@aooth/arbac-moost 0.2.2 → 0.2.4

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BbYgv9RC.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-D0cJ_iMd.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 /**

package/dist/atscript/index.mjs

@@ -475,7 +475,7 @@ var AoothArbacUserCredentials = class {
 		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
 	}
 };
-$ak("db.index.fulltext", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
-$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
+$ak("db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
+$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
 defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", $f(AoothUserCredentials, "id")).prop("username", $f(AoothUserCredentials, "username")).prop("version", $f(AoothUserCredentials, "version")).prop("password", $f(AoothUserCredentials, "password")).prop("account", $f(AoothUserCredentials, "account")).prop("mfa", $f(AoothUserCredentials, "mfa")).prop("trustedDevices", $f(AoothUserCredentials, "trustedDevices")).prop("seenDevices", $f(AoothUserCredentials, "seenDevices")).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
 export { AoothArbacUserCredentials, ArbacUserRecordCache, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-BbYgv9RC.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-D0cJ_iMd.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
-import { TAuthGuardDef } from "@moostjs/event-http";
+import { HttpError, TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
 import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbActionScopeContext, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
@@ -224,6 +224,37 @@ export interface ArbacEvaluateOptions {
    */
   table?: VisibilityTableSource;
 }
+/** The current user as ARBAC sees it — what `useArbac().principal()` returns. */
+export interface ArbacPrincipal<TUserAttrs extends object = object> {
+  /** The user id the `ArbacUserProvider` resolved for this event. */
+  userId: string;
+  /**
+   * The roles the user HOLDS (`ArbacUserProvider.getRoles`), before
+   * credential attenuation. Don't authorize on it — an attenuated credential
+   * may act with fewer roles; use {@link effectiveRoles} or `evaluate()`.
+   */
+  roles: string[];
+  /**
+   * The roles this request acts with: {@link roles} narrowed by the
+   * credential's attenuation (`roles ∩ attenuation.roles`; all held roles when
+   * the attenuation names none). A claimed role the user does not hold is
+   * never included, even with `allowUnheldRoles` — that "view as" mode only
+   * ever narrows through `evaluate()`. Use this for role checks in app code.
+   */
+  effectiveRoles: string[];
+  /** The user's attributes (`ArbacUserProvider.getAttrs`), loaded on the first call. */
+  attrs: () => Promise<TUserAttrs>;
+  /**
+   * The credential's restrict-only attenuation
+   * (`ArbacUserProvider.getAttenuation`), when it narrows the user's
+   * authority; absent otherwise.
+   */
+  attenuation?: {
+    roles?: string[];
+    attrs?: Record<string, unknown>;
+    allowUnheldRoles?: boolean;
+  };
+}
 interface ArbacBindings {
   getScopes: <TScope extends object>() => TScope[] | undefined;
   setScopes: <TScope extends object>(scope: TScope[] | undefined) => void;
@@ -246,6 +277,14 @@ interface ArbacBindings {
     scopes?: TScope[];
     userId: string;
   }>;
+  /**
+   * The current principal — user id, held and effective roles, lazy
+   * attributes and credential attenuation — read through the
+   * `ArbacUserProvider`, the same source `evaluate()` uses. Loaded fresh on
+   * every call (like `evaluate()`), so a role change applies immediately.
+   * Decide on `effectiveRoles` (or `evaluate()`), never on `roles`.
+   */
+  principal: <TUserAttrs extends object = object>() => Promise<ArbacPrincipal<TUserAttrs>>;
   resource: string;
   action: string;
   isPublic: boolean;
@@ -576,9 +615,41 @@ export declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: strin
  * caller's readable rows match the query; the action itself is authorized
  * by its source controller on every batch.
  *
+ * A read endpoint (`query`, `pages`, `geo`, `one`) under a moost-db write
+ * handler (`insert`, `update`, `replace`, `remove`, `removeComposite`) is
+ * served only inside {@link readBackUnderReadGrant} (since 0.2.4), under the
+ * read grant it installs — otherwise a 403, never the write grant. moost-db's
+ * insert read-back (`Prefer: return=representation`) then answers the plain
+ * insert result.
+ *
  * @since 0.1.72
  */
 export declare function prepareArbacRequest(ctx: TDbRequestContext, readable?: VisibilityTableSource): Promise<void>;
+/**
+ * Read back the row `id` after a write, exactly as `GET /one/:id` would
+ * answer the caller (since 0.2.4) — the body of
+ * `AsArbacDbController._readRepresentation`, and the way for a write handler
+ * override to answer the written row:
+ *
+ * ```ts
+ * await super.update(payload);
+ * return readBackUnderReadGrant(id, () => this.getOne(String(id), ""));
+ * ```
+ *
+ * `read` calls the controller's `/one` handler: `getOne` for a scalar `id`,
+ * `getOneComposite` for a key object. The caller's grant on that handler is
+ * evaluated (its `@ArbacResource` / `@ArbacAction`, credential attenuation
+ * included) and installed as the request's scopes while `read` runs — its
+ * row filter, projection and controls apply, and an overridden handler body
+ * runs too — then the write's scopes are restored.
+ *
+ * Answers `undefined` instead of the row when: the caller has no grant on
+ * that handler; the handler carries method-level interceptors (they would
+ * not run on a direct call); `read` answers or throws an `HttpError` (e.g.
+ * the row is outside the read filter → 404); or anything else fails (logged
+ * as a warning, never answered — the write is already committed).
+ */
+export declare function readBackUnderReadGrant<R>(id: unknown, read: () => Promise<R>): Promise<Exclude<R, HttpError> | undefined>;
 /**
  * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
  * caller may run at least one of the actions that take it as input — each

package/dist/index.mjs

@@ -21,6 +21,15 @@ function getOrCreate(map, key, create) {
 function hasSelfOrAncestor(set, path) {
 	return set.has(path) || findAncestorInSet(path, set) !== void 0;
 }
+/**
+* A key object (a composite id, read by `getOneComposite`) — a plain object.
+* A class instance such as a MongoDB `ObjectId` is a scalar id: `String(id)`.
+*/
+function isKeyObject(id) {
+	if (id === null || typeof id !== "object") return false;
+	const proto = Object.getPrototypeOf(id);
+	return proto === Object.prototype || proto === null;
+}
 /** A patch (`update` / `updateMany`) — only the keys it carries are written. */
 function isPatchAction(action) {
 	return action === "update" || action === "updateMany";
@@ -871,6 +880,11 @@ async function loadPrincipal(user) {
 	};
 }
 const arbacDeps = cachedBy((_controller, ctx) => Promise.all([useControllerContext(ctx).instantiate(ArbacUserProviderToken), useControllerContext(ctx).instantiate(MoostArbac)]));
+/** Load the current principal through the controller's user provider (fresh, no memo). */
+async function loadCurrentPrincipal(ctx) {
+	const [user] = await arbacDeps(useControllerContext(ctx).getController(), ctx);
+	return loadPrincipal(user);
+}
 const principalKey = key("arbac.principal");
 function isHttpEvent(ctx) {
 	return ctx.has(eventTypeKey) && ctx.get(eventTypeKey) === "http";
@@ -1044,11 +1058,23 @@ const useArbac = (_ctx) => {
 			allowed: true
 		};
 	};
+	const principal = async () => {
+		const p = await loadCurrentPrincipal(ctx);
+		const claimed = p.attenuate?.roles;
+		return {
+			userId: p.userId,
+			roles: p.roles,
+			effectiveRoles: claimed ? p.roles.filter((r) => claimed.includes(r)) : p.roles,
+			attrs: () => p.attrs(p.userId),
+			...p.attenuate && { attenuation: p.attenuate }
+		};
+	};
 	return {
 		getScopes,
 		setScopes,
 		evaluate,
 		evaluateOrThrow,
+		principal,
 		resource,
 		action,
 		isPublic
@@ -2586,10 +2612,11 @@ function cachedRequestScopes() {
 */
 async function resolveRequestScopes() {
 	const ctx = current();
+	const prior = resolved();
+	if (prior?.readBack) return prior.scopes;
 	const arbac = useArbac(ctx);
 	const cachedScopes = arbac.getScopes();
 	const fromInterceptor = cachedScopes && scopesOwnedBy(cachedScopes, arbac.resource, arbac.action) ? cachedScopes : void 0;
-	const prior = resolved();
 	if (prior && prior.resource === arbac.resource && prior.action === arbac.action && prior.source === fromInterceptor) return prior.scopes;
 	const scopes = normalizeScopes(fromInterceptor !== void 0 ? {
 		allowed: true,
@@ -2667,6 +2694,13 @@ function isScopedFieldVisible(scopes, path, source) {
 * caller's readable rows match the query; the action itself is authorized
 * by its source controller on every batch.
 *
+* A read endpoint (`query`, `pages`, `geo`, `one`) under a moost-db write
+* handler (`insert`, `update`, `replace`, `remove`, `removeComposite`) is
+* served only inside {@link readBackUnderReadGrant} (since 0.2.4), under the
+* read grant it installs — otherwise a 403, never the write grant. moost-db's
+* insert read-back (`Prefer: return=representation`) then answers the plain
+* insert result.
+*
 * @since 0.1.72
 */
 async function prepareArbacRequest(ctx, readable) {
@@ -2678,10 +2712,67 @@ async function prepareArbacRequest(ctx, readable) {
 		await authorizeDelegatedQueryTarget();
 		return;
 	}
+	if (READ_ENDPOINTS.has(ctx.endpoint) && !resolved()?.readBack && underWriteHandler()) {
+		const { resource, action } = useArbac();
+		throw insufficientPrivileges(resource, action);
+	}
 	const scopes = await resolveRequestScopes();
 	if (ctx.endpoint === "insert" && ctx.onConflict === "ignore") resolved().insertIgnore = true;
 	if (READ_ENDPOINTS.has(ctx.endpoint)) enforceRelationGates(await resolveRequestRelations(scopes, ctx.controls, readable, ctx.filter), visibilityFor(scopes, readable));
 }
+/** moost-db's write handler methods — a read under one of them must be a read-back. */
+const WRITE_HANDLERS = new Set([...WRITE_CRUD_OPS].flatMap((op) => DB_CRUD_HANDLERS[op]));
+function underWriteHandler() {
+	const method = useControllerContext().getMethod();
+	return method !== void 0 && WRITE_HANDLERS.has(method);
+}
+/**
+* Read back the row `id` after a write, exactly as `GET /one/:id` would
+* answer the caller (since 0.2.4) — the body of
+* `AsArbacDbController._readRepresentation`, and the way for a write handler
+* override to answer the written row:
+*
+* ```ts
+* await super.update(payload);
+* return readBackUnderReadGrant(id, () => this.getOne(String(id), ""));
+* ```
+*
+* `read` calls the controller's `/one` handler: `getOne` for a scalar `id`,
+* `getOneComposite` for a key object. The caller's grant on that handler is
+* evaluated (its `@ArbacResource` / `@ArbacAction`, credential attenuation
+* included) and installed as the request's scopes while `read` runs — its
+* row filter, projection and controls apply, and an overridden handler body
+* runs too — then the write's scopes are restored.
+*
+* Answers `undefined` instead of the row when: the caller has no grant on
+* that handler; the handler carries method-level interceptors (they would
+* not run on a direct call); `read` answers or throws an `HttpError` (e.g.
+* the row is outside the read filter → 404); or anything else fails (logged
+* as a warning, never answered — the write is already committed).
+*/
+async function readBackUnderReadGrant(id, read) {
+	const ctx = current();
+	const prior = resolved();
+	if (!prior) return void 0;
+	try {
+		const instance = useControllerContext(ctx).getController();
+		const method = isKeyObject(id) ? "getOneComposite" : "getOne";
+		if (getMoostMate().read(instance, method)?.interceptors?.length) return void 0;
+		const ids = resolveHandlerArbacIds(instance, method);
+		const [outcome] = await evaluateHandlerOutcomes([ids]);
+		const scopes = normalizeScopes(outcome);
+		if (!scopes) return void 0;
+		storeResolved(ctx, ids, void 0, scopes);
+		ctx.get(requestScopesKey).readBack = true;
+		const row = await read();
+		return row instanceof HttpError ? void 0 : row;
+	} catch (error) {
+		if (!(error instanceof HttpError)) useLogger("arbac", ctx).warn(`Read-back of the written row failed: ${String(error)}`);
+		return;
+	} finally {
+		ctx.set(requestScopesKey, prior);
+	}
+}
 /**
 * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
 * caller may run at least one of the actions that take it as input — each
@@ -3188,6 +3279,15 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return prepareArbacRequest(ctx, this.readable);
 	}
 	/**
+	* The read-back of `Prefer: return=representation` on `POST /` (since
+	* 0.2.4; opt in with `returnRepresentation()`): this controller's own
+	* `/one` handler under the caller's grant on it — see
+	* {@link readBackUnderReadGrant}.
+	*/
+	_readRepresentation(id) {
+		return readBackUnderReadGrant(id, () => isKeyObject(id) ? this.getOneComposite(textKey(id), "") : this.getOne(String(id), ""));
+	}
+	/**
 	* The request filter ∧ the union of the scopes' `filter`s. Computed
 	* synchronously, but typed with moost-db's async-capable contract
 	* (`FilterExpr | Promise<FilterExpr>`) so a subclass may override it
@@ -3375,6 +3475,10 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 };
 AsArbacDbController = __decorate([Inherit()], AsArbacDbController);
+/** A key object as `GET /one?…` receives it — every value as text. */
+function textKey(id) {
+	return Object.fromEntries(Object.entries(id).map(([k, v]) => [k, String(v)]));
+}
 const preservedFieldsCache = /* @__PURE__ */ new WeakMap();
 /**
 * Test-friendly internal helper — exported for unit tests and helper
@@ -3796,4 +3900,4 @@ async function useArbacDbScope() {
 		})
 	};
 }
-export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, readBackUnderReadGrant, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };

package/dist/{user.provider-BbYgv9RC.d.mts → user.provider-D0cJ_iMd.d.mts}

@@ -268,6 +268,13 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    * is resolved for the requested relations.
    */
   protected prepareRequest(ctx: TDbRequestContext): Promise<void>;
+  /**
+   * The read-back of `Prefer: return=representation` on `POST /` (since
+   * 0.2.4; opt in with `returnRepresentation()`): this controller's own
+   * `/one` handler under the caller's grant on it — see
+   * {@link readBackUnderReadGrant}.
+   */
+  protected _readRepresentation(id: unknown): Promise<TAtscriptDataType<T> | undefined>;
   /**
    * The request filter ∧ the union of the scopes' `filter`s. Computed
    * synchronously, but typed with moost-db's async-capable contract

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,30 +60,30 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.15",
-    "@aooth/arbac": "0.2.2",
-    "@aooth/user": "0.2.2",
-    "@aooth/arbac-core": "0.2.2"
+    "@uniqu/core": "^0.2.0",
+    "@aooth/arbac": "0.2.4",
+    "@aooth/user": "0.2.4",
+    "@aooth/arbac-core": "0.2.4"
   },
   "devDependencies": {
-    "@atscript/core": "^0.2.3",
-    "@atscript/db": "^0.1.167",
-    "@atscript/db-sql-tools": "^0.1.167",
-    "@atscript/db-sqlite": "^0.1.167",
-    "@atscript/moost-db": "^0.1.167",
-    "@atscript/typescript": "^0.2.3",
-    "@moostjs/event-http": "^0.7.1",
+    "@atscript/core": "^0.2.4",
+    "@atscript/db": "^0.1.169",
+    "@atscript/db-sql-tools": "^0.1.169",
+    "@atscript/db-sqlite": "^0.1.169",
+    "@atscript/moost-db": "^0.1.169",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.2.3"
+    "unplugin-atscript": "^0.2.4"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.167",
-    "@atscript/moost-db": "^0.1.167",
-    "@atscript/typescript": "^0.2.3",
-    "@moostjs/event-http": "^0.7.1",
+    "@atscript/db": "^0.1.169",
+    "@atscript/moost-db": "^0.1.169",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@wooksjs/event-core": "^0.8.0",
-    "moost": "^0.7.1"
+    "moost": "^0.7.2"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {