@classytic/arc 1.0.8 → 1.1.0

package/dist/{BaseController-nNRS3vpA.d.ts → BaseController-DVAiHxEQ.d.ts}

@@ -1,4 +1,4 @@
-import { A as AnyRecord, I as IController, R as RouteSchemaOptions, Q as QueryParserInterface, a as IRequestContext, S as ServiceContext, C as ControllerQueryOptions, b as RequestContext, H as HookSystem, c as IControllerResponse, P as PaginatedResult } from './index-D5QTob1X.js';
+import { A as AnyRecord, I as IController, R as RouteSchemaOptions, Q as QueryParserInterface, a as IRequestContext, S as ServiceContext, C as ControllerQueryOptions, b as RequestContext, H as HookSystem, c as IControllerResponse, P as PaginatedResult } from './index-B4t03KQ0.js';
 
 /**
  * Base Controller - Framework-Agnostic CRUD Operations

package/dist/adapters/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DataAdapter, y as CrudRepository, o as RepositoryLike, m as SchemaMetadata, R as RouteSchemaOptions, af as OpenApiSchemas, Q as QueryParserInterface, ae as ParsedQuery, V as ValidationResult } from '../index-D5QTob1X.js';
-export { ag as AdapterFactory, F as FieldMetadata, n as RelationMetadata } from '../index-D5QTob1X.js';
+import { D as DataAdapter, y as CrudRepository, o as RepositoryLike, m as SchemaMetadata, R as RouteSchemaOptions, af as OpenApiSchemas, Q as QueryParserInterface, ae as ParsedQuery, V as ValidationResult } from '../index-B4t03KQ0.js';
+export { ag as AdapterFactory, F as FieldMetadata, n as RelationMetadata } from '../index-B4t03KQ0.js';
 import { Model } from 'mongoose';
 import 'fastify';
 import '../types-B99TBmFV.js';

package/dist/{arcCorePlugin-CAjBQtZB.d.ts → arcCorePlugin-CsShQdyP.d.ts}

@@ -1,5 +1,5 @@
 import { FastifyPluginAsync, FastifyInstance, FastifyRequest } from 'fastify';
-import { H as HookSystem, j as ResourceRegistry } from './index-D5QTob1X.js';
+import { H as HookSystem, j as ResourceRegistry } from './index-B4t03KQ0.js';
 
 /**
  * Request ID Plugin

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 import { FastifyPluginAsync } from 'fastify';
-import { g as AuthHelpers, h as AuthPluginOptions } from '../index-D5QTob1X.js';
+import { g as AuthHelpers, h as AuthPluginOptions } from '../index-B4t03KQ0.js';
 import 'mongoose';
 import '../types-B99TBmFV.js';
 

package/dist/core/index.d.ts

@@ -1,7 +1,7 @@
-export { B as BaseController, a as BaseControllerOptions } from '../BaseController-nNRS3vpA.js';
+export { B as BaseController, a as BaseControllerOptions } from '../BaseController-DVAiHxEQ.js';
 import { RouteHandlerMethod, FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
-import { w as FastifyWithDecorators, B as CrudController, _ as CrudRouterOptions, d as RequestWithExtras, a as IRequestContext, c as IControllerResponse, I as IController } from '../index-D5QTob1X.js';
-export { q as ResourceDefinition, p as defineResource } from '../index-D5QTob1X.js';
+import { w as FastifyWithDecorators, B as CrudController, _ as CrudRouterOptions, d as RequestWithExtras, a as IRequestContext, c as IControllerResponse, I as IController } from '../index-B4t03KQ0.js';
+export { q as ResourceDefinition, p as defineResource } from '../index-B4t03KQ0.js';
 import { P as PermissionCheck } from '../types-B99TBmFV.js';
 import 'mongoose';
 

package/dist/core/index.js

@@ -312,6 +312,23 @@ var ArcQueryParser = class {
     for (const [key, value] of Object.entries(query)) {
       if (reservedKeys.has(key)) continue;
       if (value === void 0 || value === null) continue;
+      if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(key)) continue;
+      if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const operatorObj = value;
+        const operatorKeys = Object.keys(operatorObj);
+        const allOperators = operatorKeys.every((op) => this.operators[op]);
+        if (allOperators && operatorKeys.length > 0) {
+          const mongoFilters = {};
+          for (const [op, opValue] of Object.entries(operatorObj)) {
+            const mongoOp = this.operators[op];
+            if (mongoOp) {
+              mongoFilters[mongoOp] = this.parseFilterValue(opValue, op);
+            }
+          }
+          filters[key] = mongoFilters;
+          continue;
+        }
+      }
       const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_.]*)(?:\[([a-z]+)\])?$/);
       if (!match) continue;
       const [, fieldName, operator] = match;
@@ -453,6 +470,8 @@ var BaseController = class _BaseController {
       sort: sortString,
       select: this._sanitizeSelect(selectString, this.schemaOptions),
       populate: this._sanitizePopulate(parsed.populate, this.schemaOptions),
+      // Advanced populate options from MongoKit QueryParser (takes precedence over simple populate)
+      populateOptions: parsed.populateOptions,
       filters: parsed.filters,
       // MongoKit features
       search: parsed.search,
@@ -568,7 +587,7 @@ var BaseController = class _BaseController {
         return true;
       }
     }
-    return itemValue === filterValue;
+    return String(itemValue) === String(filterValue);
   }
   /**
    * Check if item matches policy filters (for get/update/delete operations)
@@ -724,7 +743,10 @@ var BaseController = class _BaseController {
     const arcContext = req.metadata;
     try {
       const item = await this.repository.getById(id, options);
-      if (!item || !this._checkOrgScope(item, arcContext) || !this._checkPolicyFilters(item, req)) {
+      const hasItem = !!item;
+      const orgScopeOk = this._checkOrgScope(item, arcContext);
+      const policyFiltersOk = this._checkPolicyFilters(item, req);
+      if (!hasItem || !orgScopeOk || !policyFiltersOk) {
         return {
           success: false,
           error: "Resource not found",

package/dist/{createApp-CjN9zZSL.d.ts → createApp-Ce9wl8W9.d.ts}

@@ -1,5 +1,5 @@
 import { FastifyInstance } from 'fastify';
-import { C as CreateAppOptions } from './types-zpN48n6B.js';
+import { C as CreateAppOptions } from './types-BvckRbs2.js';
 
 /**
  * ArcFactory - Production-ready Fastify application factory

package/dist/factory/index.d.ts

@@ -1,11 +1,11 @@
-export { A as ArcFactory, c as createApp } from '../createApp-CjN9zZSL.js';
-import { C as CreateAppOptions } from '../types-zpN48n6B.js';
-export { M as MultipartOptions, R as RawBodyOptions, U as UnderPressureOptions } from '../types-zpN48n6B.js';
+export { A as ArcFactory, c as createApp } from '../createApp-Ce9wl8W9.js';
+import { C as CreateAppOptions } from '../types-BvckRbs2.js';
+export { M as MultipartOptions, R as RawBodyOptions, U as UnderPressureOptions } from '../types-BvckRbs2.js';
 import 'fastify';
 import '@fastify/cors';
 import '@fastify/helmet';
 import '@fastify/rate-limit';
-import '../index-D5QTob1X.js';
+import '../index-B4t03KQ0.js';
 import 'mongoose';
 import '../types-B99TBmFV.js';
 

package/dist/factory/index.js

@@ -2,6 +2,7 @@ import fp from 'fastify-plugin';
 import { randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import Fastify from 'fastify';
+import qs from 'qs';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -1507,6 +1508,10 @@ async function createApp(options) {
   const fastify = Fastify({
     logger: config.logger ?? true,
     trustProxy: config.trustProxy ?? false,
+    // Use qs parser to support nested bracket notation in query strings
+    // e.g., ?populate[author][select]=name,email → { populate: { author: { select: 'name,email' } } }
+    // This is required for MongoKit's advanced populate options to work
+    querystringParser: (str) => qs.parse(str),
     ajv: {
       customOptions: {
         coerceTypes: true,

package/dist/hooks/index.d.ts

@@ -1,4 +1,4 @@
-export { ac as HookContext, ad as HookHandler, aH as HookOperation, aG as HookPhase, aI as HookRegistration, H as HookSystem, aJ as HookSystemOptions, aB as afterCreate, aF as afterDelete, aD as afterUpdate, aA as beforeCreate, aE as beforeDelete, aC as beforeUpdate, az as createHookSystem, ab as hookSystem } from '../index-D5QTob1X.js';
+export { ac as HookContext, ad as HookHandler, aI as HookOperation, aH as HookPhase, aJ as HookRegistration, H as HookSystem, aK as HookSystemOptions, aC as afterCreate, aG as afterDelete, aE as afterUpdate, aB as beforeCreate, aF as beforeDelete, aD as beforeUpdate, aA as createHookSystem, ab as hookSystem } from '../index-B4t03KQ0.js';
 import 'mongoose';
 import 'fastify';
 import '../types-B99TBmFV.js';

package/dist/{index-D5QTob1X.d.ts → index-B4t03KQ0.d.ts}

@@ -553,7 +553,13 @@ interface ControllerQueryOptions {
     page?: number;
     limit?: number;
     sort?: string | Record<string, 1 | -1>;
+    /** Simple populate (comma-separated string or array) */
     populate?: string | string[] | Record<string, unknown>;
+    /**
+     * Advanced populate options (Mongoose-compatible)
+     * When set, takes precedence over simple `populate`
+     */
+    populateOptions?: PopulateOption[];
     select?: string | string[] | Record<string, 0 | 1>;
     filters?: Record<string, unknown>;
     search?: string;
@@ -565,19 +571,57 @@ interface ControllerQueryOptions {
     /** Allow additional options */
     [key: string]: unknown;
 }
+/**
+ * Mongoose-compatible populate option for advanced field selection
+ * Used when you need to select specific fields from populated documents
+ *
+ * @example
+ * ```typescript
+ * // URL: ?populate[author][select]=name,email
+ * // Generates: { path: 'author', select: 'name email' }
+ * ```
+ */
+interface PopulateOption {
+    /** Field path to populate */
+    path: string;
+    /** Fields to select (space-separated) */
+    select?: string;
+    /** Filter conditions for populated documents */
+    match?: Record<string, unknown>;
+    /** Query options (limit, sort, skip) */
+    options?: {
+        limit?: number;
+        sort?: Record<string, 1 | -1>;
+        skip?: number;
+    };
+    /** Nested populate configuration */
+    populate?: PopulateOption;
+}
 /**
  * Parsed query result from QueryParser
  * Includes pagination, sorting, filtering, etc.
+ *
+ * The index signature allows custom query parsers (like MongoKit's QueryParser)
+ * to add additional fields without breaking Arc's type system.
  */
 interface ParsedQuery {
     filters?: Record<string, unknown>;
     limit?: number;
     sort?: string | Record<string, 1 | -1>;
+    /** Simple populate (comma-separated string or array) */
     populate?: string | string[] | Record<string, unknown>;
+    /**
+     * Advanced populate options (Mongoose-compatible)
+     * When set, takes precedence over simple `populate`
+     * @example [{ path: 'author', select: 'name email' }]
+     */
+    populateOptions?: PopulateOption[];
     search?: string;
     page?: number;
     after?: string;
     select?: string | string[] | Record<string, 0 | 1>;
+    /** Allow additional fields from custom query parsers */
+    [key: string]: unknown;
 }
 /**
  * Query Parser Interface
@@ -1319,4 +1363,4 @@ interface ValidationResult {
 }
 type AdapterFactory<TDoc> = (config: unknown) => DataAdapter<TDoc>;
 
-export { type InferDocType as $, type AnyRecord as A, type CrudController as B, type ControllerQueryOptions as C, type DataAdapter as D, type FieldRule as E, type FieldMetadata as F, type CrudSchemas as G, HookSystem as H, type IController as I, type JWTPayload as J, type AdditionalRoute as K, type PresetFunction as L, type MiddlewareConfig as M, type EventDefinition as N, type OwnershipCheck as O, type PaginatedResult as P, type QueryParserInterface as Q, type RouteSchemaOptions as R, type ServiceContext as S, type ResourceMetadata as T, type UserOrganization as U, type ValidationResult as V, type RegistryEntry as W, type RegistryStats as X, type IntrospectionData as Y, type OrgScopeOptions as Z, type CrudRouterOptions as _, type IRequestContext as a, type InferResourceDoc as a0, type TypedResourceConfig as a1, type TypedController as a2, type TypedRepository as a3, type ConfigError as a4, type ValidationResult$1 as a5, type ValidateOptions as a6, type HealthCheck as a7, type HealthOptions as a8, type GracefulShutdownOptions as a9, beforeCreate as aA, afterCreate as aB, beforeUpdate as aC, afterUpdate as aD, beforeDelete as aE, afterDelete as aF, type HookPhase as aG, type HookOperation as aH, type HookRegistration as aI, type HookSystemOptions as aJ, type RequestIdOptions as aa, hookSystem as ab, type HookContext as ac, type HookHandler as ad, type ParsedQuery as ae, type OpenApiSchemas as af, type AdapterFactory as ag, type ObjectId as ah, type UserLike as ai, getUserId as aj, type ArcDecorator as ak, type EventsDecorator as al, type ResourcePermissions as am, type ResourceHooks as an, type MiddlewareHandler as ao, type JwtContext as ap, type AuthenticatorContext as aq, type Authenticator as ar, type TokenPair as as, type PresetHook as at, type BaseControllerOptions as au, type PaginationParams as av, type InferDoc as aw, type ControllerHandler as ax, type FastifyHandler as ay, createHookSystem as az, type RequestContext as b, type IControllerResponse as c, type RequestWithExtras as d, type CrudRouteKey as e, type PresetResult as f, type AuthHelpers as g, type AuthPluginOptions as h, type IntrospectionPluginOptions as i, ResourceRegistry as j, type RegisterOptions as k, type ResourceConfig as l, type SchemaMetadata as m, type RelationMetadata as n, type RepositoryLike as o, defineResource as p, ResourceDefinition as q, resourceRegistry as r, type ApiResponse as s, type ControllerLike as t, type FastifyRequestExtras as u, type FastifyWithAuth as v, type FastifyWithDecorators as w, type QueryOptions as x, type CrudRepository as y, type RouteHandler as z };
+export { type InferDocType as $, type AnyRecord as A, type CrudController as B, type ControllerQueryOptions as C, type DataAdapter as D, type FieldRule as E, type FieldMetadata as F, type CrudSchemas as G, HookSystem as H, type IController as I, type JWTPayload as J, type AdditionalRoute as K, type PresetFunction as L, type MiddlewareConfig as M, type EventDefinition as N, type OwnershipCheck as O, type PaginatedResult as P, type QueryParserInterface as Q, type RouteSchemaOptions as R, type ServiceContext as S, type ResourceMetadata as T, type UserOrganization as U, type ValidationResult as V, type RegistryEntry as W, type RegistryStats as X, type IntrospectionData as Y, type OrgScopeOptions as Z, type CrudRouterOptions as _, type IRequestContext as a, type InferResourceDoc as a0, type TypedResourceConfig as a1, type TypedController as a2, type TypedRepository as a3, type ConfigError as a4, type ValidationResult$1 as a5, type ValidateOptions as a6, type HealthCheck as a7, type HealthOptions as a8, type GracefulShutdownOptions as a9, createHookSystem as aA, beforeCreate as aB, afterCreate as aC, beforeUpdate as aD, afterUpdate as aE, beforeDelete as aF, afterDelete as aG, type HookPhase as aH, type HookOperation as aI, type HookRegistration as aJ, type HookSystemOptions as aK, type RequestIdOptions as aa, hookSystem as ab, type HookContext as ac, type HookHandler as ad, type ParsedQuery as ae, type OpenApiSchemas as af, type AdapterFactory as ag, type ObjectId as ah, type UserLike as ai, getUserId as aj, type PopulateOption as ak, type ArcDecorator as al, type EventsDecorator as am, type ResourcePermissions as an, type ResourceHooks as ao, type MiddlewareHandler as ap, type JwtContext as aq, type AuthenticatorContext as ar, type Authenticator as as, type TokenPair as at, type PresetHook as au, type BaseControllerOptions as av, type PaginationParams as aw, type InferDoc as ax, type ControllerHandler as ay, type FastifyHandler as az, type RequestContext as b, type IControllerResponse as c, type RequestWithExtras as d, type CrudRouteKey as e, type PresetResult as f, type AuthHelpers as g, type AuthPluginOptions as h, type IntrospectionPluginOptions as i, ResourceRegistry as j, type RegisterOptions as k, type ResourceConfig as l, type SchemaMetadata as m, type RelationMetadata as n, type RepositoryLike as o, defineResource as p, ResourceDefinition as q, resourceRegistry as r, type ApiResponse as s, type ControllerLike as t, type FastifyRequestExtras as u, type FastifyWithAuth as v, type FastifyWithDecorators as w, type QueryOptions as x, type CrudRepository as y, type RouteHandler as z };

package/dist/index.d.ts

@@ -1,15 +1,15 @@
-import { l as ResourceConfig } from './index-D5QTob1X.js';
-export { V as AdapterValidationResult, K as AdditionalRoute, A as AnyRecord, s as ApiResponse, h as AuthPluginOptions, a4 as ConfigError, t as ControllerLike, B as CrudController, y as CrudRepository, e as CrudRouteKey, _ as CrudRouterOptions, G as CrudSchemas, D as DataAdapter, N as EventDefinition, u as FastifyRequestExtras, v as FastifyWithAuth, w as FastifyWithDecorators, F as FieldMetadata, E as FieldRule, a9 as GracefulShutdownOptions, a7 as HealthCheck, a8 as HealthOptions, ac as HookContext, ad as HookHandler, H as HookSystem, I as IController, c as IControllerResponse, a as IRequestContext, $ as InferDocType, a0 as InferResourceDoc, Y as IntrospectionData, i as IntrospectionPluginOptions, J as JWTPayload, M as MiddlewareConfig, Z as OrgScopeOptions, O as OwnershipCheck, P as PaginatedResult, L as PresetFunction, f as PresetResult, x as QueryOptions, W as RegistryEntry, X as RegistryStats, n as RelationMetadata, o as RepositoryLike, b as RequestContext, aa as RequestIdOptions, d as RequestWithExtras, q as ResourceDefinition, T as ResourceMetadata, z as RouteHandler, R as RouteSchemaOptions, m as SchemaMetadata, S as ServiceContext, a2 as TypedController, a3 as TypedRepository, a1 as TypedResourceConfig, U as UserOrganization, a6 as ValidateOptions, a5 as ValidationResult, p as defineResource, ab as hookSystem, r as resourceRegistry } from './index-D5QTob1X.js';
+import { l as ResourceConfig } from './index-B4t03KQ0.js';
+export { V as AdapterValidationResult, K as AdditionalRoute, A as AnyRecord, s as ApiResponse, h as AuthPluginOptions, a4 as ConfigError, t as ControllerLike, B as CrudController, y as CrudRepository, e as CrudRouteKey, _ as CrudRouterOptions, G as CrudSchemas, D as DataAdapter, N as EventDefinition, u as FastifyRequestExtras, v as FastifyWithAuth, w as FastifyWithDecorators, F as FieldMetadata, E as FieldRule, a9 as GracefulShutdownOptions, a7 as HealthCheck, a8 as HealthOptions, ac as HookContext, ad as HookHandler, H as HookSystem, I as IController, c as IControllerResponse, a as IRequestContext, $ as InferDocType, a0 as InferResourceDoc, Y as IntrospectionData, i as IntrospectionPluginOptions, J as JWTPayload, M as MiddlewareConfig, Z as OrgScopeOptions, O as OwnershipCheck, P as PaginatedResult, L as PresetFunction, f as PresetResult, x as QueryOptions, W as RegistryEntry, X as RegistryStats, n as RelationMetadata, o as RepositoryLike, b as RequestContext, aa as RequestIdOptions, d as RequestWithExtras, q as ResourceDefinition, T as ResourceMetadata, z as RouteHandler, R as RouteSchemaOptions, m as SchemaMetadata, S as ServiceContext, a2 as TypedController, a3 as TypedRepository, a1 as TypedResourceConfig, U as UserOrganization, a6 as ValidateOptions, a5 as ValidationResult, p as defineResource, ab as hookSystem, r as resourceRegistry } from './index-B4t03KQ0.js';
 export { MongooseAdapter, MongooseAdapterOptions, PrismaAdapter, PrismaAdapterOptions, createMongooseAdapter, createPrismaAdapter } from './adapters/index.js';
-export { B as BaseController, a as BaseControllerOptions } from './BaseController-nNRS3vpA.js';
+export { B as BaseController, a as BaseControllerOptions } from './BaseController-DVAiHxEQ.js';
 export { RouteHandlerMethod } from 'fastify';
 export { P as PermissionCheck, a as PermissionContext, b as PermissionResult, U as UserBase } from './types-B99TBmFV.js';
 export { A as ArcError, F as ForbiddenError, N as NotFoundError, U as UnauthorizedError, V as ValidationError } from './errors-8WIxGS_6.js';
-export { e as gracefulShutdownPlugin, a as healthPlugin, _ as requestIdPlugin } from './arcCorePlugin-CAjBQtZB.js';
+export { e as gracefulShutdownPlugin, a as healthPlugin, _ as requestIdPlugin } from './arcCorePlugin-CsShQdyP.js';
 export { DomainEvent, EventHandler, eventPlugin } from './events/index.js';
 export { allOf, allowPublic, anyOf, denyAll, requireAuth, requireOwnership, requireRoles, when } from './permissions/index.js';
-export { A as ArcFactory, c as createApp } from './createApp-CjN9zZSL.js';
-export { C as CreateAppOptions } from './types-zpN48n6B.js';
+export { A as ArcFactory, c as createApp } from './createApp-Ce9wl8W9.js';
+export { C as CreateAppOptions } from './types-BvckRbs2.js';
 import 'mongoose';
 import '@fastify/cors';
 import '@fastify/helmet';

package/dist/index.js

@@ -2,6 +2,7 @@ import fp from 'fastify-plugin';
 import { randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import Fastify from 'fastify';
+import qs from 'qs';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -2175,6 +2176,23 @@ var ArcQueryParser = class {
     for (const [key, value] of Object.entries(query)) {
       if (reservedKeys.has(key)) continue;
       if (value === void 0 || value === null) continue;
+      if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(key)) continue;
+      if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const operatorObj = value;
+        const operatorKeys = Object.keys(operatorObj);
+        const allOperators = operatorKeys.every((op) => this.operators[op]);
+        if (allOperators && operatorKeys.length > 0) {
+          const mongoFilters = {};
+          for (const [op, opValue] of Object.entries(operatorObj)) {
+            const mongoOp = this.operators[op];
+            if (mongoOp) {
+              mongoFilters[mongoOp] = this.parseFilterValue(opValue, op);
+            }
+          }
+          filters[key] = mongoFilters;
+          continue;
+        }
+      }
       const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_.]*)(?:\[([a-z]+)\])?$/);
       if (!match) continue;
       const [, fieldName, operator] = match;
@@ -2316,6 +2334,8 @@ var BaseController = class _BaseController {
       sort: sortString,
       select: this._sanitizeSelect(selectString, this.schemaOptions),
       populate: this._sanitizePopulate(parsed.populate, this.schemaOptions),
+      // Advanced populate options from MongoKit QueryParser (takes precedence over simple populate)
+      populateOptions: parsed.populateOptions,
       filters: parsed.filters,
       // MongoKit features
       search: parsed.search,
@@ -2431,7 +2451,7 @@ var BaseController = class _BaseController {
         return true;
       }
     }
-    return itemValue === filterValue;
+    return String(itemValue) === String(filterValue);
   }
   /**
    * Check if item matches policy filters (for get/update/delete operations)
@@ -2587,7 +2607,10 @@ var BaseController = class _BaseController {
     const arcContext = req.metadata;
     try {
       const item = await this.repository.getById(id, options);
-      if (!item || !this._checkOrgScope(item, arcContext) || !this._checkPolicyFilters(item, req)) {
+      const hasItem = !!item;
+      const orgScopeOk = this._checkOrgScope(item, arcContext);
+      const policyFiltersOk = this._checkPolicyFilters(item, req);
+      if (!hasItem || !orgScopeOk || !policyFiltersOk) {
         return {
           success: false,
           error: "Resource not found",
@@ -4586,6 +4609,10 @@ async function createApp(options) {
   const fastify = Fastify({
     logger: config.logger ?? true,
     trustProxy: config.trustProxy ?? false,
+    // Use qs parser to support nested bracket notation in query strings
+    // e.g., ?populate[author][select]=name,email → { populate: { author: { select: 'name,email' } } }
+    // This is required for MongoKit's advanced populate options to work
+    querystringParser: (str) => qs.parse(str),
     ajv: {
       customOptions: {
         coerceTypes: true,

package/dist/org/index.d.ts

@@ -1,5 +1,5 @@
 import { RouteHandlerMethod, FastifyPluginAsync } from 'fastify';
-import { b as RequestContext, Z as OrgScopeOptions, z as RouteHandler } from '../index-D5QTob1X.js';
+import { b as RequestContext, Z as OrgScopeOptions, z as RouteHandler } from '../index-B4t03KQ0.js';
 import { U as UserBase } from '../types-B99TBmFV.js';
 import 'mongoose';
 

package/dist/plugins/index.d.ts

@@ -1,6 +1,6 @@
-export { k as ArcCore, A as ArcCorePluginOptions, G as GracefulShutdownOptions, b as HealthCheck, H as HealthOptions, R as RequestIdOptions, T as TracingOptions, f as arcCorePlugin, j as arcCorePluginFn, d as createSpan, e as gracefulShutdownPlugin, g as gracefulShutdownPluginFn, a as healthPlugin, h as healthPluginFn, i as isTracingAvailable, _ as requestIdPlugin, r as requestIdPluginFn, t as traced, c as tracingPlugin } from '../arcCorePlugin-CAjBQtZB.js';
+export { k as ArcCore, A as ArcCorePluginOptions, G as GracefulShutdownOptions, b as HealthCheck, H as HealthOptions, R as RequestIdOptions, T as TracingOptions, f as arcCorePlugin, j as arcCorePluginFn, d as createSpan, e as gracefulShutdownPlugin, g as gracefulShutdownPluginFn, a as healthPlugin, h as healthPluginFn, i as isTracingAvailable, _ as requestIdPlugin, r as requestIdPluginFn, t as traced, c as tracingPlugin } from '../arcCorePlugin-CsShQdyP.js';
 import { FastifyInstance, FastifyRequest } from 'fastify';
-import '../index-D5QTob1X.js';
+import '../index-B4t03KQ0.js';
 import 'mongoose';
 import '../types-B99TBmFV.js';
 

package/dist/presets/index.d.ts

@@ -1,6 +1,6 @@
 import { MultiTenantOptions } from './multiTenant.js';
 export { default as multiTenantPreset } from './multiTenant.js';
-import { f as PresetResult, a as IRequestContext, c as IControllerResponse, P as PaginatedResult, A as AnyRecord, l as ResourceConfig } from '../index-D5QTob1X.js';
+import { f as PresetResult, a as IRequestContext, c as IControllerResponse, P as PaginatedResult, A as AnyRecord, l as ResourceConfig } from '../index-B4t03KQ0.js';
 import 'mongoose';
 import 'fastify';
 import '../types-B99TBmFV.js';

package/dist/presets/multiTenant.d.ts

@@ -1,4 +1,4 @@
-import { d as RequestWithExtras, e as CrudRouteKey, f as PresetResult } from '../index-D5QTob1X.js';
+import { d as RequestWithExtras, e as CrudRouteKey, f as PresetResult } from '../index-B4t03KQ0.js';
 import 'mongoose';
 import 'fastify';
 import '../types-B99TBmFV.js';

package/dist/registry/index.d.ts

@@ -1,5 +1,5 @@
-import { i as IntrospectionPluginOptions } from '../index-D5QTob1X.js';
-export { k as RegisterOptions, j as ResourceRegistry, r as resourceRegistry } from '../index-D5QTob1X.js';
+import { i as IntrospectionPluginOptions } from '../index-B4t03KQ0.js';
+export { k as RegisterOptions, j as ResourceRegistry, r as resourceRegistry } from '../index-B4t03KQ0.js';
 import { FastifyPluginAsync } from 'fastify';
 import 'mongoose';
 import '../types-B99TBmFV.js';

package/dist/testing/index.d.ts

@@ -1,6 +1,6 @@
-import { q as ResourceDefinition, A as AnyRecord, y as CrudRepository } from '../index-D5QTob1X.js';
+import { q as ResourceDefinition, A as AnyRecord, y as CrudRepository } from '../index-B4t03KQ0.js';
 import Fastify, { FastifyInstance } from 'fastify';
-import { C as CreateAppOptions } from '../types-zpN48n6B.js';
+import { C as CreateAppOptions } from '../types-BvckRbs2.js';
 import { Mock } from 'vitest';
 import { Connection } from 'mongoose';
 import '../types-B99TBmFV.js';

package/dist/testing/index.js

@@ -2,6 +2,7 @@ import fp from 'fastify-plugin';
 import { randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import Fastify from 'fastify';
+import qs from 'qs';
 import { describe, beforeAll, afterAll, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import mongoose from 'mongoose';
 
@@ -46964,6 +46965,10 @@ async function createApp(options2) {
   const fastify = Fastify({
     logger: config.logger ?? true,
     trustProxy: config.trustProxy ?? false,
+    // Use qs parser to support nested bracket notation in query strings
+    // e.g., ?populate[author][select]=name,email → { populate: { author: { select: 'name,email' } } }
+    // This is required for MongoKit's advanced populate options to work
+    querystringParser: (str) => qs.parse(str),
     ajv: {
       customOptions: {
         coerceTypes: true,

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
-export { K as AdditionalRoute, A as AnyRecord, s as ApiResponse, ak as ArcDecorator, g as AuthHelpers, h as AuthPluginOptions, ar as Authenticator, aq as AuthenticatorContext, au as BaseControllerOptions, a4 as ConfigError, ax as ControllerHandler, t as ControllerLike, C as ControllerQueryOptions, B as CrudController, y as CrudRepository, e as CrudRouteKey, _ as CrudRouterOptions, G as CrudSchemas, N as EventDefinition, al as EventsDecorator, ay as FastifyHandler, u as FastifyRequestExtras, v as FastifyWithAuth, w as FastifyWithDecorators, E as FieldRule, a9 as GracefulShutdownOptions, a7 as HealthCheck, a8 as HealthOptions, I as IController, c as IControllerResponse, a as IRequestContext, aw as InferDoc, $ as InferDocType, a0 as InferResourceDoc, Y as IntrospectionData, i as IntrospectionPluginOptions, J as JWTPayload, ap as JwtContext, M as MiddlewareConfig, ao as MiddlewareHandler, ah as ObjectId, af as OpenApiSchemas, Z as OrgScopeOptions, O as OwnershipCheck, P as PaginatedResult, av as PaginationParams, ae as ParsedQuery, L as PresetFunction, at as PresetHook, f as PresetResult, x as QueryOptions, Q as QueryParserInterface, W as RegistryEntry, X as RegistryStats, b as RequestContext, aa as RequestIdOptions, d as RequestWithExtras, l as ResourceConfig, an as ResourceHooks, T as ResourceMetadata, am as ResourcePermissions, z as RouteHandler, R as RouteSchemaOptions, S as ServiceContext, as as TokenPair, a2 as TypedController, a3 as TypedRepository, a1 as TypedResourceConfig, ai as UserLike, U as UserOrganization, a6 as ValidateOptions, a5 as ValidationResult, aj as getUserId } from '../index-D5QTob1X.js';
+export { K as AdditionalRoute, A as AnyRecord, s as ApiResponse, al as ArcDecorator, g as AuthHelpers, h as AuthPluginOptions, as as Authenticator, ar as AuthenticatorContext, av as BaseControllerOptions, a4 as ConfigError, ay as ControllerHandler, t as ControllerLike, C as ControllerQueryOptions, B as CrudController, y as CrudRepository, e as CrudRouteKey, _ as CrudRouterOptions, G as CrudSchemas, N as EventDefinition, am as EventsDecorator, az as FastifyHandler, u as FastifyRequestExtras, v as FastifyWithAuth, w as FastifyWithDecorators, E as FieldRule, a9 as GracefulShutdownOptions, a7 as HealthCheck, a8 as HealthOptions, I as IController, c as IControllerResponse, a as IRequestContext, ax as InferDoc, $ as InferDocType, a0 as InferResourceDoc, Y as IntrospectionData, i as IntrospectionPluginOptions, J as JWTPayload, aq as JwtContext, M as MiddlewareConfig, ap as MiddlewareHandler, ah as ObjectId, af as OpenApiSchemas, Z as OrgScopeOptions, O as OwnershipCheck, P as PaginatedResult, aw as PaginationParams, ae as ParsedQuery, ak as PopulateOption, L as PresetFunction, au as PresetHook, f as PresetResult, x as QueryOptions, Q as QueryParserInterface, W as RegistryEntry, X as RegistryStats, b as RequestContext, aa as RequestIdOptions, d as RequestWithExtras, l as ResourceConfig, ao as ResourceHooks, T as ResourceMetadata, an as ResourcePermissions, z as RouteHandler, R as RouteSchemaOptions, S as ServiceContext, at as TokenPair, a2 as TypedController, a3 as TypedRepository, a1 as TypedResourceConfig, ai as UserLike, U as UserOrganization, a6 as ValidateOptions, a5 as ValidationResult, aj as getUserId } from '../index-B4t03KQ0.js';
 export { RouteHandlerMethod } from 'fastify';
 export { Document, Model } from 'mongoose';
 export { P as PermissionCheck, a as PermissionContext, b as PermissionResult, U as UserBase } from '../types-B99TBmFV.js';

package/dist/{types-zpN48n6B.d.ts → types-BvckRbs2.d.ts}

@@ -2,7 +2,7 @@ import { FastifyServerOptions } from 'fastify';
 import { FastifyCorsOptions } from '@fastify/cors';
 import { FastifyHelmetOptions } from '@fastify/helmet';
 import { RateLimitOptions } from '@fastify/rate-limit';
-import { h as AuthPluginOptions } from './index-D5QTob1X.js';
+import { h as AuthPluginOptions } from './index-B4t03KQ0.js';
 
 /**
  * Types for createApp factory

package/dist/utils/index.d.ts

@@ -1,5 +1,5 @@
 export { A as ArcError, C as ConflictError, E as ErrorDetails, F as ForbiddenError, N as NotFoundError, a as OrgAccessDeniedError, O as OrgRequiredError, R as RateLimitError, S as ServiceUnavailableError, U as UnauthorizedError, V as ValidationError, c as createError, i as isArcError } from '../errors-8WIxGS_6.js';
-import { A as AnyRecord, Q as QueryParserInterface, ae as ParsedQuery } from '../index-D5QTob1X.js';
+import { A as AnyRecord, Q as QueryParserInterface, ae as ParsedQuery } from '../index-B4t03KQ0.js';
 import 'mongoose';
 import 'fastify';
 import '../types-B99TBmFV.js';

package/dist/utils/index.js

@@ -851,6 +851,23 @@ var ArcQueryParser = class {
     for (const [key, value] of Object.entries(query)) {
       if (reservedKeys.has(key)) continue;
       if (value === void 0 || value === null) continue;
+      if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(key)) continue;
+      if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const operatorObj = value;
+        const operatorKeys = Object.keys(operatorObj);
+        const allOperators = operatorKeys.every((op) => this.operators[op]);
+        if (allOperators && operatorKeys.length > 0) {
+          const mongoFilters = {};
+          for (const [op, opValue] of Object.entries(operatorObj)) {
+            const mongoOp = this.operators[op];
+            if (mongoOp) {
+              mongoFilters[mongoOp] = this.parseFilterValue(opValue, op);
+            }
+          }
+          filters[key] = mongoFilters;
+          continue;
+        }
+      }
       const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_.]*)(?:\[([a-z]+)\])?$/);
       if (!match) continue;
       const [, fieldName, operator] = match;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "Resource-oriented backend framework for Fastify + MongoDB",
   "type": "module",
   "exports": {
@@ -119,16 +119,16 @@
     "node": ">=20"
   },
   "peerDependencies": {
-    "@classytic/mongokit": "^3.0.0",
-    "fastify": "^5.0.0",
-    "mongoose": "^8.0.0 || ^9.0.0",
+    "@classytic/mongokit": "^3.1.6",
     "@fastify/cors": "^11.0.0",
     "@fastify/helmet": "^13.0.0",
+    "@fastify/multipart": "^9.0.0",
     "@fastify/rate-limit": "^10.0.0",
     "@fastify/sensible": "^6.0.0",
     "@fastify/under-pressure": "^9.0.0",
-    "@fastify/multipart": "^9.0.0",
+    "fastify": "^5.0.0",
     "fastify-raw-body": "^5.0.0",
+    "mongoose": "^8.0.0 || ^9.0.0",
     "pino-pretty": "^13.0.0"
   },
   "peerDependenciesMeta": {
@@ -185,14 +185,16 @@
     }
   },
   "dependencies": {
-    "fastify-plugin": "^5.0.1"
+    "fastify-plugin": "^5.0.1",
+    "qs": "^6.14.1"
   },
   "devDependencies": {
-    "@classytic/mongokit": "^3.1.0",
+    "@classytic/mongokit": "^3.1.6",
     "@fastify/jwt": "^9.0.0",
     "@fastify/multipart": "^9.0.0",
     "@types/jsonwebtoken": "^9.0.0",
     "@types/node": "^22.10.0",
+    "@types/qs": "^6.14.0",
     "fastify-raw-body": "^5.0.0",
     "jsonwebtoken": "^9.0.0",
     "mongodb-memory-server": "^11.0.1",
@@ -218,4 +220,4 @@
     "type": "git",
     "url": "https://github.com/classytic/arc.git"
   }
-}
+}