@atscript/moost-db 0.1.142 → 0.1.143

package/dist/index.d.cts

@@ -1,10 +1,54 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CWpYwZ4R.cjs";
 import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
-import { AggregateFn, AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdResolveOptions, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
+import { AggregateFn, AtscriptDbReadable, AtscriptDbTable, BucketUnit, FilterExpr, FlatOf, TCrudOp, TCrudOp as TCrudOp$1, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TDbRemoveGuardContext, TDbRemoveGuardContext as TDbRemoveGuardContext$1, TDbWriteAction, TDbWriteAction as TDbWriteAction$1, TDbWriteCheckContext, TDbWriteCheckContext as TDbWriteCheckContext$1, TDbWriteGuardContext, TDbWriteGuardContext as TDbWriteGuardContext$1, TFilterPredicate, TIdResolveOptions, TIdentification, TMetaResponse, TQueryPathOp, TQueryPathOp as TQueryPathOp$1, TQueryPathRefs, TQueryPathSource, Uniquery, UniqueryControls, collectQueryPaths } from "@atscript/db";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
 import { parseUrl } from "@uniqu/url";
 //#region src/as-readable.controller.d.ts
+/**
+ * Endpoint a {@link AsReadableController.prepareRequest} call serves. `/one`
+ * and `/one/:id` both report `"one"`; `DELETE /:id` and `DELETE /?…` both
+ * report `"remove"`; value-help controllers report `query` / `pages` / `one`
+ * like DB readables do; every `@DbAction` handler (row, rows and table
+ * level) reports `"action"` with the action's name in
+ * {@link TDbRequestContext.action}.
+ *
+ * @since 0.1.143
+ */
+type TDbRequestEndpoint = "query" | "pages" | "geo" | "one" | "meta" | "metaForm" | "insert" | "replace" | "update" | "remove" | "action";
+/**
+ * Context passed to {@link AsReadableController.prepareRequest}.
+ *
+ * @since 0.1.143
+ */
+interface TDbRequestContext {
+  /** The endpoint being served. */
+  readonly endpoint: TDbRequestEndpoint;
+  /**
+   * The parsed Uniquery controls (`$select`, `$with`, `$search`, …) on read
+   * endpoints (`query`, `pages`, `geo`, `one`) — the object the rest of
+   * the pipeline validates and reads with. `undefined` on `meta`,
+   * `metaForm`, writes and actions.
+   */
+  readonly controls?: Record<string, unknown>;
+  /** `"action"` endpoint only: the `@DbAction` name being run. */
+  readonly action?: string;
+}
+/** Control DTO a {@link AsReadableController.validateControls} call checks against. @since 0.1.143 (`"geo"`) */
+type TDbControlsType = "query" | "pages" | "getOne" | "geo";
+/**
+ * A read request as {@link AsReadableController.parseRequest} hands it back.
+ *
+ * @since 0.1.143
+ */
+interface TDbParsedRequest {
+  /** The parsed URL (filter, controls, insights). */
+  parsed: ReturnType<typeof parseUrl>;
+  /** `parsed.controls` — the object `prepareRequest` saw and the pipeline validates. */
+  controls: Record<string, unknown>;
+  /** `"one"` only: the URL carried non-control (filter) parts, which `/one/:id` rejects. */
+  hasNonControl: boolean;
+}
 /**
  * Abstract base class for read-only HTTP controllers over an Atscript interface.
  *
@@ -93,12 +137,71 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
   private _queryControlsValidator?;
   private _pagesControlsValidator?;
   private _getOneControlsValidator?;
+  private _geoControlsValidator?;
   protected get queryControlsValidator(): Validator<any, unknown>;
   protected get pagesControlsValidator(): Validator<any, unknown>;
   protected get getOneControlsValidator(): Validator<any, unknown>;
-  protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
+  /** `/geo` controls validator (since 0.1.143 — `/geo` runs {@link validateParsed} like `/query`). */
+  protected get geoControlsValidator(): Validator<any, unknown>;
+  /**
+   * Per-request preparation hook — THE entry point for a permission layer to
+   * resolve per-request policy asynchronously (load the principal's scopes,
+   * evaluate grants) so the synchronous hooks that follow (`hasField`,
+   * `validateControls`, `checkCapabilities`) can consult it. Not
+   * implemented by default — defining it in a subclass switches it on (it is
+   * awaited only then, so unmodified controllers pay nothing).
+   *
+   * Runs once per request, before anything else consults the request:
+   * - read endpoints (`query`, `pages`, `geo`, `one`) — right after the
+   *   URL is parsed, BEFORE validation, `hasField`, `validateControls`,
+   *   `transformFilter` / `transformProjection`; `ctx.controls` are the
+   *   parsed controls (mutating them is allowed and is what the pipeline
+   *   then validates);
+   * - writes (`insert`, `replace`, `update`, `remove`) — at handler start,
+   *   before the shape gate, `onWrite` / `onRemove` and any guard;
+   * - `meta` / `metaForm` — first;
+   * - `@DbAction` handlers of every level (`action`, with `ctx.action` = the
+   *   action name) — from the action's interceptor (after the guards),
+   *   before its ids are validated, its rows loaded, its row overlay built
+   *   and the handler runs. A permission layer needs no separate action
+   *   guard.
+   *
+   * A throw aborts the request with the thrown error (throw an `HttpError`
+   * for a specific status). Value-help controllers get it too.
+   *
+   * ```ts
+   * protected async prepareRequest(ctx: TDbRequestContext) {
+   *   const scopes = await loadScopes(useAuthorization(), ctx.endpoint)
+   *   if (!scopes) throw new HttpError(403)
+   *   requestScopes.set(scopes) // read back by hasField / transformFilter
+   * }
+   * ```
+   *
+   * @since 0.1.143
+   */
+  protected prepareRequest?(ctx: TDbRequestContext): void | Promise<void>;
+  /**
+   * The ONE request entry of every built-in route: with a `url` (read
+   * endpoints) it parses the query string — `/one` keeps only the `$`
+   * controls ({@link parseControlsOnlyFromUrl}), every other endpoint the
+   * whole query ({@link parseQueryString}) — and coerces boolean controls the
+   * URL grammar leaves as strings (`$actions=true`); then it awaits
+   * {@link prepareRequest} (when implemented) with the parsed controls.
+   * Without a `url` (writes, `meta`, `metaForm`) only the hook runs. Custom
+   * routes on a subclass should call it too.
+   *
+   * @since 0.1.143
+   */
+  protected parseRequest(endpoint: TDbRequestEndpoint): Promise<undefined>;
+  protected parseRequest(endpoint: TDbRequestEndpoint, url: string): Promise<TDbParsedRequest>;
+  /**
+   * Validates the parsed controls against the endpoint's DTO — the hook for
+   * per-control authorization (override, call `super`, add rules). `"geo"`
+   * since 0.1.143 (`/geo` used to skip it).
+   */
+  protected validateControls(controls: Record<string, unknown>, type: TDbControlsType): string | undefined;
   protected validateInsights(insights: Map<string, unknown>): string | undefined;
-  protected validateParsed(parsed: Uniquery, type: "query" | "pages" | "getOne"): HttpError | undefined;
+  protected validateParsed(parsed: Uniquery, type: TDbControlsType): HttpError | undefined;
   /**
    * Per-request gate hook, invoked by the DB readable controller right after
    * its capability gate (`checkCapabilities`) with the parsed query. The
@@ -143,6 +246,16 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
    * response by principal.
    */
   meta(): Promise<TMetaResponse>;
+  /**
+   * The `/meta` payload for the current request — the cached envelope
+   * through {@link applyMetaOverlay} — WITHOUT the `/meta` route's
+   * {@link prepareRequest} call. Internal consumers (e.g. `$actions`
+   * filtering on a read) use this, so the hook runs once per request with
+   * the endpoint actually being served.
+   *
+   * @since 0.1.143
+   */
+  protected resolveMeta(): TMetaResponse | Promise<TMetaResponse>;
   /**
    * Identity of the inputs the cached `/meta` envelope is built from — a new
    * value rebuilds it. Default: constant (built once). The DB readable
@@ -156,9 +269,20 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
    * compiled `.as` class's `.name`, registered when an action's parameter is
    * decorated with `@InputForm(FormType)`. Schemas are serialized once and
    * cached per controller; the response uses the same annotation-allowlist
-   * policy as {@link getSerializeOptions}.
+   * policy as {@link getSerializeOptions}. Since 0.1.143 the form must pass
+   * {@link authorizeForm} — a refused form answers exactly like an unknown one.
    */
   metaForm(name: string): Promise<TSerializedAnnotatedType>;
+  /**
+   * Per-request gate for `GET /meta/form/:name`: return `false` to refuse the
+   * form — the response is then the same 404 an unknown form gets, so a
+   * refused form's existence does not leak. `actionNames` are the discovered
+   * actions whose input form is `name` (a permission layer typically allows
+   * the form iff the caller may run at least one of them). Default: `true`.
+   *
+   * @since 0.1.143
+   */
+  protected authorizeForm(_name: string, _actionNames: readonly string[]): boolean | Promise<boolean>;
   /**
    * Builds the `/meta` payload. Override in subclasses to populate source-specific
    * fields. Subclasses that fully replace the envelope must call
@@ -350,6 +474,48 @@ interface TDbDecorateContext {
   /** The request's parsed controls (`$select`, `$with`, `$actions`, …). Read-only by convention. */
   controls: Record<string, unknown>;
 }
+/**
+ * One text / vector / geo index of the bound readable with the LOGICAL field
+ * paths it reads — see {@link AsDbReadableController.indexFieldPaths}.
+ *
+ * @since 0.1.143
+ */
+interface TDbIndexFieldPaths {
+  /** The name a request addresses the index by (`$index` for text and geo, `$vector` for vector). */
+  name: string;
+  type: "text" | "vector" | "geo";
+  /**
+   * Logical field paths the index reads. An index whose coverage cannot be
+   * derived from the model (e.g. a dynamic document-search mapping) lists
+   * every field — fail-closed for visibility gating.
+   */
+  fields: readonly string[];
+  /** `true` for the index a request of this type uses when it names none. */
+  isDefault: boolean;
+}
+/**
+ * The field visibility of a DB readable controller — see
+ * {@link AsDbReadableController.fieldVisibility}.
+ *
+ * @since 0.1.143
+ */
+interface TDbFieldVisibility {
+  /** `true` when `hasField` is overridden (visibility is request-scoped); else every real path is visible. */
+  readonly scoped: boolean;
+  /**
+   * `hasField(path)` and — when {@link scoped} — a `@db.column.derived`
+   * field of the bound readable only while its source path is visible too
+   * (a derived copy must not outlive a hidden source).
+   */
+  readonly isVisible: (path: string) => boolean;
+  /**
+   * The paths sealed out of `readable`'s read projection for this request:
+   * its `@db.writeOnly` fields plus, when {@link scoped}, its derived fields
+   * whose source `hasField` hides. `prefix` is `readable`'s path from the
+   * controller: `""` for the bound readable, `"rel."` for a `$with` target.
+   */
+  readonly sealedFor: (readable: AtscriptDbReadable<any>, prefix?: string) => ReadonlySet<string>;
+}
 /**
  * Read-only database controller for Moost that works with any `AtscriptDbReadable`
  * (tables or views). Provides query, pages, getOne, and meta endpoints.
@@ -385,13 +551,31 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private _capabilities?;
   /** `/meta` is a projection of {@link capabilities}: a rebuilt index rebuilds the cached envelope. */
   protected metaCacheKey(): unknown;
-  /** Bound once: the visibility check ({@link hasField}) the gate hands to `capabilities.check`. */
-  private readonly _exists;
   /**
-   * Id-resolution options (since 0.1.134): `{ isFieldVisible: hasField }`
-   * when a subclass overrides {@link hasField}, else `undefined` (the default
-   * accepts every real path, so resolution stays unfiltered). A unique index
-   * over a hidden field is never an identification.
+   * THE field-visibility answer (since 0.1.143) every read surface consults:
+   * the capability gate, the index gate and `$search` fallback, id
+   * resolution, the `@db.writeOnly` / derived seals of the projection and of
+   * every `$with` level, `$actions` widening and action `requiredFields`
+   * (the actions module reaches it duck-typed, like {@link idSource}).
+   */
+  protected readonly fieldVisibility: TDbFieldVisibility;
+  /** A subclass overrides {@link hasField}: visibility is request-scoped (derived rule, index gate, id options). */
+  private readonly _hasFieldOverridden;
+  /** `@db.column.derived` path → its source's logical path, per readable (bound + `$with` targets). */
+  private readonly _derivedSources;
+  /** The bound readable's entry of {@link _derivedSources}. */
+  private readonly _derivedSource;
+  /** `@db.writeOnly` paths of `$with` target readables, collected once per target. */
+  private readonly _targetWriteOnly;
+  private _indexFieldPathsCache?;
+  /** {@link _nativeSearch} per request, keyed by the request's parsed controls. */
+  private readonly _nativeSearchByRequest;
+  /**
+   * Id-resolution options (since 0.1.134): `{ isFieldVisible }` (the
+   * {@link fieldVisibility} check) when a subclass overrides {@link hasField},
+   * else `undefined` (the default accepts every real path, so resolution
+   * stays unfiltered). A unique index over a hidden field is never an
+   * identification.
    */
   protected readonly _idOpts: TIdResolveOptions | undefined;
   /** Narrowed id sources, one stable object per distinct visible-identification set. */
@@ -400,6 +584,8 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private readonly _overlayIsNoOp;
   /** `true` when a subclass implements {@link decorateRows} (the override switches the hook on). */
   private readonly _decorates;
+  /** `true` when a subclass overrides {@link transformOne} or {@link transformFilter} (a row overlay may exist). */
+  private readonly _hasRowOverlay;
   /** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
   private readonly _quantityRefByPath;
   /** `@db.column.searchable` paths — the `$search` fallback when the adapter has no native search. */
@@ -422,6 +608,8 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   get idSource(): IdValidationSource;
   private _collectInvertibleFields;
   private _collectQuantityRefs;
+  /** `readable`'s `@db.column.derived` path → source path map, collected once per readable. */
+  private _derivedSourcesOf;
   private _collectAnnotated;
   /**
    * THE field-visibility hook: every gated path consults it before any
@@ -437,9 +625,18 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * an action id (primary key and `preferredId` always are) — and the
    * nested-object 400 hint lists visible leaves only. The default accepts every real path
    * (`isValidFieldPath`). `/meta` does NOT consult it — prune hidden fields
-   * there with `applyMetaOverlay`. Native text search and vector search
-   * (`$vector` names an index) run inside the engine over its indexes, out of
-   * this hook's reach — keep hidden fields out of those indexes.
+   * there with `applyMetaOverlay` ({@link indexFieldPaths} names what each
+   * search / geo index reads).
+   *
+   * Since 0.1.143 an override also gates the engine's indexes: a native
+   * text-search index (`$index`, or the default one), a vector index
+   * (`$vector`) or a geo index (`/geo`, `$index`) reading a hidden path
+   * answers exactly like a nonexistent index (400); a hidden DEFAULT text
+   * index falls back to the `@db.column.searchable` substring search over
+   * visible fields (or ignores the term when there are none). A
+   * `@db.column.derived` field is visible only while its source path is,
+   * and one whose source is hidden is sealed out of every read projection
+   * for the request, like a `@db.writeOnly` field.
    */
   protected hasField(path: string): boolean;
   /**
@@ -457,7 +654,9 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * ran first); a bucket's source is checked like any other path (op
    * `bucket`). After the per-path checks the core `$having` rule runs
    * (`checkHavingKeys`: aliases or `$groupBy` fields only), so a readable mock
-   * and a real table answer alike.
+   * and a real table answer alike. Last (since 0.1.143, when {@link hasField}
+   * is overridden) the index gate: a text / vector / geo index the request
+   * uses must read only visible paths — see {@link indexFieldPaths}.
    */
   protected checkCapabilities(parsed: {
     filter?: FilterExpr;
@@ -482,8 +681,91 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * resolved against the target table through `isValidFieldPath`.
    */
   protected validateInsights(insights: Map<string, unknown>): string | undefined;
-  /** {@link checkComputedSelect} (before the controls DTO), then $with relations against the readable. */
-  protected validateParsed(parsed: Uniquery, type: "query" | "pages" | "getOne"): HttpError | undefined;
+  /**
+   * {@link checkComputedSelect} (before the controls DTO), the controls DTO
+   * ({@link validateControls}), then the `$with` relation names at every
+   * level — BEFORE the `$with` sub-query paths ({@link validateInsights}),
+   * so a hidden or nonexistent nested relation answers `Unknown relation`,
+   * never `Unknown field "rel.sub"` (since 0.1.143) — then the insights and
+   * the joined-row write-only veto.
+   */
+  protected validateParsed(parsed: Uniquery, type: TDbControlsType): HttpError | undefined;
+  /**
+   * `$with` relation names at every level (nested `$with` since 0.1.143):
+   * each segment of an entry's (dotted) name must be a relation of its
+   * level's readable that {@link hasField} accepts at its full path from
+   * this controller (`rel`, then `rel.sub` for a nested / dotted one) —
+   * hidden answers exactly like nonexistent: {@link unknownRelationError}
+   * with the entry's name and the relations visible at the level it failed
+   * at. A level whose target readable cannot be resolved is not descended.
+   */
+  private _checkWithRelations;
+  /**
+   * `@db.writeOnly` paths of a `$with` target — its own fields only (its
+   * navigation descendants are sealed one level down, by their own target).
+   */
+  private _writeOnlyOf;
+  /** {@link TDbFieldVisibility.sealedFor}. */
+  private _sealedFor;
+  /** The readable a `$with` entry name (`rel` or dotted `rel.sub`) loads from, if resolvable. */
+  private _relTarget;
+  /**
+   * Walks a `$with` tree pre-order: `visit(rel, target, path, controls)` for
+   * every entry whose target readable resolves (`path` = the entry's dotted
+   * path from this controller, `controls` = its sub-controls). The visitor
+   * returns replacement sub-controls, an `HttpError` to stop the walk (it is
+   * returned as-is), or `undefined` to keep the entry. Returns the rebuilt
+   * tree — the same array when nothing changed.
+   */
+  private _walkWith;
+  /**
+   * The read controls with every level sealed — the root `$select` (`select`,
+   * the {@link transformProjection} result) and each `$with` entry's
+   * `$select` lose the paths {@link TDbFieldVisibility.sealedFor} names for
+   * their readable (an exclusion is forced when there is no projection), so
+   * sealed values never leave the database. Runs AFTER `transformProjection`
+   * so permission overlays compose: they see the wire `$select`, this
+   * guarantees the seal on whatever they return.
+   */
+  private _sealControls;
+  /**
+   * The text / vector / geo indexes of the bound readable with the LOGICAL
+   * field paths each reads, and which one answers when a request names none.
+   * Text and vector entries are the adapter's `getSearchIndexes()` (the names
+   * `$index` / `$vector` address, their `fields` and `isDefault`; an entry
+   * without `fields` lists every field — fail-closed); geo entries are the
+   * `@db.index.geo` indexes. The request gate checks every listed path against
+   * {@link hasField} (only when `hasField` is overridden); permission
+   * overlays use it to prune `/meta` (`searchIndexes`, `searchable`,
+   * `vectorSearchable`, `geoSearchable`). Computed once. Override to describe
+   * an index the model cannot express.
+   *
+   * @since 0.1.143
+   */
+  protected indexFieldPaths(): readonly TDbIndexFieldPaths[];
+  private _searchIndexFieldPaths;
+  /** `@db.index.geo` indexes — their fields carry physical names, mapped back to logical paths. */
+  private _geoIndexFieldPaths;
+  /** Every path `entry` reads is visible to this request. */
+  private _indexVisible;
+  /**
+   * Native text search serves this request: the adapter searches natively
+   * and — under an overridden {@link hasField} — the default index (when the
+   * request names none) reads only visible fields. A named index is gated by
+   * {@link checkCapabilities}. Answered once per request (keyed by its
+   * parsed controls).
+   */
+  private _nativeSearch;
+  private _resolveNativeSearch;
+  /**
+   * Index visibility gate (only when {@link hasField} is overridden), run by
+   * {@link checkCapabilities} on every read: the geo index `/geo` reads
+   * (`$index`, or the default one), the vector index `$vector` names (or the
+   * default one) and the text index `$index` names must read only visible
+   * paths; otherwise the request is answered exactly like one naming a
+   * nonexistent index (the core's wording).
+   */
+  private _checkIndexGate;
   /**
    * Compute an embedding vector from a search term.
    * Override in subclass to integrate with your embedding provider (OpenAI, etc.).
@@ -526,13 +808,16 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private widenQuantityRefProjection;
   private _widenQuantityArrayProjection;
   private _widenQuantityMapProjection;
-  /** WHY: the URL parser only auto-coerces `$count`; every other boolean control reaches us as `"true"`/`"1"` and would fail DTO validation. */
-  private _coerceActionsControl;
   /** Normalize a post-`widenPreferredIdProjection` $select into `string[] | null` (`null` = all fields). */
   private _resolveProjectionForAugmenter;
   /** WHY: filter row/rows envelopes by the per-request `applyMetaOverlay` action set; skip `meta()` when overlay is identity. */
   private _resolveAugmentEnvelopes;
-  /** Returns a widened `$select` only when at least one `requiredFields` entry is missing; `null` means "no widening needed". */
+  /**
+   * Returns a widened `$select` only when at least one `requiredFields` entry
+   * is missing; `null` means "no widening needed". A field the request may
+   * not see (`hasField`, derived source) is never added (since 0.1.143) —
+   * the action predicate sees it as `undefined`.
+   */
   private _widenSelectForActions;
   private _prepareAugmentation;
   /**
@@ -543,20 +828,20 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    */
   private _collectSearchFallbackFields;
   /**
-   * Removes `@db.writeOnly` fields from any `$select` shape — and forces an
-   * exclusion when no projection was requested — so sealed values never leave
-   * the database on a read. Runs AFTER `transformProjection` so permission
-   * overlays compose (they see the wire `$select`; this guarantees the seal on
-   * whatever they return).
+   * `select` without the `sealed` paths (see {@link _sealControls}); an
+   * exclusion of them is forced when there is no projection, or when every
+   * requested path was sealed.
    */
-  private _sealProjection;
+  private _sealSelect;
   /** First `@db.writeOnly` field referenced by `$groupBy` / aggregate `$select`, or undefined. */
   private _findWriteOnlyInAggregate;
   /**
    * Merges the `$search` fallback into the filter: a case-insensitive literal
    * substring match OR'd across the `@db.column.searchable` fields, `$and`-combined
-   * with the existing filter. Applies only when the adapter has no native search
-   * (native wins) and the request isn't a vector search (`$vector` consumes the term).
+   * with the existing filter. Applies only when native search does not serve
+   * the request (no native search, or — since 0.1.143 — its default index
+   * reads a field {@link hasField} hides) and the request isn't a vector
+   * search (`$vector` consumes the term).
    */
   protected applySearchFallback(filter: FilterExpr | undefined, controls: Record<string, unknown>): FilterExpr | undefined;
   /**
@@ -622,6 +907,32 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * strategy to its read-method family (count vs no-count).
    */
   private _runReadWithActions;
+  /**
+   * The filter addressing exactly the ONE row `id` means — the readable's
+   * PK-first `resolveRowFilter` (since 0.1.143) under this request's
+   * identifications (`_idOpts`). `scope` (the row overlay) restricts which
+   * rows count while the id is pinned, so a row outside it never shadows one
+   * inside it. Readables without it (partial mocks) fall back to
+   * `resolveIdFilter`.
+   */
+  protected resolveRowFilter(id: unknown, scope?: FilterExpr): Promise<FilterExpr | null>;
+  /**
+   * The ONE row `id` addresses, read with `controls`. A hidden unique key is
+   * not an identification (since 0.1.134): the id resolves as if that index
+   * did not exist. Since 0.1.143 it resolves primary key first, counting
+   * only rows inside the overlay — an out-of-scope row never shadows an
+   * in-scope one, so the answer is the same as if it did not exist — in one
+   * step (`findOneByRow`). Readables without it (partial mocks) pin the row
+   * with {@link resolveRowFilter}, then read it.
+   */
+  private _findRow;
+  /**
+   * The row overlay id-addressed endpoints (`/one`, `DELETE`) apply:
+   * `transformOne({})` when non-empty, and only when a subclass overrides
+   * {@link transformOne} / {@link transformFilter} — `undefined` otherwise,
+   * at no cost (since 0.1.143).
+   */
+  protected rowOverlay(): Promise<FilterExpr | undefined>;
   /**
    * Pick the first identification (PK or unique index) whose fields are all
    * present in the query. A unique index over a field {@link hasField} hides
@@ -651,7 +962,9 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * (meters), `$index` (geo index name), plus the standard filter / `$select` /
    * `$with` / pagination syntax. Each row carries a computed `$distance`
    * (meters). With `$page` / `$size` the response is the `/pages` envelope;
-   * otherwise a plain row array (`$skip` / `$limit` compose).
+   * otherwise a plain row array (`$skip` / `$limit` compose). Since 0.1.143
+   * the controls pass {@link validateParsed} (type `"geo"`) like `/query`'s,
+   * and the geo index must read only fields {@link hasField} shows.
    */
   geo(url: string): Promise<DataType[] | {
     data: DataType[];
@@ -674,7 +987,12 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
    * gating as {@link getOne}.
    */
   getOneComposite(query: Record<string, string>, url: string): Promise<DataType | HttpError>;
-  private _findByIdAndAugment;
+  /**
+   * The shared `/one` pipeline: validation + capability gate (since 0.1.128
+   * on the composite form too — an unknown `$select` path used to reach the
+   * driver there), the sealed projection, the row read and its augmentation.
+   */
+  private _readOne;
   /**
    * **GET /meta** — returns table/view metadata for UI.
    *
@@ -702,15 +1020,18 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
  * ### Write pipeline (since 0.1.128)
  *
  * ```
- * shape gate (400) → onWrite / onRemove (outside any transaction)
+ * prepareRequest (when implemented) → shape gate (400)
+ *   → onWrite / onRemove (outside any transaction)
  *   → table op — the table's own transaction: validate → guardWrite / guardRemove
- *                (only when overridden) → re-validate → write
+ *                (only when overridden) → re-validate → write → nested phases
+ *                → checkWrite (only when overridden)
  *   → 404 / 409 disambiguation
  * ```
  *
  * The guard is the table's `guard` write option (`TWriteOptions.guard` /
  * `TDeleteOptions.guard`); overriding `guardWrite` / `guardRemove` is the
- * switch that passes it. Built-in failures are THROWN as `HttpError`
+ * switch that passes it. `checkWrite` is the `check` write option, with
+ * the same switch (since 0.1.143). Built-in failures are THROWN as `HttpError`
  * (wire-identical to returning them; a throw also rolls back a user-level
  * `withTransaction` wrapper).
  */
@@ -762,6 +1083,30 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
    * the guard.
    */
   protected guardRemove(_ctx: TDbRemoveGuardContext$1<DataType>): void | Promise<void>;
+  /**
+   * Post-write check (since 0.1.143) — a row-level "WITH CHECK". Overriding it
+   * is the switch (as with {@link guardWrite}): the override is passed to the
+   * table as its `check` write option and runs once per insert / replace /
+   * update call (bulk forms included), inside the table's transaction, AFTER
+   * the main write and every nested-relation phase. `ctx.filters` holds one
+   * exact primary-key filter per written row; `ctx.count(filter)` counts
+   * inside the same transaction — e.g. verify every written row still matches
+   * a policy filter:
+   *
+   * ```ts
+   * protected async checkWrite(ctx: TDbWriteCheckContext) {
+   *   const n = await ctx.count({ $and: [{ $or: ctx.filters }, tenantFilter()] })
+   *   if (n !== ctx.filters.length) throw new HttpError(403)
+   * }
+   * ```
+   *
+   * Throw to reject: the transaction rolls back and the error propagates
+   * unchanged. When `ctx.transactional` is `false` (the adapter's
+   * transaction is a pass-through, e.g. a standalone MongoDB) the write is
+   * already durable — validate before the write instead (`guardWrite`).
+   * Removes have no post-image and never call it.
+   */
+  protected checkWrite(_ctx: TDbWriteCheckContext$1): void | Promise<void>;
   /**
    * Runs `fn` inside the bound table's adapter transaction (nested calls
    * join it). For custom actions and routes that need one transaction across
@@ -773,10 +1118,11 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
   /** `deleteOne`'s trailing options — see {@link _hookArgs}. */
   private readonly _removeArgs;
   /**
-   * A table call's trailing options, built once: `guard` only when the guard
-   * hook is overridden, `isFieldVisible` only when `hasField` is (an id or a
-   * PK-less payload never resolves through a hidden unique key) — else
-   * nothing, so an unmodified controller calls the table exactly as before.
+   * A table call's trailing options, built once: `guard` / `check` only when
+   * the matching hook is overridden, `isFieldVisible` only when `hasField`
+   * is (an id or a PK-less payload never resolves through a hidden unique
+   * key) — else nothing, so an unmodified controller calls the table exactly
+   * as before.
    */
   private _hookArgs;
   /** Resolves a hook result: `undefined` aborts with `abortMessage`, an `Error` is thrown, anything else passes. */
@@ -802,7 +1148,13 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
    * application; callers can detect mismatches via `modifiedCount < N`.
    */
   private _resolveBulkCas;
-  /** Deletes by id (guard forwarded when overridden) and maps "nothing deleted" to 404. */
+  /**
+   * Deletes by id (guard forwarded when overridden) and maps "nothing
+   * deleted" to 404. Since 0.1.143 the row overlay ({@link rowOverlay}) is
+   * the delete's `scope`: the id is pinned among in-scope rows inside the
+   * table's transaction and an out-of-scope row is not deleted — a 404,
+   * exactly like a missing one.
+   */
   private _deleteOrThrow;
   /**
    * **POST /** — inserts one or many records.
@@ -831,6 +1183,12 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
    * returns 404 when the row is genuinely missing, 409 with
    * `{ error: "version_mismatch", currentVersion: N }` when it's present
    * but the supplied version is stale (§6.3). Callers throw the result.
+   *
+   * The row is the one the write targeted (since 0.1.143): the table's
+   * `recordFilter` — the write's own resolution, primary key first — so a
+   * payload carrying the full primary key addresses that row only, never a
+   * different row that merely shares a unique value with the payload.
+   * Tables without it (partial mocks) resolve through {@link resolveRowFilter}.
    */
   protected _disambiguateMismatch(data: unknown, versionColumn: string): Promise<HttpError>;
   /**
@@ -845,6 +1203,13 @@ declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotat
 }
 //#endregion
 //#region src/as-value-help.controller.d.ts
+/**
+ * A value-help projection: the parsed `$select` (inclusion list, or a
+ * `{ path: 0 | 1 }` map for the `-field` exclusion form).
+ *
+ * @since 0.1.143
+ */
+type ValueHelpSelect<T> = (keyof T | string)[] | Record<string, 0 | 1>;
 /**
  * Parsed Uniquery controls with the `$search` field carved out for value-help
  * use (the core DTO includes it but we narrow the type here so implementations
@@ -877,11 +1242,19 @@ interface ValueHelpQuery<T> {
  * one of their own (see {@link AsDbReadableController} for the
  * `@db.column.filterable` / `@db.column.sortable` pattern).
  *
- * **Actions are intentionally NOT supported on value-help controllers.** The
- * `/meta` payload still includes `actions: []` for shape uniformity, and any
- * `@DbAction*` / `@DbActions*` decorators applied here are silently ignored.
- * Value-help is for FK pickers and dictionary surfaces — adding row/table
- * actions there would muddy the contract.
+ * **Per-request scoping** (since 0.1.143) — the same three seams as the DB
+ * controllers, applied by the base routes to every value-help source:
+ * {@link transformFilter} (row overlay: `/query` / `/pages` filter, `/one`
+ * rows), {@link transformProjection} (returned columns) and {@link hasField}
+ * (a hidden field answers like an unknown one in filter / sort / select and
+ * never matches `$search`).
+ *
+ * **Actions are NOT supported on value-help controllers.** The `/meta`
+ * payload still includes `actions: []` for shape uniformity; since 0.1.143
+ * any `@DbAction` / `@DbActions*` on a value-help controller is a hard error
+ * (at decoration, or at construction for actions inherited from a base) —
+ * previously it was dropped from `/meta` while its `@Post` route still ran
+ * without any gate. Value-help is for FK pickers and dictionary surfaces.
  */
 declare abstract class AsValueHelpController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsReadableController<T, DataType> {
   /** Per-prop metadata map of the bound interface; eagerly built once. */
@@ -902,9 +1275,59 @@ declare abstract class AsValueHelpController<T extends TAtscriptAnnotatedType =
     data: DataType[];
     count: number;
   }>;
-  /** Returns the row whose primary key matches `id`, or `null` on miss. */
+  /**
+   * Returns the row whose primary key matches `id`, or `null` on miss. The
+   * `/one` routes then apply {@link transformFilter} (a row outside the
+   * overlay is a 404) and {@link transformProjection} to it in memory.
+   */
   protected abstract getOne(id: string | number): Promise<DataType | null>;
+  /**
+   * THE field-visibility hook: `true` when `path` is a field of the bound
+   * interface visible to this request. A path it rejects in the request's
+   * filter / `$sort` / `$select` gets the same `Unknown field "x"` 400 as a
+   * nonexistent one, and a hidden field never takes part in `$search`
+   * (`AsJsonValueHelpController`). Override to hide fields per request — it
+   * gates the request only; strip the column from responses with
+   * {@link transformProjection}.
+   */
   protected hasField(path: string): boolean;
+  /**
+   * Row overlay — the value-help counterpart of the DB controllers'
+   * `transformFilter`. Receives the request filter of `/query` / `/pages`
+   * and returns the one to run (AND your scope in: `{ $and: [filter, scope] }`).
+   * `/one` evaluates `transformFilter({})` against the found row in memory: a
+   * row outside it answers 404, exactly like a missing one. Default: identity.
+   * May be async.
+   *
+   * @since 0.1.143
+   */
+  protected transformFilter(filter: FilterExpr): FilterExpr | Promise<FilterExpr>;
+  /**
+   * Projection hook — receives the request `$select` (`undefined` when
+   * absent; `/one` always passes `undefined`) and returns the projection to
+   * apply: an inclusion list / `{ path: 1 }` map, or an exclusion
+   * `{ path: 0 }` map. Default: identity. May be async.
+   *
+   * @since 0.1.143
+   */
+  protected transformProjection(select: ValueHelpSelect<DataType> | undefined): ValueHelpSelect<DataType> | undefined | Promise<ValueHelpSelect<DataType> | undefined>;
+  /**
+   * Normalizes a value-help `$select` (the raw `parseUrl` form or a
+   * {@link transformProjection} result) to the `@atscript/db-memory`
+   * `{ path: 0 | 1 }` projection map:
+   * - `string[]` (e.g. from `?$select=a,b`) → inclusion map `{ a: 1, b: 1 }`,
+   * - a plain `{ path: 0 | 1 }` object → passed through (0 / falsy → exclude),
+   * - anything else / empty → `undefined` (no projection; whole rows returned).
+   */
+  protected normalizeSelect(select: unknown): Record<string, 0 | 1> | undefined;
+  /** `filter` through {@link transformFilter} and `controls.$select` through {@link transformProjection}. */
+  private _scopedQuery;
+  /**
+   * `getOne` + the row overlay (miss → 404) + the projection, applied in
+   * memory — `getOne` is the subclass's own lookup (id coercion included),
+   * so it is not re-expressed as a {@link query} filter.
+   */
+  private _scopedOne;
   /**
    * **GET /query** — returns an array of matched rows (up to `$limit`).
    */
@@ -964,8 +1387,8 @@ declare abstract class AsValueHelpController<T extends TAtscriptAnnotatedType =
  *   ties). Direction via `-` prefix on the field name or `{ [field]: 'asc' |
  *   'desc' | 1 | -1 }`.
  * - Search is case-insensitive substring matching across every field listed in
- *   {@link searchableFields}. This is value-help's own concern — the shared
- *   engine has no `$search`.
+ *   {@link searchableFields} that {@link hasField} keeps visible. This is
+ *   value-help's own concern — the shared engine has no `$search`.
  * - Projection (`$select`) supports inclusion (`[fields]` / `{ f: 1 }`) and
  *   exclusion (`{ f: 0 }`) with dot-path nesting; the primary key is NOT auto-
  *   added (a value-help projection returns exactly the selected fields).
@@ -999,14 +1422,6 @@ declare class AsJsonValueHelpController<T extends TAtscriptAnnotatedType = TAtsc
    * Returns `undefined` when nothing sortable was parsed (engine skips sorting).
    */
   private normalizeSort;
-  /**
-   * Normalizes the raw `parseUrl` `$select` form to the engine's `{ path: 0 |
-   * 1 }` projection map:
-   * - `string[]` (e.g. from `?$select=a,b`) → inclusion map `{ a: 1, b: 1 }`,
-   * - a plain `{ path: 0 | 1 }` object → passed through (0 / falsy → exclude),
-   * - anything else / empty → `undefined` (no projection; whole rows returned).
-   */
-  private normalizeSelect;
 }
 //#endregion
 //#region src/actions/types.d.ts
@@ -1090,6 +1505,14 @@ interface BaseActionOpts extends Partial<Omit<TDbActionInfo$1, "name" | "level"
    * `AsDbController`) — the bound table from the controller wins.
    */
   table?: AtscriptDbTable<any>;
+  /**
+   * `'rows'` level (`@DbActionIDs` / `@DbActionRows`): the most identifiers
+   * one request may carry. Above it the request is rejected with 400 before
+   * any row is loaded. Default `1000`. Server-internal — never on the wire.
+   *
+   * @since 0.1.143
+   */
+  maxIds?: number;
 }
 /**
  * Options accepted by `@DbAction(name, opts?)`. Generic over `TRow` (the
@@ -1479,6 +1902,16 @@ declare function errorEnvelope(statusCode: number, message: string, errors: THtt
  * message (defaults to `message`).
  */
 declare function badRequest(path: string, message: string, top?: string): HttpError;
+/**
+ * The 400 of a `$with` relation the request cannot reach — nonexistent, or
+ * hidden by `hasField` (the two answer alike): `Unknown relation "<name>"`,
+ * the envelope message listing `visible` (the relations the caller CAN
+ * load at that level). The single source of this wording — a permission
+ * layer that rejects a relation itself should throw this.
+ *
+ * @since 0.1.143
+ */
+declare function unknownRelationError(name: string, visible: readonly string[]): HttpError;
 //#endregion
 //#region src/validation-interceptor.d.ts
 declare const validationErrorTransform: () => import("moost").TInterceptorDef;
@@ -1487,10 +1920,16 @@ declare const UseValidationErrorTransform: () => ClassDecorator & MethodDecorato
 //#region src/actions/db-action.decorator.d.ts
 /**
  * Mark a controller method as a database action surfaced via `/meta`. Writes
- * `atscript_db_action` metadata and registers a Moost interceptor when needed
- * (gate when `disabled` is set, thin bound-table injector when only
- * `@DbActionRow*` is present). Stacking two `@DbAction` on the same method
- * is undefined and emits a warning.
+ * `atscript_db_action` metadata and, for every `'row'` / `'rows'` action,
+ * registers a Moost interceptor: the gate when `disabled` is set, else the
+ * bound-table injector that also verifies the ids against the controller's
+ * row overlay (since 0.1.143). Either first awaits the controller's
+ * `prepareRequest({ endpoint: "action", action })` when it defines one —
+ * before any id is validated or row loaded; a `'table'`-level action on an
+ * `AsReadableController` subclass gets an interceptor for that alone
+ * (since 0.1.143). Stacking two `@DbAction` on the same method
+ * is undefined and emits a warning. Throws on a value-help controller
+ * (since 0.1.143 — value-help controllers do not support actions).
  *
  * Generic over `TRow` (annotate at the call site: `@DbAction<Order>(...)`)
  * and `R` (the literal `requiredFields` tuple, inferred via `const R`).
@@ -1588,7 +2027,7 @@ declare function DbActionRows(): ParameterDecorator;
  * `disabled` predicate is type-narrowed by its own `requiredFields` literal.
  *
  * Multiple `@DbActions` (and shortcut) decorators on the same class
- * accumulate.
+ * accumulate. Throws on a value-help controller (since 0.1.143).
  */
 declare function DbActions<TRow = unknown, const D extends Record<string, unknown> = {}>(dict: D & ValidatedDict<TRow, D>): ClassDecorator;
 /** Sugar for `@DbActions` with `level: 'table'` injected into each entry. */
@@ -1784,6 +2223,26 @@ declare const QUERY_CONTROLS: readonly string[];
 declare const PAGES_CONTROLS: readonly string[];
 declare const ONE_CONTROLS: readonly string[];
 //#endregion
+//#region src/permissions/crud-handlers.d.ts
+/**
+ * The handler method(s) serving each CRUD op on `AsDbReadableController` /
+ * `AsDbController` — what a permission layer authorizes a `/meta` `crud`
+ * entry through (an op is allowed when ANY of its handlers is). `one` is
+ * served by `/one/:id` and `/one?…`, `remove` by `DELETE /:id` and
+ * `DELETE /?…`. Readables (no writes) serve only the read ops.
+ *
+ * @since 0.1.143
+ */
+declare const DB_CRUD_HANDLERS: Readonly<Record<TCrudOp$1, readonly string[]>>;
+/**
+ * The handler method(s) serving each CRUD op on the value-help controllers
+ * (`AsValueHelpController` / `AsJsonValueHelpController` — read ops only,
+ * no `geo`). Same contract as {@link DB_CRUD_HANDLERS}.
+ *
+ * @since 0.1.143
+ */
+declare const VALUE_HELP_CRUD_HANDLERS: Readonly<Partial<Record<TCrudOp$1, readonly string[]>>>;
+//#endregion
 //#region src/meta/terminal-ref.d.ts
 /**
  * Terminal-reference resolution for `/meta` and `/meta/form/:name`
@@ -1833,4 +2292,4 @@ declare function resolveTerminalRef(def: TAtscriptAnnotatedType): TTerminalRef |
  */
 declare function applyTerminalRefs(serialized: TSerializedAnnotatedType, runtime: TAtscriptAnnotatedType, options: TSerializeOptions): TSerializedAnnotatedType;
 //#endregion
-export { ActionDisabledError, type ActionDisabledErrorBody, AsDbController, AsDbReadableController, AsJsonValueHelpController, AsReadableController, AsValueHelpController, type AtscriptDbMate, type AtscriptDbMeta, type AtscriptDbParamsMeta, DEFAULT_DB_SPACE, DbAction, DbActionDefault, type DbActionEnvelope, DbActionID, DbActionIDs, type DbActionOpts, DbActionRow, DbActionRows, DbActions, DbRowActions, DbRowsActions, DbTableActions, FieldCapabilityIndex, type IdValidationSource, InputForm, ONE_CONTROLS, PAGES_CONTROLS, QUERY_CONTROLS, READABLE_DEF, ReadableController, TABLE_DEF, TAssertExposedOptions, type TCapabilityReadable, type TCapabilityVerdict, TControllerBindingOptions, type TCrudOp, type TCrudPermissions, type TDbActionDisabledVerdict, type TDbActionInfo, type TDbActionInputFormMeta, type TDbActionIntent, type TDbActionLevel, type TDbActionMeta, type TDbActionParamKind, type TDbActionProcessor, type TDbActionsEntry, type TDbActionsEntryUnpinned, type TDbClassActionMeta, TDbDecorateContext, TDbDecorateEndpoint, type TDbRemoveGuardContext, type TDbWriteAction, type TDbWriteGuardContext, type TFieldCapability, type THttpErrorEntry, type TQueryPathOp, type TQueryPathRefs, TReadableBinding, type TReadableBindingMeta, type TTerminalRef, TableController, UseValidationErrorTransform, ValueHelpQuery, ViewController, applyTerminalRefs, assertExposed, badRequest, clearDbSpaces, collectQueryPaths, dbActionBodySlot, dbActionInputSlot, discoverActions, errorEnvelope, findReadableBinding, getAtscriptDbMate, getControllerFormType, perRow, provideDbSpace, resolveBoundReadable, resolveDbSpace, resolveProp, resolveTerminalRef, useDbActionId, useDbActionIds, useDbActionInput, useDbActionRow, useDbActionRows, validationErrorTransform };
+export { ActionDisabledError, type ActionDisabledErrorBody, AsDbController, AsDbReadableController, AsJsonValueHelpController, AsReadableController, AsValueHelpController, type AtscriptDbMate, type AtscriptDbMeta, type AtscriptDbParamsMeta, DB_CRUD_HANDLERS, DEFAULT_DB_SPACE, DbAction, DbActionDefault, type DbActionEnvelope, DbActionID, DbActionIDs, type DbActionOpts, DbActionRow, DbActionRows, DbActions, DbRowActions, DbRowsActions, DbTableActions, FieldCapabilityIndex, type IdValidationSource, InputForm, ONE_CONTROLS, PAGES_CONTROLS, QUERY_CONTROLS, READABLE_DEF, ReadableController, TABLE_DEF, TAssertExposedOptions, type TCapabilityReadable, type TCapabilityVerdict, TControllerBindingOptions, type TCrudOp, type TCrudPermissions, type TDbActionDisabledVerdict, type TDbActionInfo, type TDbActionInputFormMeta, type TDbActionIntent, type TDbActionLevel, type TDbActionMeta, type TDbActionParamKind, type TDbActionProcessor, type TDbActionsEntry, type TDbActionsEntryUnpinned, type TDbClassActionMeta, TDbControlsType, TDbDecorateContext, TDbDecorateEndpoint, TDbFieldVisibility, TDbIndexFieldPaths, TDbParsedRequest, type TDbRemoveGuardContext, TDbRequestContext, TDbRequestEndpoint, type TDbWriteAction, type TDbWriteCheckContext, type TDbWriteGuardContext, type TFieldCapability, type THttpErrorEntry, type TQueryPathOp, type TQueryPathRefs, TReadableBinding, type TReadableBindingMeta, type TTerminalRef, TableController, UseValidationErrorTransform, VALUE_HELP_CRUD_HANDLERS, ValueHelpQuery, ValueHelpSelect, ViewController, applyTerminalRefs, assertExposed, badRequest, clearDbSpaces, collectQueryPaths, dbActionBodySlot, dbActionInputSlot, discoverActions, errorEnvelope, findReadableBinding, getAtscriptDbMate, getControllerFormType, perRow, provideDbSpace, resolveBoundReadable, resolveDbSpace, resolveProp, resolveTerminalRef, unknownRelationError, useDbActionId, useDbActionIds, useDbActionInput, useDbActionRow, useDbActionRows, validationErrorTransform };