@aooth/arbac-moost 0.1.74 → 0.1.76

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKjmUhkx.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-D0ySI_-A.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts

package/dist/index.d.mts

@@ -1,11 +1,11 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-CKjmUhkx.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-D0ySI_-A.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { ControlGate, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
 import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbActionScopeContext, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
-import { TAtscriptAnnotatedType, TAtscriptDataType } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializedAnnotatedType } from "@atscript/typescript/utils";
 //#region src/db/visibility.d.ts
 /**
  * The slice of an atscript-db readable (table / view) the visibility walk
@@ -311,6 +311,12 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
   protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   /** Same contract as {@link AsArbacDbController.applyMetaOverlay}. */
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
+  /**
+   * `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+   * prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+   * (or whose named fields they cannot see) is stripped.
+   */
+  metaForm(name: string): Promise<TSerializedAnnotatedType>;
   /** Same contract as {@link AsArbacDbController.authorizeForm}. */
   protected authorizeForm(_name: string, actionNames: readonly string[]): Promise<boolean>;
   /** Same contract as {@link AsArbacDbController.actionRowScope}. */
@@ -359,6 +365,8 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
  */
 declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsValueHelpController<T, DataType> {
   private _arbacHost?;
+  /** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+  protected readonly _arbacValueHelpTarget: true;
   private get arbacHost();
   protected prepareRequest(_ctx: TDbRequestContext): Promise<void>;
   /** Same contract as {@link AsArbacDbController.transformFilter}. */
@@ -392,6 +400,8 @@ declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedTy
  */
 declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsJsonValueHelpController<T, DataType> {
   private _arbacHost?;
+  /** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+  protected readonly _arbacValueHelpTarget: true;
   private get arbacHost();
   protected prepareRequest(_ctx: TDbRequestContext): Promise<void>;
   /** Same contract as {@link AsArbacDbController.transformFilter}. */
@@ -703,9 +713,14 @@ interface ArbacWriteTable {
  * - `checkRefs` — every enforced FK the write sets must reference rows the
  *   caller can read on the target table (→ 403);
  * - WITH CHECK when the adapter cannot roll back — validated here, before
- *   the write (see {@link checkArbacWrite} for the transactional path).
+ *   the write (see {@link checkArbacWrite} for the transactional path);
+ * - WITH CHECK of an insert, even on a transactional adapter, evaluated on
+ *   the submitted rows before the write when the in-memory evaluator can
+ *   model it (a forbidden row → 403, never a duplicate-key 409; since
+ *   0.1.75) — and, with `ignoreConflicts` (`?$onConflict=ignore`), refused
+ *   whenever it cannot, since the post-write check never sees skipped rows.
  */
-declare function guardArbacWrite(ctx: TDbWriteGuardContext, scopes: readonly ArbacDbScope[], table: ArbacWriteTable, refs: RefTableSource): Promise<void>;
+declare function guardArbacWrite(ctx: TDbWriteGuardContext, scopes: readonly ArbacDbScope[], table: ArbacWriteTable, refs: RefTableSource, ignoreConflicts?: boolean): Promise<void>;
 /**
  * WITH CHECK after the write, inside its transaction: every written row must
  * match the scopes' `check` (default `filter`) — else 403 and the write rolls
@@ -773,11 +788,16 @@ interface ArbacDbScopeHelpers<T = unknown> {
    * enforcement the ARBAC DB controllers' CRUD writes get — nested writes
    * (`nestedWrites`, 403), USING (pre-image in scope, 404), `checkRefs` (403)
    * and WITH CHECK (403, rolled back). `allowedFields` / `set` are not applied
-   * — overlay {@link set} yourself.
+   * — overlay {@link set} yourself. For `insertMany(rows, { onConflict: "ignore" })`
+   * pass the same `{ onConflict: "ignore" }`: conflicting rows are skipped, so
+   * a check that cannot be evaluated before the write refuses the batch
+   * (since 0.1.75).
    *
    * @since 0.1.72
    */
-  writeOptions<Row extends object = Record<string, unknown>>(table: ArbacGuardedTable): TWriteOptions<Row>;
+  writeOptions<Row extends object = Record<string, unknown>>(table: ArbacGuardedTable, opts?: {
+    onConflict?: "ignore";
+  }): TWriteOptions<Row>;
   /**
    * `TDeleteOptions` for `table.deleteOne` in a handler: the id is pinned
    * among in-scope rows and the row must match the scope filter (else 404) —

package/dist/index.mjs

@@ -4,8 +4,8 @@ import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilte
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { cached, cachedBy, current, eventTypeKey, key, tryGetCurrent } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
-import { computeInsights, containsRelationFilter, findAncestorInSet, getPath, hasRelationOp, isPlainObject, isRelationOp } from "@atscript/db";
-import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, badRequest, discoverRowLevelActions, getDbEndpoint, hasActionDelegations, resolveTerminalRef } from "@atscript/moost-db";
+import { computeInsights, containsRelationFilter, findAncestorInSet, getPath, hasRelationOp, isPlainObject, isRelationOp, translateQueryTree } from "@atscript/db";
+import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, badRequest, discoverRowLevelActions, getControllerFormType, getDbEndpoint, hasActionDelegations, resolveTerminalRef } from "@atscript/moost-db";
 import { groupByFields, walkFilter } from "@uniqu/core";
 //#region src/db/helpers.ts
 /** `map.get(key)`, created with `create()` and stored on a miss. */
@@ -298,11 +298,28 @@ const registry = /* @__PURE__ */ new WeakMap();
 */
 function registerArbacDbTarget(controller) {
 	const c = controller;
-	const target = c.readable?.type ?? c.readable;
+	const target = valueHelpTargets.get(controller)?.source.type ?? c.readable?.type ?? c.readable;
 	if (!target) return true;
 	getOrCreate(getOrCreate(registry, c.app ?? NO_APP, () => /* @__PURE__ */ new WeakMap()), target, () => /* @__PURE__ */ new Map()).set(getConstructor(controller), controller);
 	return true;
 }
+/** Value-help controllers have no `readable`: their visibility source and read handler method. */
+const valueHelpTargets = /* @__PURE__ */ new WeakMap();
+/**
+* Register an ARBAC value-help controller as an owner of its bound type's
+* ARBAC resource, so a `ui.valueHelp` binding (or `ref`) from another
+* controller's `/meta` is kept for a caller who can read the dictionary
+* through it (its `runQuery` grant, evaluated against `source`).
+*
+* @returns `true` (so it can initialize a field)
+*/
+function registerArbacValueHelpTarget(controller, source) {
+	valueHelpTargets.set(controller, {
+		source,
+		method: "runQuery"
+	});
+	return registerArbacDbTarget(controller);
+}
 function registeredControllers(target) {
 	let app = NO_APP;
 	try {
@@ -346,13 +363,14 @@ function evaluateHandlerOutcomes(ids) {
 async function evaluateTypeRead(type) {
 	const controllers = registeredControllers(type);
 	if (controllers.length === 0) return null;
+	const tableOf = (c) => valueHelpTargets.get(c)?.source ?? c.readable;
 	const scopes = await evaluateHandlers(controllers.map((c) => ({
-		...resolveHandlerArbacIds(c, "query"),
-		table: c.readable
+		...resolveHandlerArbacIds(c, valueHelpTargets.get(c)?.method ?? "query"),
+		table: tableOf(c)
 	})));
 	return scopes ? {
 		scopes,
-		table: controllers[0].readable
+		table: tableOf(controllers[0])
 	} : null;
 }
 /**
@@ -1115,7 +1133,7 @@ function pruneMetaByVisibility(meta, vis, refTargets) {
 		...meta,
 		fields,
 		relations,
-		type: pruneSerializedType(meta.type, {
+		type: pruneSerializedType(inlineTypeRefs(meta.type), {
 			basePath: "",
 			vis,
 			relationNames,
@@ -1125,6 +1143,153 @@ function pruneMetaByVisibility(meta, vis, refTargets) {
 	if (out.versionColumn !== void 0 && !isMetaFieldVisible(out.versionColumn, vis)) delete out.versionColumn;
 	return out;
 }
+/**
+* Replace every `$ref` entry with a copy of the body serialized under its `id`
+* (the first node carrying that id), so each use is pruned by ITS OWN path's
+* visibility. A shared body pruned once would resolve, on the client, to the
+* first use's shape at every other use: hidden fields leak through a later
+* `$ref`, and a hidden first use leaves later `$ref`s dangling. An `own`
+* entry keeps its own metadata / optional / `ref`. Unknown ids and recursive
+* back-references stay `$ref`s (a recursive one points at an ancestor that is
+* itself retained). Never mutates the (cached) input.
+*/
+function inlineTypeRefs(root) {
+	return getOrCreate(inlinedCache, root, () => {
+		const bodies = /* @__PURE__ */ new Map();
+		collectBodies(root, bodies);
+		if (bodies.size === 0) return root;
+		return inlineNode(root, {
+			bodies,
+			budget: 2e4,
+			n: 0
+		}, /* @__PURE__ */ new Map(), false) ?? root;
+	});
+}
+const inlinedCache = /* @__PURE__ */ new WeakMap();
+function childNodes(node) {
+	const def = node.type;
+	const out = [];
+	if (def.kind === "object") {
+		out.push(...Object.values(def.props));
+		for (const p of def.propsPatterns ?? []) out.push(p.def);
+	} else if (def.kind === "array") out.push(def.of);
+	else if (Array.isArray(def.items)) out.push(...def.items);
+	const refType = node.ref?.type;
+	if (refType && refType.type) out.push(refType);
+	return out;
+}
+function collectBodies(node, bodies) {
+	if (node.type.kind === "$ref") return;
+	if (node.id !== void 0 && !bodies.has(node.id)) bodies.set(node.id, node);
+	for (const child of childNodes(node)) collectBodies(child, bodies);
+}
+function inlineNode(node, ctx, stack, inlining) {
+	const def = node.type;
+	if (def.kind === "$ref") {
+		const ancestor = stack.get(def.id);
+		if (ancestor !== void 0) return {
+			...node,
+			type: {
+				...def,
+				id: ancestor
+			}
+		};
+		const body = ctx.bodies.get(def.id);
+		if (!body) return node;
+		const inlined = inlineNode(body, ctx, stack, true);
+		if (!inlined) return void 0;
+		if (!def.own) return inlined;
+		const { ref: _ref, optional: _optional, ...rest } = inlined;
+		return {
+			...rest,
+			metadata: node.metadata,
+			...node.optional === void 0 ? {} : { optional: node.optional },
+			...node.ref ? { ref: node.ref } : {}
+		};
+	}
+	if (inlining && --ctx.budget < 0) return void 0;
+	let nextStack = stack;
+	let out = node;
+	if (node.id !== void 0) {
+		const copyId = `${node.id}#${++ctx.n}`;
+		nextStack = new Map(stack).set(node.id, copyId);
+		out = {
+			...node,
+			id: copyId
+		};
+	}
+	const d = def;
+	if (d.kind === "object") {
+		const props = {};
+		for (const [k, v] of Object.entries(d.props)) {
+			const r = inlineNode(v, ctx, nextStack, inlining);
+			if (r) props[k] = r;
+		}
+		const propsPatterns = [];
+		for (const p of d.propsPatterns ?? []) {
+			const r = inlineNode(p.def, ctx, nextStack, inlining);
+			if (r) propsPatterns.push({
+				...p,
+				def: r
+			});
+		}
+		out = {
+			...out,
+			type: {
+				...def,
+				props,
+				propsPatterns
+			}
+		};
+	} else if (d.kind === "array") {
+		const of = inlineNode(d.of, ctx, nextStack, inlining) ?? emptyStub();
+		out = {
+			...out,
+			type: {
+				...def,
+				of
+			}
+		};
+	} else if (Array.isArray(d.items)) {
+		const items = d.items.map((i) => inlineNode(i, ctx, nextStack, inlining) ?? emptyStub());
+		out = {
+			...out,
+			type: {
+				...def,
+				items
+			}
+		};
+	}
+	const refType = out.ref?.type;
+	if (out.ref && refType && refType.type) {
+		const r = inlineNode(refType, ctx, nextStack, inlining);
+		if (r) out = {
+			...out,
+			ref: {
+				...out.ref,
+				type: r
+			}
+		};
+		else {
+			const { ref: _r, ...noRef } = out;
+			out = noRef;
+		}
+	}
+	return out;
+}
+/** A body-less placeholder for a positional child dropped by the inline budget. */
+function emptyStub() {
+	return {
+		$v: 2,
+		type: {
+			kind: "object",
+			props: {},
+			propsPatterns: [],
+			tags: []
+		},
+		metadata: {}
+	};
+}
 function pruneSerializedType(node, level) {
 	const { basePath, vis, relationNames, refTargets } = level;
 	const def = node.type;
@@ -1151,20 +1316,21 @@ function pruneSerializedType(node, level) {
 				basePath: path
 			};
 			if (!isMetaFieldVisible(path, vis)) {
-				if (isPathWritable(path, vis)) props[name] = stampWriteOnly(prop);
-				else if (hasWritableDescendant(path, vis.writable)) props[name] = stampWriteOnly(pruneSerializedType(prop, child));
+				if (isPathWritable(path, vis)) props[name] = withVisibleTargets(stampWriteOnly(prop), path, vis, refTargets, level.inBranch);
+				else if (hasWritableDescendant(path, vis.writable)) props[name] = withVisibleTargets(stampWriteOnly(pruneSerializedType(prop, child)), path, vis, refTargets, level.inBranch);
 				continue;
 			}
-			const pruned = pruneSerializedType(prop, child);
-			props[name] = pruned.ref && !isRefVisible(path, vis, refTargets) ? withoutRef(pruned) : pruned;
+			props[name] = withVisibleTargets(pruneSerializedType(prop, child), path, vis, refTargets, level.inBranch);
 		}
-		return {
+		const pruned = {
 			...node,
 			type: {
 				...def,
 				props
 			}
 		};
+		if (basePath !== "" || !def.propsPatterns?.length || !vis.table?.flatMap || !refTargets) return pruned;
+		return gateChildren(pruned, level.inBranch ? void 0 : vis.table?.type, vis, refTargets, false);
 	}
 	if (def.kind === "array") return {
 		...node,
@@ -1177,7 +1343,10 @@ function pruneSerializedType(node, level) {
 		...node,
 		type: {
 			...def,
-			items: def.items.map((item) => pruneSerializedType(item, level))
+			items: def.items.map((item) => pruneSerializedType(item, {
+				...level,
+				inBranch: true
+			}))
 		}
 	};
 	return node;
@@ -1202,36 +1371,202 @@ function withoutRef(node) {
 	const { ref: _ref, ...rest } = node;
 	return rest;
 }
+/** The `/meta` annotation key of a dictionary value-help binding (`@ui.valueHelp`, since 0.1.75); a string constant — arbac-moost does not import `@atscript/ui`. */
+const UI_VALUE_HELP = "ui.valueHelp";
+function withoutBinding(node) {
+	const { [UI_VALUE_HELP]: _binding, ...metadata } = node.metadata;
+	return {
+		...node,
+		metadata
+	};
+}
+const bindingCache = /* @__PURE__ */ new WeakMap();
+/**
+* The runtime `ui.valueHelp` binding of a flat-map entry — the dictionary and
+* the fields it names there: the committed `field` plus every field its
+* static filter reads. `undefined` = no binding; `null` = a binding that
+* cannot be resolved (callers fail closed and strip it).
+*/
+function bindingOf(entry) {
+	const raw = entry?.metadata?.get?.(UI_VALUE_HELP);
+	if (!raw) return void 0;
+	let binding = bindingCache.get(entry);
+	if (binding === void 0) {
+		binding = resolveBinding(raw);
+		bindingCache.set(entry, binding);
+	}
+	return binding;
+}
+function resolveBinding(raw) {
+	try {
+		const t = raw.target;
+		const type = typeof t === "function" ? t() : t?.type();
+		if (!type) return null;
+		const fields = typeof raw.field === "string" ? [raw.field] : [];
+		if (raw.filter) translateQueryTree(raw.filter, (ref) => {
+			fields.push(ref.field);
+			return ref.field;
+		});
+		return {
+			type,
+			fields
+		};
+	} catch {
+		return null;
+	}
+}
+/** Every table a flat-map entry points at: its `ref` target and its value-help binding. */
+function targetsOf(entry) {
+	return [refTargetOf(entry), bindingOf(entry)].filter((t) => !!t);
+}
 /** The field a runtime prop's `ref` finally points at (the same terminal `/meta` serializes). */
 function refTargetOf(entry) {
 	const def = entry;
 	if (!def?.ref) return void 0;
 	const terminal = resolveTerminalRef(def);
-	if (terminal) return terminal;
+	if (terminal) return {
+		type: terminal.type,
+		fields: terminal.field ? [terminal.field] : []
+	};
 	try {
+		const { type, field } = def.ref;
 		return {
-			type: def.ref.type(),
-			field: def.ref.field
+			type: type(),
+			fields: field ? [field] : []
 		};
 	} catch {
 		return;
 	}
 }
+/** A table-served type: any `db.*` annotation (`db.table`, `db.view`, `db.http.path`, …). */
+function isDbServed(type) {
+	const meta = type.metadata;
+	if (!meta || typeof meta.keys !== "function") return false;
+	for (const key of meta.keys()) if (key.startsWith("db.")) return true;
+	return false;
+}
+/**
+* A target survives when the caller can read its table AND see every field it
+* names: a self-target against this level's visibility, a foreign one against
+* the caller's visibility on that table (`refTargets`; unreadable → hidden). A
+* target naming no field (a prop typed as a table interface, `@db.json snap?:
+* Dict`) still needs the table readable, unless the type is not table-served.
+*/
+function isTargetVisible(target, vis, refTargets) {
+	if (target.fields.length === 0 && !isDbServed(target.type)) return true;
+	const targetVis = target.type === vis.table?.type ? vis : refTargets.get(target.type);
+	return !!targetVis && target.fields.every((f) => isMetaFieldVisible(f, targetVis));
+}
+/** The binding on the TYPE a `ref` points at (an alias such as `@ui.valueHelp X type Code = string`). */
+function refTypeBindingOf(entry) {
+	try {
+		const type = entry?.ref?.type?.();
+		return type ? bindingOf(type) : null;
+	} catch {
+		return null;
+	}
+}
+/** Both targets of one node: stripped = hidden. The serialized `ref.type` carries its own metadata. */
+function gateOwn(node, entry, visible) {
+	let out = node;
+	if (out.ref) {
+		const ref = refTargetOf(entry);
+		if (!ref || !visible(ref)) out = withoutRef(out);
+	}
+	if (out.metadata?.[UI_VALUE_HELP] !== void 0) {
+		const binding = bindingOf(entry);
+		if (!binding || !visible(binding)) out = withoutBinding(out);
+	}
+	const refMeta = out.ref?.type?.metadata;
+	if (out.ref && refMeta?.[UI_VALUE_HELP] !== void 0) {
+		const binding = refTypeBindingOf(entry);
+		if (!binding || !visible(binding)) {
+			const { [UI_VALUE_HELP]: _b, ...metadata } = refMeta;
+			out = {
+				...out,
+				ref: {
+					...out.ref,
+					type: {
+						...out.ref.type,
+						metadata
+					}
+				}
+			};
+		}
+	}
+	return out;
+}
+/**
+* Gate the children of `node` a prop walk does not reach by flat path: array
+* elements, union / intersection / tuple members and wildcard props — each
+* paired with its runtime counterpart under `runtime` (a missing one fails
+* closed). `deep` also descends object props (own-field subtrees only; a nav
+* prop belongs to its own level).
+*/
+function gateChildren(node, runtime, vis, refTargets, deep) {
+	const visible = (t) => isTargetVisible(t, vis, refTargets);
+	const gate = (child, rt) => gateChildren(gateOwn(child, rt, visible), rt, vis, refTargets, true);
+	const rtType = runtime?.type;
+	const def = node.type;
+	if (def.kind === "object") {
+		let next = def;
+		if (deep && def.props) {
+			const props = {};
+			for (const [name, prop] of Object.entries(def.props)) props[name] = isNavProp(prop) ? prop : gate(prop, rtType?.props?.get?.(name));
+			next = {
+				...next,
+				props
+			};
+		}
+		if (def.propsPatterns?.length) {
+			const patterns = def.propsPatterns.map((p) => {
+				const rt = rtType?.propsPatterns?.find((r) => r.pattern?.source === p.pattern?.source && r.pattern?.flags === p.pattern?.flags)?.def;
+				return {
+					...p,
+					def: gate(p.def, rt)
+				};
+			});
+			next = {
+				...next,
+				propsPatterns: patterns
+			};
+		}
+		return next === def ? node : {
+			...node,
+			type: next
+		};
+	}
+	if (def.kind === "array") return {
+		...node,
+		type: {
+			...def,
+			of: gate(def.of, rtType?.of)
+		}
+	};
+	if (Array.isArray(def.items)) {
+		const items = def.items.map((item, i) => gate(item, rtType?.items?.[i]));
+		return {
+			...node,
+			type: {
+				...def,
+				items
+			}
+		};
+	}
+	return node;
+}
 /**
-* A serialized `ref` at `path` survives when its target field is visible:
-* a self-reference (e.g. a derived column's source) against this level's
-* visibility; a foreign one against the caller's visibility on the target
-* table (`refTargets`, stripped when the caller cannot read it). Without
-* runtime schema info (`vis.table.flatMap`) or `refTargets`, refs are kept.
+* Strip a serialized `ref` / `ui.valueHelp` binding at `path` — on the prop
+* itself, on a `ref` target's own metadata, and on every array element, union
+* / intersection / tuple member and wildcard prop below it — whose target is
+* hidden from the caller. Without runtime schema info (`vis.table.flatMap`) or
+* `refTargets`, all are kept.
 */
-function isRefVisible(path, vis, refTargets) {
-	const table = vis.table;
-	if (!table?.flatMap || !refTargets) return true;
-	const target = refTargetOf(table.flatMap.get(path));
-	if (!target || !target.field) return true;
-	if (target.type === table.type) return isMetaFieldVisible(target.field, vis);
-	const targetVis = refTargets.get(target.type);
-	return !!targetVis && isMetaFieldVisible(target.field, targetVis);
+function withVisibleTargets(node, path, vis, refTargets, ambiguous = false) {
+	const flatMap = vis.table?.flatMap;
+	if (!flatMap || !refTargets || !serializedHasTarget(node)) return node;
+	const entry = ambiguous ? void 0 : flatMap.get(path);
+	return gateChildren(gateOwn(node, entry, (t) => isTargetVisible(t, vis, refTargets)), entry, vis, refTargets, false);
 }
 const NO_NAMES = /* @__PURE__ */ new Set();
 /** A nav prop inside a joined type: atscript-db stamps `db.rel.to` / `from` / `via`. */
@@ -1313,23 +1648,203 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 		crud
 	};
 	if (readScopes.length === 0) return overlaid;
+	const groupBy = effectiveScope(readScopes).controls.$groupBy;
 	const writable = collectWritableFields(writeScopes, false);
 	const nestedWrites = effectiveScope(writeScopes).nestedWrites;
 	if (isIdentifierSet(source)) {
 		const vis = buildScopeVisibility(readScopes, void 0, source);
-		return Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0 ? pruneMetaByVisibility(overlaid, {
+		return gateGroupable(Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0 ? pruneMetaByVisibility(overlaid, {
 			...vis,
 			writable,
 			nestedWrites
-		}) : overlaid;
+		}) : overlaid, groupBy);
 	}
 	const vis = buildScopeVisibility(readScopes, source, { relations: await resolveRelationTree(readScopes, source, metaRelationNames(meta), { listSiblings: false }) });
 	const refTargets = await resolveRefTargets(vis, meta);
-	return pruneMetaByVisibility(overlaid, {
+	return gateGroupable(pruneMetaByVisibility(overlaid, {
 		...vis,
 		writable,
 		nestedWrites
-	}, refTargets);
+	}, refTargets), groupBy);
+}
+/**
+* The `/meta/form/:name` overlay: a form is a plain annotated type (no table),
+* so only its cross-table pointers are projected. Every prop's `ref` and
+* `ui.valueHelp` binding is stripped when the caller cannot read the target
+* table, or cannot see a field the pointer names there (the same rule as the
+* `/meta` type); an unresolvable binding is stripped too. Never mutates
+* `serialized` (the base controller caches it); returns it itself when
+* nothing is stripped.
+*
+* @param serialized - the form's serialized schema as moost-db served it
+* @param formType - the runtime form type the schema was serialized from
+*/
+async function applyArbacFormOverlay(serialized, formType) {
+	if (!formType) return serialized;
+	const types = /* @__PURE__ */ new Set();
+	collectFormTargets(formType, serialized, types, 0);
+	if (types.size === 0 && !hasUnresolvedBinding(formType, serialized, 0)) return serialized;
+	const readable = /* @__PURE__ */ new Map();
+	await Promise.all([...types].map(async (type) => {
+		const read = await evaluateTypeRead(type);
+		readable.set(type, read ? buildScopeVisibility(read.scopes, read.table) : null);
+	}));
+	return stripFormTargets(formType, serialized, readable, 0);
+}
+const formTargetsOf = (entry, node) => {
+	const out = [];
+	if (node.ref) {
+		const ref = refTargetOf(entry);
+		out.push(ref ?? null);
+	}
+	if (node.metadata?.[UI_VALUE_HELP] !== void 0) {
+		const binding = bindingOf(entry);
+		if (binding !== void 0) out.push(binding);
+	}
+	if (node.ref && node.ref.type?.metadata?.[UI_VALUE_HELP] !== void 0) out.push(refTypeBindingOf(entry) ?? null);
+	return out;
+};
+/** Pairs the runtime and serialized trees over EVERY child container (props, of, items). */
+function formChildren(runtime, node) {
+	const rt = runtime.type;
+	const def = node.type;
+	const out = [];
+	if (rt.props && def.props) {
+		for (const [name, child] of rt.props) if (def.props[name]) out.push([
+			child,
+			def.props[name],
+			{ prop: name }
+		]);
+	}
+	if (rt.of && !Array.isArray(rt.of) && def.of && !Array.isArray(def.of)) out.push([
+		rt.of,
+		def.of,
+		{ of: true }
+	]);
+	if (Array.isArray(rt.items) && Array.isArray(def.items)) rt.items.forEach((child, i) => def.items[i] && out.push([
+		child,
+		def.items[i],
+		{ item: i }
+	]));
+	def.propsPatterns?.forEach((p, i) => {
+		const match = rt.propsPatterns?.find((r) => r.pattern?.source === p.pattern?.source && r.pattern?.flags === p.pattern?.flags);
+		if (match) out.push([
+			match.def,
+			p.def,
+			{ pattern: i }
+		]);
+	});
+	return out;
+}
+/** Nested-relation walk bound — serialized nav bodies are finite, this only guards pathological input. */
+const MAX_NAV_DEPTH = 8;
+/** The form walk bound; past it every `ref` / binding is stripped (fail closed). */
+const MAX_FORM_DEPTH = MAX_NAV_DEPTH * 2;
+function serializedChildren(node) {
+	const def = node.type;
+	return [
+		...Object.values(def.props ?? {}),
+		...def.of ? [def.of] : [],
+		...def.items ?? [],
+		...(def.propsPatterns ?? []).map((p) => p.def)
+	];
+}
+function serializedHasTarget(node) {
+	return !!node.ref || node.metadata?.[UI_VALUE_HELP] !== void 0 || serializedChildren(node).some(serializedHasTarget);
+}
+function stripAllTargets(node) {
+	if (!serializedHasTarget(node)) return node;
+	let out = node;
+	if (out.ref) out = withoutRef(out);
+	if (out.metadata?.[UI_VALUE_HELP] !== void 0) out = withoutBinding(out);
+	const def = out.type;
+	const next = { ...def };
+	if (def.props) next.props = Object.fromEntries(Object.entries(def.props).map(([k, v]) => [k, stripAllTargets(v)]));
+	if (def.of) next.of = stripAllTargets(def.of);
+	if (def.items) next.items = def.items.map((i) => stripAllTargets(i));
+	if (def.propsPatterns) next.propsPatterns = def.propsPatterns.map((p) => ({
+		...p,
+		def: stripAllTargets(p.def)
+	}));
+	return {
+		...out,
+		type: next
+	};
+}
+function collectFormTargets(runtime, node, into, depth) {
+	if (depth >= MAX_FORM_DEPTH) return;
+	for (const t of formTargetsOf(runtime, node)) if (t) into.add(t.type);
+	for (const [child, childNode] of formChildren(runtime, node)) collectFormTargets(child, childNode, into, depth + 1);
+}
+function hasUnresolvedBinding(runtime, node, depth) {
+	if (depth >= MAX_FORM_DEPTH) return serializedHasTarget(node);
+	if (formTargetsOf(runtime, node).includes(null)) return true;
+	return formChildren(runtime, node).some(([c, n]) => hasUnresolvedBinding(c, n, depth + 1));
+}
+function stripFormTargets(runtime, node, readable, depth) {
+	if (depth >= MAX_FORM_DEPTH) return stripAllTargets(node);
+	const visible = (t) => {
+		if (!t) return false;
+		const targetVis = readable.get(t.type);
+		return !!targetVis && t.fields.every((f) => isMetaFieldVisible(f, targetVis));
+	};
+	const out = gateOwn(node, runtime, (t) => visible(t));
+	const children = formChildren(runtime, node);
+	let changed;
+	for (const [child, childNode, key] of children) {
+		const next = stripFormTargets(child, childNode, readable, depth + 1);
+		if (next === childNode) continue;
+		const base = changed ?? out.type;
+		if ("prop" in key) changed = {
+			...base,
+			props: {
+				...base.props,
+				[key.prop]: next
+			}
+		};
+		else if ("pattern" in key) changed = {
+			...base,
+			propsPatterns: base.propsPatterns.map((o, i) => i === key.pattern ? {
+				...o,
+				def: next
+			} : o)
+		};
+		else if ("item" in key) changed = {
+			...base,
+			items: base.items.map((o, i) => i === key.item ? next : o)
+		};
+		else changed = {
+			...base,
+			of: next
+		};
+	}
+	return changed ? {
+		...out,
+		type: changed
+	} : out;
+}
+/**
+* `fields[*].groupable` follows the `controls.$groupBy` policy, mirroring the
+* 403 `applyArbacControls` raises: `false` drops the flag everywhere, a
+* whitelist keeps it only on the listed paths. Returns `meta` itself when
+* nothing is stripped.
+*
+* @since 0.1.75
+*/
+function gateGroupable(meta, gate) {
+	if (gate === void 0 || gate === true) return meta;
+	const stripped = (path, field) => field.groupable && (gate === false || !gate.includes(path));
+	const entries = Object.entries(meta.fields);
+	if (!entries.some(([path, field]) => stripped(path, field))) return meta;
+	const fields = {};
+	for (const [path, field] of entries) if (stripped(path, field)) {
+		const { groupable: _groupable, ...rest } = field;
+		fields[path] = rest;
+	} else fields[path] = field;
+	return {
+		...meta,
+		fields
+	};
 }
 const metaNamesCache = /* @__PURE__ */ new WeakMap();
 /** The relation names `/meta`'s serialized type reaches: root relations, then nav props of each nav body. */
@@ -1338,7 +1853,7 @@ function metaRelationNames(meta) {
 }
 function buildMetaRelationNames(meta) {
 	const tree = /* @__PURE__ */ new Map();
-	const rootProps = objectProps(meta.type);
+	const rootProps = objectProps(inlineTypeRefs(meta.type));
 	for (const r of meta.relations) {
 		const nested = /* @__PURE__ */ new Map();
 		tree.set(r.name, nested);
@@ -1347,8 +1862,6 @@ function buildMetaRelationNames(meta) {
 	}
 	return tree;
 }
-/** Nested-relation walk bound — serialized nav bodies are finite, this only guards pathological input. */
-const MAX_NAV_DEPTH = 8;
 function collectNavNames(node, into, depth) {
 	if (depth >= MAX_NAV_DEPTH) return;
 	const props = objectProps(node);
@@ -1382,7 +1895,7 @@ async function resolveRefTargets(root, meta) {
 			if (sub) visit(sub, prop, depth + 1);
 		}
 	};
-	visit(root, meta.type, 0);
+	visit(root, inlineTypeRefs(meta.type), 0);
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all([...types].map(async (type) => {
 		const read = await evaluateTypeRead(type);
@@ -1399,8 +1912,7 @@ function foreignRefTypes(table) {
 		const out = /* @__PURE__ */ new Set();
 		for (const [path, entry] of flatMap) {
 			if (hasSelfOrAncestor(nav, path)) continue;
-			const target = refTargetOf(entry);
-			if (target && target.type !== table.type) out.add(target.type);
+			for (const target of targetsOf(entry)) if (target.type !== table.type) out.add(target.type);
 		}
 		return out;
 	});
@@ -1624,6 +2136,17 @@ const READ_ENDPOINTS = /* @__PURE__ */ new Set([
 	"one"
 ]);
 const requestScopesKey = key("arbac.db.scopes");
+/**
+* `true` while the current request is an insert in ignore mode
+* (`?$onConflict=ignore`): conflicting rows are skipped, so the post-write
+* WITH CHECK never sees them and the write guard must refuse what it cannot
+* check up front.
+*
+* @since 0.1.75
+*/
+function isInsertIgnoreRequest() {
+	return resolved()?.insertIgnore === true;
+}
 /** Store the event's resolved scopes (for the handler `ids` resolves to). */
 function storeResolved(ctx, ids, source, scopes) {
 	ctx.set(requestScopesKey, {
@@ -1752,6 +2275,7 @@ async function prepareArbacRequest(ctx, readable) {
 		return;
 	}
 	const scopes = await resolveRequestScopes();
+	if (ctx.endpoint === "insert" && ctx.onConflict === "ignore") resolved().insertIgnore = true;
 	if (READ_ENDPOINTS.has(ctx.endpoint)) enforceRelationGates(await resolveRequestRelations(scopes, ctx.controls, readable, ctx.filter), visibilityFor(scopes, readable));
 }
 /**
@@ -2036,6 +2560,28 @@ function checkFields(filter) {
 	if (containsRelationFilter(filter)) throw new UnsupportedCheckError("relational predicate");
 	return new Set(computeInsights(filter).keys());
 }
+/**
+* The in-memory WITH CHECK verdict for rows about to be inserted: `false` when
+* a row the evaluator can decide fails the check, `true` when every row passes,
+* `undefined` when some row cannot be decided up front — the check is not
+* modelled (relational, `$regex`, …) or reads a field the row omits (a database
+* default or generated value).
+*/
+function insertRowsVerdict(rows, check) {
+	let predicate;
+	let fields;
+	try {
+		predicate = compileScopeCheck(check);
+		fields = checkFields(check);
+	} catch (error) {
+		if (error instanceof UnsupportedCheckError) return void 0;
+		throw error;
+	}
+	let verdict = true;
+	for (const row of rows) if ([...fields].some((f) => getPath(row, f) === void 0)) verdict = void 0;
+	else if (!predicate(row)) return false;
+	return verdict;
+}
 function same(a, b) {
 	if (a instanceof Date && b instanceof Date) return a.getTime() === b.getTime();
 	return a === b;
@@ -2184,9 +2730,14 @@ async function assertWrittenRowsInCheck(ctx, check) {
 * - `checkRefs` — every enforced FK the write sets must reference rows the
 *   caller can read on the target table (→ 403);
 * - WITH CHECK when the adapter cannot roll back — validated here, before
-*   the write (see {@link checkArbacWrite} for the transactional path).
-*/
-async function guardArbacWrite(ctx, scopes, table, refs) {
+*   the write (see {@link checkArbacWrite} for the transactional path);
+* - WITH CHECK of an insert, even on a transactional adapter, evaluated on
+*   the submitted rows before the write when the in-memory evaluator can
+*   model it (a forbidden row → 403, never a duplicate-key 409; since
+*   0.1.75) — and, with `ignoreConflicts` (`?$onConflict=ignore`), refused
+*   whenever it cannot, since the post-write check never sees skipped rows.
+*/
+async function guardArbacWrite(ctx, scopes, table, refs, ignoreConflicts = false) {
 	const eff = effectiveScope(scopes);
 	if (eff.filter && hasPreImage(ctx.action)) await assertIdFiltersInScope(table, ctx.rows.map((_row, i) => {
 		const filter = ctx.filterFor(i);
@@ -2194,7 +2745,12 @@ async function guardArbacWrite(ctx, scopes, table, refs) {
 		return filter;
 	}), eff.filter);
 	await assertRefsInScope(ctx, scopes, refs);
-	if (eff.check && !table.getAdapter().isInTransaction()) await assertCheckBeforeWrite(ctx, eff.check);
+	if (!eff.check) return;
+	if (!table.getAdapter().isInTransaction()) await assertCheckBeforeWrite(ctx, eff.check);
+	else if (!hasPreImage(ctx.action)) {
+		const verdict = insertRowsVerdict(ctx.rows, eff.check);
+		if (verdict === false || verdict === void 0 && ignoreConflicts) throw new HttpError(403, OUT_OF_SCOPE);
+	}
 }
 /**
 * WITH CHECK after the write, inside its transaction: every written row must
@@ -2301,6 +2857,14 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return applyArbacMetaOverlay(meta, this.readable);
 	}
 	/**
+	* `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+	* prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+	* (or whose named fields they cannot see) is stripped.
+	*/
+	async metaForm(name) {
+		return applyArbacFormOverlay(await super.metaForm(name), getControllerFormType(this.constructor, name));
+	}
+	/**
 	* `GET /meta/form/:name` serves a form only when the caller may run at
 	* least one of the actions taking it as input (else the unknown-form 404).
 	*/
@@ -2374,7 +2938,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 	/** In-transaction stage — USING, `checkRefs`, and WITH CHECK on non-transactional adapters. */
 	guardWrite(ctx) {
-		return guardArbacWrite(ctx, requireRequestScopes(), this.guardedTable, this.readable);
+		return guardArbacWrite(ctx, requireRequestScopes(), this.guardedTable, this.readable, isInsertIgnoreRequest());
 	}
 	/** USING for deletes: the exact row the delete targets must match the scope filter (else 404). */
 	guardRemove(ctx) {
@@ -2527,6 +3091,14 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	applyMetaOverlay(meta) {
 		return applyArbacMetaOverlay(meta, this.readable);
 	}
+	/**
+	* `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+	* prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+	* (or whose named fields they cannot see) is stripped.
+	*/
+	async metaForm(name) {
+		return applyArbacFormOverlay(await super.metaForm(name), getControllerFormType(this.constructor, name));
+	}
 	/** Same contract as {@link AsArbacDbController.authorizeForm}. */
 	authorizeForm(_name, actionNames) {
 		return authorizeArbacForm(actionNames);
@@ -2551,7 +3123,7 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
 //#region src/db/as-arbac-value-help-controller.ts
-function valueHelpHost(fields, primaryKey, searchableFields) {
+function valueHelpHost(boundType, primaryKey, searchableFields) {
 	const ids = primaryKey ? [primaryKey] : [];
 	return {
 		primaryKey,
@@ -2559,7 +3131,8 @@ function valueHelpHost(fields, primaryKey, searchableFields) {
 		source: {
 			primaryKeys: ids,
 			preferredId: ids,
-			flatMap: fields
+			type: boundType,
+			flatMap: boundType.type.props ?? /* @__PURE__ */ new Map()
 		}
 	};
 }
@@ -2606,8 +3179,10 @@ async function applyValueHelpMetaOverlay(host, meta) {
 }
 let AsArbacValueHelpController = class AsArbacValueHelpController extends AsValueHelpController {
 	_arbacHost;
+	/** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+	_arbacValueHelpTarget = registerArbacValueHelpTarget(this, this.arbacHost.source);
 	get arbacHost() {
-		return this._arbacHost ??= valueHelpHost(this.fieldMeta, this.primaryKey, this.searchableFields);
+		return this._arbacHost ??= valueHelpHost(this.boundType, this.primaryKey, this.searchableFields);
 	}
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
@@ -2670,8 +3245,10 @@ __decorate([
 AsArbacValueHelpController = __decorate([Inherit()], AsArbacValueHelpController);
 let AsArbacJsonValueHelpController = class AsArbacJsonValueHelpController extends AsJsonValueHelpController {
 	_arbacHost;
+	/** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
+	_arbacValueHelpTarget = registerArbacValueHelpTarget(this, this.arbacHost.source);
 	get arbacHost() {
-		return this._arbacHost ??= valueHelpHost(this.fieldMeta, this.primaryKey, this.searchableFields);
+		return this._arbacHost ??= valueHelpHost(this.boundType, this.primaryKey, this.searchableFields);
 	}
 	async prepareRequest(_ctx) {
 		await resolveRequestScopes();
@@ -2779,12 +3356,12 @@ async function useArbacDbScope() {
 			currentAll: async () => rows.map(() => null),
 			filterFor: () => null
 		}, scopes, table),
-		writeOptions: (table) => ({
+		writeOptions: (table, opts) => ({
 			isFieldVisible: visibleOn(table),
 			guard: async (ctx) => {
 				const rows = ctx;
 				assertNestedWritesAllowed(rows.rows, scopes, navFieldsOf(table));
-				await guardArbacWrite(rows, scopes, table, table);
+				await guardArbacWrite(rows, scopes, table, table, opts?.onConflict === "ignore");
 			},
 			check: (ctx) => checkArbacWrite(ctx, scopes)
 		}),

package/dist/{user.provider-CKjmUhkx.d.mts → user.provider-D0ySI_-A.d.mts}

@@ -2,7 +2,7 @@ import { ControlGate, TProjection, TProjectionChildren, TScopeFieldRules, TScope
 import { Mate, TClassConstructor, TMateParamMeta, TMoostMetadata } from "moost";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteAction, TDbWriteCheckContext, TDbWriteGuardContext, TMetaResponse, UniqueryControls } from "@atscript/db";
 import { AsDbController, TDbActionScopeContext, TDbControlsType, TDbRequestContext } from "@atscript/moost-db";
-import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType, TAtscriptDataType } from "@atscript/typescript/utils";
+import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType, TAtscriptDataType, TSerializedAnnotatedType } from "@atscript/typescript/utils";
 //#region src/arbac.mate.d.ts
 /**
  * ARBAC metadata fields attached to classes and methods by ARBAC decorators.
@@ -314,6 +314,12 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    */
   protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
+  /**
+   * `GET /meta/form/:name` under the `/meta` overlay's pointer rule: a form
+   * prop's `ref` / `ui.valueHelp` binding to a table the caller cannot read
+   * (or whose named fields they cannot see) is stripped.
+   */
+  metaForm(name: string): Promise<TSerializedAnnotatedType>;
   /**
    * `GET /meta/form/:name` serves a form only when the caller may run at
    * least one of the actions taking it as input (else the unknown-form 404).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.12",
-    "@aooth/arbac-core": "0.1.74",
-    "@aooth/user": "0.1.74",
-    "@aooth/arbac": "0.1.74"
+    "@uniqu/core": "^0.1.13",
+    "@aooth/user": "0.1.76",
+    "@aooth/arbac": "0.1.76",
+    "@aooth/arbac-core": "0.1.76"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.99",
-    "@atscript/db": "^0.1.147",
-    "@atscript/db-sql-tools": "^0.1.147",
-    "@atscript/db-sqlite": "^0.1.147",
-    "@atscript/moost-db": "^0.1.147",
-    "@atscript/typescript": "^0.1.99",
-    "@moostjs/event-http": "^0.6.43",
+    "@atscript/core": "^0.1.100",
+    "@atscript/db": "^0.1.149",
+    "@atscript/db-sql-tools": "^0.1.149",
+    "@atscript/db-sqlite": "^0.1.149",
+    "@atscript/moost-db": "^0.1.149",
+    "@atscript/typescript": "^0.1.100",
+    "@moostjs/event-http": "^0.6.45",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.99"
+    "unplugin-atscript": "^0.1.100"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.147",
-    "@atscript/moost-db": "^0.1.147",
-    "@atscript/typescript": "^0.1.99",
-    "@moostjs/event-http": "^0.6.43",
+    "@atscript/db": "^0.1.149",
+    "@atscript/moost-db": "^0.1.149",
+    "@atscript/typescript": "^0.1.100",
+    "@moostjs/event-http": "^0.6.45",
     "@wooksjs/event-core": "^0.7.26",
     "@wooksjs/event-http": "^0.7.26",
-    "moost": "^0.6.43"
+    "moost": "^0.6.45"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {