@aooth/arbac-moost 0.1.85 → 0.2.0

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BZkeBV5s.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-SisapkME.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts
@@ -196,44 +196,6 @@ declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, va
  */
 declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
 //#endregion
-//#region src/atscript/credential-metadata-spec.d.ts
-/**
- * Resolved credential-METADATA column for a credential model, discovered from
- * the `@aooth.auth.metadata` annotation (registered by `arbacPlugin`).
- * Computed once per `TAtscriptAnnotatedType` and cached.
- *
- * - `metadataField` — the field annotated `@aooth.auth.metadata` **and**
- *   carrying `@db.json`. `undefined` when no field is annotated, or when the
- *   annotated field lacks `@db.json` (metadata persistence is then DISABLED —
- *   see `warnings`). Pass it straight to `CredentialStoreAtscriptDb` as its
- *   `metadataField` option — the store stays name-agnostic; this spec owns the
- *   annotation semantics (same split as `getAoothUserHandleSpec` /
- *   `UserStore.handleFields`).
- * - `warnings` — non-fatal misconfig notes (an annotated field without
- *   `@db.json` → metadata persistence disabled, not fatal). The wiring layer
- *   should log these at boot. Ambiguity (more than one annotated field) is
- *   fatal and throws.
- *
- * The `@db.json` gate mirrors the handle spec's unique-index posture: metadata
- * is a structured object, and a non-json column would either reject the write
- * or silently stringify it engine-dependently — so a missing `@db.json`
- * disables rather than silently accepts. A model with no annotated field
- * resolves to `undefined` with NO warning here (graceful degradation — the
- * consumer may simply not persist metadata); the wiring layer decides whether
- * that deserves a boot-time note.
- */
-interface AoothCredentialMetadataSpec {
-  metadataField: string | undefined;
-  warnings: string[];
-}
-/**
- * Walk a credential model's `@aooth.auth.metadata` annotation into a cached
- * {@link AoothCredentialMetadataSpec}. Mirrors {@link getAoothUserHandleSpec}:
- * structural, computed once, fail-loud on ambiguity, warn-and-disable on a
- * misconfigured (non-`@db.json`) field.
- */
-declare function getAoothCredentialMetadataSpec(credentialType: TAtscriptAnnotatedType): AoothCredentialMetadataSpec;
-//#endregion
 //#region src/atscript/handle-spec.d.ts
 /**
  * Resolved login/recovery HANDLE fields for a user credential model, discovered
@@ -291,4 +253,4 @@ declare class AoothArbacUserCredentials extends AoothUserCredentials {
 }
 // prettier-ignore-end
 //#endregion
-export { AoothArbacUserCredentials, type AoothCredentialMetadataSpec, type AoothUserHandleSpec, type ArbacAttenuationSpec, ArbacUserRecordCache, type ArbacUserRecordCacheOptions, type ArbacUserTable, AtscriptArbacUserProvider, type AtscriptArbacUserProviderOptions, extractAttenuation, getAoothCredentialMetadataSpec, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };
+export { AoothArbacUserCredentials, type AoothUserHandleSpec, type ArbacAttenuationSpec, ArbacUserRecordCache, type ArbacUserRecordCacheOptions, type ArbacUserTable, AtscriptArbacUserProvider, type AtscriptArbacUserProviderOptions, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -23,7 +23,7 @@ function uniqueStrings(values) {
 }
 //#endregion
 //#region src/atscript/auto-provider.ts
-const specCache$3 = /* @__PURE__ */ new WeakMap();
+const specCache$2 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
 * documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
@@ -62,7 +62,7 @@ function resolveIdentifierField(type) {
 	return metaId;
 }
 function getArbacExtractSpec(type) {
-	const cached = specCache$3.get(type);
+	const cached = specCache$2.get(type);
 	if (cached !== void 0) return cached;
 	const spec = {
 		userIdField: void 0,
@@ -71,7 +71,7 @@ function getArbacExtractSpec(type) {
 	};
 	const def = type.type;
 	if (def.kind !== "object") {
-		specCache$3.set(type, spec);
+		specCache$2.set(type, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -102,7 +102,7 @@ function getArbacExtractSpec(type) {
 		};
 	}
 	spec.userIdField = resolveIdentifierField(type);
-	specCache$3.set(type, spec);
+	specCache$2.set(type, spec);
 	return spec;
 }
 /**
@@ -310,14 +310,14 @@ AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design
 ])], AtscriptArbacUserProvider);
 //#endregion
 //#region src/atscript/attenuation-extract.ts
-const specCache$2 = /* @__PURE__ */ new WeakMap();
+const specCache$1 = /* @__PURE__ */ new WeakMap();
 /**
 * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
 * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
 * structural, computed once, fail-loud on an ambiguous (multiple) role field.
 */
 function getArbacAttenuationSpec(credType) {
-	const cached = specCache$2.get(credType);
+	const cached = specCache$1.get(credType);
 	if (cached !== void 0) return cached;
 	const spec = {
 		roleField: void 0,
@@ -325,7 +325,7 @@ function getArbacAttenuationSpec(credType) {
 	};
 	const def = credType.type;
 	if (def.kind !== "object") {
-		specCache$2.set(credType, spec);
+		specCache$1.set(credType, spec);
 		return spec;
 	}
 	const roleCandidates = [];
@@ -340,7 +340,7 @@ function getArbacAttenuationSpec(credType) {
 	}
 	if (roleCandidates.length > 1) throw new Error(`getArbacAttenuationSpec: multiple @arbac.attenuate.role fields declared (${roleCandidates.join(", ")}). Exactly one assumed-role source is supported — drop @arbac.attenuate.role from all but the canonical field.`);
 	if (roleCandidates.length === 1) spec.roleField = roleCandidates[0];
-	specCache$2.set(credType, spec);
+	specCache$1.set(credType, spec);
 	return spec;
 }
 /**
@@ -404,44 +404,6 @@ function extractAttenuation(credType, record) {
 	return out;
 }
 //#endregion
-//#region src/atscript/credential-metadata-spec.ts
-const specCache$1 = /* @__PURE__ */ new WeakMap();
-/**
-* Walk a credential model's `@aooth.auth.metadata` annotation into a cached
-* {@link AoothCredentialMetadataSpec}. Mirrors {@link getAoothUserHandleSpec}:
-* structural, computed once, fail-loud on ambiguity, warn-and-disable on a
-* misconfigured (non-`@db.json`) field.
-*/
-function getAoothCredentialMetadataSpec(credentialType) {
-	const cached = specCache$1.get(credentialType);
-	if (cached !== void 0) return cached;
-	const spec = {
-		metadataField: void 0,
-		warnings: []
-	};
-	const def = credentialType.type;
-	if (def.kind !== "object") {
-		specCache$1.set(credentialType, spec);
-		return spec;
-	}
-	const candidates = [];
-	for (const [fieldName, fieldType] of def.props) {
-		const md = fieldType.metadata;
-		if (md.get("aooth.auth.metadata")) candidates.push({
-			field: fieldName,
-			md
-		});
-	}
-	if (candidates.length > 1) throw new Error(`getAoothCredentialMetadataSpec: multiple @aooth.auth.metadata fields declared (${candidates.map((c) => c.field).join(", ")}). Exactly one credential-metadata column is supported — drop @aooth.auth.metadata from all but the canonical field.`);
-	if (candidates.length === 1) {
-		const { field, md } = candidates[0];
-		if (md.get("db.json")) spec.metadataField = field;
-		else spec.warnings.push(`@aooth.auth.metadata on field "${field}" has no @db.json — a structured metadata object needs a json column, so metadata persistence is DISABLED (the atscript-db credential store will not persist/read metadata). Add @db.json to the field to enable it.`);
-	}
-	specCache$1.set(credentialType, spec);
-	return spec;
-}
-//#endregion
 //#region src/atscript/handle-spec.ts
 const specCache = /* @__PURE__ */ new WeakMap();
 /** A `@db.index.unique` annotation is a non-empty `(string | true)[]`. */
@@ -515,6 +477,6 @@ var AoothArbacUserCredentials = class {
 		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
 	}
 };
-defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).prop("verifiedEmail", defineAnnotatedType().designType("string").tags("string").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("seenDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
+defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", defineAnnotatedType().designType("string").tags("string").annotate("meta.id", true).annotate("db.default.uuid", true).$type).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).prop("invitedBy", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("inviteNonce", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("verifiedEmail", defineAnnotatedType().designType("string").tags("string").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("seenDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
 //#endregion
-export { AoothArbacUserCredentials, ArbacUserRecordCache, AtscriptArbacUserProvider, extractAttenuation, getAoothCredentialMetadataSpec, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };
+export { AoothArbacUserCredentials, ArbacUserRecordCache, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-BZkeBV5s.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-SisapkME.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
 import { TAuthGuardDef } from "@moostjs/event-http";
@@ -112,6 +112,13 @@ interface MetaVisibility {
    * behind a read projection). Absent → nothing extra survives.
    */
   writable?: ReadonlySet<string> | "all";
+  /**
+   * Fields the WRITE scopes pin via `set` (keys of the effective `set`
+   * overlay). The server overwrites whatever a client sends there, so a forced
+   * field is never a write affordance: hidden → pruned from `/meta`; visible →
+   * kept and stamped `meta.readonly`. A path under a forced key is forced too.
+   */
+  forced?: ReadonlySet<string>;
   /**
    * Nav relations the WRITE scopes opt into nested writes (union of
    * `nestedWrites`). A relation path is writable only when listed here (and

package/dist/index.mjs

@@ -696,8 +696,11 @@ function prefetchRefTargets(scopes, table) {
 * its `fields` rule; without one this THROWS — never dropped (fail closed).
 *
 * The third argument is the options object, or (legacy form) `childrenOf`.
+* Either list empty THROWS (since 0.2): an empty list means that pass denied,
+* and must not conjoin as unrestricted.
 */
 function conjoinArbacDbScopes(userScopes, credScopes, opts) {
+	if (userScopes.length === 0 || credScopes.length === 0) throw new Error("conjoinArbacDbScopes: an empty scope list is a denied evaluation");
 	const { childrenOf, refTable, fields } = typeof opts === "function" ? { childrenOf: opts } : opts ?? {};
 	return [conjoinScopes(userScopes, credScopes, {
 		childrenOf,
@@ -1104,7 +1107,7 @@ const arbacAuthorizeInterceptor = Object.assign(defineBeforeInterceptor(async ()
 	} catch (error) {
 		if (error instanceof HttpError) throw error;
 		logger.warn(String(error));
-		throw new HttpError(401, error instanceof Error ? error.message : String(error));
+		throw new HttpError(401, "Not authorized");
 	}
 }, TInterceptorPriority.GUARD), { __authTransports: {} });
 function delegatesToArbacPrepareRequest(ctx) {
@@ -1241,7 +1244,7 @@ function metaDecisionKey(input, ctx) {
 			const vis = p.refTargets.get(type);
 			refTargets.push(idOf(type), ctx.isServed(type), vis ? encodeLevel(vis, NO_TREE, ctx, seen, 1) : 0);
 		}
-		const { writable, nestedWrites } = p;
+		const { writable, nestedWrites, forced } = p;
 		const controls = [];
 		for (const op of Object.keys(p.controls).toSorted()) {
 			const policy = p.controls[op] ?? {};
@@ -1259,6 +1262,7 @@ function metaDecisionKey(input, ctx) {
 			encodeLevel(p.vis, p.tree, ctx, seen, 0),
 			writable === void 0 ? 0 : writable === "all" ? 1 : sortedNames(writable),
 			nestedWrites ? sortedNames(nestedWrites) : 0,
+			forced ? sortedNames(forced) : 0,
 			controls,
 			refTargets,
 			p.vis.table?.type ? ctx.isServed(p.vis.table.type) : 0
@@ -1315,11 +1319,16 @@ function shareMeta(obj) {
 function isPathWritable(path, vis) {
 	const writable = vis.writable;
 	if (!writable || tablePolicy(vis.table).derived.has(path)) return false;
+	if (isForced(path, vis)) return false;
 	const dot = path.indexOf(".");
 	const head = dot === -1 ? path : path.slice(0, dot);
 	if ((vis.relationNames?.has(head) || vis.table?.navFields?.has(head)) && !vis.nestedWrites?.has(head)) return false;
 	return writable === "all" || hasSelfOrAncestor(writable, path);
 }
+/** `path` (or an ancestor) is pinned by the write scopes' `set` — see {@link MetaVisibility.forced}. */
+function isForced(path, vis) {
+	return !!vis.forced?.size && hasSelfOrAncestor(vis.forced, path);
+}
 /**
 * Prune a `/meta` envelope down to the fields the principal's read scopes can
 * ever surface, so a scoped UI cannot even OFFER an out-of-scope column (the
@@ -1541,7 +1550,8 @@ function pruneSerializedType(node, level) {
 				else if (hasWritableDescendant(path, vis.writable)) props[name] = withVisibleTargets(stampWriteOnly(pruneSerializedType(prop, child)), path, vis, refTargets, level.inBranch);
 				continue;
 			}
-			props[name] = withVisibleTargets(pruneSerializedType(prop, child), path, vis, refTargets, level.inBranch);
+			const pruned = pruneSerializedType(prop, child);
+			props[name] = withVisibleTargets(isForced(path, vis) ? stampReadOnly(pruned) : pruned, path, vis, refTargets, level.inBranch);
 		}
 		const pruned = {
 			...node,
@@ -1581,6 +1591,15 @@ function stampWriteOnly(node) {
 		}
 	};
 }
+function stampReadOnly(node) {
+	return {
+		...node,
+		metadata: {
+			...node.metadata,
+			"meta.readonly": true
+		}
+	};
+}
 /** A strict descendant of `path` is in the write whitelist. */
 function hasWritableDescendant(path, writable) {
 	if (!writable || writable === "all") return false;
@@ -1904,7 +1923,9 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 		writeScopes
 	}, RECORD_CTX) : void 0, memoMax, overlay);
 	const writable = collectWritableFields(writeScopes, false);
-	const nestedWrites = effectiveScope(writeScopes).nestedWrites;
+	const writeEffective = effectiveScope(writeScopes);
+	const nestedWrites = writeEffective.nestedWrites;
+	const forced = writeEffective.set ? new Set(Object.keys(writeEffective.set)) : void 0;
 	if (isIdentifierSet(source)) {
 		const vis = buildScopeVisibility(readScopes, void 0, source);
 		const visible = Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0;
@@ -1912,7 +1933,8 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 		return gateMetaControls(visible ? pruneMetaByVisibility(overlaid, {
 			...vis,
 			writable,
-			nestedWrites
+			nestedWrites,
+			forced
 		}) : overlaid, controls);
 	}
 	const vis = buildScopeVisibility(readScopes, source, { relations: await resolveRelationTree(readScopes, source, metaRelationNames(meta), { listSiblings: false }) });
@@ -1927,13 +1949,15 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 			tree: metaRelationNames(meta),
 			writable,
 			nestedWrites,
+			forced,
 			controls,
 			refTargets
 		}
 	}, RECORD_CTX) : void 0, memoMax, () => gateMetaControls(pruneMetaByVisibility(overlay(), {
 		...vis,
 		writable,
-		nestedWrites
+		nestedWrites,
+		forced
 	}, refTargets), controls));
 }
 /** What the `/meta` memo's decision record reads from the pruning rules. */
@@ -3410,8 +3434,10 @@ function enforceControlsPolicy(policy, controls) {
 *
 * Currently supported (matches `WHITELISTABLE_CONTROLS` in `unionControlsPolicy`):
 *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
-*     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
-*     Bare strings are tolerated for forward compatibility.
+*     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`,
+*     and walk nested `controls.$with` emitting dotted paths
+*     (`author($with=org)` → `author`, `author.org`) so a whitelist can name
+*     a nested relation. Bare strings are tolerated for forward compatibility.
 *   - `$groupBy` — array of column names (strings). With `controls` given,
 *     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
 *     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
@@ -3423,18 +3449,27 @@ function enforceControlsPolicy(policy, controls) {
 */
 function extractUsedControlValues(key, value, controls) {
 	if (!Array.isArray(value)) return [];
-	if (key === "$with") {
-		const out = [];
-		for (const entry of value) if (typeof entry === "string") out.push(entry);
-		else if (typeof entry?.name === "string") out.push(entry.name);
-		return out;
-	}
+	if (key === "$with") return withPaths(value, "");
 	if (key === "$groupBy") return controls ? groupByFields({
 		$select: controls.$select,
 		$groupBy: value
 	}) : value.filter((x) => typeof x === "string");
 	return [];
 }
+/** Relation paths of a `$with` list, nested `controls.$with` as dotted paths. */
+function withPaths(list, prefix) {
+	const out = [];
+	for (const entry of list) {
+		const rel = entry;
+		const name = typeof entry === "string" ? entry : rel?.name;
+		if (typeof name !== "string") continue;
+		const path = prefix + name;
+		out.push(path);
+		const nested = rel?.controls?.$with;
+		if (Array.isArray(nested)) out.push(...withPaths(nested, `${path}.`));
+	}
+	return out;
+}
 /**
 * Translate a `@uniqu/url` parser `SyntaxError` into `HttpError(400)`. Any
 * other error (including a pre-existing `HttpError`) is returned as-is so the

package/dist/plugin.mjs

@@ -105,7 +105,7 @@ function arbacPlugin() {
 						})
 					},
 					auth: { metadata: new AnnotationSpec({
-						description: "Marks the consumer's fully-typed credential-metadata column (@db.json) on their `extends AoothAuthCredential` model — the runtime/validation twin of the `CredentialMetadata` declaration merge. Resolved by `getAoothCredentialMetadataSpec` and threaded to `CredentialStoreAtscriptDb` as `metadataField`. The field MUST carry @db.json (a structured metadata object needs a json column — without it, metadata persistence is DISABLED with a warning). At most one @aooth.auth.metadata field per type — multiple declarations throw at boot. Absent → the atscript-db credential store persists no metadata (non-fatal, warned at boot by the wiring).",
+						description: "Marks the consumer's fully-typed credential-metadata column (@db.json) on their `extends AoothAuthCredential` model — the runtime/validation twin of the `CredentialMetadata` declaration merge. `CredentialStoreAtscriptDb` finds it on `table.type` automatically (`getAoothCredentialMetadataSpec` from `@aooth/auth/atscript-db`). The field MUST carry @db.json (a structured metadata object needs a json column — without it, metadata persistence is DISABLED with a warning). At most one @aooth.auth.metadata field per type — multiple declarations throw at boot. Absent → the store refuses credentials whose metadata carries per-token restrictions (refresh rotation, access TTL, credential kind, OAuth client binding) and drops the rest with a warning.",
 						nodeType: ["prop"],
 						passedWhenReferred: false,
 						multiple: false

package/dist/{user.provider-BZkeBV5s.d.mts → user.provider-SisapkME.d.mts}

@@ -428,8 +428,10 @@ declare function enforceControlsPolicy(policy: Record<string, ControlGate>, cont
  *
  * Currently supported (matches `WHITELISTABLE_CONTROLS` in `unionControlsPolicy`):
  *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
- *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
- *     Bare strings are tolerated for forward compatibility.
+ *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`,
+ *     and walk nested `controls.$with` emitting dotted paths
+ *     (`author($with=org)` → `author`, `author.org`) so a whitelist can name
+ *     a nested relation. Bare strings are tolerated for forward compatibility.
  *   - `$groupBy` — array of column names (strings). With `controls` given,
  *     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
  *     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
@@ -517,6 +519,8 @@ interface AoothArbacClaims {
  * its `fields` rule; without one this THROWS — never dropped (fail closed).
  *
  * The third argument is the options object, or (legacy form) `childrenOf`.
+ * Either list empty THROWS (since 0.2): an empty list means that pass denied,
+ * and must not conjoin as unrestricted.
  */
 declare function conjoinArbacDbScopes(userScopes: ArbacDbScope[], credScopes: ArbacDbScope[], opts?: TProjectionChildren | ConjoinArbacDbScopesOptions): ArbacDbScope[];
 /** Options of {@link conjoinArbacDbScopes}. @since 0.1.72 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.85",
+  "version": "0.2.0",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -61,9 +61,9 @@
   },
   "dependencies": {
     "@uniqu/core": "^0.1.15",
-    "@aooth/arbac": "0.1.85",
-    "@aooth/user": "0.1.85",
-    "@aooth/arbac-core": "0.1.85"
+    "@aooth/arbac": "0.2.0",
+    "@aooth/arbac-core": "0.2.0",
+    "@aooth/user": "0.2.0"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.109",