velocious 1.0.643 → 1.0.645

package/build/utils/model-primary-key.js

@@ -0,0 +1,171 @@
+// @ts-check
+
+import isPlainObject from "./plain-object.js"
+
+/** @typedef {string | number} ModelPrimaryKeyScalar */
+/** @typedef {string | string[]} ModelPrimaryKeyDefinition */
+/** @typedef {Record<string, ModelPrimaryKeyScalar>} CompositeModelPrimaryKeyValue */
+/** @typedef {ModelPrimaryKeyScalar | CompositeModelPrimaryKeyValue} ModelPrimaryKeyValue */
+
+/**
+ * Validates an untrusted composite identity and returns its definition-ordered values.
+ * @param {string[]} primaryKey - Composite primary-key definition.
+ * @param {ReturnType<typeof JSON.parse>} value - Candidate identity.
+ * @returns {CompositeModelPrimaryKeyValue} - Validated identity.
+ */
+export function validatedCompositePrimaryKeyValue(primaryKey, value) {
+  if (!isPlainObject(value)) {
+    throw new TypeError("Expected composite primary key identity to be a plain object.")
+  }
+
+  const valueKeys = Object.keys(value)
+
+  if (valueKeys.length !== primaryKey.length || primaryKey.some((key) => !Object.prototype.hasOwnProperty.call(value, key))) {
+    throw new TypeError(`Expected composite primary key identity fields: ${primaryKey.join(", ")}.`)
+  }
+
+  /** @type {CompositeModelPrimaryKeyValue} */
+  const validatedValue = {}
+
+  for (const key of primaryKey) {
+    const keyValue = value[key]
+
+    if (typeof keyValue !== "string" && typeof keyValue !== "number") {
+      throw new TypeError(`Expected composite primary key identity field '${key}' to be a string or number.`)
+    }
+
+    validatedValue[key] = keyValue
+  }
+
+  return validatedValue
+}
+
+/**
+ * Returns a scalar primary-key definition or fails at a feature boundary that cannot represent composite identities.
+ * @param {ModelPrimaryKeyDefinition} primaryKey - Primary-key definition.
+ * @param {string} operation - Operation requiring a scalar identity.
+ * @returns {string} - Scalar primary-key column or attribute name.
+ */
+export function scalarModelPrimaryKey(primaryKey, operation) {
+  if (Array.isArray(primaryKey)) {
+    throw new Error(`${operation} does not support composite primary keys.`)
+  }
+
+  return primaryKey
+}
+
+/**
+ * Returns a scalar identity or fails at a feature boundary that cannot represent composite identities.
+ * @param {ModelPrimaryKeyValue} value - Model identity.
+ * @param {string} operation - Operation requiring a scalar identity.
+ * @returns {ModelPrimaryKeyScalar} - Scalar identity.
+ */
+export function scalarModelPrimaryKeyValue(value, operation) {
+  if (typeof value !== "string" && typeof value !== "number") {
+    throw new Error(`${operation} does not support composite primary keys.`)
+  }
+
+  return value
+}
+
+/**
+ * Builds query conditions from a scalar or composite model identity.
+ * @param {ModelPrimaryKeyDefinition} primaryKey - Primary-key definition.
+ * @param {ReturnType<typeof JSON.parse>} value - Candidate identity.
+ * @returns {Record<string, ModelPrimaryKeyScalar>} - Primary-key query conditions.
+ */
+export function modelPrimaryKeyConditions(primaryKey, value) {
+  if (Array.isArray(primaryKey)) return validatedCompositePrimaryKeyValue(primaryKey, value)
+
+  return {[primaryKey]: /** @type {ModelPrimaryKeyScalar} */ (value)}
+}
+
+/**
+ * Builds a qualified SQL predicate matching any supplied composite identity.
+ * @param {object} args - Arguments.
+ * @param {typeof import("../database/record/index.js").default} args.modelClass - Model class owning the identity attributes.
+ * @param {string[]} args.primaryKey - Composite primary-key definition.
+ * @param {import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} args.query - Query receiving the predicate.
+ * @param {ModelPrimaryKeyValue[]} args.values - Candidate identities.
+ * @returns {string} - Qualified SQL predicate.
+ */
+export function compositeModelPrimaryKeyCohortSql({modelClass, primaryKey, query, values}) {
+  if (values.length === 0) return "(1 = 0)"
+
+  const tableSql = query.driver.quoteTable(query.getTableReferenceForJoin())
+
+  return `(${values.map((value) => {
+    const conditions = modelPrimaryKeyConditions(primaryKey, value)
+    const identitySql = primaryKey.map((attributeName) => {
+      const columnName = modelClass.getColumnNameForAttributeName(attributeName)
+
+      return `${tableSql}.${query.driver.quoteColumn(columnName)} = ${query.driver.quote(conditions[attributeName])}`
+    }).join(" AND ")
+
+    return `(${identitySql})`
+  }).join(" OR ")})`
+}
+
+/**
+ * Reads a scalar or composite identity through the owning model's value reader.
+ * @param {ModelPrimaryKeyDefinition} primaryKey - Primary-key definition.
+ * @param {(key: string) => ReturnType<typeof JSON.parse>} read - Primary-key value reader.
+ * @returns {ModelPrimaryKeyValue} - Model identity.
+ */
+export function readModelPrimaryKeyValue(primaryKey, read) {
+  if (!Array.isArray(primaryKey)) return /** @type {ModelPrimaryKeyScalar} */ (read(primaryKey))
+
+  /** @type {CompositeModelPrimaryKeyValue} */
+  const value = {}
+
+  for (const key of primaryKey) value[key] = /** @type {ModelPrimaryKeyScalar} */ (read(key))
+
+  return validatedCompositePrimaryKeyValue(primaryKey, value)
+}
+
+/**
+ * Returns an unambiguous map key while preserving legacy scalar map keys.
+ * @param {ModelPrimaryKeyDefinition} primaryKey - Primary-key definition.
+ * @param {ReturnType<typeof JSON.parse>} value - Candidate identity.
+ * @returns {string} - Canonical identity key.
+ */
+export function modelPrimaryKeyCacheKey(primaryKey, value) {
+  if (!Array.isArray(primaryKey)) return String(value)
+
+  const validatedValue = validatedCompositePrimaryKeyValue(primaryKey, value)
+
+  return JSON.stringify(primaryKey.map((key) => validatedValue[key]))
+}
+
+/**
+ * Restores a model identity from its canonical string representation.
+ * @param {ModelPrimaryKeyDefinition} primaryKey - Primary-key definition.
+ * @param {string} cacheKey - Canonical identity key.
+ * @returns {ModelPrimaryKeyValue} - Restored identity.
+ */
+export function modelPrimaryKeyValueFromCacheKey(primaryKey, cacheKey) {
+  if (!Array.isArray(primaryKey)) return cacheKey
+
+  let parsed
+
+  try {
+    parsed = JSON.parse(cacheKey)
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error
+
+    throw new TypeError("Expected composite primary key cache value to be valid JSON.", {cause: error})
+  }
+
+  if (!Array.isArray(parsed) || parsed.length !== primaryKey.length) {
+    throw new TypeError(`Expected composite primary key cache value with ${primaryKey.length} fields.`)
+  }
+
+  /** @type {CompositeModelPrimaryKeyValue} */
+  const value = {}
+
+  for (let index = 0; index < primaryKey.length; index += 1) {
+    value[primaryKey[index]] = parsed[index]
+  }
+
+  return validatedCompositePrimaryKeyValue(primaryKey, value)
+}

package/build/utils/sha256-bytes-hex.js

@@ -0,0 +1,132 @@
+// @ts-check
+
+/**
+ * Computes a SHA-256 hex digest for arbitrary bytes without Node-only imports.
+ * @param {Uint8Array} bytes - Bytes to digest.
+ * @returns {string} Hex digest.
+ */
+export default function sha256BytesHex(bytes) {
+  const bitLength = bytes.length * 8
+  const blockCount = Math.ceil((bytes.length + 9) / 64)
+  const block = new Uint8Array(64)
+  const hash = SHA256_INITIAL_HASH.slice()
+  /** @type {number[]} */
+  const words = new Array(64)
+
+  const highLength = Math.floor(bitLength / 0x100000000)
+  const lowLength = bitLength >>> 0
+
+  for (let blockIndex = 0; blockIndex < blockCount; blockIndex += 1) {
+    const offset = blockIndex * 64
+    const chunkLength = Math.min(64, Math.max(0, bytes.length - offset))
+
+    block.fill(0)
+    if (chunkLength > 0) block.set(bytes.subarray(offset, offset + chunkLength))
+    if (bytes.length >= offset && bytes.length < offset + 64) block[bytes.length - offset] = 0x80
+
+    if (blockIndex === blockCount - 1) {
+      block[56] = (highLength >>> 24) & 0xff
+      block[57] = (highLength >>> 16) & 0xff
+      block[58] = (highLength >>> 8) & 0xff
+      block[59] = highLength & 0xff
+      block[60] = (lowLength >>> 24) & 0xff
+      block[61] = (lowLength >>> 16) & 0xff
+      block[62] = (lowLength >>> 8) & 0xff
+      block[63] = lowLength & 0xff
+    }
+
+    for (let index = 0; index < 16; index++) {
+      const byteIndex = index * 4
+
+      words[index] = ((block[byteIndex] << 24) | (block[byteIndex + 1] << 16) | (block[byteIndex + 2] << 8) | block[byteIndex + 3]) >>> 0
+    }
+
+    for (let index = 16; index < 64; index++) {
+      const s0 = rotateRight(words[index - 15], 7) ^ rotateRight(words[index - 15], 18) ^ (words[index - 15] >>> 3)
+      const s1 = rotateRight(words[index - 2], 17) ^ rotateRight(words[index - 2], 19) ^ (words[index - 2] >>> 10)
+
+      words[index] = add32(words[index - 16], s0, words[index - 7], s1)
+    }
+
+    let a = hash[0]
+    let b = hash[1]
+    let c = hash[2]
+    let d = hash[3]
+    let e = hash[4]
+    let f = hash[5]
+    let g = hash[6]
+    let h = hash[7]
+
+    for (let index = 0; index < 64; index++) {
+      const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
+      const ch = (e & f) ^ ((~e) & g)
+      const temp1 = add32(h, s1, ch, SHA256_K[index], words[index])
+      const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
+      const maj = (a & b) ^ (a & c) ^ (b & c)
+      const temp2 = add32(s0, maj)
+
+      h = g
+      g = f
+      f = e
+      e = add32(d, temp1)
+      d = c
+      c = b
+      b = a
+      a = add32(temp1, temp2)
+    }
+
+    hash[0] = add32(hash[0], a)
+    hash[1] = add32(hash[1], b)
+    hash[2] = add32(hash[2], c)
+    hash[3] = add32(hash[3], d)
+    hash[4] = add32(hash[4], e)
+    hash[5] = add32(hash[5], f)
+    hash[6] = add32(hash[6], g)
+    hash[7] = add32(hash[7], h)
+  }
+
+  return hash.map((value) => value.toString(16).padStart(8, "0")).join("")
+}
+
+const SHA256_INITIAL_HASH = [
+  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+  0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
+]
+
+const SHA256_K = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+  0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+  0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+  0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+]
+
+/**
+ * Rotates an unsigned value right.
+ * @param {number} value Unsigned value.
+ * @param {number} bits Rotation count.
+ * @returns {number} Rotated value.
+ */
+function rotateRight(value, bits) {
+  return (value >>> bits) | (value << (32 - bits))
+}
+
+/**
+ * Adds numbers with unsigned 32-bit overflow.
+ * @param {...number} values Values to add.
+ * @returns {number} Unsigned sum.
+ */
+function add32(...values) {
+  return values.reduce((sum, value) => (sum + value) >>> 0, 0)
+}

package/build/utils/sha256-hex.js

@@ -1,141 +1,13 @@
+// @ts-check
+
+import sha256BytesHex from "./sha256-bytes-hex.js"
+
 /**
  * Computes SHA-256 without importing Node-only crypto modules, keeping this
- * module safe for Expo/browser bundles. Implementation is a straightforward
- * pure-JavaScript SHA-256 derived from FIPS 180-4, using only 32-bit unsigned
- * integer arithmetic.
+ * module safe for Expo/browser bundles.
  * @param {string} message - UTF-8 message.
- * @returns {string} - Hex digest.
+ * @returns {string} Hex digest.
  */
 export default function sha256Hex(message) {
-  const bytes = utf8Bytes(message)
-  const padded = [...bytes]
-  const bitLength = bytes.length * 8
-  const hash = [...SHA256_INITIAL_HASH]
-  /** @type {number[]} */
-  const words = new Array(64)
-
-  padded.push(0x80)
-  while (padded.length % 64 !== 56) padded.push(0)
-
-  const highLength = Math.floor(bitLength / 0x100000000)
-  const lowLength = bitLength >>> 0
-
-  for (const value of [highLength, lowLength]) {
-    padded.push((value >>> 24) & 0xff, (value >>> 16) & 0xff, (value >>> 8) & 0xff, value & 0xff)
-  }
-
-  for (let offset = 0; offset < padded.length; offset += 64) {
-    for (let i = 0; i < 16; i++) {
-      const index = offset + (i * 4)
-
-      words[i] = (((padded[index] || 0) << 24) | ((padded[index + 1] || 0) << 16) | ((padded[index + 2] || 0) << 8) | (padded[index + 3] || 0)) >>> 0
-    }
-
-    for (let i = 16; i < 64; i++) {
-      const s0 = rotateRight(words[i - 15], 7) ^ rotateRight(words[i - 15], 18) ^ (words[i - 15] >>> 3)
-      const s1 = rotateRight(words[i - 2], 17) ^ rotateRight(words[i - 2], 19) ^ (words[i - 2] >>> 10)
-
-      words[i] = add32(words[i - 16], s0, words[i - 7], s1)
-    }
-
-    let [a, b, c, d, e, f, g, h] = hash
-
-    for (let i = 0; i < 64; i++) {
-      const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25)
-      const ch = (e & f) ^ ((~e) & g)
-      const temp1 = add32(h, s1, ch, SHA256_K[i], words[i])
-      const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22)
-      const maj = (a & b) ^ (a & c) ^ (b & c)
-      const temp2 = add32(s0, maj)
-
-      h = g
-      g = f
-      f = e
-      e = add32(d, temp1)
-      d = c
-      c = b
-      b = a
-      a = add32(temp1, temp2)
-    }
-
-    hash[0] = add32(hash[0], a)
-    hash[1] = add32(hash[1], b)
-    hash[2] = add32(hash[2], c)
-    hash[3] = add32(hash[3], d)
-    hash[4] = add32(hash[4], e)
-    hash[5] = add32(hash[5], f)
-    hash[6] = add32(hash[6], g)
-    hash[7] = add32(hash[7], h)
-  }
-
-  return hash.map((value) => value.toString(16).padStart(8, "0")).join("")
-}
-
-const SHA256_INITIAL_HASH = [
-  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
-  0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
-]
-
-const SHA256_K = [
-  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
-  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
-  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
-  0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
-  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
-  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
-  0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
-  0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
-  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-]
-
-/**
- * Converts a string to UTF-8 bytes.
- * @param {string} value - String value.
- * @returns {number[]} - UTF-8 bytes.
- */
-function utf8Bytes(value) {
-  /** @type {number[]} */
-  const bytes = []
-
-  for (const character of value) {
-    const codePoint = /** @type {number} */ (character.codePointAt(0))
-
-    if (codePoint <= 0x7f) {
-      bytes.push(codePoint)
-    } else if (codePoint <= 0x7ff) {
-      bytes.push(0xc0 | (codePoint >>> 6), 0x80 | (codePoint & 0x3f))
-    } else if (codePoint <= 0xffff) {
-      bytes.push(0xe0 | (codePoint >>> 12), 0x80 | ((codePoint >>> 6) & 0x3f), 0x80 | (codePoint & 0x3f))
-    } else {
-      bytes.push(0xf0 | (codePoint >>> 18), 0x80 | ((codePoint >>> 12) & 0x3f), 0x80 | ((codePoint >>> 6) & 0x3f), 0x80 | (codePoint & 0x3f))
-    }
-  }
-
-  return bytes
-}
-
-/**
- * Adds unsigned 32-bit integers.
- * @param {...number} values - Values to add.
- * @returns {number} - Unsigned 32-bit result.
- */
-function add32(...values) {
-  return values.reduce((sum, value) => (sum + value) >>> 0, 0)
-}
-
-/**
- * Rotates a 32-bit integer right.
- * @param {number} value - Value to rotate.
- * @param {number} bits - Bit count.
- * @returns {number} - Rotated value.
- */
-function rotateRight(value, bits) {
-  return (value >>> bits) | (value << (32 - bits))
+  return sha256BytesHex(new TextEncoder().encode(message))
 }

package/package.json

@@ -3,7 +3,7 @@
     "velocious": "build/bin/velocious.js"
   },
   "name": "velocious",
-  "version": "1.0.643",
+  "version": "1.0.645",
   "main": "build/index.js",
   "types": "build/index.d.ts",
   "files": [
@@ -64,7 +64,6 @@
   "description": "",
   "dependencies": {
     "@js-temporal/polyfill": "^0.5.1",
-    "@velocious/testing": "0.0.1",
     "awaitery": "^1.0.19",
     "bcryptjs": "^3.0.2",
     "better-localstorage": "^1.0.7",
@@ -92,10 +91,11 @@
     "ws": "^8.21.3"
   },
   "peerDependencies": {
+    "@velocious/testing": "0.0.9",
     "react": ">=18",
+    "smtp-connection": "^4.0.2",
     "sqlite": "^5.1.1",
-    "sqlite3": "^6.0.1",
-    "smtp-connection": "^4.0.2"
+    "sqlite3": "^6.0.1"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -121,6 +121,7 @@
     "@types/react-dom": "^19.2.3",
     "@types/strftime": "^0.9.8",
     "@types/ws": "^8.18.1",
+    "@velocious/testing": "0.0.9",
     "chokidar-cli": "^3.0.0",
     "cpy-cli": "^7.0.0",
     "esbuild": "^0.28.0",

package/src/authorization/ability.js

@@ -189,9 +189,10 @@ export default class VelociousAuthorizationAbility {
    * @param {string} args.action - Requested action.
    * @param {typeof import("../database/record/index.js").default} args.modelClass - Model class.
    * @param {import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} args.query - Query.
+   * @param {() => import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} [args.ruleQueryFactory] - Optional factory for the queries that evaluate individual conditional rules.
    * @returns {import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} - Authorized query.
    */
-  applyToQuery({action, modelClass, query}) {
+  applyToQuery({action, modelClass, query, ruleQueryFactory}) {
     this.loadAbilitiesForModelClass(modelClass)
 
     const applicableRules = this.rulesFor({action, modelClass})
@@ -203,18 +204,18 @@ export default class VelociousAuthorizationAbility {
     }
 
     if (allowRules.some((rule) => !rule.conditions)) {
-      this.applyDenyRules({action, denyRules, modelClass, query})
+      this.applyDenyRules({action, denyRules, modelClass, query, ruleQueryFactory})
       return query
     }
 
-    const allowSqlParts = this.conditionSqlParts({action, modelClass, query, rules: allowRules})
+    const allowSqlParts = this.conditionSqlParts({action, modelClass, query, ruleQueryFactory, rules: allowRules})
 
     if (allowSqlParts.length === 0) {
       return query.where("1=0")
     }
 
     query.where(`(${allowSqlParts.join(" OR ")})`)
-    this.applyDenyRules({action, denyRules, modelClass, query})
+    this.applyDenyRules({action, denyRules, modelClass, query, ruleQueryFactory})
 
     return query
   }
@@ -240,19 +241,20 @@ export default class VelociousAuthorizationAbility {
    * @param {string} args.action - Action.
    * @param {typeof import("../database/record/index.js").default} args.modelClass - Model class.
    * @param {import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} args.query - Base query.
+   * @param {() => import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} [args.ruleQueryFactory] - Optional conditional-rule query factory.
    * @param {AbilityRuleType[]} args.rules - Rules.
    * @returns {string[]} - SQL condition parts.
    */
-  conditionSqlParts({action, modelClass, query, rules}) {
-    const pk = modelClass.primaryKey()
-    const quotedBaseTable = query.driver.quoteTable(modelClass.tableName())
-    const quotedPk = query.driver.quoteColumn(pk)
+  conditionSqlParts({action, modelClass, query, ruleQueryFactory, rules}) {
+    const primaryKey = modelClass.primaryKey()
+    const primaryKeyAttributes = Array.isArray(primaryKey) ? primaryKey : [primaryKey]
+    const quotedBaseTable = query.driver.quoteTable(query.getTableReferenceForJoin())
     const sqlParts = []
 
     for (const rule of rules) {
       if (!rule.conditions) continue
 
-      const scopedQuery = modelClass._newQuery()
+      const scopedQuery = ruleQueryFactory ? ruleQueryFactory() : modelClass._newQuery()
       const resultQuery = this.applyRuleCondition({
         action,
         conditions: rule.conditions,
@@ -260,7 +262,16 @@ export default class VelociousAuthorizationAbility {
         query: scopedQuery
       })
       const finalQuery = resultQuery || scopedQuery
-      const selectedPkSql = `${quotedBaseTable}.${quotedPk}`
+
+      if (ruleQueryFactory && finalQuery !== scopedQuery) {
+        const finalFroms = finalQuery.getFroms()
+
+        finalFroms.splice(0, finalFroms.length, ...scopedQuery.getFroms())
+      }
+
+      const quotedScopedTable = query.driver.quoteTable(finalQuery.getTableReferenceForJoin())
+      const primaryKeyColumns = primaryKeyAttributes.map((attributeName) => modelClass.getColumnNameForAttributeName(attributeName))
+      const selectedPkSql = primaryKeyColumns.map((columnName) => `${quotedScopedTable}.${query.driver.quoteColumn(columnName)}`)
 
       if (finalQuery._distinct) {
         query.distinct(true)
@@ -268,7 +279,18 @@ export default class VelociousAuthorizationAbility {
 
       finalQuery.select(selectedPkSql)
 
-      sqlParts.push(`${quotedBaseTable}.${quotedPk} IN (${finalQuery.toSql()})`)
+      if (Array.isArray(primaryKey)) {
+        const authorizedRowsAlias = query.driver.quoteTable("velocious_authorized_rows")
+        const identitySql = primaryKeyColumns.map((columnName) => {
+          const quotedColumn = query.driver.quoteColumn(columnName)
+
+          return `${authorizedRowsAlias}.${quotedColumn} = ${quotedBaseTable}.${quotedColumn}`
+        }).join(" AND ")
+
+        sqlParts.push(`EXISTS (SELECT 1 FROM (${finalQuery.toSql()}) AS ${authorizedRowsAlias} WHERE ${identitySql})`)
+      } else {
+        sqlParts.push(`${quotedBaseTable}.${query.driver.quoteColumn(primaryKeyColumns[0])} IN (${finalQuery.toSql()})`)
+      }
     }
 
     return sqlParts
@@ -281,9 +303,10 @@ export default class VelociousAuthorizationAbility {
    * @param {AbilityRuleType[]} args.denyRules - Deny rules.
    * @param {typeof import("../database/record/index.js").default} args.modelClass - Model class.
    * @param {import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} args.query - Query.
+   * @param {() => import("../database/query/model-class-query.js").default<typeof import("../database/record/index.js").default>} [args.ruleQueryFactory] - Optional conditional-rule query factory.
    * @returns {void} - No return value.
    */
-  applyDenyRules({action, denyRules, modelClass, query}) {
+  applyDenyRules({action, denyRules, modelClass, query, ruleQueryFactory}) {
     if (denyRules.length === 0) return
 
     if (denyRules.some((rule) => !rule.conditions)) {
@@ -291,7 +314,7 @@ export default class VelociousAuthorizationAbility {
       return
     }
 
-    const denySqlParts = this.conditionSqlParts({action, modelClass, query, rules: denyRules})
+    const denySqlParts = this.conditionSqlParts({action, modelClass, query, ruleQueryFactory, rules: denyRules})
 
     if (denySqlParts.length > 0) {
       query.where(`NOT (${denySqlParts.join(" OR ")})`)

package/src/background-jobs/adapter.js

@@ -48,6 +48,15 @@ export default class BackgroundJobsAdapter {
    */
   async reconcileQueueConcurrency() { throw new Error("BackgroundJobsAdapter#reconcileQueueConcurrency is not implemented") }
 
+  /**
+   * Repairs drift in adapter-owned durable active concurrency counts. Adapters
+   * without duplicate active-count persistence can keep this no-op result.
+   * @returns {Promise<import("./types.js").BackgroundJobConcurrencyReconciliation>} - Repair summary.
+   */
+  async reconcileActiveConcurrency() {
+    return {candidateCount: 0, checkedCount: 0, repairedCount: 0, repairs: [], repairsTruncatedCount: 0}
+  }
+
   /**
    * Enqueues a job.
    * @param {{jobName: string, args: Array<ReturnType<typeof JSON.parse>>, options?: import("./types.js").BackgroundJobOptions}} _args - Job request.