@atscript/moost-db 0.1.62 → 0.1.64

package/dist/index.cjs

@@ -691,6 +691,42 @@ let AsReadableController = class AsReadableController {
 		const idx = url.indexOf("?");
 		return (0, _uniqu_url.parseUrl)(idx >= 0 ? url.slice(idx + 1) : "");
 	}
+	/**
+	* Parse a URL keeping only `$*` control keywords; report whether any
+	* non-control parts were present. Used by `/one` routes where the
+	* uniquery lexer cannot tokenise PK values containing `-` and other
+	* reserved chars, so non-control parts must be stripped before lexing.
+	* `/one/:id` rejects stray filter params with 400 via `hasNonControl`;
+	* `/one` (composite) ignores it because the composite-key params have
+	* already been extracted via `@Query()`.
+	*/
+	parseControlsOnlyFromUrl(url) {
+		const idx = url.indexOf("?");
+		const qs = idx >= 0 ? url.slice(idx + 1) : "";
+		if (!qs) return {
+			parsed: (0, _uniqu_url.parseUrl)(""),
+			hasNonControl: false
+		};
+		const kept = [];
+		let hasNonControl = false;
+		for (const part of qs.split("&")) {
+			if (!part) continue;
+			const eq = part.indexOf("=");
+			const rawKey = eq === -1 ? part : part.slice(0, eq);
+			let key;
+			try {
+				key = decodeURIComponent(rawKey);
+			} catch {
+				key = rawKey;
+			}
+			if (key.startsWith("$")) kept.push(part);
+			else hasNonControl = true;
+		}
+		return {
+			parsed: (0, _uniqu_url.parseUrl)(kept.join("&")),
+			hasNonControl
+		};
+	}
 	async returnOne(result) {
 		const item = await result;
 		if (!item) return new _moostjs_event_http.HttpError(404);
@@ -955,14 +991,27 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	_gates;
 	_preferredIdSet;
 	_overlayIsNoOp;
+	/** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
+	_quantityRefByPath;
 	constructor(readable, app) {
 		super(readable.type, readable.tableName, app, readable.isView ? "view" : "table");
 		this.readable = readable;
 		this._gates = this._buildGates();
 		this._preferredIdSet = new Set(readable.preferredId ?? []);
+		this._quantityRefByPath = this._collectQuantityRefs();
 		const defaultOverlay = AsReadableController.prototype.applyMetaOverlay;
 		this._overlayIsNoOp = this.applyMetaOverlay === defaultOverlay;
 	}
+	_collectQuantityRefs() {
+		const out = /* @__PURE__ */ new Map();
+		if (!this.readable.flatMap) return out;
+		for (const [path, entry] of this.readable.flatMap) {
+			const meta = entry?.metadata;
+			const ref = meta?.get("db.amount.currency.ref") ?? meta?.get("db.unit.ref");
+			if (ref) out.set(path, ref);
+		}
+		return out;
+	}
 	_buildGates() {
 		const meta = this.readable.type.metadata;
 		const gates = {};
@@ -1030,9 +1079,11 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		return projection;
 	}
 	widenPreferredIdProjection(projection) {
-		if (this._preferredIdSet.size === 0 || projection === void 0) return projection;
-		if (Array.isArray(projection)) return this._widenArrayProjection(projection);
-		return this._widenMapProjection(projection);
+		const widened = this.widenQuantityRefProjection(projection);
+		if (widened instanceof _moostjs_event_http.HttpError) return widened;
+		if (this._preferredIdSet.size === 0 || widened === void 0) return widened;
+		if (Array.isArray(widened)) return this._widenArrayProjection(widened);
+		return this._widenMapProjection(widened);
 	}
 	_widenArrayProjection(projection) {
 		const stringItems = /* @__PURE__ */ new Set();
@@ -1072,6 +1123,46 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		for (const field of this._preferredIdSet) widened[field] = 1;
 		return widened;
 	}
+	/**
+	* Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
+	* / `@db.unit.ref` quantity is selected — UI must never get a value without
+	* its dimension. No-op when `$select` is undefined (full row covers it).
+	*/
+	widenQuantityRefProjection(projection) {
+		if (this._quantityRefByPath.size === 0 || projection === void 0) return projection;
+		if (Array.isArray(projection)) return this._widenQuantityArrayProjection(projection);
+		return this._widenQuantityMapProjection(projection);
+	}
+	_widenQuantityArrayProjection(projection) {
+		const stringItems = /* @__PURE__ */ new Set();
+		for (const item of projection) if (typeof item === "string") stringItems.add(item);
+		const toAdd = [];
+		for (const [valuePath, refPath] of this._quantityRefByPath) if (stringItems.has(valuePath) && !stringItems.has(refPath)) {
+			toAdd.push(refPath);
+			stringItems.add(refPath);
+		}
+		if (toAdd.length === 0) return projection;
+		return [...projection, ...toAdd];
+	}
+	_widenQuantityMapProjection(projection) {
+		const entries = Object.entries(projection);
+		if (entries.length === 0) return projection;
+		const included = /* @__PURE__ */ new Set();
+		const excluded = /* @__PURE__ */ new Set();
+		for (const [k, v] of entries) if (v === 1 || v === true) included.add(k);
+		else if (v === 0 || v === false) excluded.add(k);
+		if (included.size > 0 && excluded.size > 0) return new _moostjs_event_http.HttpError(400, "Mixed inclusion/exclusion $select maps are not supported");
+		if (excluded.size === 0) {
+			const toAdd = [];
+			for (const [valuePath, refPath] of this._quantityRefByPath) if (included.has(valuePath) && !included.has(refPath)) toAdd.push(refPath);
+			if (toAdd.length === 0) return projection;
+			const widened = {};
+			for (const k of included) widened[k] = 1;
+			for (const k of toAdd) widened[k] = 1;
+			return widened;
+		}
+		return projection;
+	}
 	/** WHY: the URL parser only auto-coerces `$count`; every other boolean control reaches us as `"true"`/`"1"` and would fail DTO validation. */
 	_coerceActionsControl(controls) {
 		const v = controls.$actions;
@@ -1298,9 +1389,9 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	* **GET /one/:id** — retrieves a single record by ID or unique property.
 	*/
 	async getOne(id, url) {
-		const parsed = this.parseQueryString(url);
+		const { parsed, hasNonControl } = this.parseControlsOnlyFromUrl(url);
+		if (hasNonControl) return new _moostjs_event_http.HttpError(400, "Filtering is not allowed for \"one\" endpoint");
 		this._coerceActionsControl(parsed.controls);
-		if (Object.keys(parsed.filter).length > 0) return new _moostjs_event_http.HttpError(400, "Filtering is not allowed for \"one\" endpoint");
 		const error = this.validateParsed(parsed, "getOne");
 		if (error) return error;
 		const rawSelect = await this.transformProjection(parsed.controls.$select);
@@ -1315,7 +1406,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	async getOneComposite(query, url) {
 		const idObj = this.extractIdShape(query);
 		if (idObj instanceof _moostjs_event_http.HttpError) return idObj;
-		const parsed = this.parseQueryString(url);
+		const { parsed } = this.parseControlsOnlyFromUrl(url);
 		this._coerceActionsControl(parsed.controls);
 		const rawSelect = await this.transformProjection(parsed.controls.$select);
 		const select = this.widenPreferredIdProjection(rawSelect);

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import * as _uniqu_url0 from "@uniqu/url";
+import { parseUrl } from "@uniqu/url";
 import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, Validator } from "@atscript/typescript/utils";
 import { AtscriptDbReadable, AtscriptDbTable, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TIdentification, TMetaResponse, Uniquery, UniqueryControls } from "@atscript/db";
 import { HttpError } from "@moostjs/event-http";
@@ -106,6 +107,19 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
    */
   protected checkGates(filter: FilterExpr | undefined, controls: Record<string, unknown>, gates: ReadableGates): HttpError | undefined;
   protected parseQueryString(url: string): _uniqu_url0.UrlQuery;
+  /**
+   * Parse a URL keeping only `$*` control keywords; report whether any
+   * non-control parts were present. Used by `/one` routes where the
+   * uniquery lexer cannot tokenise PK values containing `-` and other
+   * reserved chars, so non-control parts must be stripped before lexing.
+   * `/one/:id` rejects stray filter params with 400 via `hasNonControl`;
+   * `/one` (composite) ignores it because the composite-key params have
+   * already been extracted via `@Query()`.
+   */
+  protected parseControlsOnlyFromUrl(url: string): {
+    parsed: ReturnType<typeof parseUrl>;
+    hasNonControl: boolean;
+  };
   protected returnOne(result: Promise<DataType | null>): Promise<DataType | HttpError>;
   /**
    * **GET /meta** — returns the bound interface's metadata envelope. The
@@ -166,7 +180,10 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private readonly _gates;
   private readonly _preferredIdSet;
   private readonly _overlayIsNoOp;
+  /** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
+  private readonly _quantityRefByPath;
   constructor(readable: AtscriptDbReadable<T>, app: Moost);
+  private _collectQuantityRefs;
   private _buildGates;
   private _collectAnnotated;
   protected hasField(path: string): boolean;
@@ -191,6 +208,14 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private widenPreferredIdProjection;
   private _widenArrayProjection;
   private _widenMapProjection;
+  /**
+   * Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
+   * / `@db.unit.ref` quantity is selected — UI must never get a value without
+   * its dimension. No-op when `$select` is undefined (full row covers it).
+   */
+  private widenQuantityRefProjection;
+  private _widenQuantityArrayProjection;
+  private _widenQuantityMapProjection;
   /** WHY: the URL parser only auto-coerces `$count`; every other boolean control reaches us as `"true"`/`"1"` and would fail DTO validation. */
   private _coerceActionsControl;
   /** Normalize a post-`widenPreferredIdProjection` $select into `string[] | null` (`null` = all fields). */

package/dist/index.d.mts

@@ -3,6 +3,7 @@ import { HttpError } from "@moostjs/event-http";
 import * as moost from "moost";
 import { Moost, TConsoleBase } from "moost";
 import * as _uniqu_url0 from "@uniqu/url";
+import { parseUrl } from "@uniqu/url";
 import { AtscriptDbReadable, AtscriptDbTable, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TIdentification, TMetaResponse, Uniquery, UniqueryControls } from "@atscript/db";
 import * as _wooksjs_event_core0 from "@wooksjs/event-core";
 
@@ -106,6 +107,19 @@ declare abstract class AsReadableController<T extends TAtscriptAnnotatedType = T
    */
   protected checkGates(filter: FilterExpr | undefined, controls: Record<string, unknown>, gates: ReadableGates): HttpError | undefined;
   protected parseQueryString(url: string): _uniqu_url0.UrlQuery;
+  /**
+   * Parse a URL keeping only `$*` control keywords; report whether any
+   * non-control parts were present. Used by `/one` routes where the
+   * uniquery lexer cannot tokenise PK values containing `-` and other
+   * reserved chars, so non-control parts must be stripped before lexing.
+   * `/one/:id` rejects stray filter params with 400 via `hasNonControl`;
+   * `/one` (composite) ignores it because the composite-key params have
+   * already been extracted via `@Query()`.
+   */
+  protected parseControlsOnlyFromUrl(url: string): {
+    parsed: ReturnType<typeof parseUrl>;
+    hasNonControl: boolean;
+  };
   protected returnOne(result: Promise<DataType | null>): Promise<DataType | HttpError>;
   /**
    * **GET /meta** — returns the bound interface's metadata envelope. The
@@ -166,7 +180,10 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private readonly _gates;
   private readonly _preferredIdSet;
   private readonly _overlayIsNoOp;
+  /** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
+  private readonly _quantityRefByPath;
   constructor(readable: AtscriptDbReadable<T>, app: Moost);
+  private _collectQuantityRefs;
   private _buildGates;
   private _collectAnnotated;
   protected hasField(path: string): boolean;
@@ -191,6 +208,14 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private widenPreferredIdProjection;
   private _widenArrayProjection;
   private _widenMapProjection;
+  /**
+   * Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
+   * / `@db.unit.ref` quantity is selected — UI must never get a value without
+   * its dimension. No-op when `$select` is undefined (full row covers it).
+   */
+  private widenQuantityRefProjection;
+  private _widenQuantityArrayProjection;
+  private _widenQuantityMapProjection;
   /** WHY: the URL parser only auto-coerces `$count`; every other boolean control reaches us as `"true"`/`"1"` and would fail DTO validation. */
   private _coerceActionsControl;
   /** Normalize a post-`widenPreferredIdProjection` $select into `string[] | null` (`null` = all fields). */

package/dist/index.mjs

@@ -690,6 +690,42 @@ let AsReadableController = class AsReadableController {
 		const idx = url.indexOf("?");
 		return parseUrl(idx >= 0 ? url.slice(idx + 1) : "");
 	}
+	/**
+	* Parse a URL keeping only `$*` control keywords; report whether any
+	* non-control parts were present. Used by `/one` routes where the
+	* uniquery lexer cannot tokenise PK values containing `-` and other
+	* reserved chars, so non-control parts must be stripped before lexing.
+	* `/one/:id` rejects stray filter params with 400 via `hasNonControl`;
+	* `/one` (composite) ignores it because the composite-key params have
+	* already been extracted via `@Query()`.
+	*/
+	parseControlsOnlyFromUrl(url) {
+		const idx = url.indexOf("?");
+		const qs = idx >= 0 ? url.slice(idx + 1) : "";
+		if (!qs) return {
+			parsed: parseUrl(""),
+			hasNonControl: false
+		};
+		const kept = [];
+		let hasNonControl = false;
+		for (const part of qs.split("&")) {
+			if (!part) continue;
+			const eq = part.indexOf("=");
+			const rawKey = eq === -1 ? part : part.slice(0, eq);
+			let key;
+			try {
+				key = decodeURIComponent(rawKey);
+			} catch {
+				key = rawKey;
+			}
+			if (key.startsWith("$")) kept.push(part);
+			else hasNonControl = true;
+		}
+		return {
+			parsed: parseUrl(kept.join("&")),
+			hasNonControl
+		};
+	}
 	async returnOne(result) {
 		const item = await result;
 		if (!item) return new HttpError(404);
@@ -954,14 +990,27 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	_gates;
 	_preferredIdSet;
 	_overlayIsNoOp;
+	/** path → sibling-ref path for `@db.amount.currency.ref` / `@db.unit.ref`. */
+	_quantityRefByPath;
 	constructor(readable, app) {
 		super(readable.type, readable.tableName, app, readable.isView ? "view" : "table");
 		this.readable = readable;
 		this._gates = this._buildGates();
 		this._preferredIdSet = new Set(readable.preferredId ?? []);
+		this._quantityRefByPath = this._collectQuantityRefs();
 		const defaultOverlay = AsReadableController.prototype.applyMetaOverlay;
 		this._overlayIsNoOp = this.applyMetaOverlay === defaultOverlay;
 	}
+	_collectQuantityRefs() {
+		const out = /* @__PURE__ */ new Map();
+		if (!this.readable.flatMap) return out;
+		for (const [path, entry] of this.readable.flatMap) {
+			const meta = entry?.metadata;
+			const ref = meta?.get("db.amount.currency.ref") ?? meta?.get("db.unit.ref");
+			if (ref) out.set(path, ref);
+		}
+		return out;
+	}
 	_buildGates() {
 		const meta = this.readable.type.metadata;
 		const gates = {};
@@ -1029,9 +1078,11 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		return projection;
 	}
 	widenPreferredIdProjection(projection) {
-		if (this._preferredIdSet.size === 0 || projection === void 0) return projection;
-		if (Array.isArray(projection)) return this._widenArrayProjection(projection);
-		return this._widenMapProjection(projection);
+		const widened = this.widenQuantityRefProjection(projection);
+		if (widened instanceof HttpError) return widened;
+		if (this._preferredIdSet.size === 0 || widened === void 0) return widened;
+		if (Array.isArray(widened)) return this._widenArrayProjection(widened);
+		return this._widenMapProjection(widened);
 	}
 	_widenArrayProjection(projection) {
 		const stringItems = /* @__PURE__ */ new Set();
@@ -1071,6 +1122,46 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 		for (const field of this._preferredIdSet) widened[field] = 1;
 		return widened;
 	}
+	/**
+	* Auto-includes the sibling-ref field whenever its `@db.amount.currency.ref`
+	* / `@db.unit.ref` quantity is selected — UI must never get a value without
+	* its dimension. No-op when `$select` is undefined (full row covers it).
+	*/
+	widenQuantityRefProjection(projection) {
+		if (this._quantityRefByPath.size === 0 || projection === void 0) return projection;
+		if (Array.isArray(projection)) return this._widenQuantityArrayProjection(projection);
+		return this._widenQuantityMapProjection(projection);
+	}
+	_widenQuantityArrayProjection(projection) {
+		const stringItems = /* @__PURE__ */ new Set();
+		for (const item of projection) if (typeof item === "string") stringItems.add(item);
+		const toAdd = [];
+		for (const [valuePath, refPath] of this._quantityRefByPath) if (stringItems.has(valuePath) && !stringItems.has(refPath)) {
+			toAdd.push(refPath);
+			stringItems.add(refPath);
+		}
+		if (toAdd.length === 0) return projection;
+		return [...projection, ...toAdd];
+	}
+	_widenQuantityMapProjection(projection) {
+		const entries = Object.entries(projection);
+		if (entries.length === 0) return projection;
+		const included = /* @__PURE__ */ new Set();
+		const excluded = /* @__PURE__ */ new Set();
+		for (const [k, v] of entries) if (v === 1 || v === true) included.add(k);
+		else if (v === 0 || v === false) excluded.add(k);
+		if (included.size > 0 && excluded.size > 0) return new HttpError(400, "Mixed inclusion/exclusion $select maps are not supported");
+		if (excluded.size === 0) {
+			const toAdd = [];
+			for (const [valuePath, refPath] of this._quantityRefByPath) if (included.has(valuePath) && !included.has(refPath)) toAdd.push(refPath);
+			if (toAdd.length === 0) return projection;
+			const widened = {};
+			for (const k of included) widened[k] = 1;
+			for (const k of toAdd) widened[k] = 1;
+			return widened;
+		}
+		return projection;
+	}
 	/** WHY: the URL parser only auto-coerces `$count`; every other boolean control reaches us as `"true"`/`"1"` and would fail DTO validation. */
 	_coerceActionsControl(controls) {
 		const v = controls.$actions;
@@ -1297,9 +1388,9 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	* **GET /one/:id** — retrieves a single record by ID or unique property.
 	*/
 	async getOne(id, url) {
-		const parsed = this.parseQueryString(url);
+		const { parsed, hasNonControl } = this.parseControlsOnlyFromUrl(url);
+		if (hasNonControl) return new HttpError(400, "Filtering is not allowed for \"one\" endpoint");
 		this._coerceActionsControl(parsed.controls);
-		if (Object.keys(parsed.filter).length > 0) return new HttpError(400, "Filtering is not allowed for \"one\" endpoint");
 		const error = this.validateParsed(parsed, "getOne");
 		if (error) return error;
 		const rawSelect = await this.transformProjection(parsed.controls.$select);
@@ -1314,7 +1405,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	async getOneComposite(query, url) {
 		const idObj = this.extractIdShape(query);
 		if (idObj instanceof HttpError) return idObj;
-		const parsed = this.parseQueryString(url);
+		const { parsed } = this.parseControlsOnlyFromUrl(url);
 		this._coerceActionsControl(parsed.controls);
 		const rawSelect = await this.transformProjection(parsed.controls.$select);
 		const select = this.widenPreferredIdProjection(rawSelect);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/moost-db",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "description": "Generic database controller for Moost with Atscript.",
   "keywords": [
     "annotations",
@@ -58,7 +58,7 @@
     "@wooksjs/event-core": "^0.7.10",
     "@wooksjs/http-body": "^0.7.10",
     "moost": "^0.6.8",
-    "@atscript/db": "^0.1.62"
+    "@atscript/db": "^0.1.64"
   },
   "scripts": {
     "postinstall": "asc -f dts",