@aooth/arbac-moost 0.2.1 → 0.2.3

package/dist/atscript/index.d.mts

@@ -1,7 +1,6 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-SisapkME.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BbYgv9RC.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
-//#region src/atscript/auto-provider.d.ts
 /**
  * Minimal atscript-db readable surface used to fetch the user record.
  * Structurally compatible with `AtscriptDbTable<T>.findOne` so the runtime
@@ -74,7 +73,7 @@ interface ArbacUserRecordCacheOptions {
  *
  * @since 0.1.78
  */
-declare class ArbacUserRecordCache {
+export declare class ArbacUserRecordCache {
   private readonly ttlMs;
   private readonly max;
   private readonly now;
@@ -103,7 +102,7 @@ declare class ArbacUserRecordCache {
  * `extraSelect` (third constructor argument) to have the fetch include the
  * extra fields they read.
  */
-declare abstract class AtscriptArbacUserProvider<T extends object = object> extends ArbacUserProvider {
+export declare abstract class AtscriptArbacUserProvider<T extends object = object> extends ArbacUserProvider {
   protected readonly userType: TAtscriptAnnotatedType;
   protected readonly table: ArbacUserTable<T>;
   private readonly spec;
@@ -142,8 +141,6 @@ declare abstract class AtscriptArbacUserProvider<T extends object = object> exte
    */
   private fetchRecord;
 }
-//#endregion
-//#region src/atscript/attenuation-extract.d.ts
 /**
  * Spec computed once per credential `TAtscriptAnnotatedType` — which typed root
  * fields carry the restrict-only ARBAC attenuation:
@@ -165,7 +162,7 @@ interface ArbacAttenuationSpec {
  * {@link ArbacAttenuationSpec}. Mirrors the user-side `getArbacExtractSpec`:
  * structural, computed once, fail-loud on an ambiguous (multiple) role field.
  */
-declare function getArbacAttenuationSpec(credType: TAtscriptAnnotatedType): ArbacAttenuationSpec;
+export declare function getArbacAttenuationSpec(credType: TAtscriptAnnotatedType): ArbacAttenuationSpec;
 /**
  * Boot-time cross-model check: every `@arbac.attenuate.attr "userAttr"` target
  * must name a real key in the user model's `@arbac.attribute` keyspace
@@ -174,7 +171,7 @@ declare function getArbacAttenuationSpec(credType: TAtscriptAnnotatedType): Arba
  * cached). Soundness does NOT depend on this — the scope conjunction clips
  * regardless — but it turns a silent misconfig into a loud boot failure.
  */
-declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, validUserAttrs: Iterable<string>): void;
+export declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, validUserAttrs: Iterable<string>): void;
 /**
  * Build the restrict-only {@link AoothArbacClaims} for a credential `record`
  * (its typed root fields — e.g. the auth context, which carries the credential
@@ -194,9 +191,7 @@ declare function validateAttenuationTargets(credType: TAtscriptAnnotatedType, va
  * are omitted (attrs-only narrowing), which is the distinct "no role narrowing"
  * case, not a malformed one.
  */
-declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
-//#endregion
-//#region src/atscript/handle-spec.d.ts
+export declare function extractAttenuation(credType: TAtscriptAnnotatedType, record: object | null | undefined): AoothArbacClaims | undefined;
 /**
  * Resolved login/recovery HANDLE fields for a user credential model, discovered
  * from the `@aooth.user.*` annotations (registered by `arbacPlugin`). Computed
@@ -233,14 +228,12 @@ interface AoothUserHandleSpec {
  * `@aooth.user.*` field resolves to all-`undefined` handles (email/phone login
  * is simply unavailable — graceful degradation, not an error).
  */
-declare function getAoothUserHandleSpec(userType: TAtscriptAnnotatedType): AoothUserHandleSpec;
-//#endregion
-//#region src/atscript/models/user.as.d.ts
+export declare function getAoothUserHandleSpec(userType: TAtscriptAnnotatedType): AoothUserHandleSpec;
 /**
  * Atscript interface **AoothArbacUserCredentials**
  * @see {@link ./user.as:7:18}
  */
-declare class AoothArbacUserCredentials extends AoothUserCredentials {
+export declare class AoothArbacUserCredentials extends AoothUserCredentials {
   roles: string[];
   static __is_atscript_annotated_type: true;
   static type: TAtscriptTypeObject<keyof AoothArbacUserCredentials, AoothArbacUserCredentials>;
@@ -252,5 +245,4 @@ declare class AoothArbacUserCredentials extends AoothUserCredentials {
   static toExampleData?: () => any;
 }
 // prettier-ignore-end
-//#endregion
-export { AoothArbacUserCredentials, type AoothUserHandleSpec, type ArbacAttenuationSpec, ArbacUserRecordCache, type ArbacUserRecordCacheOptions, type ArbacUserTable, AtscriptArbacUserProvider, type AtscriptArbacUserProviderOptions, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };
+export type { AoothUserHandleSpec, ArbacAttenuationSpec, ArbacUserRecordCacheOptions, ArbacUserTable, AtscriptArbacUserProviderOptions };

package/dist/atscript/index.mjs

@@ -1,9 +1,9 @@
-import { i as __decorate, n as ArbacUserProvider, t as __decorateMetadata } from "../decorateMetadata-CU_mqYGT.mjs";
+import { i as __decorate, n as ArbacUserProvider, t as __decorateMetadata } from "../decorateMetadata-BqEexuhv.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
 import { $ak, $f, $nr, defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
-//#region src/atscript/role-list.ts
+// src/atscript/role-list.ts
 /**
 * Collect unique, non-empty strings from an iterable of unknown values,
 * preserving first-seen order and dropping anything that is not a non-empty
@@ -21,8 +21,7 @@ function uniqueStrings(values) {
 	}
 	return out;
 }
-//#endregion
-//#region src/atscript/auto-provider.ts
+// src/atscript/auto-provider.ts
 const specCache$2 = /* @__PURE__ */ new WeakMap();
 /**
 * Resolve the identifier field on an object type using the three-step chain
@@ -52,12 +51,14 @@ function resolveIdentifierField(type) {
 	}
 	if (explicit) return explicit;
 	const preferred = type.metadata.get("db.table.preferredId.uniqueIndex");
-	if (preferred !== void 0) if (typeof preferred === "string") {
-		const fields = uniqueIndexFields.get(preferred);
-		if (fields && fields.length === 1) return fields[0];
-	} else {
-		for (const fields of uniqueIndexFields.values()) if (fields.length === 1) return fields[0];
-		if (anyUniqueField.length > 0) return anyUniqueField[0];
+	if (preferred !== void 0) {
+		if (typeof preferred === "string") {
+			const fields = uniqueIndexFields.get(preferred);
+			if (fields && fields.length === 1) return fields[0];
+		} else {
+			for (const fields of uniqueIndexFields.values()) if (fields.length === 1) return fields[0];
+			if (anyUniqueField.length > 0) return anyUniqueField[0];
+		}
 	}
 	return metaId;
 }
@@ -308,8 +309,7 @@ AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design
 	Object,
 	Object
 ])], AtscriptArbacUserProvider);
-//#endregion
-//#region src/atscript/attenuation-extract.ts
+// src/atscript/attenuation-extract.ts
 const specCache$1 = /* @__PURE__ */ new WeakMap();
 /**
 * Walk a credential model's `@arbac.attenuate.*` annotations into a cached
@@ -403,8 +403,7 @@ function extractAttenuation(credType, record) {
 	if (attrs !== void 0) out.attrs = attrs;
 	return out;
 }
-//#endregion
-//#region src/atscript/handle-spec.ts
+// src/atscript/handle-spec.ts
 const specCache = /* @__PURE__ */ new WeakMap();
 /** A `@db.index.unique` annotation is a non-empty `(string | true)[]`. */
 function hasUniqueIndex(md) {
@@ -466,8 +465,7 @@ function getAoothUserHandleSpec(userType) {
 	specCache.set(userType, spec);
 	return spec;
 }
-//#endregion
-//#region src/atscript/models/user.as
+// src/atscript/models/user.as
 var AoothArbacUserCredentials = class {
 	static __is_atscript_annotated_type = true;
 	static type = {};
@@ -477,8 +475,7 @@ var AoothArbacUserCredentials = class {
 		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
 	}
 };
-$ak("db.index.fulltext", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
-$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
+$ak("db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
+$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
 defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", $f(AoothUserCredentials, "id")).prop("username", $f(AoothUserCredentials, "username")).prop("version", $f(AoothUserCredentials, "version")).prop("password", $f(AoothUserCredentials, "password")).prop("account", $f(AoothUserCredentials, "account")).prop("mfa", $f(AoothUserCredentials, "mfa")).prop("trustedDevices", $f(AoothUserCredentials, "trustedDevices")).prop("seenDevices", $f(AoothUserCredentials, "seenDevices")).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
-//#endregion
 export { AoothArbacUserCredentials, ArbacUserRecordCache, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/{decorateMetadata-CU_mqYGT.mjs → decorateMetadata-BqEexuhv.mjs}

@@ -1,12 +1,11 @@
-//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.155.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
-//#region src/user.provider.ts
+// src/user.provider.ts
 /**
 * Abstract base class for providing user data required for ARBAC evaluations.
 *
@@ -27,10 +26,8 @@ var ArbacUserProvider = class {};
 * etc. Runtime resolves to the concrete subclass registered via DI.
 */
 const ArbacUserProviderToken = ArbacUserProvider;
-//#endregion
-//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateMetadata.js
+// \0@oxc-project+runtime@0.155.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-//#endregion
 export { __decorate as i, ArbacUserProvider as n, ArbacUserProviderToken as r, __decorateMetadata as t };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-SisapkME.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-BbYgv9RC.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
 import { TAuthGuardDef } from "@moostjs/event-http";
@@ -6,7 +6,6 @@ import { EventContext } from "@wooksjs/event-core";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
 import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbActionScopeContext, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
 import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializedAnnotatedType } from "@atscript/typescript/utils";
-//#region src/db/visibility.d.ts
 /**
  * The slice of an atscript-db readable (table / view) the visibility walk
  * reads — a moost-db controller's `this.readable` satisfies it: identifiers
@@ -136,20 +135,20 @@ interface MetaVisibility {
  * scopes at all, or any scope without a `projection` (a universal grant makes
  * `unionProjections` collapse to the universe `{}`).
  */
-declare function unionScopeProjection(scopes: ArbacDbScope[]): TProjection | undefined;
+export declare function unionScopeProjection(scopes: ArbacDbScope[]): TProjection | undefined;
 /**
  * Relation names any scope explicitly declares via `with.<name>` — those
  * relations are governed by the declared sub-scopes alone (parent authority),
  * and the declaration implies the relation EXISTS for this principal even
  * when the projection union does not name it (see {@link ArbacDbScope.with}).
  */
-declare function collectWithGrantNames(scopes: ArbacDbScope[]): ReadonlySet<string>;
+export declare function collectWithGrantNames(scopes: ArbacDbScope[]): ReadonlySet<string>;
 /**
  * Union of write-scope `allowedFields`; `"all"` for field-unrestricted write
  * access. The whitelist exists only when at least one scope carries an
  * `allowedFields` array — scoped-but-unlisted writes are field-unrestricted.
  */
-declare function collectWritableFields(scopes: ArbacDbScope[], unrestricted: boolean): ReadonlySet<string> | "all" | undefined;
+export declare function collectWritableFields(scopes: ArbacDbScope[], unrestricted: boolean): ReadonlySet<string> | "all" | undefined;
 /**
  * Whether a flattened dot-path field exists for this principal.
  *
@@ -164,13 +163,13 @@ declare function collectWritableFields(scopes: ArbacDbScope[], unrestricted: boo
  * So a field a joined table hides is as unknown in a `$with` sub-query as a
  * top-level hidden column is in the main query (no filter/sort value oracle).
  */
-declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
+export declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
 /**
  * PK + `preferredId` for a controller's table/readable — the
  * {@link MetaVisibility.alwaysVisible} set. Kept for compatibility: the
  * controllers now pass `this.readable` and it is derived there.
  */
-declare function metaAlwaysVisibleFields(_controller: object, source: {
+export declare function metaAlwaysVisibleFields(_controller: object, source: {
   primaryKeys: readonly string[];
   preferredId: readonly string[];
 }): ReadonlySet<string>;
@@ -199,9 +198,7 @@ interface ScopeVisibilityOptions {
  * @param opts - {@link ScopeVisibilityOptions}; a bare identifier set is the
  *   0.1.71 `alwaysVisible` argument
  */
-declare function buildScopeVisibility(scopes: ArbacDbScope[], table: VisibilityTableSource | undefined, opts?: ScopeVisibilityOptions | ReadonlySet<string>): MetaVisibility;
-//#endregion
-//#region src/arbac.composables.d.ts
+export declare function buildScopeVisibility(scopes: ArbacDbScope[], table: VisibilityTableSource | undefined, opts?: ScopeVisibilityOptions | ReadonlySet<string>): MetaVisibility;
 /**
  * The scopes cached for the current event (`undefined` before the authorize
  * interceptor / `setScopes` ran). A direct slot read — no controller
@@ -210,9 +207,9 @@ declare function buildScopeVisibility(scopes: ArbacDbScope[], table: VisibilityT
  *
  * `TScope` is a caller-side type witness (see `evaluate` below).
  */
-declare function getArbacScopes<TScope extends object>(ctx?: EventContext): TScope[] | undefined;
+export declare function getArbacScopes<TScope extends object>(ctx?: EventContext): TScope[] | undefined;
 /** Options of `useArbac().evaluate()` / `evaluateOrThrow()`. */
-interface ArbacEvaluateOptions {
+export interface ArbacEvaluateOptions {
   /** Resource to evaluate; defaults to the current handler's. */
   resource?: string;
   /** Action to evaluate; defaults to the current handler's. */
@@ -227,6 +224,37 @@ interface ArbacEvaluateOptions {
    */
   table?: VisibilityTableSource;
 }
+/** The current user as ARBAC sees it — what `useArbac().principal()` returns. */
+export interface ArbacPrincipal<TUserAttrs extends object = object> {
+  /** The user id the `ArbacUserProvider` resolved for this event. */
+  userId: string;
+  /**
+   * The roles the user HOLDS (`ArbacUserProvider.getRoles`), before
+   * credential attenuation. Don't authorize on it — an attenuated credential
+   * may act with fewer roles; use {@link effectiveRoles} or `evaluate()`.
+   */
+  roles: string[];
+  /**
+   * The roles this request acts with: {@link roles} narrowed by the
+   * credential's attenuation (`roles ∩ attenuation.roles`; all held roles when
+   * the attenuation names none). A claimed role the user does not hold is
+   * never included, even with `allowUnheldRoles` — that "view as" mode only
+   * ever narrows through `evaluate()`. Use this for role checks in app code.
+   */
+  effectiveRoles: string[];
+  /** The user's attributes (`ArbacUserProvider.getAttrs`), loaded on the first call. */
+  attrs: () => Promise<TUserAttrs>;
+  /**
+   * The credential's restrict-only attenuation
+   * (`ArbacUserProvider.getAttenuation`), when it narrows the user's
+   * authority; absent otherwise.
+   */
+  attenuation?: {
+    roles?: string[];
+    attrs?: Record<string, unknown>;
+    allowUnheldRoles?: boolean;
+  };
+}
 interface ArbacBindings {
   getScopes: <TScope extends object>() => TScope[] | undefined;
   setScopes: <TScope extends object>(scope: TScope[] | undefined) => void;
@@ -249,6 +277,14 @@ interface ArbacBindings {
     scopes?: TScope[];
     userId: string;
   }>;
+  /**
+   * The current principal — user id, held and effective roles, lazy
+   * attributes and credential attenuation — read through the
+   * `ArbacUserProvider`, the same source `evaluate()` uses. Loaded fresh on
+   * every call (like `evaluate()`), so a role change applies immediately.
+   * Decide on `effectiveRoles` (or `evaluate()`), never on `roles`.
+   */
+  principal: <TUserAttrs extends object = object>() => Promise<ArbacPrincipal<TUserAttrs>>;
   resource: string;
   action: string;
   isPublic: boolean;
@@ -268,9 +304,7 @@ interface ArbacBindings {
  * step handlers. Scope read/write goes through `arbacScopesKey` directly
  * so it still lives on the per-event slot.
  */
-declare const useArbac: (_ctx?: EventContext) => ArbacBindings;
-//#endregion
-//#region src/arbac.decorator.d.ts
+export declare const useArbac: (_ctx?: EventContext) => ArbacBindings;
 /**
  * ARBAC checks authorization, not authentication, so the transport
  * declaration is empty — pair with an upstream auth guard (e.g. JWT
@@ -281,21 +315,19 @@ declare const useArbac: (_ctx?: EventContext) => ArbacBindings;
  * apply it to controllers/handlers that should remain reachable without an
  * evaluated rule (e.g. login/recovery workflows, health probes).
  */
-declare const arbacAuthorizeInterceptor: TAuthGuardDef;
+export declare const arbacAuthorizeInterceptor: TAuthGuardDef;
 /** Wrapped via `Authenticate` so `@moostjs/swagger` picks up the auth-guard metadata. */
-declare const ArbacAuthorize: () => ClassDecorator & MethodDecorator;
+export declare const ArbacAuthorize: () => ClassDecorator & MethodDecorator;
 /**
  * Decorator to specify a resource id for ARBAC evaluation. Apply to a
  * controller class or a handler method.
  */
-declare const ArbacResource: (name: string) => MethodDecorator & ClassDecorator & ParameterDecorator & PropertyDecorator;
+export declare const ArbacResource: (name: string) => MethodDecorator & ClassDecorator & ParameterDecorator & PropertyDecorator;
 /**
  * Decorator to specify an action id for ARBAC evaluation. Typically applied
  * at the method level.
  */
-declare const ArbacAction: (name: string) => MethodDecorator & ClassDecorator & ParameterDecorator & PropertyDecorator;
-//#endregion
-//#region src/db/as-arbac-db-readable-controller.d.ts
+export declare const ArbacAction: (name: string) => MethodDecorator & ClassDecorator & ParameterDecorator & PropertyDecorator;
 type TSelect = UniqueryControls["$select"];
 /**
  * Read-only mirror of {@link AsArbacDbController} for view-style controllers
@@ -303,7 +335,7 @@ type TSelect = UniqueryControls["$select"];
  * Applies the same fail-closed `prepareRequest` and filter / projection /
  * controls overlays — no write-side hooks because the parent exposes none.
  */
-declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbReadableController<T> {
+export declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbReadableController<T> {
   /** Makes this controller the `$with` policy source for its table's ARBAC resource. */
   protected readonly _arbacRelationTarget: true;
   /** Same contract as {@link AsArbacDbController.prepareRequest}. */
@@ -335,8 +367,6 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
   /** Same contract as {@link AsArbacDbController.hasField}. */
   protected hasField(path: string): boolean;
 }
-//#endregion
-//#region src/db/as-arbac-value-help-controller.d.ts
 /**
  * ARBAC-scoped mirror of `@atscript/moost-db`'s {@link AsValueHelpController}
  * (bring your own backing source): the same scope contract as
@@ -370,7 +400,7 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
  *
  * @since 0.1.72
  */
-declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsValueHelpController<T, DataType> {
+export declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsValueHelpController<T, DataType> {
   private _arbacHost?;
   /** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
   protected readonly _arbacValueHelpTarget: true;
@@ -405,7 +435,7 @@ declare abstract class AsArbacValueHelpController<T extends TAtscriptAnnotatedTy
  *
  * @since 0.1.72
  */
-declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsJsonValueHelpController<T, DataType> {
+export declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsJsonValueHelpController<T, DataType> {
   private _arbacHost?;
   /** Makes this controller the binding / `ref` policy source for its bound type's ARBAC resource. */
   protected readonly _arbacValueHelpTarget: true;
@@ -422,8 +452,6 @@ declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType =
   runGetOne(id: string): ReturnType<AsJsonValueHelpController<T, DataType>["runGetOne"]>;
   runGetOneComposite(query: Record<string, string>): ReturnType<AsJsonValueHelpController<T, DataType>["runGetOneComposite"]>;
 }
-//#endregion
-//#region src/db/relation-policy.d.ts
 /**
  * Register an ARBAC DB controller as an owner of its readable's ARBAC
  * resource, so a `$with` from another controller can evaluate the caller's
@@ -435,7 +463,7 @@ declare class AsArbacJsonValueHelpController<T extends TAtscriptAnnotatedType =
  * @returns `true` (so it can initialize a field)
  * @since 0.1.72
  */
-declare function registerArbacDbTarget(controller: object): true;
+export declare function registerArbacDbTarget(controller: object): true;
 /**
  * The ARBAC resource + action a controller's handler is authorized as — the
  * precedence `useArbac()` applies while that handler serves a request.
@@ -445,12 +473,10 @@ declare function registerArbacDbTarget(controller: object): true;
  *
  * @since 0.1.72
  */
-declare function resolveHandlerArbacIds(instance: object, methodName: string): {
+export declare function resolveHandlerArbacIds(instance: object, methodName: string): {
   resource: string;
   action: string;
 };
-//#endregion
-//#region src/db/meta-projection.d.ts
 /**
  * Foreign `ref` targets for `/meta` pruning: annotated type → the caller's
  * visibility on it, or `null` when the caller cannot read it.
@@ -475,7 +501,7 @@ type MetaRefTargets = ReadonlyMap<object, MetaVisibility | null>;
  * NEVER mutates the input — the base controller caches the static envelope
  * (`applyMetaOverlay` contract); every pruned branch is a fresh object.
  */
-declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility, refTargets?: MetaRefTargets): TMetaResponse;
+export declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility, refTargets?: MetaRefTargets): TMetaResponse;
 /**
  * The full ARBAC `/meta` overlay, shared by the ARBAC DB and value-help
  * controllers.
@@ -511,7 +537,7 @@ declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility,
  *   signature) still works, without them
  * @param _indexes - @deprecated ignored since 0.1.74 (moost-db prunes the search surface)
  */
-declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTableSource | ReadonlySet<string>, _indexes?: readonly TDbIndexFieldPaths[]): Promise<TMetaResponse>;
+export declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTableSource | ReadonlySet<string>, _indexes?: readonly TDbIndexFieldPaths[]): Promise<TMetaResponse>;
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.
@@ -524,16 +550,14 @@ declare function applyArbacMetaOverlay(meta: TMetaResponse, source: VisibilityTa
  * properties are skipped entirely (a getter-valued property is not a method
  * and can never carry `@DbAction` metadata).
  */
-declare function collectMethodNames(instance: object): string[];
-//#endregion
-//#region src/db/request-scopes.d.ts
+export declare function collectMethodNames(instance: object): string[];
 /**
  * The scopes resolved for the current event, or `undefined` before
  * {@link resolveRequestScopes} ran.
  *
  * @since 0.1.72
  */
-declare function cachedRequestScopes(): ArbacDbScope[] | undefined;
+export declare function cachedRequestScopes(): ArbacDbScope[] | undefined;
 /**
  * Resolve the current event's scopes once: the ones the authorize
  * interceptor cached, else an ARBAC evaluation of the handler's
@@ -544,7 +568,7 @@ declare function cachedRequestScopes(): ArbacDbScope[] | undefined;
  *
  * @since 0.1.72
  */
-declare function resolveRequestScopes(): Promise<ArbacDbScope[]>;
+export declare function resolveRequestScopes(): Promise<ArbacDbScope[]>;
 /**
  * The resolved scopes, synchronously — for the hooks that run after the
  * entry point (`validateControls`, `transformFilter`, the write guards …).
@@ -552,7 +576,7 @@ declare function resolveRequestScopes(): Promise<ArbacDbScope[]>;
  *
  * @since 0.1.72
  */
-declare function requireRequestScopes(): ArbacDbScope[];
+export declare function requireRequestScopes(): ArbacDbScope[];
 /**
  * Shared body of the ARBAC controllers' `hasField` overrides: a field
  * outside the read-scope visibility — hidden by the projection union, a
@@ -563,7 +587,7 @@ declare function requireRequestScopes(): ArbacDbScope[];
  *
  * @since 0.1.72
  */
-declare function requestFieldVisible(path: string, source: VisibilityTableSource | ReadonlySet<string>): boolean;
+export declare function requestFieldVisible(path: string, source: VisibilityTableSource | ReadonlySet<string>): boolean;
 /**
  * Whether `path` is visible to `scopes` over `source` (see
  * {@link requestFieldVisible}, which reads the request's scopes).
@@ -571,7 +595,7 @@ declare function requestFieldVisible(path: string, source: VisibilityTableSource
  * @param source - the controller's `this.readable`; an identifier set (the
  *   0.1.67 signature) still works, without relation / schema rules
  */
-declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, source: VisibilityTableSource | ReadonlySet<string>): boolean;
+export declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, source: VisibilityTableSource | ReadonlySet<string>): boolean;
 /**
  * Body of the ARBAC DB / value-help controllers' `prepareRequest` — every
  * endpoint, `@DbAction` handlers included (`endpoint: "action"`, before any
@@ -593,7 +617,7 @@ declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, sour
  *
  * @since 0.1.72
  */
-declare function prepareArbacRequest(ctx: TDbRequestContext, readable?: VisibilityTableSource): Promise<void>;
+export declare function prepareArbacRequest(ctx: TDbRequestContext, readable?: VisibilityTableSource): Promise<void>;
 /**
  * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
  * caller may run at least one of the actions that take it as input — each
@@ -601,7 +625,7 @@ declare function prepareArbacRequest(ctx: TDbRequestContext, readable?: Visibili
  *
  * @since 0.1.72
  */
-declare function authorizeArbacForm(actionNames: readonly string[]): Promise<boolean>;
+export declare function authorizeArbacForm(actionNames: readonly string[]): Promise<boolean>;
 /**
  * Body of the ARBAC DB controllers' `allowedActions`: the action `names` the
  * caller holds a grant on — each evaluated as {@link actionArbacIds} names
@@ -610,7 +634,7 @@ declare function authorizeArbacForm(actionNames: readonly string[]): Promise<boo
  *
  * @since 0.1.72
  */
-declare function arbacAllowedActions(names: readonly string[]): Promise<string[]>;
+export declare function arbacAllowedActions(names: readonly string[]): Promise<string[]>;
 /**
  * Body of the ARBAC DB controllers' `actionRowScope`: the rows the
  * `@DbAction` `name` may run on — the filter of the caller's grant on the
@@ -629,7 +653,7 @@ declare function arbacAllowedActions(names: readonly string[]): Promise<string[]
  *
  * @since 0.1.72
  */
-declare function arbacActionRowScope(name: string): Promise<Record<string, unknown> | undefined>;
+export declare function arbacActionRowScope(name: string): Promise<Record<string, unknown> | undefined>;
 /**
  * Body of the ARBAC controllers' `transformFilter` (and so of the row
  * overlay `/one`, `DELETE` and `@DbAction` ids use): the user filter
@@ -637,7 +661,7 @@ declare function arbacActionRowScope(name: string): Promise<Record<string, unkno
  *
  * @since 0.1.72
  */
-declare function arbacRowFilter(filter: Record<string, unknown> | undefined): Record<string, unknown>;
+export declare function arbacRowFilter(filter: Record<string, unknown> | undefined): Record<string, unknown>;
 /**
  * Body of the ARBAC DB controllers' `transformRelationFilter` (since 0.1.74):
  * the operand of a CLIENT relational predicate at `path` (`ticket`,
@@ -651,9 +675,7 @@ declare function arbacRowFilter(filter: Record<string, unknown> | undefined): Re
  *
  * @since 0.1.74
  */
-declare function arbacRelationFilter(path: string, filter: FilterExpr, readable: VisibilityTableSource): FilterExpr;
-//#endregion
-//#region src/db/shared-read-helpers.d.ts
+export declare function arbacRelationFilter(path: string, filter: FilterExpr, readable: VisibilityTableSource): FilterExpr;
 /**
  * Restrict the user-supplied `$select` to the scopes' projection union.
  * Returns the original projection untouched when no scope declares a
@@ -677,14 +699,14 @@ declare function arbacRelationFilter(path: string, filter: FilterExpr, readable:
  *
  * @since 0.1.72
  */
-declare function applyArbacProjection(projection: unknown, scopes: ArbacDbScope[], readable?: VisibilityTableSource): TProjection | undefined;
+export declare function applyArbacProjection(projection: unknown, scopes: ArbacDbScope[], readable?: VisibilityTableSource): TProjection | undefined;
 /**
  * Enforce the union of per-scope `controls` gates against the parsed
  * Uniquery controls. Throws `HttpError(403)` on the first violation.
  *
  * @since 0.1.72
  */
-declare function applyArbacControls(controls: Record<string, unknown>, scopes: ArbacDbScope[]): void;
+export declare function applyArbacControls(controls: Record<string, unknown>, scopes: ArbacDbScope[]): void;
 /**
  * Walk the user-supplied `$with` items in `controls` and overlay each joined
  * relation with the policy of its rows (the `$with` inherit-target policy):
@@ -701,9 +723,7 @@ declare function applyArbacControls(controls: Record<string, unknown>, scopes: A
  *
  * @since 0.1.72
  */
-declare function applyArbacRelationScopes(controls: Record<string, unknown>, scopes: ArbacDbScope[], readable?: VisibilityTableSource): void;
-//#endregion
-//#region src/db/write-policy.d.ts
+export declare function applyArbacRelationScopes(controls: Record<string, unknown>, scopes: ArbacDbScope[], readable?: VisibilityTableSource): void;
 /** The table surface the write guards need (`AtscriptDbTable` satisfies it). */
 interface ArbacWriteTable {
   count(query: {
@@ -732,17 +752,15 @@ interface ArbacWriteTable {
  *   0.1.75) — and, with `ignoreConflicts` (`?$onConflict=ignore`), refused
  *   whenever it cannot, since the post-write check never sees skipped rows.
  */
-declare function guardArbacWrite(ctx: TDbWriteGuardContext, scopes: readonly ArbacDbScope[], table: ArbacWriteTable, refs: RefTableSource, ignoreConflicts?: boolean): Promise<void>;
+export declare function guardArbacWrite(ctx: TDbWriteGuardContext, scopes: readonly ArbacDbScope[], table: ArbacWriteTable, refs: RefTableSource, ignoreConflicts?: boolean): Promise<void>;
 /**
  * WITH CHECK after the write, inside its transaction: every written row must
  * match the scopes' `check` (default `filter`) — else 403 and the write rolls
  * back. Non-transactional adapters were checked in {@link guardArbacWrite}.
  */
-declare function checkArbacWrite(ctx: TDbWriteCheckContext, scopes: readonly ArbacDbScope[]): Promise<void>;
+export declare function checkArbacWrite(ctx: TDbWriteCheckContext, scopes: readonly ArbacDbScope[]): Promise<void>;
 /** USING for deletes: the exact row the delete targets must match the scope filter (else 404). */
-declare function guardArbacRemove(ctx: TDbRemoveGuardContext, scopes: readonly ArbacDbScope[], table: Pick<ArbacWriteTable, "count">): Promise<void>;
-//#endregion
-//#region src/db/use-arbac-db-scope.d.ts
+export declare function guardArbacRemove(ctx: TDbRemoveGuardContext, scopes: readonly ArbacDbScope[], table: Pick<ArbacWriteTable, "count">): Promise<void>;
 /**
  * The slice of an atscript-db table {@link ArbacDbScopeHelpers.assertRowsInScope}
  * needs — satisfied by `AtscriptDbTable` / a controller's `this.table`.
@@ -835,9 +853,7 @@ interface ArbacDbScopeHelpers<T = unknown> {
  * await this.table.insertOne({ ...row, ...scope.set() }, scope.writeOptions(this.table));
  * ```
  */
-declare function useArbacDbScope<T = unknown>(): Promise<ArbacDbScopeHelpers<T>>;
-//#endregion
-//#region src/moost-arbac.d.ts
+export declare function useArbacDbScope<T = unknown>(): Promise<ArbacDbScopeHelpers<T>>;
 /**
  * A DI-enabled extension of the `Arbac` class for use within Moost.
  *
@@ -849,7 +865,7 @@ declare function useArbacDbScope<T = unknown>(): Promise<ArbacDbScopeHelpers<T>>
  * @template TUserAttrs - The type representing user attributes relevant to access control.
  * @template TScope - The type representing access control scopes.
  */
-declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {
+export declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {
   private scopeFieldRules;
   /**
    * Register the conjunction rule of custom (declaration-merged) scope
@@ -916,5 +932,4 @@ declare class MoostArbac<TUserAttrs extends object, TScope extends object> exten
   /** The registered custom scope field rules. @since 0.1.72 */
   getScopeFields(): TScopeFieldRules<TScope>;
 }
-//#endregion
-export { ARBAC_DELEGATED_AUTH, type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, type ArbacDbScopeHelpers, ArbacDelegatedAuth, ArbacEvaluateOptions, type ArbacGuardedTable, type ArbacRelationResolution, ArbacResource, type ArbacScopedTable, ArbacUserProvider, ArbacUserProviderToken, type ArbacWriteTable, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, type ConjoinArbacDbScopesOptions, type ControlGate, type ControlsOf, type MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type RefForeignKey, type RefTableSource, type ScopeVisibilityOptions, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, type VisibilityTableSource, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, type AoothArbacClaims, Arbac, ArbacDbScope, type ArbacDbScopeHelpers, ArbacDelegatedAuth, type ArbacGuardedTable, type ArbacRelationResolution, type ArbacScopedTable, ArbacUserProvider, ArbacUserProviderToken, type ArbacWriteTable, AsArbacDbController, type ConjoinArbacDbScopesOptions, type ControlGate, type ControlsOf, type MetaVisibility, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type RefForeignKey, type RefTableSource, type ScopeVisibilityOptions, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, type VisibilityTableSource, applyAllowedFieldsAndSet, arbacPatternToRegex, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { i as __decorate, n as ArbacUserProvider, r as ArbacUserProviderToken, t as __decorateMetadata } from "./decorateMetadata-CU_mqYGT.mjs";
+import { i as __decorate, n as ArbacUserProvider, r as ArbacUserProviderToken, t as __decorateMetadata } from "./decorateMetadata-BqEexuhv.mjs";
 import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core";
 import { DB_SCOPE_KEYS, DENY_FILTER, ScopeFieldConfigError, applyScopeFieldFilters, conjoinScopeFilters, conjoinScopeFilters as conjoinScopeFilters$1, conjoinScopes, effectiveScope, expandExcludeToLeaves, getProjectionMode, intersectEnabled, isFieldAllowed, needsInheritedConjunction, normalizeScopes, restrictProjection, stableKey, unionOutcomes } from "@aooth/arbac";
 import { Authenticate, HttpError } from "@moostjs/event-http";
@@ -7,7 +7,7 @@ import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, get
 import { computeInsights, containsRelationFilter, findAncestorInSet, getPath, hasRelationOp, isPlainObject, isRelationOp, translateQueryTree } from "@atscript/db";
 import { AsDbController, AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, DB_CRUD_HANDLERS, VALUE_HELP_CRUD_HANDLERS, badRequest, discoverRowLevelActions, getControllerFormType, getDbEndpoint, hasActionDelegations, resolveTerminalRef, stableMeta } from "@atscript/moost-db";
 import { groupByFields, walkFilter } from "@uniqu/core";
-//#region src/db/helpers.ts
+// src/db/helpers.ts
 /** `map.get(key)`, created with `create()` and stored on a miss. */
 function getOrCreate(map, key, create) {
 	let value = map.get(key);
@@ -44,8 +44,7 @@ const navFieldsCache = /* @__PURE__ */ new WeakMap();
 function navFieldsOf(table) {
 	return table.navFields ?? getOrCreate(navFieldsCache, table, () => new Set(table.relations?.keys()));
 }
-//#endregion
-//#region src/db/visibility.ts
+// src/db/visibility.ts
 /**
 * Union the per-scope `projection` whitelists into the single access-control
 * projection used for FIELD-EXISTENCE decisions (`hasField` parity + `/meta`
@@ -289,8 +288,7 @@ function isIdentifierSet(source) {
 function scopeVisibility(scopes, source = NO_TABLE) {
 	return getOrCreate(getOrCreate(scopeVisibilityCache, scopes, () => /* @__PURE__ */ new WeakMap()), source, () => isIdentifierSet(source) ? buildScopeVisibility(scopes, void 0, source) : buildScopeVisibility(scopes, source === NO_TABLE ? void 0 : source));
 }
-//#endregion
-//#region src/db/relation-policy.ts
+// src/db/relation-policy.ts
 /** Registry bucket for controllers without an `app`. */
 const NO_APP = {};
 const registry = /* @__PURE__ */ new WeakMap();
@@ -504,8 +502,7 @@ function requestRelations(readable) {
 	const stored = ctx.has(requestRelationsKey) ? ctx.get(requestRelationsKey) : void 0;
 	return stored && stored.readable === readable ? stored.relations : void 0;
 }
-//#endregion
-//#region src/db/write-refs.ts
+// src/db/write-refs.ts
 /**
 * The FK a `checkRefs` entry designates: one of its local fields, or the TO
 * relation it backs (`readable.foreignKeyOf`). A name that is neither is a
@@ -664,8 +661,7 @@ function prefetchRefTargets(scopes, table) {
 	}
 	for (const type of types) evaluateTypeRead(type).catch(() => {});
 }
-//#endregion
-//#region src/attenuation.ts
+// src/attenuation.ts
 /**
 * Conjoin the full-authority scopes (`userScopes`, the ceiling) and the
 * credential's narrowed scopes (`credScopes`) into ONE composite
@@ -708,8 +704,7 @@ function conjoinArbacDbScopes(userScopes, credScopes, opts) {
 		fields
 	})];
 }
-//#endregion
-//#region src/db/field-children.ts
+// src/db/field-children.ts
 const fieldChildrenCache = /* @__PURE__ */ new WeakMap();
 const NONE = /* @__PURE__ */ new Set();
 /**
@@ -735,8 +730,7 @@ function fieldChildrenOf(table) {
 		return (path) => byParent.get(path) ?? [];
 	});
 }
-//#endregion
-//#region src/moost-arbac.ts
+// src/moost-arbac.ts
 /** Default number of memoized `/meta` projections per envelope. */
 const DEFAULT_META_MEMO_MAX = 64;
 let MoostArbac = class MoostArbac extends Arbac$1 {
@@ -830,8 +824,7 @@ let MoostArbac = class MoostArbac extends Arbac$1 {
 	}
 };
 MoostArbac = __decorate([Injectable()], MoostArbac);
-//#endregion
-//#region src/arbac.evaluate.ts
+// src/arbac.evaluate.ts
 /**
 * The ARBAC resource + action a handler is authorized as. Resource: method
 * `@ArbacResource` → class `@ArbacResource` → controller id → class name.
@@ -878,6 +871,11 @@ async function loadPrincipal(user) {
 	};
 }
 const arbacDeps = cachedBy((_controller, ctx) => Promise.all([useControllerContext(ctx).instantiate(ArbacUserProviderToken), useControllerContext(ctx).instantiate(MoostArbac)]));
+/** Load the current principal through the controller's user provider (fresh, no memo). */
+async function loadCurrentPrincipal(ctx) {
+	const [user] = await arbacDeps(useControllerContext(ctx).getController(), ctx);
+	return loadPrincipal(user);
+}
 const principalKey = key("arbac.principal");
 function isHttpEvent(ctx) {
 	return ctx.has(eventTypeKey) && ctx.get(eventTypeKey) === "http";
@@ -980,8 +978,7 @@ function evaluateArbacCached(resource, action, table) {
 		table: normalized
 	}, true);
 }
-//#endregion
-//#region src/arbac.composables.ts
+// src/arbac.composables.ts
 /**
 * Writable slot holding the evaluated scopes for the current event.
 *
@@ -1042,24 +1039,39 @@ const useArbac = (_ctx) => {
 	};
 	const evaluateOrThrow = async (opts) => {
 		const result = await evaluate(opts);
-		if (!result.allowed) throw new HttpError(403, `Forbidden: ${opts?.resource || resource}/${opts?.action || action}`);
+		if (!result.allowed) {
+			const r = opts?.resource || resource;
+			const a = opts?.action || action;
+			throw new HttpError(403, `Forbidden: ${r}/${a}`);
+		}
 		return {
 			...result,
 			allowed: true
 		};
 	};
+	const principal = async () => {
+		const p = await loadCurrentPrincipal(ctx);
+		const claimed = p.attenuate?.roles;
+		return {
+			userId: p.userId,
+			roles: p.roles,
+			effectiveRoles: claimed ? p.roles.filter((r) => claimed.includes(r)) : p.roles,
+			attrs: () => p.attrs(p.userId),
+			...p.attenuate && { attenuation: p.attenuate }
+		};
+	};
 	return {
 		getScopes,
 		setScopes,
 		evaluate,
 		evaluateOrThrow,
+		principal,
 		resource,
 		action,
 		isPublic
 	};
 };
-//#endregion
-//#region src/arbac.mate.ts
+// src/arbac.mate.ts
 /**
 * Returns the shared `Mate` instance typed with ARBAC metadata fields.
 *
@@ -1081,8 +1093,7 @@ function getArbacMate() {
 * @since 0.1.72
 */
 const ARBAC_DELEGATED_AUTH = Symbol.for("aooth.arbac.delegatedAuth");
-//#endregion
-//#region src/arbac.decorator.ts
+// src/arbac.decorator.ts
 /**
 * ARBAC checks authorization, not authentication, so the transport
 * declaration is empty — pair with an upstream auth guard (e.g. JWT
@@ -1129,8 +1140,7 @@ const ArbacResource = (name) => getArbacMate().decorate("arbacResourceId", name)
 * at the method level.
 */
 const ArbacAction = (name) => getArbacMate().decorate("arbacActionId", name);
-//#endregion
-//#region src/db/meta-memo.ts
+// src/db/meta-memo.ts
 /** Deepest relation nesting the decision record follows; deeper → not memoized. */
 const MAX_RECORD_DEPTH = 16;
 var Unkeyable = class extends Error {};
@@ -1307,8 +1317,7 @@ function memoMetaProjection(envelope, key, max, compute) {
 function shareMeta(obj) {
 	return stableMeta(obj);
 }
-//#endregion
-//#region src/db/meta-projection.ts
+// src/db/meta-projection.ts
 /**
 * Exact-or-ancestor membership in the write whitelist: `credit.credentials.user`
 * matches a `credit.credentials` grant. A path through a nav relation is
@@ -2037,7 +2046,7 @@ function formChildren(runtime, node) {
 /** Nested-relation walk bound — serialized nav bodies are finite, this only guards pathological input. */
 const MAX_NAV_DEPTH = 8;
 /** The form walk bound; past it every `ref` / binding is stripped (fail closed). */
-const MAX_FORM_DEPTH = MAX_NAV_DEPTH * 2;
+const MAX_FORM_DEPTH = 16;
 function serializedChildren(node) {
 	const def = node.type;
 	return [
@@ -2421,8 +2430,7 @@ function collectMethodNames(instance) {
 	}
 	return [...names];
 }
-//#endregion
-//#region src/db/shared-read-helpers.ts
+// src/db/shared-read-helpers.ts
 /**
 * Restrict the user-supplied `$select` to the scopes' projection union.
 * Returns the original projection untouched when no scope declares a
@@ -2453,7 +2461,8 @@ function applyArbacProjection(projection, scopes, readable) {
 function restrictSelect(projection, vis) {
 	if (Object.keys(vis.allowed).length === 0) return projection;
 	const childrenOf = fieldChildrenOf(vis.table);
-	return expandExcludeToLeaves(restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf), childrenOf);
+	const result = restrictProjection(normalizeSelect(projection) ?? {}, vis.allowed, childrenOf);
+	return expandExcludeToLeaves(result, childrenOf);
 }
 /**
 * Enforce the union of per-scope `controls` gates against the parsed
@@ -2539,8 +2548,7 @@ function normalizeSelect(value) {
 	}
 	if (typeof value === "object") return value;
 }
-//#endregion
-//#region src/db/request-scopes.ts
+// src/db/request-scopes.ts
 /** Endpoints whose `prepareRequest` carries parsed Uniquery controls. */
 const READ_ENDPOINTS = /* @__PURE__ */ new Set([
 	"query",
@@ -2829,8 +2837,7 @@ function arbacRelationFilter(path, filter, readable) {
 	if (!level?.scopes) throw badRequest(path, `Unknown field "${path}"`);
 	return conjoinScopeFilters$1(effectiveScope(level.scopes).filter, filter) ?? filter;
 }
-//#endregion
-//#region src/db/write-fields.ts
+// src/db/write-fields.ts
 /**
 * Test-friendly internal helper — exported for unit tests and helper
 * composition; regular consumers should not call this directly.
@@ -2947,8 +2954,7 @@ function applyPreparedOverlay(data, prepared) {
 	if (prepared.setOverrides) for (const [path, value] of prepared.setOverrides) setPath$1(merged, path, value, prepared.isMergePatch);
 	return merged;
 }
-//#endregion
-//#region src/db/write-check.ts
+// src/db/write-check.ts
 /** Thrown by {@link compileScopeCheck} for an operator the evaluator does not model. */
 var UnsupportedCheckError = class extends Error {};
 /**
@@ -3071,8 +3077,7 @@ function setPath(target, path, value) {
 	}
 	node[segs.at(-1)] = value;
 }
-//#endregion
-//#region src/db/write-policy.ts
+// src/db/write-policy.ts
 const OUT_OF_SCOPE = "Row outside your write scope";
 /**
 * Nested writes through nav props are denied unless a write scope opts the
@@ -3185,8 +3190,7 @@ async function guardArbacRemove(ctx, scopes, table) {
 		controls: {}
 	}) === 0) throw new HttpError(404, "Not found");
 }
-//#endregion
-//#region src/db/as-arbac-db-controller.ts
+// src/db/as-arbac-db-controller.ts
 let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	/** Makes this controller the `$with` policy source for its table's ARBAC resource. */
 	_arbacRelationTarget = registerArbacDbTarget(this);
@@ -3488,8 +3492,7 @@ function remapUniquUrlSyntaxError(err) {
 	if (!/at (?:pos )?\d+/.test(msg)) return err;
 	return new HttpError(400, `Invalid query string: ${msg}`);
 }
-//#endregion
-//#region src/db/as-arbac-db-readable-controller.ts
+// src/db/as-arbac-db-readable-controller.ts
 let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDbReadableController {
 	/** Makes this controller the `$with` policy source for its table's ARBAC resource. */
 	_arbacRelationTarget = registerArbacDbTarget(this);
@@ -3551,8 +3554,7 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 	}
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
-//#endregion
-//#region src/db/as-arbac-value-help-controller.ts
+// src/db/as-arbac-value-help-controller.ts
 function valueHelpHost(boundType, primaryKey, searchableFields) {
 	const ids = primaryKey ? [primaryKey] : [];
 	return {
@@ -3749,8 +3751,7 @@ __decorate([
 	__decorateMetadata("design:returntype", typeof ReturnType === "undefined" ? Object : ReturnType)
 ], AsArbacJsonValueHelpController.prototype, "runGetOneComposite", null);
 AsArbacJsonValueHelpController = __decorate([Inherit()], AsArbacJsonValueHelpController);
-//#endregion
-//#region src/db/use-arbac-db-scope.ts
+// src/db/use-arbac-db-scope.ts
 /**
 * The current event's merged ARBAC DB scope, for custom routes and
 * `@DbAction` handlers that query the table directly. Resolves the event's
@@ -3812,5 +3813,4 @@ async function useArbacDbScope() {
 		})
 	};
 }
-//#endregion
 export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };

package/dist/plugin.d.mts

@@ -1,5 +1,4 @@
 import { TAtscriptPlugin } from "@atscript/core";
-//#region src/plugin.d.ts
 /**
  * Registers the `@arbac.*` annotation namespace for `@aooth/arbac-moost`:
  *
@@ -45,6 +44,4 @@ import { TAtscriptPlugin } from "@atscript/core";
  * export default { plugins: [arbacPlugin()] }
  * ```
  */
-declare function arbacPlugin(): TAtscriptPlugin;
-//#endregion
-export { arbacPlugin as default };
+export default function arbacPlugin(): TAtscriptPlugin;

package/dist/plugin.mjs

@@ -1,5 +1,5 @@
 import { AnnotationSpec } from "@atscript/core";
-//#region src/plugin.ts
+// src/plugin.ts
 /**
 * Registers the `@arbac.*` annotation namespace for `@aooth/arbac-moost`:
 *
@@ -115,5 +115,4 @@ function arbacPlugin() {
 		}
 	};
 }
-//#endregion
 export { arbacPlugin as default };

package/dist/{user.provider-SisapkME.d.mts → user.provider-BbYgv9RC.d.mts}

@@ -3,7 +3,6 @@ import { Mate, TClassConstructor, TMateParamMeta, TMoostMetadata } from "moost";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteAction, TDbWriteCheckContext, TDbWriteGuardContext, TMetaResponse, UniqueryControls } from "@atscript/db";
 import { AsDbController, TDbActionScopeContext, TDbControlsType, TDbRequestContext } from "@atscript/moost-db";
 import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType, TAtscriptDataType, TSerializedAnnotatedType } from "@atscript/typescript/utils";
-//#region src/arbac.mate.d.ts
 /**
  * ARBAC metadata fields attached to classes and methods by ARBAC decorators.
  *
@@ -47,8 +46,6 @@ declare const ARBAC_DELEGATED_AUTH: unique symbol;
 interface ArbacDelegatedAuth {
   [ARBAC_DELEGATED_AUTH](method: string): boolean;
 }
-//#endregion
-//#region src/db/scope-types.d.ts
 /**
  * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
  * `Comment[]` → `Comment`, `Task` → `Task`. Used to recurse `with.<K>` into
@@ -99,8 +96,6 @@ type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate> : {
   $with?: ReadonlyArray<NavRelationKey<T>> | boolean;
   $groupBy?: ReadonlyArray<OwnFieldKey<T>> | boolean;
 } & Partial<Record<BooleanControl, boolean>>;
-//#endregion
-//#region src/db/write-fields.d.ts
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.
@@ -123,8 +118,6 @@ type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate> : {
  * does not carry is skipped (adding the block would clear its other leaves).
  */
 declare function applyAllowedFieldsAndSet(data: unknown, scopes: ArbacDbScope[], preserveFields?: readonly string[], isMergePatch?: (objectPath: string) => boolean): unknown;
-//#endregion
-//#region src/db/as-arbac-db-controller.d.ts
 type TSelect = UniqueryControls["$select"];
 /**
  * Contract returned by an ARBAC role's scope predicate on a DB-backed resource.
@@ -442,8 +435,6 @@ declare function enforceControlsPolicy(policy: Record<string, ControlGate>, cont
  * gate, which throws if a non-whitelistable control receives a string[]).
  */
 declare function extractUsedControlValues(key: string, value: unknown, controls?: Record<string, unknown>): string[];
-//#endregion
-//#region src/db/write-refs.d.ts
 /** A `@db.rel.FK` entry as atscript-db's readable exposes it. */
 interface RefForeignKey {
   readonly fields: readonly string[];
@@ -458,8 +449,6 @@ interface RefTableSource {
   /** The FK a TO relation is backed by (atscript-db's `readable.foreignKeyOf`). @since 0.1.72 */
   foreignKeyOf?(relationName: string): RefForeignKey | undefined;
 }
-//#endregion
-//#region src/attenuation.d.ts
 /**
  * The restrict-only ARBAC attenuation carried by a credential — its assumed
  * role SUBSET and narrowing attribute overrides. Sourced into evaluation via
@@ -535,8 +524,6 @@ interface ConjoinArbacDbScopesOptions {
    */
   fields?: TScopeFieldRules<ArbacDbScope>;
 }
-//#endregion
-//#region src/user.provider.d.ts
 /**
  * Abstract base class for providing user data required for ARBAC evaluations.
  *
@@ -591,5 +578,4 @@ declare abstract class ArbacUserProvider<TUserAttrs extends object = object> {
  * etc. Runtime resolves to the concrete subclass registered via DI.
  */
 declare const ArbacUserProviderToken: TClassConstructor<ArbacUserProvider>;
-//#endregion
 export { ProjectionOf as _, conjoinArbacDbScopes as a, TArbacMeta as b, ArbacDbScope as c, extractUsedControlValues as d, applyAllowedFieldsAndSet as f, OwnFieldKey as g, NavTarget as h, ConjoinArbacDbScopesOptions as i, AsArbacDbController as l, NavRelationKey as m, ArbacUserProviderToken as n, RefForeignKey as o, ControlsOf as p, AoothArbacClaims as r, RefTableSource as s, ArbacUserProvider as t, enforceControlsPolicy as u, ARBAC_DELEGATED_AUTH as v, getArbacMate as x, ArbacDelegatedAuth as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,30 +60,30 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.15",
-    "@aooth/arbac": "0.2.1",
-    "@aooth/arbac-core": "0.2.1",
-    "@aooth/user": "0.2.1"
+    "@uniqu/core": "^0.2.0",
+    "@aooth/arbac": "0.2.3",
+    "@aooth/user": "0.2.3",
+    "@aooth/arbac-core": "0.2.3"
   },
   "devDependencies": {
-    "@atscript/core": "^0.2.1",
-    "@atscript/db": "^0.1.166",
-    "@atscript/db-sql-tools": "^0.1.166",
-    "@atscript/db-sqlite": "^0.1.166",
-    "@atscript/moost-db": "^0.1.166",
-    "@atscript/typescript": "^0.2.1",
-    "@moostjs/event-http": "^0.7.0",
+    "@atscript/core": "^0.2.4",
+    "@atscript/db": "^0.1.168",
+    "@atscript/db-sql-tools": "^0.1.168",
+    "@atscript/db-sqlite": "^0.1.168",
+    "@atscript/moost-db": "^0.1.168",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.2.1"
+    "unplugin-atscript": "^0.2.4"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.166",
-    "@atscript/moost-db": "^0.1.166",
-    "@atscript/typescript": "^0.2.1",
-    "@moostjs/event-http": "^0.7.0",
+    "@atscript/db": "^0.1.168",
+    "@atscript/moost-db": "^0.1.168",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@wooksjs/event-core": "^0.8.0",
-    "moost": "^0.7.0"
+    "moost": "^0.7.2"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {