@aooth/arbac-moost 0.1.73 → 0.1.75

package/dist/index.mjs

@@ -1,11 +1,11 @@
 import { i as __decorate, n as ArbacUserProvider, r as ArbacUserProviderToken, t as __decorateMetadata } from "./decorateMetadata-CU_mqYGT.mjs";
 import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core";
+import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilters, conjoinScopeFilters, conjoinScopeFilters as conjoinScopeFilters$1, conjoinScopes, effectiveScope, expandExcludeToLeaves, getProjectionMode, intersectEnabled, isFieldAllowed, needsInheritedConjunction, normalizeScopes, restrictProjection, stableKey, unionOutcomes } from "@aooth/arbac";
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { cached, cachedBy, current, eventTypeKey, key, tryGetCurrent } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
-import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilters, conjoinScopeFilters, conjoinScopes, effectiveScope, expandExcludeToLeaves, getProjectionMode, intersectEnabled, isFieldAllowed, needsInheritedConjunction, normalizeScopes, restrictProjection, stableKey, unionOutcomes } from "@aooth/arbac";
-import { computeInsights, findAncestorInSet, getPath, isPlainObject } from "@atscript/db";
-import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, discoverRowLevelActions, getDbEndpoint, resolveTerminalRef } from "@atscript/moost-db";
+import { computeInsights, containsRelationFilter, findAncestorInSet, getPath, hasRelationOp, isPlainObject, isRelationOp, translateQueryTree } from "@atscript/db";
+import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, badRequest, discoverRowLevelActions, getControllerFormType, getDbEndpoint, hasActionDelegations, resolveTerminalRef } from "@atscript/moost-db";
 import { groupByFields, walkFilter } from "@uniqu/core";
 //#region src/db/helpers.ts
 /** `map.get(key)`, created with `create()` and stored on a miss. */
@@ -110,6 +110,10 @@ function isMetaFieldVisible(path, vis) {
 	}
 	return allowed(path);
 }
+/** The level of relation `name` when it is visible at `vis` (see {@link isMetaFieldVisible}). */
+function visibleRelation(name, vis) {
+	return isMetaFieldVisible(name, vis) ? vis.relation?.(name) : void 0;
+}
 const NO_NAMES$1 = /* @__PURE__ */ new Set();
 const identifierSetCache = /* @__PURE__ */ new WeakMap();
 /** PK + `preferredId` of a table — the identifiers reads always return. */
@@ -294,11 +298,28 @@ const registry = /* @__PURE__ */ new WeakMap();
 */
 function registerArbacDbTarget(controller) {
 	const c = controller;
-	const target = c.readable?.type ?? c.readable;
+	const target = valueHelpTargets.get(controller)?.source.type ?? c.readable?.type ?? c.readable;
 	if (!target) return true;
 	getOrCreate(getOrCreate(registry, c.app ?? NO_APP, () => /* @__PURE__ */ new WeakMap()), target, () => /* @__PURE__ */ new Map()).set(getConstructor(controller), controller);
 	return true;
 }
+/** Value-help controllers have no `readable`: their visibility source and read handler method. */
+const valueHelpTargets = /* @__PURE__ */ new WeakMap();
+/**
+* Register an ARBAC value-help controller as an owner of its bound type's
+* ARBAC resource, so a `ui.valueHelp` binding (or `ref`) from another
+* controller's `/meta` is kept for a caller who can read the dictionary
+* through it (its `runQuery` grant, evaluated against `source`).
+*
+* @returns `true` (so it can initialize a field)
+*/
+function registerArbacValueHelpTarget(controller, source) {
+	valueHelpTargets.set(controller, {
+		source,
+		method: "runQuery"
+	});
+	return registerArbacDbTarget(controller);
+}
 function registeredControllers(target) {
 	let app = NO_APP;
 	try {
@@ -342,13 +363,14 @@ function evaluateHandlerOutcomes(ids) {
 async function evaluateTypeRead(type) {
 	const controllers = registeredControllers(type);
 	if (controllers.length === 0) return null;
+	const tableOf = (c) => valueHelpTargets.get(c)?.source ?? c.readable;
 	const scopes = await evaluateHandlers(controllers.map((c) => ({
-		...resolveHandlerArbacIds(c, "query"),
-		table: c.readable
+		...resolveHandlerArbacIds(c, valueHelpTargets.get(c)?.method ?? "query"),
+		table: tableOf(c)
 	})));
 	return scopes ? {
 		scopes,
-		table: controllers[0].readable
+		table: tableOf(controllers[0])
 	} : null;
 }
 /**
@@ -358,7 +380,9 @@ async function evaluateTypeRead(type) {
 const MAX_WITH_DEPTH = 16;
 /**
 * Relation names a parsed `$with` control reaches, per level. A dotted
-* name (`a.b`) nests like `a($with=b)`.
+* name (`a.b`) nests like `a($with=b)`. The relational predicates of each
+* entry's sub-filter (`$with=a(b=$some(…))`) join the entry's level
+* ({@link relationFilterNameTree}).
 */
 function withNameTree(withArr, into = /* @__PURE__ */ new Map(), depth = 0) {
 	if (!Array.isArray(withArr) || depth >= MAX_WITH_DEPTH) return into;
@@ -370,7 +394,29 @@ function withNameTree(withArr, into = /* @__PURE__ */ new Map(), depth = 0) {
 		if (depth + segments.length > MAX_WITH_DEPTH) continue;
 		let level = into;
 		for (const segment of segments) level = getOrCreate(level, segment, () => /* @__PURE__ */ new Map());
-		if (entry && typeof entry === "object") withNameTree(entry.controls?.$with ?? entry.$with, level, depth + segments.length);
+		if (entry && typeof entry === "object") {
+			withNameTree(entry.controls?.$with ?? entry.$with, level, depth + segments.length);
+			relationFilterNameTree(entry.filter, level, depth + segments.length);
+		}
+	}
+	return into;
+}
+/**
+* Relation names the relational predicates of a filter reach, per level
+* (`ticket=$some(team=$some(…))` → `ticket → { team }`), through
+* `$and` / `$or` / `$not` and nested predicate operands. Only reads
+* `filter` (moost-db hands `prepareRequest` a deep-frozen copy).
+*
+* @since 0.1.74
+*/
+function relationFilterNameTree(filter, into = /* @__PURE__ */ new Map(), depth = 0) {
+	if (!filter || typeof filter !== "object" || depth >= MAX_WITH_DEPTH) return into;
+	for (const [k, value] of Object.entries(filter)) if (k === "$and" || k === "$or") {
+		if (Array.isArray(value)) for (const c of value) relationFilterNameTree(c, into, depth);
+	} else if (k === "$not") relationFilterNameTree(value, into, depth);
+	else if (!k.startsWith("$") && hasRelationOp(value)) {
+		const level = getOrCreate(into, k, () => /* @__PURE__ */ new Map());
+		for (const [op, operand] of Object.entries(value)) if (isRelationOp(op)) relationFilterNameTree(operand, level, depth + 1);
 	}
 	return into;
 }
@@ -412,19 +458,35 @@ async function resolveRelationTree(scopes, table, names, opts = {}) {
 const requestRelationsKey = key("arbac.db.relations");
 /**
 * Per-request `$with` policy for the ARBAC DB controllers' `prepareRequest`:
-* resolves every relation `controls.$with` names (recursively) and stores
-* the resolution the request's visibility (`hasField`, `validateControls`,
-* `transformProjection`) reads.
+* resolves every relation `controls.$with` names (recursively) and — since
+* 0.1.74 — every relation the client `filter`'s relational predicates name
+* (`ticket=$some(…)`, also inside `$with` sub-filters), and stores the
+* resolution the request's visibility reads.
+*
+* @returns the relation names resolved, per level
 */
-async function resolveRequestRelations(scopes, controls, readable) {
+async function resolveRequestRelations(scopes, controls, readable, filter) {
 	const names = withNameTree(controls?.$with);
-	if (names.size === 0) return;
-	current().set(requestRelationsKey, await resolveRelationTree(scopes, readable, names));
+	const listSiblings = names.size > 0;
+	relationFilterNameTree(filter, names);
+	if (names.size === 0) return names;
+	const relations = await resolveRelationTree(scopes, readable, names, { listSiblings });
+	current().set(requestRelationsKey, {
+		readable,
+		relations
+	});
+	return names;
 }
-/** The resolution {@link resolveRequestRelations} stored for the current event, if any. */
-function requestRelations() {
+/**
+* The resolution {@link resolveRequestRelations} stored for the current
+* event, if any — only for the readable it was resolved for: another
+* controller evaluated in the same event (a `@DbActionsFrom` source) never
+* sees the delegating request's `$with` resolution.
+*/
+function requestRelations(readable) {
 	const ctx = current();
-	return ctx.has(requestRelationsKey) ? ctx.get(requestRelationsKey) : void 0;
+	const stored = ctx.has(requestRelationsKey) ? ctx.get(requestRelationsKey) : void 0;
+	return stored && stored.readable === readable ? stored.relations : void 0;
 }
 //#endregion
 //#region src/db/write-refs.ts
@@ -741,6 +803,20 @@ function arbacIdsFromMeta(cMeta, mMeta, controller, methodName) {
 		action: mMeta?.arbacActionId || mMeta?.atscript_db_action?.name || cMeta?.arbacActionId || mMeta?.id || methodName
 	};
 }
+const scopeOwners = /* @__PURE__ */ new WeakMap();
+/** Record that `scopes` were evaluated for `resource` / `action` (see {@link scopesOwnedBy}). */
+function tagScopesOwner(scopes, resource, action) {
+	scopeOwners.set(scopes, `${resource}\u0000${action}`);
+}
+/**
+* `true` when the cached `scopes` were set for `resource` / `action`. An
+* event slot read can fall through to a parent context (moost-db evaluates a
+* `@DbActionsFrom` source in a child of the delegating event), so scopes
+* cached for another handler are never taken as this handler's grant.
+*/
+function scopesOwnedBy(scopes, resource, action) {
+	return scopeOwners.get(scopes) === `${resource}\u0000${action}`;
+}
 /** The 403 every ARBAC deny answers. */
 function insufficientPrivileges(resource, action) {
 	return new HttpError(403, `Insufficient privileges for action "${action}" on resource "${resource}"`);
@@ -899,6 +975,7 @@ const useArbac = (_ctx) => {
 	const cc = useControllerContext(ctx);
 	const getScopes = () => getArbacScopes(ctx);
 	const setScopes = (scope) => {
+		if (scope) tagScopesOwner(scope, resource, action);
 		ctx.set(arbacScopesKey, scope);
 	};
 	const cMeta = cc.getControllerMeta();
@@ -1056,7 +1133,7 @@ function pruneMetaByVisibility(meta, vis, refTargets) {
 		...meta,
 		fields,
 		relations,
-		type: pruneSerializedType(meta.type, {
+		type: pruneSerializedType(inlineTypeRefs(meta.type), {
 			basePath: "",
 			vis,
 			relationNames,
@@ -1066,6 +1143,153 @@ function pruneMetaByVisibility(meta, vis, refTargets) {
 	if (out.versionColumn !== void 0 && !isMetaFieldVisible(out.versionColumn, vis)) delete out.versionColumn;
 	return out;
 }
+/**
+* Replace every `$ref` entry with a copy of the body serialized under its `id`
+* (the first node carrying that id), so each use is pruned by ITS OWN path's
+* visibility. A shared body pruned once would resolve, on the client, to the
+* first use's shape at every other use: hidden fields leak through a later
+* `$ref`, and a hidden first use leaves later `$ref`s dangling. An `own`
+* entry keeps its own metadata / optional / `ref`. Unknown ids and recursive
+* back-references stay `$ref`s (a recursive one points at an ancestor that is
+* itself retained). Never mutates the (cached) input.
+*/
+function inlineTypeRefs(root) {
+	return getOrCreate(inlinedCache, root, () => {
+		const bodies = /* @__PURE__ */ new Map();
+		collectBodies(root, bodies);
+		if (bodies.size === 0) return root;
+		return inlineNode(root, {
+			bodies,
+			budget: 2e4,
+			n: 0
+		}, /* @__PURE__ */ new Map(), false) ?? root;
+	});
+}
+const inlinedCache = /* @__PURE__ */ new WeakMap();
+function childNodes(node) {
+	const def = node.type;
+	const out = [];
+	if (def.kind === "object") {
+		out.push(...Object.values(def.props));
+		for (const p of def.propsPatterns ?? []) out.push(p.def);
+	} else if (def.kind === "array") out.push(def.of);
+	else if (Array.isArray(def.items)) out.push(...def.items);
+	const refType = node.ref?.type;
+	if (refType && refType.type) out.push(refType);
+	return out;
+}
+function collectBodies(node, bodies) {
+	if (node.type.kind === "$ref") return;
+	if (node.id !== void 0 && !bodies.has(node.id)) bodies.set(node.id, node);
+	for (const child of childNodes(node)) collectBodies(child, bodies);
+}
+function inlineNode(node, ctx, stack, inlining) {
+	const def = node.type;
+	if (def.kind === "$ref") {
+		const ancestor = stack.get(def.id);
+		if (ancestor !== void 0) return {
+			...node,
+			type: {
+				...def,
+				id: ancestor
+			}
+		};
+		const body = ctx.bodies.get(def.id);
+		if (!body) return node;
+		const inlined = inlineNode(body, ctx, stack, true);
+		if (!inlined) return void 0;
+		if (!def.own) return inlined;
+		const { ref: _ref, optional: _optional, ...rest } = inlined;
+		return {
+			...rest,
+			metadata: node.metadata,
+			...node.optional === void 0 ? {} : { optional: node.optional },
+			...node.ref ? { ref: node.ref } : {}
+		};
+	}
+	if (inlining && --ctx.budget < 0) return void 0;
+	let nextStack = stack;
+	let out = node;
+	if (node.id !== void 0) {
+		const copyId = `${node.id}#${++ctx.n}`;
+		nextStack = new Map(stack).set(node.id, copyId);
+		out = {
+			...node,
+			id: copyId
+		};
+	}
+	const d = def;
+	if (d.kind === "object") {
+		const props = {};
+		for (const [k, v] of Object.entries(d.props)) {
+			const r = inlineNode(v, ctx, nextStack, inlining);
+			if (r) props[k] = r;
+		}
+		const propsPatterns = [];
+		for (const p of d.propsPatterns ?? []) {
+			const r = inlineNode(p.def, ctx, nextStack, inlining);
+			if (r) propsPatterns.push({
+				...p,
+				def: r
+			});
+		}
+		out = {
+			...out,
+			type: {
+				...def,
+				props,
+				propsPatterns
+			}
+		};
+	} else if (d.kind === "array") {
+		const of = inlineNode(d.of, ctx, nextStack, inlining) ?? emptyStub();
+		out = {
+			...out,
+			type: {
+				...def,
+				of
+			}
+		};
+	} else if (Array.isArray(d.items)) {
+		const items = d.items.map((i) => inlineNode(i, ctx, nextStack, inlining) ?? emptyStub());
+		out = {
+			...out,
+			type: {
+				...def,
+				items
+			}
+		};
+	}
+	const refType = out.ref?.type;
+	if (out.ref && refType && refType.type) {
+		const r = inlineNode(refType, ctx, nextStack, inlining);
+		if (r) out = {
+			...out,
+			ref: {
+				...out.ref,
+				type: r
+			}
+		};
+		else {
+			const { ref: _r, ...noRef } = out;
+			out = noRef;
+		}
+	}
+	return out;
+}
+/** A body-less placeholder for a positional child dropped by the inline budget. */
+function emptyStub() {
+	return {
+		$v: 2,
+		type: {
+			kind: "object",
+			props: {},
+			propsPatterns: [],
+			tags: []
+		},
+		metadata: {}
+	};
+}
 function pruneSerializedType(node, level) {
 	const { basePath, vis, relationNames, refTargets } = level;
 	const def = node.type;
@@ -1092,20 +1316,21 @@ function pruneSerializedType(node, level) {
 				basePath: path
 			};
 			if (!isMetaFieldVisible(path, vis)) {
-				if (isPathWritable(path, vis)) props[name] = stampWriteOnly(prop);
-				else if (hasWritableDescendant(path, vis.writable)) props[name] = stampWriteOnly(pruneSerializedType(prop, child));
+				if (isPathWritable(path, vis)) props[name] = withVisibleTargets(stampWriteOnly(prop), path, vis, refTargets, level.inBranch);
+				else if (hasWritableDescendant(path, vis.writable)) props[name] = withVisibleTargets(stampWriteOnly(pruneSerializedType(prop, child)), path, vis, refTargets, level.inBranch);
 				continue;
 			}
-			const pruned = pruneSerializedType(prop, child);
-			props[name] = pruned.ref && !isRefVisible(path, vis, refTargets) ? withoutRef(pruned) : pruned;
+			props[name] = withVisibleTargets(pruneSerializedType(prop, child), path, vis, refTargets, level.inBranch);
 		}
-		return {
+		const pruned = {
 			...node,
 			type: {
 				...def,
 				props
 			}
 		};
+		if (basePath !== "" || !def.propsPatterns?.length || !vis.table?.flatMap || !refTargets) return pruned;
+		return gateChildren(pruned, level.inBranch ? void 0 : vis.table?.type, vis, refTargets, false);
 	}
 	if (def.kind === "array") return {
 		...node,
@@ -1118,7 +1343,10 @@ function pruneSerializedType(node, level) {
 		...node,
 		type: {
 			...def,
-			items: def.items.map((item) => pruneSerializedType(item, level))
+			items: def.items.map((item) => pruneSerializedType(item, {
+				...level,
+				inBranch: true
+			}))
 		}
 	};
 	return node;
@@ -1143,36 +1371,202 @@ function withoutRef(node) {
 	const { ref: _ref, ...rest } = node;
 	return rest;
 }
+/** The `/meta` annotation key of a dictionary value-help binding (`@ui.valueHelp`, since 0.1.75); a string constant — arbac-moost does not import `@atscript/ui`. */
+const UI_VALUE_HELP = "ui.valueHelp";
+function withoutBinding(node) {
+	const { [UI_VALUE_HELP]: _binding, ...metadata } = node.metadata;
+	return {
+		...node,
+		metadata
+	};
+}
+const bindingCache = /* @__PURE__ */ new WeakMap();
+/**
+* The runtime `ui.valueHelp` binding of a flat-map entry — the dictionary and
+* the fields it names there: the committed `field` plus every field its
+* static filter reads. `undefined` = no binding; `null` = a binding that
+* cannot be resolved (callers fail closed and strip it).
+*/
+function bindingOf(entry) {
+	const raw = entry?.metadata?.get?.(UI_VALUE_HELP);
+	if (!raw) return void 0;
+	let binding = bindingCache.get(entry);
+	if (binding === void 0) {
+		binding = resolveBinding(raw);
+		bindingCache.set(entry, binding);
+	}
+	return binding;
+}
+function resolveBinding(raw) {
+	try {
+		const t = raw.target;
+		const type = typeof t === "function" ? t() : t?.type();
+		if (!type) return null;
+		const fields = typeof raw.field === "string" ? [raw.field] : [];
+		if (raw.filter) translateQueryTree(raw.filter, (ref) => {
+			fields.push(ref.field);
+			return ref.field;
+		});
+		return {
+			type,
+			fields
+		};
+	} catch {
+		return null;
+	}
+}
+/** Every table a flat-map entry points at: its `ref` target and its value-help binding. */
+function targetsOf(entry) {
+	return [refTargetOf(entry), bindingOf(entry)].filter((t) => !!t);
+}
 /** The field a runtime prop's `ref` finally points at (the same terminal `/meta` serializes). */
 function refTargetOf(entry) {
 	const def = entry;
 	if (!def?.ref) return void 0;
 	const terminal = resolveTerminalRef(def);
-	if (terminal) return terminal;
+	if (terminal) return {
+		type: terminal.type,
+		fields: terminal.field ? [terminal.field] : []
+	};
 	try {
+		const { type, field } = def.ref;
 		return {
-			type: def.ref.type(),
-			field: def.ref.field
+			type: type(),
+			fields: field ? [field] : []
 		};
 	} catch {
 		return;
 	}
 }
+/** A table-served type: any `db.*` annotation (`db.table`, `db.view`, `db.http.path`, …). */
+function isDbServed(type) {
+	const meta = type.metadata;
+	if (!meta || typeof meta.keys !== "function") return false;
+	for (const key of meta.keys()) if (key.startsWith("db.")) return true;
+	return false;
+}
 /**
-* A serialized `ref` at `path` survives when its target field is visible:
-* a self-reference (e.g. a derived column's source) against this level's
-* visibility; a foreign one against the caller's visibility on the target
-* table (`refTargets`, stripped when the caller cannot read it). Without
-* runtime schema info (`vis.table.flatMap`) or `refTargets`, refs are kept.
+* A target survives when the caller can read its table AND see every field it
+* names: a self-target against this level's visibility, a foreign one against
+* the caller's visibility on that table (`refTargets`; unreadable → hidden). A
+* target naming no field (a prop typed as a table interface, `@db.json snap?:
+* Dict`) still needs the table readable, unless the type is not table-served.
 */
-function isRefVisible(path, vis, refTargets) {
-	const table = vis.table;
-	if (!table?.flatMap || !refTargets) return true;
-	const target = refTargetOf(table.flatMap.get(path));
-	if (!target || !target.field) return true;
-	if (target.type === table.type) return isMetaFieldVisible(target.field, vis);
-	const targetVis = refTargets.get(target.type);
-	return !!targetVis && isMetaFieldVisible(target.field, targetVis);
+function isTargetVisible(target, vis, refTargets) {
+	if (target.fields.length === 0 && !isDbServed(target.type)) return true;
+	const targetVis = target.type === vis.table?.type ? vis : refTargets.get(target.type);
+	return !!targetVis && target.fields.every((f) => isMetaFieldVisible(f, targetVis));
+}
+/** The binding on the TYPE a `ref` points at (an alias such as `@ui.valueHelp X type Code = string`). */
+function refTypeBindingOf(entry) {
+	try {
+		const type = entry?.ref?.type?.();
+		return type ? bindingOf(type) : null;
+	} catch {
+		return null;
+	}
+}
+/** Both targets of one node: stripped = hidden. The serialized `ref.type` carries its own metadata. */
+function gateOwn(node, entry, visible) {
+	let out = node;
+	if (out.ref) {
+		const ref = refTargetOf(entry);
+		if (!ref || !visible(ref)) out = withoutRef(out);
+	}
+	if (out.metadata?.[UI_VALUE_HELP] !== void 0) {
+		const binding = bindingOf(entry);
+		if (!binding || !visible(binding)) out = withoutBinding(out);
+	}
+	const refMeta = out.ref?.type?.metadata;
+	if (out.ref && refMeta?.[UI_VALUE_HELP] !== void 0) {
+		const binding = refTypeBindingOf(entry);
+		if (!binding || !visible(binding)) {
+			const { [UI_VALUE_HELP]: _b, ...metadata } = refMeta;
+			out = {
+				...out,
+				ref: {
+					...out.ref,
+					type: {
+						...out.ref.type,
+						metadata
+					}
+				}
+			};
+		}
+	}
+	return out;
+}
+/**
+* Gate the children of `node` a prop walk does not reach by flat path: array
+* elements, union / intersection / tuple members and wildcard props — each
+* paired with its runtime counterpart under `runtime` (a missing one fails
+* closed). `deep` also descends object props (own-field subtrees only; a nav
+* prop belongs to its own level).
+*/
+function gateChildren(node, runtime, vis, refTargets, deep) {
+	const visible = (t) => isTargetVisible(t, vis, refTargets);
+	const gate = (child, rt) => gateChildren(gateOwn(child, rt, visible), rt, vis, refTargets, true);
+	const rtType = runtime?.type;
+	const def = node.type;
+	if (def.kind === "object") {
+		let next = def;
+		if (deep && def.props) {
+			const props = {};
+			for (const [name, prop] of Object.entries(def.props)) props[name] = isNavProp(prop) ? prop : gate(prop, rtType?.props?.get?.(name));
+			next = {
+				...next,
+				props
+			};
+		}
+		if (def.propsPatterns?.length) {
+			const patterns = def.propsPatterns.map((p) => {
+				const rt = rtType?.propsPatterns?.find((r) => r.pattern?.source === p.pattern?.source && r.pattern?.flags === p.pattern?.flags)?.def;
+				return {
+					...p,
+					def: gate(p.def, rt)
+				};
+			});
+			next = {
+				...next,
+				propsPatterns: patterns
+			};
+		}
+		return next === def ? node : {
+			...node,
+			type: next
+		};
+	}
+	if (def.kind === "array") return {
+		...node,
+		type: {
+			...def,
+			of: gate(def.of, rtType?.of)
+		}
+	};
+	if (Array.isArray(def.items)) {
+		const items = def.items.map((item, i) => gate(item, rtType?.items?.[i]));
+		return {
+			...node,
+			type: {
+				...def,
+				items
+			}
+		};
+	}
+	return node;
+}
+/**
+* Strip a serialized `ref` / `ui.valueHelp` binding at `path` — on the prop
+* itself, on a `ref` target's own metadata, and on every array element, union
+* / intersection / tuple member and wildcard prop below it — whose target is
+* hidden from the caller. Without runtime schema info (`vis.table.flatMap`) or
+* `refTargets`, all are kept.
+*/
+function withVisibleTargets(node, path, vis, refTargets, ambiguous = false) {
+	const flatMap = vis.table?.flatMap;
+	if (!flatMap || !refTargets || !serializedHasTarget(node)) return node;
+	const entry = ambiguous ? void 0 : flatMap.get(path);
+	return gateChildren(gateOwn(node, entry, (t) => isTargetVisible(t, vis, refTargets)), entry, vis, refTargets, false);
 }
 const NO_NAMES = /* @__PURE__ */ new Set();
 /** A nav prop inside a joined type: atscript-db stamps `db.rel.to` / `from` / `via`. */
@@ -1222,22 +1616,21 @@ function crudHandlers(op, methods) {
 *    `crud` already advertises no read surface, and write-only principals
 *    still need `type` for their insert/update forms. PK + `preferredId` are
 *    never pruned.
-* 3. The search surface: `searchIndexes` reading a hidden field are dropped,
-*    `searchable` / `vectorSearchable` / `geoSearchable` recomputed, and the
-*    `query` / `pages` control lists lose the controls that became unusable
-*    (`crud.geo` goes when no geo index is left).
+*
+* The search surface (`searchIndexes`, `searchable`, `vectorSearchable`,
+* `geoSearchable`) is narrowed by moost-db itself (≥ 0.1.147, under the
+* overridden `hasField`), after this overlay.
 *
 * @param source - the controller's `this.readable` (identifiers, relations
 *   and schema rules are derived from it); an identifier set (the 0.1.67
 *   signature) still works, without them
-* @param indexes - the controller's `indexFieldPaths()`; defaults to calling
-*   it on the current controller when it has one
+* @param _indexes - @deprecated ignored since 0.1.74 (moost-db prunes the search surface)
 */
-async function applyArbacMetaOverlay(meta, source, indexes) {
+async function applyArbacMetaOverlay(meta, source, _indexes) {
 	const instance = useControllerContext().getController();
 	const { methods } = controllerMethodIndex(instance);
 	const crudKeys = Object.keys(meta.crud);
-	const [allowedActions, crudScopes] = await Promise.all([grantedActions(instance, meta.actions.map((entry) => entry.name)), Promise.all(crudKeys.map((op) => evaluateHandlers(crudHandlers(op, methods).map((m) => resolveHandlerArbacIds(instance, m)))))]);
+	const [allowedActions, crudScopes] = await Promise.all([grantedActions(instance, meta.actions.map((entry) => entry.name)), Promise.all(crudKeys.map((op) => evaluateHandlers(crudHandlerIds(instance, op, methods))))]);
 	const allowed = new Set(allowedActions);
 	const actions = meta.actions.filter((entry) => allowed.has(entry.name));
 	const crud = {};
@@ -1255,23 +1648,203 @@ async function applyArbacMetaOverlay(meta, source, indexes) {
 		crud
 	};
 	if (readScopes.length === 0) return overlaid;
+	const groupBy = effectiveScope(readScopes).controls.$groupBy;
 	const writable = collectWritableFields(writeScopes, false);
 	const nestedWrites = effectiveScope(writeScopes).nestedWrites;
 	if (isIdentifierSet(source)) {
 		const vis = buildScopeVisibility(readScopes, void 0, source);
-		return Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0 ? pruneMetaByVisibility(overlaid, {
+		return gateGroupable(Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0 ? pruneMetaByVisibility(overlaid, {
 			...vis,
 			writable,
 			nestedWrites
-		}) : overlaid;
+		}) : overlaid, groupBy);
 	}
 	const vis = buildScopeVisibility(readScopes, source, { relations: await resolveRelationTree(readScopes, source, metaRelationNames(meta), { listSiblings: false }) });
 	const refTargets = await resolveRefTargets(vis, meta);
-	return pruneSearchSurface(pruneMetaByVisibility(overlaid, {
+	return gateGroupable(pruneMetaByVisibility(overlaid, {
 		...vis,
 		writable,
 		nestedWrites
-	}, refTargets), meta, vis, indexes ?? controllerIndexes(instance));
+	}, refTargets), groupBy);
+}
+/**
+* The `/meta/form/:name` overlay: a form is a plain annotated type (no table),
+* so only its cross-table pointers are projected. Every prop's `ref` and
+* `ui.valueHelp` binding is stripped when the caller cannot read the target
+* table, or cannot see a field the pointer names there (the same rule as the
+* `/meta` type); an unresolvable binding is stripped too. Never mutates
+* `serialized` (the base controller caches it); returns it itself when
+* nothing is stripped.
+*
+* @param serialized - the form's serialized schema as moost-db served it
+* @param formType - the runtime form type the schema was serialized from
+*/
+async function applyArbacFormOverlay(serialized, formType) {
+	if (!formType) return serialized;
+	const types = /* @__PURE__ */ new Set();
+	collectFormTargets(formType, serialized, types, 0);
+	if (types.size === 0 && !hasUnresolvedBinding(formType, serialized, 0)) return serialized;
+	const readable = /* @__PURE__ */ new Map();
+	await Promise.all([...types].map(async (type) => {
+		const read = await evaluateTypeRead(type);
+		readable.set(type, read ? buildScopeVisibility(read.scopes, read.table) : null);
+	}));
+	return stripFormTargets(formType, serialized, readable, 0);
+}
+const formTargetsOf = (entry, node) => {
+	const out = [];
+	if (node.ref) {
+		const ref = refTargetOf(entry);
+		out.push(ref ?? null);
+	}
+	if (node.metadata?.[UI_VALUE_HELP] !== void 0) {
+		const binding = bindingOf(entry);
+		if (binding !== void 0) out.push(binding);
+	}
+	if (node.ref && node.ref.type?.metadata?.[UI_VALUE_HELP] !== void 0) out.push(refTypeBindingOf(entry) ?? null);
+	return out;
+};
+/** Pairs the runtime and serialized trees over EVERY child container (props, of, items). */
+function formChildren(runtime, node) {
+	const rt = runtime.type;
+	const def = node.type;
+	const out = [];
+	if (rt.props && def.props) {
+		for (const [name, child] of rt.props) if (def.props[name]) out.push([
+			child,
+			def.props[name],
+			{ prop: name }
+		]);
+	}
+	if (rt.of && !Array.isArray(rt.of) && def.of && !Array.isArray(def.of)) out.push([
+		rt.of,
+		def.of,
+		{ of: true }
+	]);
+	if (Array.isArray(rt.items) && Array.isArray(def.items)) rt.items.forEach((child, i) => def.items[i] && out.push([
+		child,
+		def.items[i],
+		{ item: i }
+	]));
+	def.propsPatterns?.forEach((p, i) => {
+		const match = rt.propsPatterns?.find((r) => r.pattern?.source === p.pattern?.source && r.pattern?.flags === p.pattern?.flags);
+		if (match) out.push([
+			match.def,
+			p.def,
+			{ pattern: i }
+		]);
+	});
+	return out;
+}
+/** Nested-relation walk bound — serialized nav bodies are finite, this only guards pathological input. */
+const MAX_NAV_DEPTH = 8;
+/** The form walk bound; past it every `ref` / binding is stripped (fail closed). */
+const MAX_FORM_DEPTH = MAX_NAV_DEPTH * 2;
+function serializedChildren(node) {
+	const def = node.type;
+	return [
+		...Object.values(def.props ?? {}),
+		...def.of ? [def.of] : [],
+		...def.items ?? [],
+		...(def.propsPatterns ?? []).map((p) => p.def)
+	];
+}
+function serializedHasTarget(node) {
+	return !!node.ref || node.metadata?.[UI_VALUE_HELP] !== void 0 || serializedChildren(node).some(serializedHasTarget);
+}
+function stripAllTargets(node) {
+	if (!serializedHasTarget(node)) return node;
+	let out = node;
+	if (out.ref) out = withoutRef(out);
+	if (out.metadata?.[UI_VALUE_HELP] !== void 0) out = withoutBinding(out);
+	const def = out.type;
+	const next = { ...def };
+	if (def.props) next.props = Object.fromEntries(Object.entries(def.props).map(([k, v]) => [k, stripAllTargets(v)]));
+	if (def.of) next.of = stripAllTargets(def.of);
+	if (def.items) next.items = def.items.map((i) => stripAllTargets(i));
+	if (def.propsPatterns) next.propsPatterns = def.propsPatterns.map((p) => ({
+		...p,
+		def: stripAllTargets(p.def)
+	}));
+	return {
+		...out,
+		type: next
+	};
+}
+function collectFormTargets(runtime, node, into, depth) {
+	if (depth >= MAX_FORM_DEPTH) return;
+	for (const t of formTargetsOf(runtime, node)) if (t) into.add(t.type);
+	for (const [child, childNode] of formChildren(runtime, node)) collectFormTargets(child, childNode, into, depth + 1);
+}
+function hasUnresolvedBinding(runtime, node, depth) {
+	if (depth >= MAX_FORM_DEPTH) return serializedHasTarget(node);
+	if (formTargetsOf(runtime, node).includes(null)) return true;
+	return formChildren(runtime, node).some(([c, n]) => hasUnresolvedBinding(c, n, depth + 1));
+}
+function stripFormTargets(runtime, node, readable, depth) {
+	if (depth >= MAX_FORM_DEPTH) return stripAllTargets(node);
+	const visible = (t) => {
+		if (!t) return false;
+		const targetVis = readable.get(t.type);
+		return !!targetVis && t.fields.every((f) => isMetaFieldVisible(f, targetVis));
+	};
+	const out = gateOwn(node, runtime, (t) => visible(t));
+	const children = formChildren(runtime, node);
+	let changed;
+	for (const [child, childNode, key] of children) {
+		const next = stripFormTargets(child, childNode, readable, depth + 1);
+		if (next === childNode) continue;
+		const base = changed ?? out.type;
+		if ("prop" in key) changed = {
+			...base,
+			props: {
+				...base.props,
+				[key.prop]: next
+			}
+		};
+		else if ("pattern" in key) changed = {
+			...base,
+			propsPatterns: base.propsPatterns.map((o, i) => i === key.pattern ? {
+				...o,
+				def: next
+			} : o)
+		};
+		else if ("item" in key) changed = {
+			...base,
+			items: base.items.map((o, i) => i === key.item ? next : o)
+		};
+		else changed = {
+			...base,
+			of: next
+		};
+	}
+	return changed ? {
+		...out,
+		type: changed
+	} : out;
+}
+/**
+* `fields[*].groupable` follows the `controls.$groupBy` policy, mirroring the
+* 403 `applyArbacControls` raises: `false` drops the flag everywhere, a
+* whitelist keeps it only on the listed paths. Returns `meta` itself when
+* nothing is stripped.
+*
+* @since 0.1.75
+*/
+function gateGroupable(meta, gate) {
+	if (gate === void 0 || gate === true) return meta;
+	const stripped = (path, field) => field.groupable && (gate === false || !gate.includes(path));
+	const entries = Object.entries(meta.fields);
+	if (!entries.some(([path, field]) => stripped(path, field))) return meta;
+	const fields = {};
+	for (const [path, field] of entries) if (stripped(path, field)) {
+		const { groupable: _groupable, ...rest } = field;
+		fields[path] = rest;
+	} else fields[path] = field;
+	return {
+		...meta,
+		fields
+	};
 }
 const metaNamesCache = /* @__PURE__ */ new WeakMap();
 /** The relation names `/meta`'s serialized type reaches: root relations, then nav props of each nav body. */
@@ -1280,7 +1853,7 @@ function metaRelationNames(meta) {
 }
 function buildMetaRelationNames(meta) {
 	const tree = /* @__PURE__ */ new Map();
-	const rootProps = objectProps(meta.type);
+	const rootProps = objectProps(inlineTypeRefs(meta.type));
 	for (const r of meta.relations) {
 		const nested = /* @__PURE__ */ new Map();
 		tree.set(r.name, nested);
@@ -1289,8 +1862,6 @@ function buildMetaRelationNames(meta) {
 	}
 	return tree;
 }
-/** Nested-relation walk bound — serialized nav bodies are finite, this only guards pathological input. */
-const MAX_NAV_DEPTH = 8;
 function collectNavNames(node, into, depth) {
 	if (depth >= MAX_NAV_DEPTH) return;
 	const props = objectProps(node);
@@ -1319,12 +1890,12 @@ async function resolveRefTargets(root, meta) {
 		if (!props || depth >= MAX_NAV_DEPTH) return;
 		for (const name of /* @__PURE__ */ new Set([...vis.relationNames ?? NO_NAMES, ...vis.withGrants])) {
 			const prop = props[name];
-			if (!prop || !isMetaFieldVisible(name, vis)) continue;
-			const sub = vis.relation?.(name);
+			if (!prop) continue;
+			const sub = visibleRelation(name, vis);
 			if (sub) visit(sub, prop, depth + 1);
 		}
 	};
-	visit(root, meta.type, 0);
+	visit(root, inlineTypeRefs(meta.type), 0);
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all([...types].map(async (type) => {
 		const read = await evaluateTypeRead(type);
@@ -1341,66 +1912,12 @@ function foreignRefTypes(table) {
 		const out = /* @__PURE__ */ new Set();
 		for (const [path, entry] of flatMap) {
 			if (hasSelfOrAncestor(nav, path)) continue;
-			const target = refTargetOf(entry);
-			if (target && target.type !== table.type) out.add(target.type);
+			for (const target of targetsOf(entry)) if (target.type !== table.type) out.add(target.type);
 		}
 		return out;
 	});
 }
 const NO_TYPES = /* @__PURE__ */ new Set();
-/** Controls a text / vector search needs, dropped from `crud.query` / `crud.pages` when unusable. */
-const TEXT_SEARCH_CONTROLS = ["search", "fuzzy"];
-const VECTOR_CONTROLS = ["vector", "threshold"];
-/**
-* Drop `searchIndexes` reading a hidden field, recompute the search /
-* vector / geo flags over what is left (native search, or the visible
-* `@db.column.searchable` fallback), and remove the controls that became
-* unusable from the `query` / `pages` control lists (`crud.geo` goes with
-* the last visible geo index).
-*/
-function pruneSearchSurface(meta, original, vis, indexes) {
-	if (!indexes) return meta;
-	const shown = indexes.filter((e) => e.fields.every((f) => isMetaFieldVisible(f, vis)));
-	const shownOf = (type) => shown.some((e) => e.type === type);
-	const hasText = indexes.some((e) => e.type === "text");
-	const native = vis.table?.isSearchable?.() ?? hasText;
-	const fallback = searchFallbackVisible(meta, vis.table);
-	const searchable = original.searchable && (native && (!hasText || shownOf("text")) || fallback);
-	const vectorSearchable = original.vectorSearchable && shownOf("vector");
-	const geoSearchable = original.geoSearchable === true ? shownOf("geo") : original.geoSearchable;
-	const out = {
-		...meta,
-		searchIndexes: original.searchIndexes.filter((info) => shown.some((e) => e.name === info.name && e.type === (info.type ?? "text"))),
-		searchable,
-		vectorSearchable
-	};
-	if (geoSearchable !== void 0) out.geoSearchable = geoSearchable;
-	const drop = /* @__PURE__ */ new Set();
-	if (original.searchable && !searchable && !vectorSearchable) for (const c of TEXT_SEARCH_CONTROLS) drop.add(c);
-	if (original.vectorSearchable && !vectorSearchable) for (const c of VECTOR_CONTROLS) drop.add(c);
-	if (hasText && !shownOf("text")) drop.add("index");
-	if (drop.size > 0 || original.geoSearchable && !geoSearchable) {
-		const crud = { ...meta.crud };
-		for (const op of ["query", "pages"]) {
-			const list = crud[op];
-			if (list && drop.size > 0) crud[op] = list.filter((c) => !drop.has(c));
-		}
-		if (original.geoSearchable && !geoSearchable) delete crud.geo;
-		out.crud = crud;
-	}
-	return out;
-}
-/** A `@db.column.searchable` field is still listed (visible) in the pruned `fields`. */
-function searchFallbackVisible(meta, table) {
-	if (!table?.flatMap) return false;
-	for (const path of Object.keys(meta.fields)) if (table.flatMap.get(path)?.metadata?.has?.("db.column.searchable") && !meta.fields[path].writeOnly) return true;
-	return false;
-}
-/** The current controller's `indexFieldPaths()` (moost-db 0.1.143 DB readables), if it has one. */
-function controllerIndexes(instance) {
-	const c = instance;
-	return typeof c.indexFieldPaths === "function" ? c.indexFieldPaths() : void 0;
-}
 const methodIndexCache = /* @__PURE__ */ new WeakMap();
 /**
 * THE ARBAC ids an action is authorized as — used by the `/meta` overlay,
@@ -1432,14 +1949,20 @@ async function grantedActions(instance, names) {
 function controllerArbacResource(instance) {
 	return arbacIdsFromMeta(getMoostMate().read(instance), void 0, instance, "").resource;
 }
-/** A controller class's methods and `@DbAction` name → methods map (memoized per class). */
+/**
+* A controller class's methods and `@DbAction` name → methods map (memoized
+* per class). The method metadata is read from `instance` itself — never from
+* the event's current controller, which differs whenever another
+* controller's actions are evaluated in this event (a view's
+* `@DbActionsFrom` delegation).
+*/
 function controllerMethodIndex(instance) {
 	return getOrCreate(methodIndexCache, getConstructor(instance), () => {
-		const cc = useControllerContext();
+		const mate = getMoostMate();
 		const methods = new Set(collectMethodNames(instance));
 		const actionMethods = /* @__PURE__ */ new Map();
 		for (const methodName of methods) {
-			const name = cc.getMethodMeta(methodName)?.atscript_db_action?.name;
+			const name = mate.read(instance, methodName)?.atscript_db_action?.name;
 			if (name) getOrCreate(actionMethods, name, () => []).push(methodName);
 		}
 		return {
@@ -1448,6 +1971,18 @@ function controllerMethodIndex(instance) {
 		};
 	});
 }
+/** The ARBAC ids of the handler method(s) serving crud op `op` on `instance` (`useArbac()` precedence). */
+function crudHandlerIds(instance, op, methods = controllerMethodIndex(instance).methods) {
+	return crudHandlers(op, methods).map((m) => resolveHandlerArbacIds(instance, m));
+}
+/**
+* The ARBAC ids of `instance`'s READ handler — the `query` crud op's
+* handler method(s), exactly what the `/meta` overlay evaluates for
+* `crud.query`.
+*/
+function readHandlerIds(instance) {
+	return crudHandlerIds(instance, "query");
+}
 /**
 * Test-friendly internal helper — exported for unit tests and helper
 * composition; regular consumers should not call this directly.
@@ -1474,6 +2009,124 @@ function collectMethodNames(instance) {
 	return [...names];
 }
 //#endregion
+//#region src/db/shared-read-helpers.ts
+/**
+* Restrict the user-supplied `$select` to the scopes' projection union.
+* Returns the original projection untouched when no scope declares a
+* projection (so caller sees the unrestricted shape). Reads the same cached
+* visibility (`vis.allowed`) `hasField` / `/meta` pruning use, so value
+* stripping and name hiding cannot drift.
+*
+* `projection` is the `$select` as moost-db parsed it: an inclusion is an
+* ARRAY of names, an exclusion an object — both are normalized first. A
+* requested parent (`$select=a`) narrows to what the scope shows: to the
+* whitelisted descendants (`a.b: 1`), or — for a hidden descendant
+* (`a.c: 0`) — to its visible children via `childrenOf` (without a schema
+* the parent is dropped). Never the whole object, and never the empty
+* (universe) projection: when nothing survives, the scope's own projection
+* applies (`restrictProjection`'s ceiling fallback).
+*
+* An exclusion result names nested-object parents by their leaves
+* (`{ a: 0 }` → `{ "a.b": 0, "a.c": 0 }`): flattening adapters invert an
+* exclusion against their leaf columns, so a parent key alone would strip
+* nothing (a scope `{ a: 0 }` would otherwise return all of `a`).
+*
+* @since 0.1.72
+*/
+function applyArbacProjection(projection, scopes, readable) {
+	return restrictSelect(projection, visibilityFor(scopes, readable));
+}
+/** {@link applyArbacProjection} over an already-built visibility level. */
+function restrictSelect(projection, vis) {
+	if (Object.keys(vis.allowed).length === 0) return projection;
+	const childrenOf = fieldChildrenOf(vis.table);
+	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
+}
+/**
+* Enforce the union of per-scope `controls` gates against the parsed
+* Uniquery controls. Throws `HttpError(403)` on the first violation.
+*
+* @since 0.1.72
+*/
+function applyArbacControls(controls, scopes) {
+	enforceControlsPolicy(effectiveScope(scopes).controls, controls);
+}
+/**
+* The per-role `controls.$with` gates over every relation a read reaches —
+* its `$with` entries and its client relational predicates alike (see
+* `prepareArbacRequest`) — each level against that level's scopes.
+* Overlaps `validateControls`' gate for the `$with` entries on purpose: one
+* rule for both. Throws `HttpError(403)` on the first violation; a hidden
+* relation's nested names are left to moost-db (`Unknown field`).
+*
+* @since 0.1.74
+*/
+function enforceRelationGates(names, vis) {
+	if (!vis?.scopes || names.size === 0) return;
+	enforceControlsPolicy(effectiveScope(vis.scopes).controls, { $with: [...names.keys()] });
+	for (const [name, nested] of names) if (nested.size > 0) enforceRelationGates(nested, visibleRelation(name, vis));
+}
+/**
+* Walk the user-supplied `$with` items in `controls` and overlay each joined
+* relation with the policy of its rows (the `$with` inherit-target policy):
+* a relation some scope declares `with.<name>` for gets the union of those
+* sub-scopes (parent authority — silent roles contribute nothing); any other
+* gets the caller's OWN read scopes on the related table, as resolved in
+* `prepareRequest` (for the request's own scopes). Filter conjoined, `$select`
+* restricted, per-relation `controls` gates enforced, recursively.
+*
+* Mutates `controls` in place (matches the `validateControls` contract).
+* Throws `HttpError(403)` if a per-relation control policy is violated. A
+* hidden relation is skipped: moost-db (≥ 0.1.143) rejects it at every
+* level through `hasField`, byte-for-byte like a nonexistent one.
+*
+* @since 0.1.72
+*/
+function applyArbacRelationScopes(controls, scopes, readable) {
+	const withArr = controls.$with;
+	if (!Array.isArray(withArr) || withArr.length === 0) return;
+	applyRelationLevel(controls, visibilityFor(scopes, readable));
+}
+/** One `$with` level of {@link applyArbacRelationScopes}. */
+function applyRelationLevel(controls, vis) {
+	const withArr = controls.$with;
+	if (!Array.isArray(withArr) || withArr.length === 0) return;
+	for (const raw of withArr) {
+		if (!raw || typeof raw !== "object") continue;
+		const entry = raw;
+		if (typeof entry.name !== "string" || entry.name.includes(".")) continue;
+		const level = (!vis.relationNames || vis.relationNames.has(entry.name)) && isMetaFieldVisible(entry.name, vis) ? vis.relation?.(entry.name) : void 0;
+		if (!level) continue;
+		const sub = effectiveScope(level.scopes ?? []);
+		const conjoined = conjoinScopeFilters$1(sub.filter, entry.filter);
+		if (conjoined) entry.filter = conjoined;
+		const entryControls = entry.controls ?? {};
+		const restricted = restrictSelect(entryControls.$select, level);
+		if (restricted !== void 0) {
+			entryControls.$select = restricted;
+			entry.controls = entryControls;
+		}
+		enforceControlsPolicy(sub.controls, entryControls);
+		applyRelationLevel(entryControls, level);
+	}
+}
+/**
+* `$select` may be an array of field names (uniquery inclusion list) or a
+* `TProjection` object. `restrictProjection` operates on the object form
+* (it would read `["a"]` as an exclusion keyed `"0"`), so normalize the array
+* to `{ field: 1 }` first. Returns undefined if the input is empty (caller
+* treats as "no projection set").
+*/
+function normalizeSelect(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (Array.isArray(value)) {
+		const out = {};
+		for (const item of value) if (typeof item === "string") out[item] = 1;
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
+	if (typeof value === "object") return value;
+}
+//#endregion
 //#region src/db/request-scopes.ts
 /** Endpoints whose `prepareRequest` carries parsed Uniquery controls. */
 const READ_ENDPOINTS = /* @__PURE__ */ new Set([
@@ -1483,6 +2136,17 @@ const READ_ENDPOINTS = /* @__PURE__ */ new Set([
 	"one"
 ]);
 const requestScopesKey = key("arbac.db.scopes");
+/**
+* `true` while the current request is an insert in ignore mode
+* (`?$onConflict=ignore`): conflicting rows are skipped, so the post-write
+* WITH CHECK never sees them and the write guard must refuse what it cannot
+* check up front.
+*
+* @since 0.1.75
+*/
+function isInsertIgnoreRequest() {
+	return resolved()?.insertIgnore === true;
+}
 /** Store the event's resolved scopes (for the handler `ids` resolves to). */
 function storeResolved(ctx, ids, source, scopes) {
 	ctx.set(requestScopesKey, {
@@ -1519,7 +2183,8 @@ function cachedRequestScopes() {
 async function resolveRequestScopes() {
 	const ctx = current();
 	const arbac = useArbac(ctx);
-	const fromInterceptor = arbac.getScopes();
+	const cachedScopes = arbac.getScopes();
+	const fromInterceptor = cachedScopes && scopesOwnedBy(cachedScopes, arbac.resource, arbac.action) ? cachedScopes : void 0;
 	const prior = resolved();
 	if (prior && prior.resource === arbac.resource && prior.action === arbac.action && prior.source === fromInterceptor) return prior.scopes;
 	const scopes = normalizeScopes(fromInterceptor !== void 0 ? {
@@ -1551,7 +2216,7 @@ function requireRequestScopes() {
 */
 function visibilityFor(scopes, source) {
 	const request = resolved();
-	if (source && !isIdentifierSet(source) && request?.scopes === scopes) return getOrCreate(request.visibility, source, () => buildScopeVisibility(scopes, source, { relations: requestRelations() }));
+	if (source && !isIdentifierSet(source) && request?.scopes === scopes) return getOrCreate(request.visibility, source, () => buildScopeVisibility(scopes, source, { relations: requestRelations(source) }));
 	return scopeVisibility(scopes, source);
 }
 /**
@@ -1585,7 +2250,18 @@ function isScopedFieldVisible(scopes, path, source) {
 * action id / row is read): resolve the request's scopes
 * ({@link resolveRequestScopes} — 403 on denial, `arbacPublic` does not
 * bypass) and, on read endpoints, the `$with` relation policy for the
-* requested relations.
+* requested relations — the `$with` entries and, since 0.1.74, the
+* relations the client filter's relational predicates name (`ctx.filter`):
+* a predicate on a relation is allowed exactly when `$with` of it is (same
+* visibility, same `controls.$with` gates).
+*
+* Delegated endpoints (no grant of their own): `"availableActions"`
+* (`GET /meta/actions…`) — some row-level action grant (or, on a
+* `@DbActionsFrom` controller, none: its own part lists nothing);
+* `"delegatedAction"` (`POST /delegated-actions/:name`, since 0.1.74) — the
+* controller's READ grant, since the route only resolves which of the
+* caller's readable rows match the query; the action itself is authorized
+* by its source controller on every batch.
 *
 * @since 0.1.72
 */
@@ -1594,8 +2270,13 @@ async function prepareArbacRequest(ctx, readable) {
 		await authorizeAvailableActions();
 		return;
 	}
+	if (ctx.endpoint === "delegatedAction") {
+		await authorizeDelegatedQueryTarget();
+		return;
+	}
 	const scopes = await resolveRequestScopes();
-	if (ctx.controls && READ_ENDPOINTS.has(ctx.endpoint)) await resolveRequestRelations(scopes, ctx.controls, readable);
+	if (ctx.endpoint === "insert" && ctx.onConflict === "ignore") resolved().insertIgnore = true;
+	if (READ_ENDPOINTS.has(ctx.endpoint)) enforceRelationGates(await resolveRequestRelations(scopes, ctx.controls, readable, ctx.filter), visibilityFor(scopes, readable));
 }
 /**
 * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
@@ -1621,14 +2302,42 @@ function actionsIds(names) {
 * overlay stays unrestricted — each action's rows come from
 * `actionRowScope` ({@link arbacActionRowScope}) — while field visibility
 * is never wider than the widest granted action.
+*
+* A `@DbActionsFrom` controller without an own row-level grant is served
+* too (since 0.1.74): its own part lists nothing (a match-nothing row
+* overlay), and each delegated action is answered by its source controller,
+* under the caller's grants THERE.
 */
 async function authorizeAvailableActions() {
 	const ctx = current();
 	const instance = useControllerContext(ctx).getController();
-	const granted = await evaluateHandlers(actionsIds(discoverRowLevelActions(getConstructor(instance), instance.app, instance.logger).map((e) => e.info.name)));
+	const ctor = getConstructor(instance);
+	const granted = await evaluateHandlers(actionsIds(discoverRowLevelActions(ctor, instance.app, instance.logger).map((e) => e.info.name)));
+	const arbac = useArbac(ctx);
+	if (granted) storeResolved(ctx, arbac, void 0, granted.map(withoutRowPolicy));
+	else if (hasActionDelegations(ctor)) storeResolved(ctx, arbac, void 0, NO_OWN_ACTIONS);
+	else throw insufficientPrivileges(arbac.resource, arbac.action);
+}
+/** The own scopes of a delegating controller's `GET /meta/actions` without an own grant. */
+const NO_OWN_ACTIONS = [{
+	filter: DENY_FILTER,
+	check: DENY_FILTER
+}];
+/**
+* `POST /delegated-actions/:name` (endpoint `"delegatedAction"`): the route
+* resolves which rows of THIS controller match the query — a read, so it
+* is served under the caller's read grant (its `query` handler; none →
+* 403), stored as the request's scopes (`transformFilter`, `hasField` and
+* moost-db's default `queryTargetScope` read them). It grants nothing on
+* the action: the source controller's route re-authorizes every batch.
+*/
+async function authorizeDelegatedQueryTarget() {
+	const ctx = current();
 	const arbac = useArbac(ctx);
-	if (!granted) throw insufficientPrivileges(arbac.resource, arbac.action);
-	storeResolved(ctx, arbac, void 0, granted.map(withoutRowPolicy));
+	const ids = readHandlerIds(useControllerContext(ctx).getController());
+	const scopes = ids.length > 0 ? await evaluateHandlers(ids) : void 0;
+	if (!scopes) throw insufficientPrivileges(ids[0]?.resource ?? arbac.resource, ids[0]?.action ?? "query");
+	storeResolved(ctx, arbac, void 0, scopes);
 }
 /** A scope without its row policy (`filter` / `check`). */
 function withoutRowPolicy(scope) {
@@ -1653,12 +2362,17 @@ const actionScopes = cached(() => /* @__PURE__ */ new Map());
 * `@DbAction` `name` may run on — the filter of the caller's grant on the
 * action ({@link actionArbacIds}: every handler method of the action, or a
 * class-level entry's fallback ids), including custom-field row filters and
-* credential attenuation. No grant → a match-nothing filter (fail closed);
-* an unrestricted grant → `undefined`. When the current request IS that
-* action (its resolved scopes are the same evaluation), the row overlay
+* credential attenuation. Several grants union (`$or`); attenuation is
+* already intersected into each. No grant → a match-nothing filter (fail
+* closed); an unrestricted grant → `undefined`. When the current request IS
+* that action (its resolved scopes are the same evaluation), the row overlay
 * already applies it → `undefined`. Equal filters are returned as ONE
 * object per request.
 *
+* Candidate-free on purpose (evaluated once per action per event) — see
+* `AsArbacDbController.actionRowScope` to bound an action by its candidate
+* rows.
+*
 * @since 0.1.72
 */
 async function arbacActionRowScope(name) {
@@ -1681,110 +2395,26 @@ async function arbacActionRowScope(name) {
 * @since 0.1.72
 */
 function arbacRowFilter(filter) {
-	return conjoinScopeFilters(effectiveScope(requireRequestScopes()).filter, filter) ?? {};
-}
-//#endregion
-//#region src/db/shared-read-helpers.ts
-/**
-* Restrict the user-supplied `$select` to the scopes' projection union.
-* Returns the original projection untouched when no scope declares a
-* projection (so caller sees the unrestricted shape). Reads the same cached
-* visibility (`vis.allowed`) `hasField` / `/meta` pruning use, so value
-* stripping and name hiding cannot drift.
-*
-* `projection` is the `$select` as moost-db parsed it: an inclusion is an
-* ARRAY of names, an exclusion an object — both are normalized first. A
-* requested parent (`$select=a`) narrows to what the scope shows: to the
-* whitelisted descendants (`a.b: 1`), or — for a hidden descendant
-* (`a.c: 0`) — to its visible children via `childrenOf` (without a schema
-* the parent is dropped). Never the whole object, and never the empty
-* (universe) projection: when nothing survives, the scope's own projection
-* applies (`restrictProjection`'s ceiling fallback).
-*
-* An exclusion result names nested-object parents by their leaves
-* (`{ a: 0 }` → `{ "a.b": 0, "a.c": 0 }`): flattening adapters invert an
-* exclusion against their leaf columns, so a parent key alone would strip
-* nothing (a scope `{ a: 0 }` would otherwise return all of `a`).
-*
-* @since 0.1.72
-*/
-function applyArbacProjection(projection, scopes, readable) {
-	return restrictSelect(projection, visibilityFor(scopes, readable));
-}
-/** {@link applyArbacProjection} over an already-built visibility level. */
-function restrictSelect(projection, vis) {
-	if (Object.keys(vis.allowed).length === 0) return projection;
-	const childrenOf = fieldChildrenOf(vis.table);
-	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
-}
-/**
-* Enforce the union of per-scope `controls` gates against the parsed
-* Uniquery controls. Throws `HttpError(403)` on the first violation.
+	return conjoinScopeFilters$1(effectiveScope(requireRequestScopes()).filter, filter) ?? {};
+}
+/**
+* Body of the ARBAC DB controllers' `transformRelationFilter` (since 0.1.74):
+* the operand of a CLIENT relational predicate at `path` (`ticket`,
+* `ticket.team`, `tickets.issues` inside `$with=tickets(…)`) CONJOINED
+* with the row filter of the related rows the caller may see there — the
+* same policy `$with` of that relation applies: a declared `with.<rel>`
+* sub-scope, else the caller's own read grant on the related table. So
+* `$some` matches, and `$none` excludes, only on rows the caller could
+* load. A relation the request did not resolve answers like an unknown
+* field (400 — the request gate rejects it first).
 *
-* @since 0.1.72
+* @since 0.1.74
 */
-function applyArbacControls(controls, scopes) {
-	enforceControlsPolicy(effectiveScope(scopes).controls, controls);
-}
-/**
-* Walk the user-supplied `$with` items in `controls` and overlay each joined
-* relation with the policy of its rows (the `$with` inherit-target policy):
-* a relation some scope declares `with.<name>` for gets the union of those
-* sub-scopes (parent authority — silent roles contribute nothing); any other
-* gets the caller's OWN read scopes on the related table, as resolved in
-* `prepareRequest` (for the request's own scopes). Filter conjoined, `$select`
-* restricted, per-relation `controls` gates enforced, recursively.
-*
-* Mutates `controls` in place (matches the `validateControls` contract).
-* Throws `HttpError(403)` if a per-relation control policy is violated. A
-* hidden relation is skipped: moost-db (≥ 0.1.143) rejects it at every
-* level through `hasField`, byte-for-byte like a nonexistent one.
-*
-* @since 0.1.72
-*/
-function applyArbacRelationScopes(controls, scopes, readable) {
-	const withArr = controls.$with;
-	if (!Array.isArray(withArr) || withArr.length === 0) return;
-	applyRelationLevel(controls, visibilityFor(scopes, readable));
-}
-/** One `$with` level of {@link applyArbacRelationScopes}. */
-function applyRelationLevel(controls, vis) {
-	const withArr = controls.$with;
-	if (!Array.isArray(withArr) || withArr.length === 0) return;
-	for (const raw of withArr) {
-		if (!raw || typeof raw !== "object") continue;
-		const entry = raw;
-		if (typeof entry.name !== "string" || entry.name.includes(".")) continue;
-		const level = (!vis.relationNames || vis.relationNames.has(entry.name)) && isMetaFieldVisible(entry.name, vis) ? vis.relation?.(entry.name) : void 0;
-		if (!level) continue;
-		const sub = effectiveScope(level.scopes ?? []);
-		const conjoined = conjoinScopeFilters(sub.filter, entry.filter);
-		if (conjoined) entry.filter = conjoined;
-		const entryControls = entry.controls ?? {};
-		const restricted = restrictSelect(entryControls.$select, level);
-		if (restricted !== void 0) {
-			entryControls.$select = restricted;
-			entry.controls = entryControls;
-		}
-		enforceControlsPolicy(sub.controls, entryControls);
-		applyRelationLevel(entryControls, level);
-	}
-}
-/**
-* `$select` may be an array of field names (uniquery inclusion list) or a
-* `TProjection` object. `restrictProjection` operates on the object form
-* (it would read `["a"]` as an exclusion keyed `"0"`), so normalize the array
-* to `{ field: 1 }` first. Returns undefined if the input is empty (caller
-* treats as "no projection set").
-*/
-function normalizeSelect(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (Array.isArray(value)) {
-		const out = {};
-		for (const item of value) if (typeof item === "string") out[item] = 1;
-		return Object.keys(out).length > 0 ? out : void 0;
-	}
-	if (typeof value === "object") return value;
+function arbacRelationFilter(path, filter, readable) {
+	let level = visibilityFor(requireRequestScopes(), readable);
+	for (const name of path.split(".")) level = level && visibleRelation(name, level);
+	if (!level?.scopes) throw badRequest(path, `Unknown field "${path}"`);
+	return conjoinScopeFilters$1(effectiveScope(level.scopes).filter, filter) ?? filter;
 }
 //#endregion
 //#region src/db/write-fields.ts
@@ -1914,16 +2544,44 @@ var UnsupportedCheckError = class extends Error {};
 * BEFORE the write. Deliberately a small subset of the filter language
 * (`$eq`/`$ne`/`$in`/`$nin`/ordering/`$exists` + `$and`/`$or`/`$not`) with the
 * database's null model (`$eq: null` matches null or missing, `$exists`
-* means "holds a non-null value"); any other operator (e.g. `$regex`) throws
-* {@link UnsupportedCheckError} — callers fail closed.
+* means "holds a non-null value"); any other operator (e.g. `$regex`) and
+* a relational predicate (`{ ticket: { $some: … } }` — it needs the related
+* rows) throw {@link UnsupportedCheckError} — callers fail closed.
 */
 function compileScopeCheck(filter) {
 	return walkFilter(filter, checkVisitor) ?? (() => true);
 }
-/** The field paths a filter references (dotted, as written). */
+/**
+* The field paths a filter references (dotted, as written). A relational
+* predicate throws {@link UnsupportedCheckError} (its fields live on the
+* related table).
+*/
 function checkFields(filter) {
+	if (containsRelationFilter(filter)) throw new UnsupportedCheckError("relational predicate");
 	return new Set(computeInsights(filter).keys());
 }
+/**
+* The in-memory WITH CHECK verdict for rows about to be inserted: `false` when
+* a row the evaluator can decide fails the check, `true` when every row passes,
+* `undefined` when some row cannot be decided up front — the check is not
+* modelled (relational, `$regex`, …) or reads a field the row omits (a database
+* default or generated value).
+*/
+function insertRowsVerdict(rows, check) {
+	let predicate;
+	let fields;
+	try {
+		predicate = compileScopeCheck(check);
+		fields = checkFields(check);
+	} catch (error) {
+		if (error instanceof UnsupportedCheckError) return void 0;
+		throw error;
+	}
+	let verdict = true;
+	for (const row of rows) if ([...fields].some((f) => getPath(row, f) === void 0)) verdict = void 0;
+	else if (!predicate(row)) return false;
+	return verdict;
+}
 function same(a, b) {
 	if (a instanceof Date && b instanceof Date) return a.getTime() === b.getTime();
 	return a === b;
@@ -1938,6 +2596,9 @@ const checkVisitor = {
 	and: (children) => (row) => children.every((c) => c(row)),
 	or: (children) => (row) => children.some((c) => c(row)),
 	not: (child) => (row) => !child(row),
+	relation(field, op) {
+		throw new UnsupportedCheckError(`${field}: ${op}`);
+	},
 	comparison(field, op, value) {
 		const read = (row) => getPath(row, field);
 		const compare = (test) => (row) => {
@@ -2069,9 +2730,14 @@ async function assertWrittenRowsInCheck(ctx, check) {
 * - `checkRefs` — every enforced FK the write sets must reference rows the
 *   caller can read on the target table (→ 403);
 * - WITH CHECK when the adapter cannot roll back — validated here, before
-*   the write (see {@link checkArbacWrite} for the transactional path).
-*/
-async function guardArbacWrite(ctx, scopes, table, refs) {
+*   the write (see {@link checkArbacWrite} for the transactional path);
+* - WITH CHECK of an insert, even on a transactional adapter, evaluated on
+*   the submitted rows before the write when the in-memory evaluator can
+*   model it (a forbidden row → 403, never a duplicate-key 409; since
+*   0.1.75) — and, with `ignoreConflicts` (`?$onConflict=ignore`), refused
+*   whenever it cannot, since the post-write check never sees skipped rows.
+*/
+async function guardArbacWrite(ctx, scopes, table, refs, ignoreConflicts = false) {
 	const eff = effectiveScope(scopes);
 	if (eff.filter && hasPreImage(ctx.action)) await assertIdFiltersInScope(table, ctx.rows.map((_row, i) => {
 		const filter = ctx.filterFor(i);
@@ -2079,7 +2745,12 @@ async function guardArbacWrite(ctx, scopes, table, refs) {
 		return filter;
 	}), eff.filter);
 	await assertRefsInScope(ctx, scopes, refs);
-	if (eff.check && !table.getAdapter().isInTransaction()) await assertCheckBeforeWrite(ctx, eff.check);
+	if (!eff.check) return;
+	if (!table.getAdapter().isInTransaction()) await assertCheckBeforeWrite(ctx, eff.check);
+	else if (!hasPreImage(ctx.action)) {
+		const verdict = insertRowsVerdict(ctx.rows, eff.check);
+		if (verdict === false || verdict === void 0 && ignoreConflicts) throw new HttpError(403, OUT_OF_SCOPE);
+	}
 }
 /**
 * WITH CHECK after the write, inside its transaction: every written row must
@@ -2115,9 +2786,23 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	prepareRequest(ctx) {
 		return prepareArbacRequest(ctx, this.readable);
 	}
+	/**
+	* The request filter ∧ the union of the scopes' `filter`s. Computed
+	* synchronously, but typed with moost-db's async-capable contract
+	* (`FilterExpr | Promise<FilterExpr>`) so a subclass may override it
+	* `async` — `await super.transformFilter(filter)` — and moost-db awaits it.
+	*/
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
+	/** A client relational predicate's operand ∧ the related rows the caller may see ({@link arbacRelationFilter}). Since 0.1.74. */
+	transformRelationFilter(path, filter) {
+		return arbacRelationFilter(path, filter, this.readable);
+	}
+	/**
+	* `$select` restricted to the scopes' projection union. Synchronous, typed
+	* async-capable like {@link transformFilter}.
+	*/
 	transformProjection(projection) {
 		return applyArbacProjection(projection, requireRequestScopes(), this.readable);
 	}
@@ -2172,6 +2857,14 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return applyArbacMetaOverlay(meta, this.readable);
 	}
 	/**
+	* `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+	* prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+	* (or whose named fields they cannot see) is stripped.
+	*/
+	async metaForm(name) {
+		return applyArbacFormOverlay(await super.metaForm(name), getControllerFormType(this.constructor, name));
+	}
+	/**
 	* `GET /meta/form/:name` serves a form only when the caller may run at
 	* least one of the actions taking it as input (else the unknown-form 404).
 	*/
@@ -2180,10 +2873,22 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 	/**
 	* The rows each `@DbAction` may run on: the caller's grant on that action
-	* (see `arbacActionRowScope`). Enforced by the action gate and reflected
-	* in `$actions` and `GET /meta/actions/:id`. Since 0.1.72.
+	* ({@link arbacActionRowScope} — several grants union, attenuation
+	* intersects). Enforced by the action gate and reflected in `$actions` and
+	* `GET /meta/actions/:id`. Since 0.1.72.
+	*
+	* The grant does not depend on `ctx` (the candidate rows, since 0.1.74).
+	* To bound an action further by the candidates, override and AND your
+	* filter onto `super`'s — it must never replace it:
+	*
+	* ```ts
+	* protected async actionRowScope(name: string, ctx: TDbActionScopeContext) {
+	*   const grant = await super.actionRowScope(name, ctx);
+	*   return conjoinScopeFilters(grant, await myCandidateScope(name, ctx));
+	* }
+	* ```
 	*/
-	actionRowScope(name) {
+	actionRowScope(name, _ctx) {
 		return arbacActionRowScope(name);
 	}
 	/**
@@ -2233,7 +2938,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 	/** In-transaction stage — USING, `checkRefs`, and WITH CHECK on non-transactional adapters. */
 	guardWrite(ctx) {
-		return guardArbacWrite(ctx, requireRequestScopes(), this.guardedTable, this.readable);
+		return guardArbacWrite(ctx, requireRequestScopes(), this.guardedTable, this.readable, isInsertIgnoreRequest());
 	}
 	/** USING for deletes: the exact row the delete targets must match the scope filter (else 404). */
 	guardRemove(ctx) {
@@ -2366,6 +3071,10 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
+	/** Same contract as {@link AsArbacDbController.transformRelationFilter}. Since 0.1.74. */
+	transformRelationFilter(path, filter) {
+		return arbacRelationFilter(path, filter, this.readable);
+	}
 	/** Same contract as {@link AsArbacDbController.transformProjection}. */
 	transformProjection(projection) {
 		return applyArbacProjection(projection, requireRequestScopes(), this.readable);
@@ -2382,12 +3091,20 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	applyMetaOverlay(meta) {
 		return applyArbacMetaOverlay(meta, this.readable);
 	}
+	/**
+	* `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+	* prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+	* (or whose named fields they cannot see) is stripped.
+	*/
+	async metaForm(name) {
+		return applyArbacFormOverlay(await super.metaForm(name), getControllerFormType(this.constructor, name));
+	}
 	/** Same contract as {@link AsArbacDbController.authorizeForm}. */
 	authorizeForm(_name, actionNames) {
 		return authorizeArbacForm(actionNames);
 	}
 	/** Same contract as {@link AsArbacDbController.actionRowScope}. */
-	actionRowScope(name) {
+	actionRowScope(name, _ctx) {
 		return arbacActionRowScope(name);
 	}
 	/** Same contract as {@link AsArbacDbController.allowedActions}. */
@@ -2406,7 +3123,7 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
 //#region src/db/as-arbac-value-help-controller.ts
-function valueHelpHost(fields, primaryKey, searchableFields) {
+function valueHelpHost(boundType, primaryKey, searchableFields) {
 	const ids = primaryKey ? [primaryKey] : [];
 	return {
 		primaryKey,
@@ -2414,7 +3131,8 @@ function valueHelpHost(fields, primaryKey, searchableFields) {
 		source: {
 			primaryKeys: ids,
 			preferredId: ids,
-			flatMap: fields
+			type: boundType,
+			flatMap: boundType.type.props ?? /* @__PURE__ */ new Map()
 		}
 	};
 }
@@ -2461,12 +3179,15 @@ async function applyValueHelpMetaOverlay(host, meta) {
 }
 let AsArbacValueHelpController = class AsArbacValueHelpController extends AsValueHelpController {
 	_arbacHost;
+	/** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+	_arbacValueHelpTarget = registerArbacValueHelpTarget(this, this.arbacHost.source);
 	get arbacHost() {
-		return this._arbacHost ??= valueHelpHost(this.fieldMeta, this.primaryKey, this.searchableFields);
+		return this._arbacHost ??= valueHelpHost(this.boundType, this.primaryKey, this.searchableFields);
 	}
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
 	}
+	/** Same contract as {@link AsArbacDbController.transformFilter}. */
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
@@ -2501,35 +3222,38 @@ __decorate([
 	ArbacAction("query"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runQuery", null);
 __decorate([
 	ArbacAction("pages"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runPages", null);
 __decorate([
 	ArbacAction("getOne"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runGetOne", null);
 __decorate([
 	ArbacAction("getOneComposite"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacValueHelpController.prototype, "runGetOneComposite", null);
 AsArbacValueHelpController = __decorate([Inherit()], AsArbacValueHelpController);
 let AsArbacJsonValueHelpController = class AsArbacJsonValueHelpController extends AsJsonValueHelpController {
 	_arbacHost;
+	/** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+	_arbacValueHelpTarget = registerArbacValueHelpTarget(this, this.arbacHost.source);
 	get arbacHost() {
-		return this._arbacHost ??= valueHelpHost(this.fieldMeta, this.primaryKey, this.searchableFields);
+		return this._arbacHost ??= valueHelpHost(this.boundType, this.primaryKey, this.searchableFields);
 	}
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
 	}
+	/** Same contract as {@link AsArbacDbController.transformFilter}. */
 	transformFilter(filter) {
 		return arbacRowFilter(filter);
 	}
@@ -2564,25 +3288,25 @@ __decorate([
 	ArbacAction("query"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runQuery", null);
 __decorate([
 	ArbacAction("pages"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runPages", null);
 __decorate([
 	ArbacAction("getOne"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [String]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runGetOne", null);
 __decorate([
 	ArbacAction("getOneComposite"),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record]),
-	__decorateMetadata("design:returntype", void 0)
+	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runGetOneComposite", null);
 AsArbacJsonValueHelpController = __decorate([Inherit()], AsArbacJsonValueHelpController);
 //#endregion
@@ -2609,7 +3333,7 @@ async function useArbacDbScope() {
 	const visibleOn = (table) => (path) => isScopedFieldVisible(scopes, path, table);
 	return {
 		scopes,
-		filter: (extra) => conjoinScopeFilters(eff.filter, extra) ?? {},
+		filter: (extra) => conjoinScopeFilters$1(eff.filter, extra) ?? {},
 		set: () => ({ ...eff.set }),
 		check: () => eff.check ?? {},
 		async assertRowsInScope(table, ids) {
@@ -2632,12 +3356,12 @@ async function useArbacDbScope() {
 			currentAll: async () => rows.map(() => null),
 			filterFor: () => null
 		}, scopes, table),
-		writeOptions: (table) => ({
+		writeOptions: (table, opts) => ({
 			isFieldVisible: visibleOn(table),
 			guard: async (ctx) => {
 				const rows = ctx;
 				assertNestedWritesAllowed(rows.rows, scopes, navFieldsOf(table));
-				await guardArbacWrite(rows, scopes, table, table);
+				await guardArbacWrite(rows, scopes, table, table, opts?.onConflict === "ignore");
 			},
 			check: (ctx) => checkArbacWrite(ctx, scopes)
 		}),
@@ -2649,4 +3373,4 @@ async function useArbacDbScope() {
 	};
 }
 //#endregion
-export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };