-db";
 import { groupByFields, walkFilter } from "@uniqu/core";
 //#region src/db/helpers.ts
 /** `map.get(key)`, created with `create()` and stored on a miss. */
@@ -110,6 +110,10 @@ function isMetaFieldVisible(path, vis) {
 	}
 	return allowed(path);
 }
+/** The level of relation `name` when it is visible at `vis` (see {@link isMetaFieldVisible}). */
+function visibleRelation(name, vis) {
+	return isMetaFieldVisible(name, vis) ? vis.relation?.(name) : void 0;
+}
 const NO_NAMES$1 = /* @__PURE__ */ new Set();
 const identifierSetCache = /* @__PURE__ */ new WeakMap();
 /** PK + `preferredId` of a table — the identifiers reads always return. */
@@ -358,7 +362,9 @@ async function evaluateTypeRead(type) {
 const MAX_WITH_DEPTH = 16;
 /**
 * Relation names a parsed `$with` control reaches, per level. A dotted
-* name (`a.b`) nests like `a($with=b)`.
+* name (`a.b`) nests like `a($with=b)`. The relational predicates of each
+* entry's sub-filter (`$with=a(b=$some(…))`) join the entry's level
+* ({@link relationFilterNameTree}).
 */
 function withNameTree(withArr, into = /* @__PURE__ */ new Map(), depth = 0) {
 	if (!Array.isArray(withArr) || depth >= MAX_WITH_DEPTH) return into;
@@ -370,7 +376,29 @@ function withNameTree(withArr, into = /* @__PURE__ */ new Map(), depth = 0) {
 		if (depth + segments.length > MAX_WITH_DEPTH) continue;
 		let level = into;
 		for (const segment of segments) level = getOrCreate(level, segment, () => /* @__PURE__ */ new Map());
-		if (entry && typeof entry === "object") withNameTree(entry.controls?.$with ?? entry.$with, level, depth + segments.length);
+		if (entry && typeof entry === "object") {
+			withNameTree(entry.controls?.$with ?? entry.$with, level, depth + segments.length);
+			relationFilterNameTree(entry.filter, level, depth + segments.length);
+		}
+	}
+	return into;
+}
+/**
+* Relation names the relational predicates of a filter reach, per level
+* (`ticket=$some(team=$some(…))` → `ticket → { team }`), through
+* `$and` / `$or` / `$not` and nested predicate operands. Only reads
+* `filter` (moost-db hands `prepareRequest` a deep-frozen copy).
+*
+* @since 0.1.74
+*/
+function relationFilterNameTree(filter, into = /* @__PURE__ */ new Map(), depth = 0) {
+	if (!filter || typeof filter !== "object" || depth >= MAX_WITH_DEPTH) return into;
+	for (const [k, value] of Object.entries(filter)) if (k === "$and" || k === "$or") {
+		if (Array.isArray(value)) for (const c of value) relationFilterNameTree(c, into, depth);
+	} else if (k === "$not") relationFilterNameTree(value, into, depth);
+	else if (!k.startsWith("$") && hasRelationOp(value)) {
+		const level = getOrCreate(into, k, () => /* @__PURE__ */ new Map());
+		for (const [op, operand] of Object.entries(value)) if (isRelationOp(op)) relationFilterNameTree(operand, level, depth + 1);
 	}
 	return into;
 }
@@ -412,19 +440,35 @@ async function resolveRelationTree(scopes, table, names, opts = {}) {
 const requestRelationsKey = key("arbac.db.relations");
 /**
 * Per-request `$with` policy for the ARBAC DB controllers' `prepareRequest`:
-* resolves every relation `controls.$with` names (recursively) and stores
-* the resolution the request's visibility (`hasField`, `validateControls`,
-* `transformProjection`) reads.
+* resolves every relation `controls.$with` names (recursively) and — since
+* 0.1.74 — every relation the client `filter`'s relational predicates name
+* (`ticket=$some(…)`, also inside `$with` sub-filters), and stores the
+* resolution the request's visibility reads.
+*
+* @returns the relation names resolved, per level
 */
-async function resolveRequestRelations(scopes, controls, readable) {
+async function resolveRequestRelations(scopes, controls, readable, filter) {
 	const names = withNameTree(controls?.$with);
-	if (names.size === 0) return;
-	current().set(requestRelationsKey, await resolveRelationTree(scopes, readable, names));
+	const listSiblings = names.size > 0;
+	relationFilterNameTree(filter, names);
+	if (names.size === 0) return names;
+	const relations = await resolveRelationTree(scopes, readable, names, { listSiblings });
+	current().set(requestRelationsKey, {
+		readable,
+		relations
+	});
+	return names;
 }
-/** The resolution {@link resolveRequestRelations} stored for the current event, if any. */
-function requestRelations() {
+/**
+* The resolution {@link resolveRequestRelations} stored for the current
+* event, if any — only for the readable it was resolved for: another
+* controller evaluated in the same event (a `@DbActionsFrom` source) never
+* sees the delegating request's `$with` resolution.
+*/
+function requestRelations(readable) {
 	const ctx = current();
-	return ctx.has(requestRelationsKey) ? ctx.get(requestRelationsKey) : void 0;
+	const stored = ctx.has(requestRelationsKey) ? ctx.get(requestRelationsKey) : void 0;
+	return stored && stored.readable === readable ? stored.relations : void 0;
 }
 //#endregion
 //#region src/db/write-refs.ts
@@ -741,6 +785,20 @@ function arbacIdsFromMeta(cMeta, mMeta, controller, methodName) {
 		action: mMeta?.arbacActionId || mMeta?.atscript_db_action?.name || cMeta?.arbacActionId || mMeta?.id || methodName
 	};
 }
+const scopeOwners = /* @__PURE__ */ new WeakMap();
+/** Record that `scopes` were evaluated for `resource` / `action` (see {@link scopesOwnedBy}). */
+function tagScopesOwner(scopes, resource, action) {
+	scopeOwners.set(scopes, `${resource}\u0000${action}`);
+}
+/**
+* `true` when the cached `scopes` were set for `resource` / `action`. An
+* event slot read can fall through to a parent context (moost-db evaluates a
+* `@DbActionsFrom` source in a child of the delegating event), so scopes
+* cached for another handler are never taken as this handler's grant.
+*/
+function scopesOwnedBy(scopes, resource, action) {
+	return scopeOwners.get(scopes) === `${resource}\u0000${action}`;
+}
 /** The 403 every ARBAC deny answers. */
 function insufficientPrivileges(resource, action) {
 	return new HttpError(403, `Insufficient privileges for action "${action}" on resource "${resource}"`);
@@ -899,6 +957,7 @@ const useArbac = (_ctx) => {
 	const cc = useControllerContext(ctx);
 	const getScopes = () => getArbacScopes(ctx);
 	const setScopes = (scope) => {
+		if (scope) tagScopesOwner(scope, resource, action);
 		ctx.set(arbacScopesKey, scope);
 	};
 	const cMeta = cc.getControllerMeta();
@@ -1222,22 +1281,21 @@ function crudHandlers(op, methods) {
 *    `crud` already advertises no read surface, and write-only principals
 *    still need `type` for their insert/update forms. PK + `preferredId` are
 *    never pruned.
-* 3. The search surface: `searchIndexes` reading a hidden field are dropped,
-*    `searchable` / `vectorSearchable` / `geoSearchable` recomputed, and the
-*    `query` / `pages` control lists lose the controls that became unusable
-*    (`crud.geo` goes when no geo index is left).
+*
+* The search surface (`searchIndexes`, `searchable`, `vectorSearchable`,
+* `geoSearchable`) is narrowed by moost-db itself (≥ 0.1.147, under the
+* overridden `hasField`), after this overlay.
 *
 * @param source - the controller's `this.readable` (identifiers, relations
 *   and schema rules are derived from it); an identifier set (the 0.1.67
 *   signature) still works, without them
-* @param indexes - the controller's `indexFieldPaths()`; defaults to calling
-*   it on the current controller when it has one
+* @param _indexes - @deprecated ignored since 0.1.74 (moost-db prunes the search surface)
 */
-async function applyArbacMetaOverlay(meta, source, indexes) {
+async function applyArbacMetaOverlay(meta, source, _indexes) {
 	const instance = useControllerContext().getController();
 	const { methods } = controllerMethodIndex(instance);
 	const crudKeys = Object.keys(meta.crud);
-	const [allowedActions, crudScopes] = await Promise.all([grantedActions(instance, meta.actions.map((entry) => entry.name)), Promise.all(crudKeys.map((op) => evaluateHandlers(crudHandlers(op, methods).map((m) => resolveHandlerArbacIds(instance, m)))))]);
+	const [allowedActions, crudScopes] = await Promise.all([grantedActions(instance, meta.actions.map((entry) => entry.name)), Promise.all(crudKeys.map((op) => evaluateHandlers(crudHandlerIds(instance, op, methods))))]);
 	const allowed = new Set(allowedActions);
 	const actions = meta.actions.filter((entry) => allowed.has(entry.name));
 	const crud = {};
@@ -1267,11 +1325,11 @@ async function applyArbacMetaOverlay(meta, source, indexes) {
 	}
 	const vis = buildScopeVisibility(readScopes, source, { relations: await resolveRelationTree(readScopes, source, metaRelationNames(meta), { listSiblings: false }) });
 	const refTargets = await resolveRefTargets(vis, meta);
-	return pruneSearchSurface(pruneMetaByVisibility(overlaid, {
+	return pruneMetaByVisibility(overlaid, {
 		...vis,
 		writable,
 		nestedWrites
-	}, refTargets), meta, vis, indexes ?? controllerIndexes(instance));
+	}, refTargets);
 }
 const metaNamesCache = /* @__PURE__ */ new WeakMap();
 /** The relation names `/meta`'s serialized type reaches: root relations, then nav props of each nav body. */
@@ -1319,8 +1377,8 @@ async function resolveRefTargets(root, meta) {
 		if (!props || depth >= MAX_NAV_DEPTH) return;
 		for (const name of /* @__PURE__ */ new Set([...vis.relationNames ?? NO_NAMES, ...vis.withGrants])) {
 			const prop = props[name];
-			if (!prop || !isMetaFieldVisible(name, vis)) continue;
-			const sub = vis.relation?.(name);
+			if (!prop) continue;
+			const sub = visibleRelation(name, vis);
 			if (sub) visit(sub, prop, depth + 1);
 		}
 	};
@@ -1348,59 +1406,6 @@ function foreignRefTypes(table) {
 	});
 }
 const NO_TYPES = /* @__PURE__ */ new Set();
-/** Controls a text / vector search needs, dropped from `crud.query` / `crud.pages` when unusable. */
-const TEXT_SEARCH_CONTROLS = ["search", "fuzzy"];
-const VECTOR_CONTROLS = ["vector", "threshold"];
-/**
-* Drop `searchIndexes` reading a hidden field, recompute the search /
-* vector / geo flags over what is left (native search, or the visible
-* `@db.column.searchable` fallback), and remove the controls that became
-* unusable from the `query` / `pages` control lists (`crud.geo` goes with
-* the last visible geo index).
-*/
-function pruneSearchSurface(meta, original, vis, indexes) {
-	if (!indexes) return meta;
-	const shown = indexes.filter((e) => e.fields.every((f) => isMetaFieldVisible(f, vis)));
-	const shownOf = (type) => shown.some((e) => e.type === type);
-	const hasText = indexes.some((e) => e.type === "text");
-	const native = vis.table?.isSearchable?.() ?? hasText;
-	const fallback = searchFallbackVisible(meta, vis.table);
-	const searchable = original.searchable && (native && (!hasText || shownOf("text")) || fallback);
-	const vectorSearchable = original.vectorSearchable && shownOf("vector");
-	const geoSearchable = original.geoSearchable === true ? shownOf("geo") : original.geoSearchable;
-	const out = {
-		...meta,
-		searchIndexes: original.searchIndexes.filter((info) => shown.some((e) => e.name === info.name && e.type === (info.type ?? "text"))),
-		searchable,
-		vectorSearchable
-	};
-	if (geoSearchable !== void 0) out.geoSearchable = geoSearchable;
-	const drop = /* @__PURE__ */ new Set();
-	if (original.searchable && !searchable && !vectorSearchable) for (const c of TEXT_SEARCH_CONTROLS) drop.add(c);
-	if (original.vectorSearchable && !vectorSearchable) for (const c of VECTOR_CONTROLS) drop.add(c);
-	if (hasText && !shownOf("text")) drop.add("index");
-	if (drop.size > 0 || original.geoSearchable && !geoSearchable) {
-		const crud = { ...meta.crud };
-		for (const op of ["query", "pages"]) {
-			const list = crud[op];
-			if (list && drop.size > 0) crud[op] = list.filter((c) => !drop.has(c));
-		}
-		if (original.geoSearchable && !geoSearchable) delete crud.geo;
-		out.crud = crud;
-	}
-	return out;
-}
-/** A `@db.column.searchable` field is still listed (visible) in the pruned `fields`. */
-function searchFallbackVisible(meta, table) {
-	if (!table?.flatMap) return false;
-	for (const path of Object.keys(meta.fields)) if (table.flatMap.get(path)?.metadata?.has?.("db.column.searchable") && !meta.fields[path].writeOnly) return true;
-	return false;
-}
-/** The current controller's `indexFieldPaths()` (moost-db 0.1.143 DB readables), if it has one. */
-function controllerIndexes(instance) {
-	const c = instance;
-	return typeof c.indexFieldPaths === "function" ? c.indexFieldPaths() : void 0;
-}
 const methodIndexCache = /* @__PURE__ */ new WeakMap();
 /**
 * THE ARBAC ids an action is authorized as — used by the `/meta` overlay,
@@ -1432,14 +1437,20 @@ async function grantedActions(instance, names) {
 function controllerArbacResource(instance) {
 	return arbacIdsFromMeta(getMoostMate().read(instance), void 0, instance, "").resource;
 }
-/** A controller class's methods and `@DbAction` name → methods map (memoized per class). */
+/**
+* A controller class's methods and `@DbAction` name → methods map (memoized
+* per class). The method metadata is read from `instance` itself — never from
+* the event's current controller, which differs whenever another
+* controller's actions are evaluated in this event (a view's
+* `@DbActionsFrom` delegation).
+*/
 function controllerMethodIndex(instance) {
 	return getOrCreate(methodIndexCache, getConstructor(instance), () => {
-		const cc = useControllerContext();
+		const mate = getMoostMate();
 		const methods = new Set(collectMethodNames(instance));
 		const actionMethods = /* @__PURE__ */ new Map();
 		for (const methodName of methods) {
-			const name = cc.getMethodMeta(methodName)?.atscript_db_action?.name;
+			const name = mate.read(instance, methodName)?.atscript_db_action?.name;
 			if (name) getOrCreate(actionMethods, name, () => []).push(methodName);
 		}
 		return {
@@ -1448,6 +1459,18 @@ function controllerMethodIndex(instance) {
 		};
 	});
 }
+/** The ARBAC ids of the handler method(s) serving crud op `op` on `instance` (`useArbac()` precedence). */
+function crudHandlerIds(instance, op, methods = controllerMethodIndex(instance).methods) {
+	return crudHandlers(op, methods).map((m) => resolveHandlerArbacIds(instance, m));
+}
+/**
+* The ARBAC ids of `instance`'s READ handler — the `query` crud op's
+* handler method(s), exactly what the `/meta` overlay evaluates for
+* `crud.query`.
+*/
+function readHandlerIds(instance) {
+	return crudHandlerIds(instance, "query");
+}
 /**
 * Test-friendly internal helper — exported for unit tests and helper
 * composition; regular consumers should not call this directly.
@@ -1474,6 +1497,124 @@ function collectMethodNames(instance) {
 	return [...names];
 }
 //#endregion
+//#region src/db/shared-read-helpers.ts
+/**
+* Restrict the user-supplied `$select` to the scopes' projection union.
+* Returns the original projection untouched when no scope declares a
+* projection (so caller sees the unrestricted shape). Reads the same cached
+* visibility (`vis.allowed`) `hasField` / `/meta` pruning use, so value
+* stripping and name hiding cannot drift.
+*
+* `projection` is the `$select` as moost-db parsed it: an inclusion is an
+* ARRAY of names, an exclusion an object — both are normalized first. A
+* requested parent (`$select=a`) narrows to what the scope shows: to the
+* whitelisted descendants (`a.b: 1`), or — for a hidden descendant
+* (`a.c: 0`) — to its visible children via `childrenOf` (without a schema
+* the parent is dropped). Never the whole object, and never the empty
+* (universe) projection: when nothing survives, the scope's own projection
+* applies (`restrictProjection`'s ceiling fallback).
+*
+* An exclusion result names nested-object parents by their leaves
+* (`{ a: 0 }` → `{ "a.b": 0, "a.c": 0 }`): flattening adapters invert an
+* exclusion against their leaf columns, so a parent key alone would strip
+* nothing (a scope `{ a: 0 }` would otherwise return all of `a`).
+*
+* @since 0.1.72
+*/
+function applyArbacProjection(projection, scopes, readable) {
+	return restrictSelect(projection, visibilityFor(scopes, readable));
+}
+/** {@link applyArbacProjection} over an already-built visibility level. */
+function restrictSelect(projection, vis) {
+	if (Object.keys(vis.allowed).length === 0) return projection;
+	const childrenOf = fieldChildrenOf(vis.table);
+	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
+}
+/**
+* Enforce the union of per-scope `controls` gates against the parsed
+* Uniquery controls. Throws `HttpError(403)` on the first violation.
+*
+* @since 0.1.72
+*/
+function applyArbacControls(controls, scopes) {
+	enforceControlsPolicy(effectiveScope(scopes).controls, controls);
+}
+/**
+* The per-role `controls.$with` gates over every relation a read reaches —
+* its `$with` entries and its client relational predicates alike (see
+* `prepareArbacRequest`) — each level against that level's scopes.
+* Overlaps `validateControls`' gate for the `$with` entries on purpose: one
+* rule for both. Throws `HttpError(403)` on the first violation; a hidden
+* relation's nested names are left to moost-db (`Unknown field`).
+*
+* @since 0.1.74
+*/
+function enforceRelationGates(names, vis) {
+	if (!vis?.scopes || names.size === 0) return;
+	enforceControlsPolicy(effectiveScope(vis.scopes).controls, { $with: [...names.keys()] });
+	for (const [name, nested] of names) if (nested.size > 0) enforceRelationGates(nested, visibleRelation(name, vis));
+}
+/**
+* Walk the user-supplied `$with` items in `controls` and overlay each joined
+* relation with the policy of its rows (the `$with` inherit-target policy):
+* a relation some scope declares `with.<name>` for gets the union of those
+* sub-scopes (parent authority — silent roles contribute nothing); any other
+* gets the caller's OWN read scopes on the related table, as resolved in
+* `prepareRequest` (for the request's own scopes). Filter conjoined, `$select`
+* restricted, per-relation `controls` gates enforced, recursively.
+*
+* Mutates `controls` in place (matches the `validateControls` contract).
+* Throws `HttpError(403)` if a per-relation control policy is violated. A
+* hidden relation is skipped: moost-db (≥ 0.1.143) rejects it at every
+* level through `hasField`, byte-for-byte like a nonexistent one.
+*
+* @since 0.1.72
+*/
+function applyArbacRelationScopes(controls, scopes, readable) {
+	const withArr = controls.$with;
+	if (!Array.isArray(withArr) || withArr.length === 0) return;
+	applyRelationLevel(controls, visibilityFor(scopes, readable));
+}
+/** One `$with` level of {@link applyArbacRelationScopes}. */
+function applyRelationLevel(controls, vis) {
+	const withArr = controls.$with;
+	if (!Array.isArray(withArr) || withArr.length === 0) return;
+	for (const raw of withArr) {
+		if (!raw || typeof raw !== "object") continue;
+		const entry = raw;
+		if (typeof entry.name !== "string" || entry.name.includes(".")) continue;
+		const level = (!vis.relationNames || vis.relationNames.has(entry.name)) && isMetaFieldVisible(entry.name, vis) ? vis.relation?.(entry.name) : void 0;
+		if (!level) continue;
+		const sub = effectiveScope(level.scopes ?? []);
+		const conjoined = conjoinScopeFilters$1(sub.filter, entry.filter);
+		if (conjoined) entry.filter = conjoined;
+		const entryControls = entry.controls ?? {};
+		const restricted = restrictSelect(entryControls.$select, level);
+		if (restricted !== void 0) {
+			entryControls.$select = restricted;
+			entry.controls = entryControls;
+		}
+		enforceControlsPolicy(sub.controls, entryControls);
+		applyRelationLevel(entryControls, level);
+	}
+}
+/**
+* `$select` may be an array of field names (uniquery inclusion list) or a
+* `TProjection` object. `restrictProjection` operates on the object form
+* (it would read `["a"]` as an exclusion keyed `"0"`), so normalize the array
+* to `{ field: 1 }` first. Returns undefined if the input is empty (caller
+* treats as "no projection set").
+*/
+function normalizeSelect(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (Array.isArray(value)) {
+		const out = {};
+		for (const item of value) if (typeof item === "string") out[item] = 1;
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
+	if (typeof value === "object") return value;
+}
+//#endregion
 //#region src/db/request-scopes.ts
 /** Endpoints whose `prepareRequest` carries parsed Uniquery controls. */
 const READ_ENDPOINTS = /* @__PURE__ */ new Set([
@@ -1519,7 +1660,8 @@ function cachedRequestScopes() {
 async function resolveRequestScopes() {
 	const ctx = current();
 	const arbac = useArbac(ctx);
-	const fromInterceptor = arbac.getScopes();
+	const cachedScopes = arbac.getScopes();
+	const fromInterceptor = cachedScopes && scopesOwnedBy(cachedScopes, arbac.resource, arbac.action) ? cachedScopes : void 0;
 	const prior = resolved();
 	if (prior && prior.resource === arbac.resource && prior.action === arbac.action && prior.source === fromInterceptor) return prior.scopes;
 	const scopes = normalizeScopes(fromInterceptor !== void 0 ? {
@@ -1551,7 +1693,7 @@ function requireRequestScopes() {
 */
 function visibilityFor(scopes, source) {
 	const request = resolved();
-	if (source && !isIdentifierSet(source) && request?.scopes === scopes) return getOrCreate(request.visibility, source, () => buildScopeVisibility(scopes, source, { relations: requestRelations() }));
+	if (source && !isIdentifierSet(source) && request?.scopes === scopes) return getOrCreate(request.visibility, source, () => buildScopeVisibility(scopes, source, { relations: requestRelations(source) }));
 	return scopeVisibility(scopes, source);
 }
 /**
@@ -1585,7 +1727,18 @@ function isScopedFieldVisible(scopes, path, source) {
 * action id / row is read): resolve the request's scopes
 * ({@link resolveRequestScopes} — 403 on denial, `arbacPublic` does not
 * bypass) and, on read endpoints, the `$with` relation policy for the
-* requested relations.
+* requested relations — the `$with` entries and, since 0.1.74, the
+* relations the client filter's relational predicates name (`ctx.filter`):
+* a predicate on a relation is allowed exactly when `$with` of it is (same
+* visibility, same `controls.$with` gates).
+*
+* Delegated endpoints (no grant of their own): `"availableActions"`
+* (`GET /meta/actions…`) — some row-level action grant (or, on a
+* `@DbActionsFrom` controller, none: its own part lists nothing);
+* `"delegatedAction"` (`POST /delegated-actions/:name`, since 0.1.74) — the
+* controller's READ grant, since the route only resolves which of the
+* caller's readable rows match the query; the action itself is authorized
+* by its source controller on every batch.
 *
 * @since 0.1.72
 */
@@ -1594,8 +1747,12 @@ async function prepareArbacRequest(ctx, readable) {
 		await authorizeAvailableActions();
 		return;
 	}
+	if (ctx.endpoint === "delegatedAction") {
+		await authorizeDelegatedQueryTarget();
+		return;
+	}
 	const scopes = await resolveRequestScopes();
-	if (ctx.controls && READ_ENDPOINTS.has(ctx.endpoint)) await resolveRequestRelations(scopes, ctx.controls, readable);
+	if (READ_ENDPOINTS.has(ctx.endpoint)) enforceRelationGates(await resolveRequestRelations(scopes, ctx.controls, readable, ctx.filter), visibilityFor(scopes, readable));
 }
 /**
 * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
@@ -1621,14 +1778,42 @@ function actionsIds(names) {
 * overlay stays unrestricted — each action's rows come from
 * `actionRowScope` ({@link arbacActionRowScope}) — while field visibility
 * is never wider than the widest granted action.
+*
+* A `@DbActionsFrom` controller without an own row-level grant is served
+* too (since 0.1.74): its own part lists nothing (a match-nothing row
+* overlay), and each delegated action is answered by its source controller,
+* under the caller's grants THERE.
 */
 async function authorizeAvailableActions() {
 	const ctx = current();
 	const instance = useControllerContext(ctx).getController();
-	const granted = await evaluateHandlers(actionsIds(discoverRowLevelActions(getConstructor(instance), instance.app, instance.logger).map((e) => e.info.name)));
+	const ctor = getConstructor(instance);
+	const granted = await evaluateHandlers(actionsIds(discoverRowLevelActions(ctor, instance.app, instance.logger).map((e) => e.info.name)));
 	const arbac = useArbac(ctx);
-	if (!granted) throw insufficientPrivileges(arbac.resource, arbac.action);
-	storeResolved(ctx, arbac, void 0, granted.map(withoutRowPolicy));
+	if (granted) storeResolved(ctx, arbac, void 0, granted.map(withoutRowPolicy));
+	else if (hasActionDelegations(ctor)) storeResolved(ctx, arbac, void 0, NO_OWN_ACTIONS);
+	else throw insufficientPrivileges(arbac.resource, arbac.action);
+}
+/** The own scopes of a delegating controller's `GET /meta/actions` without an own grant. */
+const NO_OWN_ACTIONS = [{
+	filter: DENY_FILTER,
+	check: DENY_FILTER
+}];
+/**
+* `POST /delegated-actions/:name` (endpoint `"delegatedAction"`): the route
+* resolves which rows of THIS controller match the query — a read, so it
+* is served under the caller's read grant (its `query` handler; none →
+* 403), stored as the request's scopes (`transformFilter`, `hasField` and
+* moost-db's default `queryTargetScope` read them). It grants nothing on
+* the action: the source controller's route re-authorizes every batch.
+*/
+async function authorizeDelegatedQueryTarget() {
+	const ctx = current();
+	const arbac = useArbac(ctx);
+	const ids = readHandlerIds(useControllerContext(ctx).getController());
+	const scopes = ids.length > 0 ? await evaluateHandlers(ids) : void 0;
+	if (!scopes) throw insufficientPrivileges(ids[0]?.resource ?? arbac.resource, ids[0]?.action ?? "query");
+	storeResolved(ctx, arbac, void 0, scopes);
 }
 /** A scope without its row policy (`filter` / `check`). */
 function withoutRowPolicy(scope) {
@@ -1653,12 +1838,17 @@ const actionScopes = cached(() => /* @__PURE__ */ new Map());
 * `@DbAction` `name` may run on — the filter of the caller's grant on the
 * action ({@link actionArbacIds}: every handler method of the action, or a
 * class-level entry's fallback ids), including custom-field row filters and
-* credential attenuation. No grant → a match-nothing filter (fail closed);
-* an unrestricted grant → `undefined`. When the current request IS that
-* action (its resolved scopes are the same evaluation), the row overlay
+* credential attenuation. Several grants union (`$or`); attenuation is
+* already intersected into each. No grant → a match-nothing filter (fail
+* closed); an unrestricted grant → `undefined`. When the current request IS
+* that action (its resolved scopes are the same evaluation), the row overlay
 * already applies it → `undefined`. Equal filters are returned as ONE
 * object per request.
 *
+* Candidate-free on purpose (evaluated once per action per event) — see
+* `AsArbacDbController.actionRowScope` to bound an action by its candidate
+* rows.
+*
 * @since 0.1.72
 */
 async function arbacActionRowScope(name) {
@@ -1681,110 +1871,26 @@ async function arbacActionRowScope(name) {
 * @since 0.1.72
 */
 function arbacRowFilter(filter) {
-	return conjoinScopeFilters(effectiveScope(requireRequestScopes()).filter, filter) ?? {};
-}
-//#endregion
-//#region src/db/shared-read-helpers.ts
-/**
-* Restrict the user-supplied `$select` to the scopes' projection union.
-* Returns the original projection untouched when no scope declares a
-* projection (so caller sees the unrestricted shape). Reads the same cached
-* visibility (`vis.allowed`) `hasField` / `/meta` pruning use, so value
-* stripping and name hiding cannot drift.
-*
-* `projection` is the `$select` as moost-db parsed it: an inclusion is an
-* ARRAY of names, an exclusion an object — both are normalized first. A
-* requested parent (`$select=a`) narrows to what the scope shows: to the
-* whitelisted descendants (`a.b: 1`), or — for a hidden descendant
-* (`a.c: 0`) — to its visible children via `childrenOf` (without a schema
-* the parent is dropped). Never the whole object, and never the empty
-* (universe) projection: when nothing survives, the scope's own projection
-* applies (`restrictProjection`'s ceiling fallback).
-*
-* An exclusion result names nested-object parents by their leaves
-* (`{ a: 0 }` → `{ "a.b": 0, "a.c": 0 }`): flattening adapters invert an
-* exclusion against their leaf columns, so a parent key alone would strip
-* nothing (a scope `{ a: 0 }` would otherwise return all of `a`).
-*
-* @since 0.1.72
-*/
-function applyArbacProjection(projection, scopes, readable) {
-	return restrictSelect(projection, visibilityFor(scopes, readable));
-}
-/** {@link applyArbacProjection} over an already-built visibility level. */
-function restrictSelect(projection, vis) {
-	if (Object.keys(vis.allowed).length === 0) return projection;
-	const childrenOf = fieldChildrenOf(vis.table);
-	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
-}
-/**
-* Enforce the union of per-scope `controls` gates against the parsed
-* Uniquery controls. Throws `HttpError(403)` on the first violation.
-*
-* @since 0.1.72
-*/
-function applyArbacControls(controls, scopes) {
-	enforceControlsPolicy(effectiveScope(scopes).controls, controls);
-}
-/**
-* Walk the user-supplied `$with` items in `controls` and overlay each joined
-* relation with the policy of its rows (the `$with` inherit-target policy):
-* a relation some scope declares `with.<name>` for gets the union of those
-* sub-scopes (parent authority — silent roles contribute nothing); any other
-* gets the caller's OWN read scopes on the related table, as resolved in
-* `prepareRequest` (for the request's own scopes). Filter conjoined, `$select`
-* restricted, per-relation `controls` gates enforced, recursively.
+	return conjoinScopeFilters$1(effectiveScope(requireRequestScopes()).filter, filter) ?? {};
+}
+/**
+* Body of the ARBAC DB controllers' `transformRelationFilter` (since 0.1.74):
+* the operand of a CLIENT relational predicate at `path` (`ticket`,
+* `ticket.team`, `tickets.issues` inside `$with=tickets(…)`) CONJOINED
+* with the row filter of the related rows the caller may see there — the
+* same policy `$with` of that relation applies: a declared `with.<rel>`
+* sub-scope, else the caller's own read grant on the related table. So
+* `$some` matches, and `$none` excludes, only on rows the caller could
+* load. A relation the request did not resolve answers like an unknown
+* field (400 — the request gate rejects it first).
 *
-* Mutates `controls` in place (matches the `validateControls` contract).
-* Throws `HttpError(403)` if a per-relation control policy is violated. A
-* hidden relation is skipped: moost-db (≥ 0.1.143) rejects it at every
-* level through `hasField`, byte-for-byte like a nonexistent one.
-*
-* @since 0.1.72
+* @since 0.1.74
 */
-function applyArbacRelationScopes(controls, scopes, readable) {
-	const withArr = controls.$with;
-	if (!Array.isArray(withArr) || withArr.length === 0) return;
-	applyRelationLevel(controls, visibilityFor(scopes, readable));
-}
-/** One `$with` level of {@link applyArbacRelationScopes}. */
-function applyRelationLevel(controls, vis) {
-	const withArr = controls.$with;
-	if (!Array.isArray(withArr) || withArr.length === 0) return;
-	for (const raw of withArr) {
-		if (!raw || typeof raw !== "object") continue;
-		const entry = raw;
-		if (typeof entry.name !== "string" || entry.name.includes(".")) continue;
-		const level = (!vis.relationNames || vis.relationNames.has(entry.name)) && isMetaFieldVisible(entry.name, vis) ? vis.relation?.(entry.name) : void 0;
-		if (!level) continue;
-		const sub = effectiveScope(level.scopes ?? []);
-		const conjoined = conjoinScopeFilters(sub.filter, entry.filter);
-		if (conjoined) entry.filter = conjoined;
-		const entryControls = entry.controls ?? {};
-		const restricted = restrictSelect(entryControls.$select, level);
-		if (restricted !== void 0) {
-			entryControls.$select = restricted;
-			entry.controls = entryControls;
-		}
-		enforceControlsPolicy(sub.controls, entryControls);
-		applyRelationLevel(entryControls, level);
-	}
-}
-/**
-* `$select` may be an array of field names (uniquery inclusion list) or a
-* `TProjection` object. `restrictProjection` operates on the object form
-* (it would read `["a"]` as an exclusion keyed `"0"`), so normalize the array
-* to `{ field: 1 }` first. Returns undefined if the input is empty (caller
-* treats as "no projection set").
-*/
-function normalizeSelect(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (Array.isArray(value)) {
-		const out = {};
-		for (const item of value) if (typeof item === "string") out[item] = 1;
-		return Object.keys(out).length > 0 ? out : void 0;
-	}
-	if (typeof value === "object") return value;
+function arbacRelationFilter(path, filter, readable) {
+	let level = visibilityFor(requireRequestScopes(), readable);
+	for (const name of path.split(".")) level = level && visibleRelation(name, level);
+	if (!level?.scopes) throw badRequest(path, `Unknown field "${path}"`);
+	return conjoinScopeFilters$1(effectiveScope(level.scopes).filter, filter) ?? filter;
 }
 //#endregion
 //#region src/db/write-fields.ts
@@ -1914,14 +2020,20 @@ var UnsupportedCheckError = class extends Error {};
 * BEFORE the write. Deliberately a small subset of the filter language
 * (`$eq`/`$ne`/`$in`/`$nin`/ordering/`$exists` + `$and`/`$or`/`$not`) with the
 * database's null model (`$eq: null` matches null or missing, `$exists`
-* means "holds a non-null value"); any other operator (e.g. `$regex`) throws
-* {@link UnsupportedCheckError} — callers fail closed.
+* means "holds a non-null value"); any other operator (e.g. `$regex`) and
+* a relational predicate (`{ ticket: { $some: … } }` — it needs the related
+* rows) throw {@link UnsupportedCheckError} — callers fail closed.
 */
 function compileScopeCheck(filter) {
 	return walkFilter(filter, checkVisitor) ?? (() => true);
 }
-/** The field paths a filter references (dotted, as written). */
+/**
+* The field paths a filter references (dotted, as written). A relational
+* predicate throws {@link UnsupportedCheckError} (its fields live on the
+* related table).
+*/
 function checkFields(filter) {
+	if (containsRelationFilter(filter)) throw new UnsupportedCheckError("relational predicate");
 	return new Set(computeInsights(filter).keys());
 }
 function same(a, b) {
@@ -1938,6 +2050,9 @@ const checkVisitor = {
 	and: (children) => (row) => children.every((c) => c(row)),
 	or: (children) => (row) => children.some((c) => c(row)),
 	not: (child) => (row) => !child(row),
+	relation(field, op) {
+		throw new UnsupportedCheckError(`${field}: ${op}`);
+	},
 	comparison(field, op, value) {
 		const read = (row) => getPath(row, field);
 		const compare = (test) => (row) => {
@@ -2115,9 +2230,23 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	prepareRequest(ctx) {
 		return prepareArbacRequest(ctx, this.readable);
 	}
+	/**
+	* The request filter ∧ the union of the scopes' `filter`s. Computed
+	* synchronously, but typed with moost-db's async-capable contract
+	* (`FilterExpr | Promise<FilterExpr>`) so a subclass may override it
+	* `async` — `await super.transformFilter(filter)` — and moost-db awaits it.
+	*/
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
+	/** A client relational predicate's operand ∧ the related rows the caller may see ({@link arbacRelationFilter}). Since 0.1.74. */
+	transformRelationFilter(path, filter) {
+		return arbacRelationFilter(path, filter, this.readable);
+	}
+	/**
+	* `$select` restricted to the scopes' projection union. Synchronous, typed
+	* async-capable like {@link transformFilter}.
+	*/
 	transformProjection(projection) {
 		return applyArbacProjection(projection, requireRequestScopes(), this.readable);
 	}
@@ -2180,10 +2309,22 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 	/**
 	* The rows each `@DbAction` may run on: the caller's grant on that action
-	* (see `arbacActionRowScope`). Enforced by the action gate and reflected
-	* in `$actions` and `GET /meta/actions/:id`. Since 0.1.72.
+	* ({@link arbacActionRowScope} — several grants union, attenuation
+	* intersects). Enforced by the action gate and reflected in `$actions` and
+	* `GET /meta/actions/:id`. Since 0.1.72.
+	*
+	* The grant does not depend on `ctx` (the candidate rows, since 0.1.74).
+	* To bound an action further by the candidates, override and AND your
+	* filter onto `super`'s — it must never replace it:
+	*
+	* ```ts
+	* protected async actionRowScope(name: string, ctx: TDbActionScopeContext) {
+	*   const grant = await super.actionRowScope(name, ctx);
+	*   return conjoinScopeFilters(grant, await myCandidateScope(name, ctx));
+	* }
+	* ```
 	*/
-	actionRowScope(name) {
+	actionRowScope(name, _ctx) {
 		return arbacActionRowScope(name);
 	}
 	/**
@@ -2366,6 +2507,10 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
+	/** Same contract as {@link AsArbacDbController.transformRelationFilter}. Since 0.1.74. */
+	transformRelationFilter(path, filter) {
+		return arbacRelationFilter(path, filter, this.readable);
+	}
 	/** Same contract as {@link AsArbacDbController.transformProjection}. */
 	transformProjection(projection) {
 		return applyArbacProjection(projection, requireRequestScopes(), this.readable);
@@ -2387,7 +2532,7 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 		return authorizeArbacForm(actionNames);
 	}
 	/** Same contract as {@link AsArbacDbController.actionRowScope}. */
-	actionRowScope(name) {
+	actionRowScope(name, _ctx) {
 		return arbacActionRowScope(name);
 	}
 	/** Same contract as {@link AsArbacDbController.allowedActions}. */
@@ -2467,6 +2612,7 @@ let AsArbacValueHelpController = class AsArbacValueHelpController extends AsValu
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
 	}
+	/** Same contract as {@link AsArbacDbController.transformFilter}. */
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
@@ -2501,25 +2647,25 @@ __decorate([
 	ArbacAction("query"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runQuery", null);
 __decorate([
 	ArbacAction("pages"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runPages", null);
 __decorate([
 	ArbacAction("getOne"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runGetOne", null);
 __decorate([
 	ArbacAction("getOneComposite"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runGetOneComposite", null);
 AsArbacValueHelpController = __decorate([Inherit()], AsArbacValueHelpController);
 let AsArbacJsonValueHelpController = class AsArbacJsonValueHelpController extends AsJsonValueHelpController {
@@ -2530,6 +2676,7 @@ let AsArbacJsonValueHelpController = class AsArbacJsonValueHelpController extend
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
 	}
+	/** Same contract as {@link AsArbacDbController.transformFilter}. */
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
@@ -2564,25 +2711,25 @@ __decorate([
 	ArbacAction("query"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runQuery", null);
 __decorate([
 	ArbacAction("pages"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runPages", null);
 __decorate([
 	ArbacAction("getOne"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runGetOne", null);
 __decorate([
 	ArbacAction("getOneComposite"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runGetOneComposite", null);
 AsArbacJsonValueHelpController = __decorate([Inherit()], AsArbacJsonValueHelpController);
 //#endregion
@@ -2609,7 +2756,7 @@ async function useArbacDbScope() {
 	const visibleOn = (table) => (path) => isScopedFieldVisible(scopes, path, table);
 	return {
 		scopes,
-		filter: (extra) => conjoinScopeFilters(eff.filter, extra) ?? {},
+		filter: (extra) => conjoinScopeFilters$1(eff.filter, extra) ?? {},
 		set: () => ({ ...eff.set }),
 		check: () => eff.check ?? {},
 		async assertRowsInScope(table, ids) {
@@ -2649,4 +2796,4 @@ async function useArbacDbScope() {
 	};
 }
 //#endregion
-export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };

package/dist/{user.provider-NMSzynGK.d.mts → user.provider-CKjmUhkx.d.mts}

@@ -1,7 +1,7 @@
-import { Mate, TClassConstructor, TMateParamMeta, TMoostMetadata } from "moost";
 import { ControlGate, TProjection, TProjectionChildren, TScopeFieldRules, TScopeFilter } from "@aooth/arbac";
-import { TDbRemoveGuardContext, TDbWriteAction, TDbWriteCheckContext, TDbWriteGuardContext, TMetaResponse } from "@atscript/db";
-import { AsDbController, TDbControlsType, TDbRequestContext } from "@atscript/moost-db";
+import { Mate, TClassConstructor, TMateParamMeta, TMoostMetadata } from "moost";
+import { FilterExpr, TDbRemoveGuardContext, TDbWriteAction, TDbWriteCheckContext, TDbWriteGuardContext, TMetaResponse, UniqueryControls } from "@atscript/db";
+import { AsDbController, TDbActionScopeContext, TDbControlsType, TDbRequestContext } from "@atscript/moost-db";
 import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType, TAtscriptDataType } from "@atscript/typescript/utils";
 //#region src/arbac.mate.d.ts
 /**
@@ -124,6 +124,7 @@ type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate> : {
 declare function applyAllowedFieldsAndSet(data: unknown, scopes: ArbacDbScope[], preserveFields?: readonly string[], isMergePatch?: (objectPath: string) => boolean): unknown;
 //#endregion
 //#region src/db/as-arbac-db-controller.d.ts
+type TSelect = UniqueryControls["$select"];
 /**
  * Contract returned by an ARBAC role's scope predicate on a DB-backed resource.
  *
@@ -269,8 +270,20 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    * is resolved for the requested relations.
    */
   protected prepareRequest(ctx: TDbRequestContext): Promise<void>;
-  protected transformFilter(filter: Record<string, unknown> | undefined): Record<string, unknown>;
-  protected transformProjection(projection?: TProjection): TProjection | undefined;
+  /**
+   * The request filter ∧ the union of the scopes' `filter`s. Computed
+   * synchronously, but typed with moost-db's async-capable contract
+   * (`FilterExpr | Promise<FilterExpr>`) so a subclass may override it
+   * `async` — `await super.transformFilter(filter)` — and moost-db awaits it.
+   */
+  protected transformFilter(filter: Record<string, unknown> | undefined): FilterExpr | Promise<FilterExpr>;
+  /** A client relational predicate's operand ∧ the related rows the caller may see ({@link arbacRelationFilter}). Since 0.1.74. */
+  protected transformRelationFilter(path: string, filter: FilterExpr): FilterExpr | Promise<FilterExpr>;
+  /**
+   * `$select` restricted to the scopes' projection union. Synchronous, typed
+   * async-capable like {@link transformFilter}.
+   */
+  protected transformProjection(projection?: TSelect): TSelect | undefined | Promise<TSelect | undefined>;
   /**
    * Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
    * bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
@@ -308,10 +321,22 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
   protected authorizeForm(_name: string, actionNames: readonly string[]): Promise<boolean>;
   /**
    * The rows each `@DbAction` may run on: the caller's grant on that action
-   * (see `arbacActionRowScope`). Enforced by the action gate and reflected
-   * in `$actions` and `GET /meta/actions/:id`. Since 0.1.72.
+   * ({@link arbacActionRowScope} — several grants union, attenuation
+   * intersects). Enforced by the action gate and reflected in `$actions` and
+   * `GET /meta/actions/:id`. Since 0.1.72.
+   *
+   * The grant does not depend on `ctx` (the candidate rows, since 0.1.74).
+   * To bound an action further by the candidates, override and AND your
+   * filter onto `super`'s — it must never replace it:
+   *
+   * ```ts
+   * protected async actionRowScope(name: string, ctx: TDbActionScopeContext) {
+   *   const grant = await super.actionRowScope(name, ctx);
+   *   return conjoinScopeFilters(grant, await myCandidateScope(name, ctx));
+   * }
+   * ```
    */
-  protected actionRowScope(name: string): Promise<Record<string, unknown> | undefined>;
+  protected actionRowScope(name: string, _ctx?: TDbActionScopeContext): Promise<Record<string, unknown> | undefined>;
   /**
    * The row-level actions `$actions` and `GET /meta/actions/:id` may list:
    * those the caller holds a grant on (the `/meta` overlay's rule, without

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.72",
+  "version": "0.1.74",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.11",
-    "@aooth/arbac": "0.1.72",
-    "@aooth/user": "0.1.72",
-    "@aooth/arbac-core": "0.1.72"
+    "@uniqu/core": "^0.1.12",
+    "@aooth/arbac-core": "0.1.74",
+    "@aooth/user": "0.1.74",
+    "@aooth/arbac": "0.1.74"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.97",
-    "@atscript/db": "^0.1.145",
-    "@atscript/db-sql-tools": "^0.1.145",
-    "@atscript/db-sqlite": "^0.1.145",
-    "@atscript/moost-db": "^0.1.145",
-    "@atscript/typescript": "^0.1.97",
-    "@moostjs/event-http": "^0.6.41",
+    "@atscript/core": "^0.1.99",
+    "@atscript/db": "^0.1.147",
+    "@atscript/db-sql-tools": "^0.1.147",
+    "@atscript/db-sqlite": "^0.1.147",
+    "@atscript/moost-db": "^0.1.147",
+    "@atscript/typescript": "^0.1.99",
+    "@moostjs/event-http": "^0.6.43",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.97"
+    "unplugin-atscript": "^0.1.99"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.145",
-    "@atscript/moost-db": "^0.1.145",
-    "@atscript/typescript": "^0.1.97",
-    "@moostjs/event-http": "^0.6.41",
-    "@wooksjs/event-core": "^0.7.24",
-    "@wooksjs/event-http": "^0.7.24",
-    "moost": "^0.6.41"
+    "@atscript/db": "^0.1.147",
+    "@atscript/moost-db": "^0.1.147",
+    "@atscript/typescript": "^0.1.99",
+    "@moostjs/event-http": "^0.6.43",
+    "@wooksjs/event-core": "^0.7.26",
+    "@wooksjs/event-http": "^0.7.26",
+    "moost": "^0.6.43"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {