@atscript/moost-db 0.1.133 → 0.1.134

package/dist/index.cjs

@@ -1181,6 +1181,13 @@ const OP_VERB = {
 	aggregate: "aggregate over",
 	bucket: "bucket"
 };
+/** The one "nonexistent path" verdict — hidden paths answer with it byte for byte. */
+function unknownField(path) {
+	return {
+		path,
+		message: `Unknown field "${path}"`
+	};
+}
 function leafHint(leaves) {
 	if (leaves.length === 0) return "no leaf fields";
 	const shown = leaves.slice(0, 5).join(", ");
@@ -1380,10 +1387,7 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 	* occurrence); it only matters for `op === "filter"` on a listed leaf.
 	*/
 	check(path, op, exists, predicate = "compare") {
-		if (!exists(path)) return {
-			path,
-			message: `Unknown field "${path}"`
-		};
+		if (!exists(path)) return unknownField(path);
 		const { kind, parent } = (0, _atscript_db.classifyQueryPath)(this, path);
 		if (kind === "nav") {
 			if (parent === void 0) return {
@@ -1424,12 +1428,16 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 			}
 		}
 		switch (kind) {
-			case "objectParent":
+			case "objectParent": {
 				if (op === "select") return void 0;
+				const all = this._objectParents.get(path);
+				const leaves = all.filter(exists);
+				if (leaves.length === 0 && all.length > 0) return unknownField(path);
 				return {
 					path,
-					message: `"${path}" is a nested object — filter or sort on one of its leaves (${leafHint(this._objectParents.get(path))})`
+					message: `"${path}" is a nested object — filter or sort on one of its leaves (${leafHint(leaves)})`
 				};
+			}
 			case "jsonDescendant": return {
 				path,
 				message: `"${path}" is inside JSON-stored column "${parent}" — this adapter cannot ${OP_VERB[op]} JSON paths; select "${parent}" and read the value client-side.`
@@ -1441,10 +1449,7 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 				path,
 				message: `Cannot ${OP_VERB[op]} encrypted field "${path}"`
 			};
-			default: return {
-				path,
-				message: `Unknown field "${path}"`
-			};
+			default: return unknownField(path);
 		}
 	}
 };
@@ -1486,6 +1491,7 @@ const GEO_CONTROLS = [
 ];
 //#endregion
 //#region src/as-db-readable.controller.ts
+var _AsDbReadableController;
 /** Gate positions checked after the filter entries, in order; `refs[op]` are their paths. */
 const PATH_OPS = [
 	"sort",
@@ -1495,7 +1501,7 @@ const PATH_OPS = [
 	"aggregate",
 	"bucket"
 ];
-let AsDbReadableController = class AsDbReadableController extends AsReadableController {
+let AsDbReadableController = _AsDbReadableController = class AsDbReadableController extends AsReadableController {
 	/** Reference to the underlying readable (table or view). */
 	readable;
 	/**
@@ -1535,6 +1541,15 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	}
 	/** Bound once: the visibility check ({@link hasField}) the gate hands to `capabilities.check`. */
 	_exists = (path) => this.hasField(path);
+	/**
+	* Id-resolution options (since 0.1.134): `{ isFieldVisible: hasField }`
+	* when a subclass overrides {@link hasField}, else `undefined` (the default
+	* accepts every real path, so resolution stays unfiltered). A unique index
+	* over a hidden field is never an identification.
+	*/
+	_idOpts;
+	/** Narrowed id sources, one stable object per distinct visible-identification set. */
+	_idSources = /* @__PURE__ */ new Map();
 	_preferredIdSet;
 	_overlayIsNoOp;
 	/** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
@@ -1560,6 +1575,29 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		this._quantityRefByPath = this._collectQuantityRefs();
 		const defaultOverlay = AsReadableController.prototype.applyMetaOverlay;
 		this._overlayIsNoOp = this.applyMetaOverlay === defaultOverlay;
+		this._idOpts = this.hasField === _AsDbReadableController.prototype.hasField ? void 0 : { isFieldVisible: this._exists };
+	}
+	/**
+	* The identifications this request may address rows through (since
+	* 0.1.134): the readable's own, minus unique indexes over fields
+	* {@link hasField} hides. Used by `/one?…`, `DELETE /?…` and action `ids`.
+	* Stable per distinct outcome, so per-source caches keyed on it hit.
+	*/
+	get idSource() {
+		const opts = this._idOpts;
+		if (!opts) return this.readable;
+		const visible = this.readable.identificationsVisibleTo(opts.isFieldVisible);
+		if (visible.length === this.readable.identifications.length) return this.readable;
+		const key = visible.map((ident) => ident.source).join("");
+		let source = this._idSources.get(key);
+		if (!source) {
+			source = {
+				identifications: visible,
+				fieldDescriptors: this.readable.fieldDescriptors
+			};
+			this._idSources.set(key, source);
+		}
+		return source;
 	}
 	_collectInvertibleFields() {
 		const out = [];
@@ -1594,7 +1632,11 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	* `$with` relation names and sub-query paths, and the `$search` fallback
 	* fields. A path it rejects is answered exactly like a nonexistent one
 	* (`Unknown field "x"` / `Unknown relation "x"`), so override it to hide
-	* fields per request (read scopes). The default accepts every real path
+	* fields per request (read scopes). Since 0.1.134 it also governs row
+	* identification — a unique index over a hidden field is not an
+	* identification for `/one/:id`, `/one?…`, `DELETE`, a PK-less `PATCH` or
+	* an action id (primary key and `preferredId` always are) — and the
+	* nested-object 400 hint lists visible leaves only. The default accepts every real path
 	* (`isValidFieldPath`). `/meta` does NOT consult it — prune hidden fields
 	* there with `applyMetaOverlay`. Native text search and vector search
 	* (`$vector` names an index) run inside the engine over its indexes, out of
@@ -1768,11 +1810,26 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 			return widened;
 		}
 		const widened = {};
-		for (const path of this._invertibleFields) if (!excluded.has(path)) widened[path] = 1;
+		for (const path of this._invertExclusion(excluded)) widened[path] = 1;
 		for (const field of this._preferredIdSet) widened[field] = 1;
 		return widened;
 	}
 	/**
+	* The logical paths an exclusion keeps. A path goes when it, an ancestor
+	* or a descendant is excluded: excluding an object parent excludes its
+	* whole subtree, and a kept parent would carry an excluded child back
+	* (its other leaves stay listed on their own). Before 0.1.134 only the
+	* exact paths were dropped, so `$select=-a` still returned `a`'s leaves.
+	*/
+	_invertExclusion(excluded) {
+		return this._invertibleFields.filter((path) => {
+			if (excluded.has(path) || (0, _atscript_db.findAncestorInSet)(path, excluded) !== void 0) return false;
+			const prefix = `${path}.`;
+			for (const key of excluded) if (key.startsWith(prefix)) return false;
+			return true;
+		});
+	}
+	/**
 	* Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
 	* / `@db.unit.ref` quantity is selected — UI must never get a value without
 	* its dimension. No-op when `$select` is undefined (full row covers it).
@@ -1835,10 +1892,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		for (const [k, v] of Object.entries(obj)) if (v === 1 || v === true) included.push(k);
 		else if (v === 0 || v === false) excluded.push(k);
 		if (included.length > 0 && excluded.length === 0) return included;
-		if (excluded.length > 0 && included.length === 0) {
-			const excludedSet = new Set(excluded);
-			return this._invertibleFields.filter((path) => !excludedSet.has(path));
-		}
+		if (excluded.length > 0 && included.length === 0) return this._invertExclusion(new Set(excluded));
 		throw new _moostjs_event_http.HttpError(500, "[moost-db] mixed inclusion/exclusion projection reached augmenter; widenPreferredIdProjection should have rejected it");
 	}
 	/** WHY: filter row/rows envelopes by the per-request `applyMetaOverlay` action set; skip `meta()` when overlay is identity. */
@@ -2019,9 +2073,14 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		});
 		return result;
 	}
-	/** Pick the first identification (PK or unique index) whose fields are all present in the query. */
+	/**
+	* Pick the first identification (PK or unique index) whose fields are all
+	* present in the query. A unique index over a field {@link hasField} hides
+	* is not a candidate (since 0.1.134) — `?hidden=x` answers exactly like
+	* `?nope=x`, so it cannot probe whether a row with that value exists.
+	*/
 	extractIdShape(query) {
-		for (const id of this.readable.identifications) {
+		for (const id of this.idSource.identifications) {
 			const idObj = {};
 			let allPresent = true;
 			for (const field of id.fields) {
@@ -2258,7 +2317,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 			...parsedControls,
 			$select: initialSelect
 		};
-		const idFilter = this.readable.resolveIdFilter(id);
+		const idFilter = this.readable.resolveIdFilter(id, this._idOpts);
 		let row = null;
 		if (idFilter) {
 			const overlay = await this.transformOne({});
@@ -2381,7 +2440,7 @@ __decorate([
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record, String]),
 	__decorateMetadata("design:returntype", Promise)
 ], AsDbReadableController.prototype, "getOneComposite", null);
-AsDbReadableController = __decorate([
+AsDbReadableController = _AsDbReadableController = __decorate([
 	(0, moost.Inherit)(),
 	__decorateParam(1, (0, moost.Inject)(READABLE_DEF)),
 	__decorateParam(1, (0, moost.Optional)()),
@@ -2413,6 +2472,9 @@ function hasWriteShape(data, many) {
 let AsDbController = _AsDbController = class AsDbController extends AsDbReadableController {
 	constructor(app, table) {
 		super(app, table);
+		const proto = _AsDbController.prototype;
+		this._writeArgs = this._hookArgs(this.guardWrite !== proto.guardWrite ? (ctx) => this.guardWrite(ctx) : void 0);
+		this._removeArgs = this._hookArgs(this.guardRemove !== proto.guardRemove ? (ctx) => this.guardRemove(ctx) : void 0);
 	}
 	buildCrud() {
 		return {
@@ -2480,19 +2542,20 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	withTransaction(fn) {
 		return this.table.getAdapter().withTransaction(fn);
 	}
+	/** The table write call's trailing options — see {@link _hookArgs}. */
+	_writeArgs;
+	/** `deleteOne`'s trailing options — see {@link _hookArgs}. */
+	_removeArgs;
 	/**
-	* The table write call's trailing options: `[{ guard }]` only when
-	* `guardWrite` is overridden, else nothing (the table is called exactly as
-	* an unmodified controller always called it).
+	* A table call's trailing options, built once: `guard` only when the guard
+	* hook is overridden, `isFieldVisible` only when `hasField` is (an id or a
+	* PK-less payload never resolves through a hidden unique key) — else
+	* nothing, so an unmodified controller calls the table exactly as before.
 	*/
-	_writeArgs() {
-		if (this.guardWrite === _AsDbController.prototype.guardWrite) return [];
-		return [{ guard: (ctx) => this.guardWrite(ctx) }];
-	}
-	/** `deleteOne`'s trailing options: `[{ guard }]` only when `guardRemove` is overridden. */
-	_removeArgs() {
-		if (this.guardRemove === _AsDbController.prototype.guardRemove) return [];
-		return [{ guard: (ctx) => this.guardRemove(ctx) }];
+	_hookArgs(guard) {
+		const opts = { ...this._idOpts };
+		if (guard) opts.guard = guard;
+		return Object.keys(opts).length > 0 ? [opts] : [];
 	}
 	/** Resolves a hook result: `undefined` aborts with `abortMessage`, an `Error` is thrown, anything else passes. */
 	async _checkHook(pending, abortMessage) {
@@ -2542,7 +2605,7 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	}
 	/** Deletes by id (guard forwarded when overridden) and maps "nothing deleted" to 404. */
 	async _deleteOrThrow(id) {
-		const result = await this.table.deleteOne(id, ...this._removeArgs());
+		const result = await this.table.deleteOne(id, ...this._removeArgs);
 		if (result.deletedCount < 1) throw new _moostjs_event_http.HttpError(404);
 		return result;
 	}
@@ -2553,10 +2616,10 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		assertWriteShape(payload);
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("insertMany", payload, true);
-			return this.table.insertMany(rows, ...this._writeArgs());
+			return this.table.insertMany(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("insert", payload, false);
-		return this.table.insertOne(row, ...this._writeArgs());
+		return this.table.insertOne(row, ...this._writeArgs);
 	}
 	/**
 	* **PUT /** — fully replaces one or many records matched by primary key.
@@ -2573,11 +2636,11 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("replaceMany", payload, true);
 			this._resolveBulkCas(rows, versionColumn);
-			return this.table.bulkReplace(rows, ...this._writeArgs());
+			return this.table.bulkReplace(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("replace", payload, false);
 		const hadCas = this._resolveCas(row, versionColumn);
-		const result = await this.table.replaceOne(row, ...this._writeArgs());
+		const result = await this.table.replaceOne(row, ...this._writeArgs);
 		if (hadCas && result.matchedCount === 0) throw await this._disambiguateMismatch(row, versionColumn);
 		return result;
 	}
@@ -2594,11 +2657,11 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("updateMany", payload, true);
 			this._resolveBulkCas(rows, versionColumn);
-			return this.table.bulkUpdate(rows, ...this._writeArgs());
+			return this.table.bulkUpdate(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("update", payload, false);
 		const hadCas = this._resolveCas(row, versionColumn);
-		const result = await this.table.updateOne(row, ...this._writeArgs());
+		const result = await this.table.updateOne(row, ...this._writeArgs);
 		if (hadCas && result.matchedCount === 0) throw await this._disambiguateMismatch(row, versionColumn);
 		return result;
 	}
@@ -2609,7 +2672,7 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	* but the supplied version is stale (§6.3). Callers throw the result.
 	*/
 	async _disambiguateMismatch(data, versionColumn) {
-		const filter = this.table.resolveIdFilter(data);
+		const filter = this.table.resolveIdFilter(data, this._idOpts);
 		const row = filter ? await this.table.findOne({
 			filter,
 			controls: {}
@@ -3158,8 +3221,11 @@ function isPlainObject(value) {
 //#endregion
 //#region src/actions/id-cache.ts
 const boundTableKey = (0, _wooksjs_event_core.key)("atscript_db_action_bound_table");
+function controllerOf(ctx) {
+	return (0, moost.useControllerContext)(ctx).getController();
+}
 function controllerTable(ctx) {
-	const ctrl = (0, moost.useControllerContext)(ctx).getController();
+	const ctrl = controllerOf(ctx);
 	return ctrl?.readable ?? ctrl?.table ?? null;
 }
 function getActionTable(ctx) {
@@ -3180,11 +3246,22 @@ function noTableError(ctx) {
 		code: "ACTION_TABLE_NOT_BOUND"
 	});
 }
+/**
+* Validates the body's `ids` against the action table's identifications. For
+* the controller's own table that is its `idSource` (since 0.1.134): a unique
+* index over a field `hasField` hides neither addresses a row nor appears in
+* the "must exactly match one of" message. An `opts.table` binding has no
+* visibility hook.
+*/
 async function resolveValidatedId(ctx, validate) {
-	const table = getActionTable(ctx);
-	if (!isIdValidationSource(table)) throw noTableError(ctx);
+	let source = ctx.has(boundTableKey) ? ctx.get(boundTableKey) : void 0;
+	if (!source) {
+		const ctrl = controllerOf(ctx);
+		source = ctrl?.idSource ?? ctrl?.readable ?? ctrl?.table ?? null;
+	}
+	if (!isIdValidationSource(source)) throw noTableError(ctx);
 	const env = await ctx.get(dbActionBodySlot);
-	validate(env.ids, table);
+	validate(env.ids, source);
 	return env.ids;
 }
 const dbActionIdSlot = (0, _wooksjs_event_core.cached)((ctx) => resolveValidatedId(ctx, validateSingleId));

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CWpYwZ4R.cjs";
 import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
-import { AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
+import { AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdResolveOptions, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
 import { parseUrl } from "@uniqu/url";
@@ -185,6 +185,13 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
   protected applyMetaOverlay(meta: TMetaResponse): TMetaResponse | Promise<TMetaResponse>;
 }
 //#endregion
+//#region src/actions/id-validation.d.ts
+/** Duck-typed shape; matches `AtscriptDbReadable`'s public surface. */
+interface IdValidationSource {
+  readonly identifications: readonly TIdentification[];
+  readonly fieldDescriptors: readonly TDbFieldMeta[];
+}
+//#endregion
 //#region src/meta/field-capabilities.d.ts
 /**
  * Per-path HTTP capability of a DB readable — the single source that both the
@@ -352,6 +359,15 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   protected metaCacheKey(): unknown;
   /** Bound once: the visibility check ({@link hasField}) the gate hands to `capabilities.check`. */
   private readonly _exists;
+  /**
+   * Id-resolution options (since 0.1.134): `{ isFieldVisible: hasField }`
+   * when a subclass overrides {@link hasField}, else `undefined` (the default
+   * accepts every real path, so resolution stays unfiltered). A unique index
+   * over a hidden field is never an identification.
+   */
+  protected readonly _idOpts: TIdResolveOptions | undefined;
+  /** Narrowed id sources, one stable object per distinct visible-identification set. */
+  private readonly _idSources;
   private readonly _preferredIdSet;
   private readonly _overlayIsNoOp;
   /** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
@@ -367,6 +383,13 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    */
   private readonly _invertibleFields;
   constructor(app: Moost, readable?: AtscriptDbReadable<T>);
+  /**
+   * The identifications this request may address rows through (since
+   * 0.1.134): the readable's own, minus unique indexes over fields
+   * {@link hasField} hides. Used by `/one?…`, `DELETE /?…` and action `ids`.
+   * Stable per distinct outcome, so per-source caches keyed on it hit.
+   */
+  get idSource(): IdValidationSource;
   private _collectInvertibleFields;
   private _collectQuantityRefs;
   private _collectAnnotated;
@@ -378,7 +401,11 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * `$with` relation names and sub-query paths, and the `$search` fallback
    * fields. A path it rejects is answered exactly like a nonexistent one
    * (`Unknown field "x"` / `Unknown relation "x"`), so override it to hide
-   * fields per request (read scopes). The default accepts every real path
+   * fields per request (read scopes). Since 0.1.134 it also governs row
+   * identification — a unique index over a hidden field is not an
+   * identification for `/one/:id`, `/one?…`, `DELETE`, a PK-less `PATCH` or
+   * an action id (primary key and `preferredId` always are) — and the
+   * nested-object 400 hint lists visible leaves only. The default accepts every real path
    * (`isValidFieldPath`). `/meta` does NOT consult it — prune hidden fields
    * there with `applyMetaOverlay`. Native text search and vector search
    * (`$vector` names an index) run inside the engine over its indexes, out of
@@ -453,6 +480,14 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private widenPreferredIdProjection;
   private _widenArrayProjection;
   private _widenMapProjection;
+  /**
+   * The logical paths an exclusion keeps. A path goes when it, an ancestor
+   * or a descendant is excluded: excluding an object parent excludes its
+   * whole subtree, and a kept parent would carry an excluded child back
+   * (its other leaves stay listed on their own). Before 0.1.134 only the
+   * exact paths were dropped, so `$select=-a` still returned `a`'s leaves.
+   */
+  private _invertExclusion;
   /**
    * Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
    * / `@db.unit.ref` quantity is selected — UI must never get a value without
@@ -523,7 +558,12 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * family (count vs no-count).
    */
   private _runReadWithActions;
-  /** Pick the first identification (PK or unique index) whose fields are all present in the query. */
+  /**
+   * Pick the first identification (PK or unique index) whose fields are all
+   * present in the query. A unique index over a field {@link hasField} hides
+   * is not a candidate (since 0.1.134) — `?hidden=x` answers exactly like
+   * `?nope=x`, so it cannot probe whether a row with that value exists.
+   */
   protected extractIdShape(query: Record<string, string>): Record<string, unknown> | HttpError;
   /**
    * **GET /query** — returns an array of records or a count.
@@ -664,14 +704,17 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
    * several table operations.
    */
   protected withTransaction<R>(fn: () => Promise<R>): Promise<R>;
+  /** The table write call's trailing options — see {@link _hookArgs}. */
+  private readonly _writeArgs;
+  /** `deleteOne`'s trailing options — see {@link _hookArgs}. */
+  private readonly _removeArgs;
   /**
-   * The table write call's trailing options: `[{ guard }]` only when
-   * `guardWrite` is overridden, else nothing (the table is called exactly as
-   * an unmodified controller always called it).
+   * A table call's trailing options, built once: `guard` only when the guard
+   * hook is overridden, `isFieldVisible` only when `hasField` is (an id or a
+   * PK-less payload never resolves through a hidden unique key) — else
+   * nothing, so an unmodified controller calls the table exactly as before.
    */
-  private _writeArgs;
-  /** `deleteOne`'s trailing options: `[{ guard }]` only when `guardRemove` is overridden. */
-  private _removeArgs;
+  private _hookArgs;
   /** Resolves a hook result: `undefined` aborts with `abortMessage`, an `Error` is thrown, anything else passes. */
   private _checkHook;
   /** Runs `onWrite` and re-applies the shape gate to its output (a non-object is a 500 "Not saved"). */
@@ -1528,13 +1571,6 @@ declare function getControllerFormType(ctor: Function, name: string): TAtscriptA
 /** Discover actions on a controller, memoized per ctor. `info`-only callers map `e => e.info`. */
 declare function discoverActions(controllerCtor: Function, app: Moost, logger: TConsoleBase): TDbActionEnvelope[];
 //#endregion
-//#region src/actions/id-validation.d.ts
-/** Duck-typed shape; matches `AtscriptDbReadable`'s public surface. */
-interface IdValidationSource {
-  readonly identifications: readonly TIdentification[];
-  readonly fieldDescriptors: readonly TDbFieldMeta[];
-}
-//#endregion
 //#region src/actions/id-cache.d.ts
 declare const useDbActionId: import("@wooksjs/event-core").WookComposable<{
   load: () => Promise<Record<string, unknown>>;

package/dist/index.d.mts

@@ -3,7 +3,7 @@ import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializ
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
 import { parseUrl } from "@uniqu/url";
-import { AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
+import { AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdResolveOptions, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
 //#region src/as-readable.controller.d.ts
 /**
  * Abstract base class for read-only HTTP controllers over an Atscript interface.
@@ -185,6 +185,13 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
   protected applyMetaOverlay(meta: TMetaResponse): TMetaResponse | Promise<TMetaResponse>;
 }
 //#endregion
+//#region src/actions/id-validation.d.ts
+/** Duck-typed shape; matches `AtscriptDbReadable`'s public surface. */
+interface IdValidationSource {
+  readonly identifications: readonly TIdentification[];
+  readonly fieldDescriptors: readonly TDbFieldMeta[];
+}
+//#endregion
 //#region src/meta/field-capabilities.d.ts
 /**
  * Per-path HTTP capability of a DB readable — the single source that both the
@@ -352,6 +359,15 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   protected metaCacheKey(): unknown;
   /** Bound once: the visibility check ({@link hasField}) the gate hands to `capabilities.check`. */
   private readonly _exists;
+  /**
+   * Id-resolution options (since 0.1.134): `{ isFieldVisible: hasField }`
+   * when a subclass overrides {@link hasField}, else `undefined` (the default
+   * accepts every real path, so resolution stays unfiltered). A unique index
+   * over a hidden field is never an identification.
+   */
+  protected readonly _idOpts: TIdResolveOptions | undefined;
+  /** Narrowed id sources, one stable object per distinct visible-identification set. */
+  private readonly _idSources;
   private readonly _preferredIdSet;
   private readonly _overlayIsNoOp;
   /** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
@@ -367,6 +383,13 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    */
   private readonly _invertibleFields;
   constructor(app: Moost, readable?: AtscriptDbReadable<T>);
+  /**
+   * The identifications this request may address rows through (since
+   * 0.1.134): the readable's own, minus unique indexes over fields
+   * {@link hasField} hides. Used by `/one?…`, `DELETE /?…` and action `ids`.
+   * Stable per distinct outcome, so per-source caches keyed on it hit.
+   */
+  get idSource(): IdValidationSource;
   private _collectInvertibleFields;
   private _collectQuantityRefs;
   private _collectAnnotated;
@@ -378,7 +401,11 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * `$with` relation names and sub-query paths, and the `$search` fallback
    * fields. A path it rejects is answered exactly like a nonexistent one
    * (`Unknown field "x"` / `Unknown relation "x"`), so override it to hide
-   * fields per request (read scopes). The default accepts every real path
+   * fields per request (read scopes). Since 0.1.134 it also governs row
+   * identification — a unique index over a hidden field is not an
+   * identification for `/one/:id`, `/one?…`, `DELETE`, a PK-less `PATCH` or
+   * an action id (primary key and `preferredId` always are) — and the
+   * nested-object 400 hint lists visible leaves only. The default accepts every real path
    * (`isValidFieldPath`). `/meta` does NOT consult it — prune hidden fields
    * there with `applyMetaOverlay`. Native text search and vector search
    * (`$vector` names an index) run inside the engine over its indexes, out of
@@ -453,6 +480,14 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private widenPreferredIdProjection;
   private _widenArrayProjection;
   private _widenMapProjection;
+  /**
+   * The logical paths an exclusion keeps. A path goes when it, an ancestor
+   * or a descendant is excluded: excluding an object parent excludes its
+   * whole subtree, and a kept parent would carry an excluded child back
+   * (its other leaves stay listed on their own). Before 0.1.134 only the
+   * exact paths were dropped, so `$select=-a` still returned `a`'s leaves.
+   */
+  private _invertExclusion;
   /**
    * Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
    * / `@db.unit.ref` quantity is selected — UI must never get a value without
@@ -523,7 +558,12 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * family (count vs no-count).
    */
   private _runReadWithActions;
-  /** Pick the first identification (PK or unique index) whose fields are all present in the query. */
+  /**
+   * Pick the first identification (PK or unique index) whose fields are all
+   * present in the query. A unique index over a field {@link hasField} hides
+   * is not a candidate (since 0.1.134) — `?hidden=x` answers exactly like
+   * `?nope=x`, so it cannot probe whether a row with that value exists.
+   */
   protected extractIdShape(query: Record<string, string>): Record<string, unknown> | HttpError;
   /**
    * **GET /query** — returns an array of records or a count.
@@ -664,14 +704,17 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
    * several table operations.
    */
   protected withTransaction<R>(fn: () => Promise<R>): Promise<R>;
+  /** The table write call's trailing options — see {@link _hookArgs}. */
+  private readonly _writeArgs;
+  /** `deleteOne`'s trailing options — see {@link _hookArgs}. */
+  private readonly _removeArgs;
   /**
-   * The table write call's trailing options: `[{ guard }]` only when
-   * `guardWrite` is overridden, else nothing (the table is called exactly as
-   * an unmodified controller always called it).
+   * A table call's trailing options, built once: `guard` only when the guard
+   * hook is overridden, `isFieldVisible` only when `hasField` is (an id or a
+   * PK-less payload never resolves through a hidden unique key) — else
+   * nothing, so an unmodified controller calls the table exactly as before.
    */
-  private _writeArgs;
-  /** `deleteOne`'s trailing options: `[{ guard }]` only when `guardRemove` is overridden. */
-  private _removeArgs;
+  private _hookArgs;
   /** Resolves a hook result: `undefined` aborts with `abortMessage`, an `Error` is thrown, anything else passes. */
   private _checkHook;
   /** Runs `onWrite` and re-applies the shape gate to its output (a non-object is a 500 "Not saved"). */
@@ -1528,13 +1571,6 @@ declare function getControllerFormType(ctor: Function, name: string): TAtscriptA
 /** Discover actions on a controller, memoized per ctor. `info`-only callers map `e => e.info`. */
 declare function discoverActions(controllerCtor: Function, app: Moost, logger: TConsoleBase): TDbActionEnvelope[];
 //#endregion
-//#region src/actions/id-validation.d.ts
-/** Duck-typed shape; matches `AtscriptDbReadable`'s public surface. */
-interface IdValidationSource {
-  readonly identifications: readonly TIdentification[];
-  readonly fieldDescriptors: readonly TDbFieldMeta[];
-}
-//#endregion
 //#region src/actions/id-cache.d.ts
 declare const useDbActionId: import("@wooksjs/event-core").WookComposable<{
   load: () => Promise<Record<string, unknown>>;

package/dist/index.mjs

@@ -1180,6 +1180,13 @@ const OP_VERB = {
 	aggregate: "aggregate over",
 	bucket: "bucket"
 };
+/** The one "nonexistent path" verdict — hidden paths answer with it byte for byte. */
+function unknownField(path) {
+	return {
+		path,
+		message: `Unknown field "${path}"`
+	};
+}
 function leafHint(leaves) {
 	if (leaves.length === 0) return "no leaf fields";
 	const shown = leaves.slice(0, 5).join(", ");
@@ -1379,10 +1386,7 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 	* occurrence); it only matters for `op === "filter"` on a listed leaf.
 	*/
 	check(path, op, exists, predicate = "compare") {
-		if (!exists(path)) return {
-			path,
-			message: `Unknown field "${path}"`
-		};
+		if (!exists(path)) return unknownField(path);
 		const { kind, parent } = classifyQueryPath(this, path);
 		if (kind === "nav") {
 			if (parent === void 0) return {
@@ -1423,12 +1427,16 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 			}
 		}
 		switch (kind) {
-			case "objectParent":
+			case "objectParent": {
 				if (op === "select") return void 0;
+				const all = this._objectParents.get(path);
+				const leaves = all.filter(exists);
+				if (leaves.length === 0 && all.length > 0) return unknownField(path);
 				return {
 					path,
-					message: `"${path}" is a nested object — filter or sort on one of its leaves (${leafHint(this._objectParents.get(path))})`
+					message: `"${path}" is a nested object — filter or sort on one of its leaves (${leafHint(leaves)})`
 				};
+			}
 			case "jsonDescendant": return {
 				path,
 				message: `"${path}" is inside JSON-stored column "${parent}" — this adapter cannot ${OP_VERB[op]} JSON paths; select "${parent}" and read the value client-side.`
@@ -1440,10 +1448,7 @@ var FieldCapabilityIndex = class FieldCapabilityIndex {
 				path,
 				message: `Cannot ${OP_VERB[op]} encrypted field "${path}"`
 			};
-			default: return {
-				path,
-				message: `Unknown field "${path}"`
-			};
+			default: return unknownField(path);
 		}
 	}
 };
@@ -1485,6 +1490,7 @@ const GEO_CONTROLS = [
 ];
 //#endregion
 //#region src/as-db-readable.controller.ts
+var _AsDbReadableController;
 /** Gate positions checked after the filter entries, in order; `refs[op]` are their paths. */
 const PATH_OPS = [
 	"sort",
@@ -1494,7 +1500,7 @@ const PATH_OPS = [
 	"aggregate",
 	"bucket"
 ];
-let AsDbReadableController = class AsDbReadableController extends AsReadableController {
+let AsDbReadableController = _AsDbReadableController = class AsDbReadableController extends AsReadableController {
 	/** Reference to the underlying readable (table or view). */
 	readable;
 	/**
@@ -1534,6 +1540,15 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	}
 	/** Bound once: the visibility check ({@link hasField}) the gate hands to `capabilities.check`. */
 	_exists = (path) => this.hasField(path);
+	/**
+	* Id-resolution options (since 0.1.134): `{ isFieldVisible: hasField }`
+	* when a subclass overrides {@link hasField}, else `undefined` (the default
+	* accepts every real path, so resolution stays unfiltered). A unique index
+	* over a hidden field is never an identification.
+	*/
+	_idOpts;
+	/** Narrowed id sources, one stable object per distinct visible-identification set. */
+	_idSources = /* @__PURE__ */ new Map();
 	_preferredIdSet;
 	_overlayIsNoOp;
 	/** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
@@ -1559,6 +1574,29 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		this._quantityRefByPath = this._collectQuantityRefs();
 		const defaultOverlay = AsReadableController.prototype.applyMetaOverlay;
 		this._overlayIsNoOp = this.applyMetaOverlay === defaultOverlay;
+		this._idOpts = this.hasField === _AsDbReadableController.prototype.hasField ? void 0 : { isFieldVisible: this._exists };
+	}
+	/**
+	* The identifications this request may address rows through (since
+	* 0.1.134): the readable's own, minus unique indexes over fields
+	* {@link hasField} hides. Used by `/one?…`, `DELETE /?…` and action `ids`.
+	* Stable per distinct outcome, so per-source caches keyed on it hit.
+	*/
+	get idSource() {
+		const opts = this._idOpts;
+		if (!opts) return this.readable;
+		const visible = this.readable.identificationsVisibleTo(opts.isFieldVisible);
+		if (visible.length === this.readable.identifications.length) return this.readable;
+		const key = visible.map((ident) => ident.source).join("");
+		let source = this._idSources.get(key);
+		if (!source) {
+			source = {
+				identifications: visible,
+				fieldDescriptors: this.readable.fieldDescriptors
+			};
+			this._idSources.set(key, source);
+		}
+		return source;
 	}
 	_collectInvertibleFields() {
 		const out = [];
@@ -1593,7 +1631,11 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	* `$with` relation names and sub-query paths, and the `$search` fallback
 	* fields. A path it rejects is answered exactly like a nonexistent one
 	* (`Unknown field "x"` / `Unknown relation "x"`), so override it to hide
-	* fields per request (read scopes). The default accepts every real path
+	* fields per request (read scopes). Since 0.1.134 it also governs row
+	* identification — a unique index over a hidden field is not an
+	* identification for `/one/:id`, `/one?…`, `DELETE`, a PK-less `PATCH` or
+	* an action id (primary key and `preferredId` always are) — and the
+	* nested-object 400 hint lists visible leaves only. The default accepts every real path
 	* (`isValidFieldPath`). `/meta` does NOT consult it — prune hidden fields
 	* there with `applyMetaOverlay`. Native text search and vector search
 	* (`$vector` names an index) run inside the engine over its indexes, out of
@@ -1767,11 +1809,26 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 			return widened;
 		}
 		const widened = {};
-		for (const path of this._invertibleFields) if (!excluded.has(path)) widened[path] = 1;
+		for (const path of this._invertExclusion(excluded)) widened[path] = 1;
 		for (const field of this._preferredIdSet) widened[field] = 1;
 		return widened;
 	}
 	/**
+	* The logical paths an exclusion keeps. A path goes when it, an ancestor
+	* or a descendant is excluded: excluding an object parent excludes its
+	* whole subtree, and a kept parent would carry an excluded child back
+	* (its other leaves stay listed on their own). Before 0.1.134 only the
+	* exact paths were dropped, so `$select=-a` still returned `a`'s leaves.
+	*/
+	_invertExclusion(excluded) {
+		return this._invertibleFields.filter((path) => {
+			if (excluded.has(path) || findAncestorInSet(path, excluded) !== void 0) return false;
+			const prefix = `${path}.`;
+			for (const key of excluded) if (key.startsWith(prefix)) return false;
+			return true;
+		});
+	}
+	/**
 	* Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
 	* / `@db.unit.ref` quantity is selected — UI must never get a value without
 	* its dimension. No-op when `$select` is undefined (full row covers it).
@@ -1834,10 +1891,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		for (const [k, v] of Object.entries(obj)) if (v === 1 || v === true) included.push(k);
 		else if (v === 0 || v === false) excluded.push(k);
 		if (included.length > 0 && excluded.length === 0) return included;
-		if (excluded.length > 0 && included.length === 0) {
-			const excludedSet = new Set(excluded);
-			return this._invertibleFields.filter((path) => !excludedSet.has(path));
-		}
+		if (excluded.length > 0 && included.length === 0) return this._invertExclusion(new Set(excluded));
 		throw new HttpError(500, "[moost-db] mixed inclusion/exclusion projection reached augmenter; widenPreferredIdProjection should have rejected it");
 	}
 	/** WHY: filter row/rows envelopes by the per-request `applyMetaOverlay` action set; skip `meta()` when overlay is identity. */
@@ -2018,9 +2072,14 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		});
 		return result;
 	}
-	/** Pick the first identification (PK or unique index) whose fields are all present in the query. */
+	/**
+	* Pick the first identification (PK or unique index) whose fields are all
+	* present in the query. A unique index over a field {@link hasField} hides
+	* is not a candidate (since 0.1.134) — `?hidden=x` answers exactly like
+	* `?nope=x`, so it cannot probe whether a row with that value exists.
+	*/
 	extractIdShape(query) {
-		for (const id of this.readable.identifications) {
+		for (const id of this.idSource.identifications) {
 			const idObj = {};
 			let allPresent = true;
 			for (const field of id.fields) {
@@ -2257,7 +2316,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 			...parsedControls,
 			$select: initialSelect
 		};
-		const idFilter = this.readable.resolveIdFilter(id);
+		const idFilter = this.readable.resolveIdFilter(id, this._idOpts);
 		let row = null;
 		if (idFilter) {
 			const overlay = await this.transformOne({});
@@ -2380,7 +2439,7 @@ __decorate([
 	__decorateMetadata("design:paramtypes", [typeof Record === "undefined" ? Object : Record, String]),
 	__decorateMetadata("design:returntype", Promise)
 ], AsDbReadableController.prototype, "getOneComposite", null);
-AsDbReadableController = __decorate([
+AsDbReadableController = _AsDbReadableController = __decorate([
 	Inherit(),
 	__decorateParam(1, Inject(READABLE_DEF)),
 	__decorateParam(1, Optional()),
@@ -2412,6 +2471,9 @@ function hasWriteShape(data, many) {
 let AsDbController = _AsDbController = class AsDbController extends AsDbReadableController {
 	constructor(app, table) {
 		super(app, table);
+		const proto = _AsDbController.prototype;
+		this._writeArgs = this._hookArgs(this.guardWrite !== proto.guardWrite ? (ctx) => this.guardWrite(ctx) : void 0);
+		this._removeArgs = this._hookArgs(this.guardRemove !== proto.guardRemove ? (ctx) => this.guardRemove(ctx) : void 0);
 	}
 	buildCrud() {
 		return {
@@ -2479,19 +2541,20 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	withTransaction(fn) {
 		return this.table.getAdapter().withTransaction(fn);
 	}
+	/** The table write call's trailing options — see {@link _hookArgs}. */
+	_writeArgs;
+	/** `deleteOne`'s trailing options — see {@link _hookArgs}. */
+	_removeArgs;
 	/**
-	* The table write call's trailing options: `[{ guard }]` only when
-	* `guardWrite` is overridden, else nothing (the table is called exactly as
-	* an unmodified controller always called it).
+	* A table call's trailing options, built once: `guard` only when the guard
+	* hook is overridden, `isFieldVisible` only when `hasField` is (an id or a
+	* PK-less payload never resolves through a hidden unique key) — else
+	* nothing, so an unmodified controller calls the table exactly as before.
 	*/
-	_writeArgs() {
-		if (this.guardWrite === _AsDbController.prototype.guardWrite) return [];
-		return [{ guard: (ctx) => this.guardWrite(ctx) }];
-	}
-	/** `deleteOne`'s trailing options: `[{ guard }]` only when `guardRemove` is overridden. */
-	_removeArgs() {
-		if (this.guardRemove === _AsDbController.prototype.guardRemove) return [];
-		return [{ guard: (ctx) => this.guardRemove(ctx) }];
+	_hookArgs(guard) {
+		const opts = { ...this._idOpts };
+		if (guard) opts.guard = guard;
+		return Object.keys(opts).length > 0 ? [opts] : [];
 	}
 	/** Resolves a hook result: `undefined` aborts with `abortMessage`, an `Error` is thrown, anything else passes. */
 	async _checkHook(pending, abortMessage) {
@@ -2541,7 +2604,7 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	}
 	/** Deletes by id (guard forwarded when overridden) and maps "nothing deleted" to 404. */
 	async _deleteOrThrow(id) {
-		const result = await this.table.deleteOne(id, ...this._removeArgs());
+		const result = await this.table.deleteOne(id, ...this._removeArgs);
 		if (result.deletedCount < 1) throw new HttpError(404);
 		return result;
 	}
@@ -2552,10 +2615,10 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		assertWriteShape(payload);
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("insertMany", payload, true);
-			return this.table.insertMany(rows, ...this._writeArgs());
+			return this.table.insertMany(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("insert", payload, false);
-		return this.table.insertOne(row, ...this._writeArgs());
+		return this.table.insertOne(row, ...this._writeArgs);
 	}
 	/**
 	* **PUT /** — fully replaces one or many records matched by primary key.
@@ -2572,11 +2635,11 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("replaceMany", payload, true);
 			this._resolveBulkCas(rows, versionColumn);
-			return this.table.bulkReplace(rows, ...this._writeArgs());
+			return this.table.bulkReplace(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("replace", payload, false);
 		const hadCas = this._resolveCas(row, versionColumn);
-		const result = await this.table.replaceOne(row, ...this._writeArgs());
+		const result = await this.table.replaceOne(row, ...this._writeArgs);
 		if (hadCas && result.matchedCount === 0) throw await this._disambiguateMismatch(row, versionColumn);
 		return result;
 	}
@@ -2593,11 +2656,11 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 		if (Array.isArray(payload)) {
 			const rows = await this._writeBody("updateMany", payload, true);
 			this._resolveBulkCas(rows, versionColumn);
-			return this.table.bulkUpdate(rows, ...this._writeArgs());
+			return this.table.bulkUpdate(rows, ...this._writeArgs);
 		}
 		const row = await this._writeBody("update", payload, false);
 		const hadCas = this._resolveCas(row, versionColumn);
-		const result = await this.table.updateOne(row, ...this._writeArgs());
+		const result = await this.table.updateOne(row, ...this._writeArgs);
 		if (hadCas && result.matchedCount === 0) throw await this._disambiguateMismatch(row, versionColumn);
 		return result;
 	}
@@ -2608,7 +2671,7 @@ let AsDbController = _AsDbController = class AsDbController extends AsDbReadable
 	* but the supplied version is stale (§6.3). Callers throw the result.
 	*/
 	async _disambiguateMismatch(data, versionColumn) {
-		const filter = this.table.resolveIdFilter(data);
+		const filter = this.table.resolveIdFilter(data, this._idOpts);
 		const row = filter ? await this.table.findOne({
 			filter,
 			controls: {}
@@ -3157,8 +3220,11 @@ function isPlainObject$1(value) {
 //#endregion
 //#region src/actions/id-cache.ts
 const boundTableKey = key("atscript_db_action_bound_table");
+function controllerOf(ctx) {
+	return useControllerContext(ctx).getController();
+}
 function controllerTable(ctx) {
-	const ctrl = useControllerContext(ctx).getController();
+	const ctrl = controllerOf(ctx);
 	return ctrl?.readable ?? ctrl?.table ?? null;
 }
 function getActionTable(ctx) {
@@ -3179,11 +3245,22 @@ function noTableError(ctx) {
 		code: "ACTION_TABLE_NOT_BOUND"
 	});
 }
+/**
+* Validates the body's `ids` against the action table's identifications. For
+* the controller's own table that is its `idSource` (since 0.1.134): a unique
+* index over a field `hasField` hides neither addresses a row nor appears in
+* the "must exactly match one of" message. An `opts.table` binding has no
+* visibility hook.
+*/
 async function resolveValidatedId(ctx, validate) {
-	const table = getActionTable(ctx);
-	if (!isIdValidationSource(table)) throw noTableError(ctx);
+	let source = ctx.has(boundTableKey) ? ctx.get(boundTableKey) : void 0;
+	if (!source) {
+		const ctrl = controllerOf(ctx);
+		source = ctrl?.idSource ?? ctrl?.readable ?? ctrl?.table ?? null;
+	}
+	if (!isIdValidationSource(source)) throw noTableError(ctx);
 	const env = await ctx.get(dbActionBodySlot);
-	validate(env.ids, table);
+	validate(env.ids, source);
 	return env.ids;
 }
 const dbActionIdSlot = cached((ctx) => resolveValidatedId(ctx, validateSingleId));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/moost-db",
-  "version": "0.1.133",
+  "version": "0.1.134",
   "description": "Generic database controller for Moost with Atscript.",
   "keywords": [
     "annotations",
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "@uniqu/url": "^0.1.10",
-    "@atscript/db-memory": "^0.1.133"
+    "@atscript/db-memory": "^0.1.134"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.92",
@@ -64,7 +64,7 @@
     "@wooksjs/event-core": "^0.7.23",
     "@wooksjs/http-body": "^0.7.23",
     "moost": "^0.6.37",
-    "@atscript/db": "^0.1.133"
+    "@atscript/db": "^0.1.134"
   },
   "scripts": {
     "postinstall": "asc -f dts",