@classytic/arc 2.15.4 → 2.16.0

package/dist/utils/index.mjs

@@ -1,5 +1,5 @@
 import { a as OrgAccessDeniedError, c as ServiceUnavailableError, d as createDomainError, f as createError, i as NotFoundError, l as UnauthorizedError, n as ConflictError, o as OrgRequiredError, p as isArcError, r as ForbiddenError, s as RateLimitError, t as ArcError, u as ValidationError } from "../errors-j4aJm1Wg.mjs";
-import { A as assertValidConfig, C as withCompensation, D as CircuitState, E as CircuitBreakerRegistry, M as validateResourceConfig, N as simpleEqualityMatcher, O as createCircuitBreaker, S as defineCompensation, T as CircuitBreakerError, _ as ArcQueryParser, a as bareListResponse, b as defineGuard, c as errorDetailSchema, d as keysetListResponse, f as listResponse, g as responses, h as queryParams, i as aggregateListResponse, j as formatValidationErrors, k as createCircuitBreakerRegistry, l as getDefaultCrudSchemas, m as paginationSchema, n as createStateMachine, o as deleteResponse, p as offsetListResponse, r as scheduleBackground, s as errorContractSchema, t as getUserId, u as getListQueryParams, v as createQueryParser, w as CircuitBreaker, x as defineErrorMapper, y as handleRaw } from "../utils-_h9B3c57.mjs";
+import { A as assertValidConfig, C as withCompensation, D as CircuitState, E as CircuitBreakerRegistry, M as validateResourceConfig, N as simpleEqualityMatcher, O as createCircuitBreaker, S as defineCompensation, T as CircuitBreakerError, _ as ArcQueryParser, a as bareListResponse, b as defineGuard, c as errorDetailSchema, d as keysetListResponse, f as listResponse, g as responses, h as queryParams, i as aggregateListResponse, j as formatValidationErrors, k as createCircuitBreakerRegistry, l as getDefaultCrudSchemas, m as paginationSchema, n as createStateMachine, o as deleteResponse, p as offsetListResponse, r as scheduleBackground, s as errorContractSchema, t as getUserId, u as getListQueryParams, v as createQueryParser, w as CircuitBreaker, x as defineErrorMapper, y as handleRaw } from "../utils-DC5ycPfr.mjs";
 import { a as toJsonSchema, i as isZodSchema, n as convertRouteSchema, r as isJsonSchema, t as convertOpenApiSchemas } from "../schemaConverter-De34B1ZG.mjs";
 import { t as hasEvents } from "../typeGuards-BzkXkvVv.mjs";
 export { ArcError, ArcQueryParser, CircuitBreaker, CircuitBreakerError, CircuitBreakerRegistry, CircuitState, ConflictError, ForbiddenError, NotFoundError, OrgAccessDeniedError, OrgRequiredError, RateLimitError, ServiceUnavailableError, UnauthorizedError, ValidationError, aggregateListResponse, assertValidConfig, bareListResponse, convertOpenApiSchemas, convertRouteSchema, createCircuitBreaker, createCircuitBreakerRegistry, createDomainError, createError, createQueryParser, createStateMachine, defineCompensation, defineErrorMapper, defineGuard, deleteResponse, errorContractSchema, errorDetailSchema, formatValidationErrors, getDefaultCrudSchemas, getListQueryParams, getUserId, handleRaw, hasEvents, isArcError, isJsonSchema, isZodSchema, keysetListResponse, listResponse, offsetListResponse, paginationSchema, queryParams, responses, scheduleBackground, simpleEqualityMatcher, toJsonSchema, validateResourceConfig, withCompensation };

package/dist/{utils-_h9B3c57.mjs → utils-DC5ycPfr.mjs}

@@ -1,7 +1,7 @@
-import { m as RESERVED_QUERY_PARAMS, t as CRUD_OPERATIONS } from "./constants-Cxde4rpC.mjs";
+import { m as RESERVED_QUERY_PARAMS, t as CRUD_OPERATIONS } from "./constants-TrJVIJl0.mjs";
 import { arcLog } from "./logger/index.mjs";
 import { t as ArcError } from "./errors-j4aJm1Wg.mjs";
-import { r as getAvailablePresets } from "./presets-BbkjdPeH.mjs";
+import { r as getAvailablePresets } from "./presets-C9BE6WaZ.mjs";
 import { errorContractSchema as errorContractSchema$1, errorDetailSchema as errorDetailSchema$1 } from "@classytic/repo-core/errors";
 //#region src/utils/simpleEqualityMatcher.ts
 /**
@@ -236,9 +236,11 @@ function validateRoutes(routes, errors) {
 			message: `Route path must start with "/" (got "${route.path}")`,
 			suggestion: `Change to "/${route.path}"`
 		});
-		if (!route.handler) errors.push({
+		const routeWithRefs = route;
+		if (!route.handler && typeof routeWithRefs.controllerMethod !== "function") errors.push({
 			field: `routes[${i}].handler`,
-			message: "Route handler is required"
+			message: "Route must declare either `handler` (string / function) or `controllerMethod`",
+			suggestion: "Prefer `controllerMethod: (c: MyController) => c.method` for typed handler refs."
 		});
 		const routeKey = `${route.method} ${route.path}`;
 		if (seenRoutes.has(routeKey)) errors.push({
@@ -761,12 +763,26 @@ const DANGEROUS_REGEX_PATTERNS = /(\{[0-9,]+\}|\*\+|\+\+|\?\+|(\(.+\))\+|\(\?:|\
 * Converts URL query parameters to a structured query format:
 * - Pagination: ?page=1&limit=20
 * - Sorting: ?sort=-createdAt,name (- prefix = descending)
-* - Filtering: ?status=active&price[gte]=100&price[lte]=500
+* - Filtering — TWO supported forms (both produce identical output):
+*     - Bare (default, terse):     `?status=active&price[gte]=100&price[lte]=500`
+*     - Bracket envelope:          `?filter[status]=active&filter[price][gte]=100`
+*   The envelope form matches the convention used by JSON:API / Stripe /
+*   most modern REST style guides, and is the safe choice on busy URLs
+*   that might otherwise collide with reserved meta keys (`page`, `sort`,
+*   `select`, `populate`, etc.). Operator notation (`[gte]`, `[lte]`,
+*   `[ne]`, `[in]`, ...) works inside either form.
 * - Search: ?search=keyword
 * - Populate: ?populate=author,category
 * - Field selection: ?select=name,price,status
 * - Keyset pagination: ?after=cursor_value
 *
+* **NOTE on parser portability.** `ArcQueryParser` accepts both filter
+* forms. Other parser implementations (`@classytic/mongokit`'s
+* `QueryParser`, custom hosts-side parsers) may accept only one form —
+* MongoKit historically only accepts the bare form. If your host swaps
+* `queryParser` to a different implementation, double-check which forms
+* it understands before publishing URLs that mix the two.
+*
 * For advanced MongoDB features ($lookup, aggregations), use MongoKit's QueryParser.
 */
 var ArcQueryParser = class {
@@ -930,49 +946,82 @@ var ArcQueryParser = class {
 		if (typeof obj !== "object") return false;
 		return Object.values(obj).some((v) => this.exceedsDepth(v, currentDepth + 1));
 	}
+	/**
+	* Parse all filter entries from the query, supporting BOTH the bare
+	* top-level form and the bracket-wrapped `filter[...]` envelope.
+	*
+	* Two equivalent ways to express the same query:
+	*   - Bare (legacy, arc default): `?status=active&price[gte]=40`
+	*   - Bracket envelope (REST convention): `?filter[status]=active&filter[price][gte]=40`
+	*
+	* Both forms parse to the same `filters: { status: 'active', price: { $gte: 40 } }`.
+	* The envelope form mirrors the convention used by most REST API style
+	* guides (JSON:API, Stripe API, etc.) and disambiguates filter fields
+	* from reserved meta params on busy URLs — a query string with a field
+	* literally named `page` or `sort` can't collide with the framework's
+	* meta keys when wrapped under `filter[...]`. The bare form stays as
+	* the default since it's the shortest path for simple queries; expect
+	* it to remain supported indefinitely.
+	*
+	* Precedence when the same key appears in both forms:
+	*   `?status=closed&filter[status]=active` → bare wins (`status: closed`).
+	* Mixing should be rare; the deterministic rule avoids silent surprises.
+	*/
 	parseFilters(query) {
 		const filters = {};
+		const envelope = query.filter;
+		if (typeof envelope === "object" && envelope !== null && !Array.isArray(envelope)) for (const [key, value] of Object.entries(envelope)) this.applyFilterEntry(filters, key, value);
 		for (const [key, value] of Object.entries(query)) {
 			if (RESERVED_QUERY_PARAMS.has(key)) continue;
-			if (value === void 0 || value === null) continue;
-			if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(key)) continue;
-			if (this._allowedFilterFields && !this._allowedFilterFields.has(key)) continue;
-			if (this.exceedsDepth(value)) continue;
-			if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-				const operatorObj = value;
-				const operatorKeys = Object.keys(operatorObj);
-				const allOperators = operatorKeys.every((op) => this.operators[op] && (!this._allowedOperators || this._allowedOperators.has(op)));
-				const allKnownOperators = operatorKeys.every((op) => this.operators[op]);
-				if (allOperators && operatorKeys.length > 0) {
-					const mongoFilters = {};
-					let needsCaseInsensitive = false;
-					for (const [op, opValue] of Object.entries(operatorObj)) {
-						const mongoOp = this.operators[op];
-						if (mongoOp) {
-							mongoFilters[mongoOp] = this.parseFilterValue(opValue, op);
-							if (op === "contains" || op === "like") needsCaseInsensitive = true;
-						}
+			this.applyFilterEntry(filters, key, value);
+		}
+		return filters;
+	}
+	/**
+	* Apply one filter entry — used by both the bracket-envelope branch and
+	* the bare top-level branch of `parseFilters`. Centralising the field-
+	* validation + operator-conversion logic keeps the two forms in
+	* lockstep; a future regex/security tweak only changes one place.
+	*/
+	applyFilterEntry(filters, key, value) {
+		if (value === void 0 || value === null) return;
+		if (!/^[a-zA-Z_][a-zA-Z0-9_.]*(?:\[[a-z]+\])?$/.test(key)) return;
+		const bareKey = key.replace(/\[[a-z]+\]$/, "");
+		if (this._allowedFilterFields && !this._allowedFilterFields.has(bareKey)) return;
+		if (this.exceedsDepth(value)) return;
+		if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+			const operatorObj = value;
+			const operatorKeys = Object.keys(operatorObj);
+			const allOperators = operatorKeys.every((op) => this.operators[op] && (!this._allowedOperators || this._allowedOperators.has(op)));
+			const allKnownOperators = operatorKeys.every((op) => this.operators[op]);
+			if (allOperators && operatorKeys.length > 0) {
+				const mongoFilters = {};
+				let needsCaseInsensitive = false;
+				for (const [op, opValue] of Object.entries(operatorObj)) {
+					const mongoOp = this.operators[op];
+					if (mongoOp) {
+						mongoFilters[mongoOp] = this.parseFilterValue(opValue, op);
+						if (op === "contains" || op === "like") needsCaseInsensitive = true;
 					}
-					if (needsCaseInsensitive) mongoFilters.$options = "i";
-					filters[key] = mongoFilters;
-					continue;
 				}
-				if (allKnownOperators && this._allowedOperators) continue;
+				if (needsCaseInsensitive) mongoFilters.$options = "i";
+				filters[key] = mongoFilters;
+				return;
 			}
-			const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_.]*)(?:\[([a-z]+)\])?$/);
-			if (!match) continue;
-			const [, fieldName, operator] = match;
-			if (!fieldName) continue;
-			if (operator && this.operators[operator] && (!this._allowedOperators || this._allowedOperators.has(operator))) {
-				const mongoOp = this.operators[operator];
-				const parsedValue = this.parseFilterValue(value, operator);
-				if (!filters[fieldName]) filters[fieldName] = {};
-				const fieldFilter = filters[fieldName];
-				fieldFilter[mongoOp] = parsedValue;
-				if (operator === "contains" || operator === "like") fieldFilter.$options = "i";
-			} else if (!operator) filters[fieldName] = this.parseFilterValue(value);
+			if (allKnownOperators && this._allowedOperators) return;
 		}
-		return filters;
+		const match = key.match(/^([a-zA-Z_][a-zA-Z0-9_.]*)(?:\[([a-z]+)\])?$/);
+		if (!match) return;
+		const [, fieldName, operator] = match;
+		if (!fieldName) return;
+		if (operator && this.operators[operator] && (!this._allowedOperators || this._allowedOperators.has(operator))) {
+			const mongoOp = this.operators[operator];
+			const parsedValue = this.parseFilterValue(value, operator);
+			if (!filters[fieldName]) filters[fieldName] = {};
+			const fieldFilter = filters[fieldName];
+			fieldFilter[mongoOp] = parsedValue;
+			if (operator === "contains" || operator === "like") fieldFilter.$options = "i";
+		} else if (!operator) filters[fieldName] = this.parseFilterValue(value);
 	}
 	parseFilterValue(value, operator) {
 		if (operator === "in" || operator === "nin") {

package/dist/{buildHandler-CcFOpJLh.mjs → validate-By96rH0r.mjs}

@@ -1,4 +1,11 @@
+import { t as __exportAll } from "./chunk-BpYLSNr0.mjs";
 //#region src/core/aggregation/validate.ts
+var validate_exports = /* @__PURE__ */ __exportAll({
+	ArcAggregationConfigError: () => ArcAggregationConfigError,
+	adapterSupportsAggregate: () => adapterSupportsAggregate,
+	compileAggRequest: () => compileAggRequest,
+	validateAggregations: () => validateAggregations
+});
 /** Thrown on aggregation misconfig at boot time. */
 var ArcAggregationConfigError = class extends Error {
 	name = "ArcAggregationConfigError";
@@ -373,302 +380,4 @@ function assertFieldAllowed(context, ref, input) {
 	if (blockedFields.has(ref)) throw new ArcAggregationConfigError(`Resource "${resourceName}" aggregation "${aggregationName}" references field "${ref}" in ${context}, but the field is blocked from aggregation (\`hidden: true\` or \`aggregable: false\` in schemaOptions.fieldRules). Aggregating hidden fields would leak cardinality information.`);
 }
 //#endregion
-//#region src/core/aggregation/buildHandler.ts
-/**
-* Framework-agnostic aggregation execution. Runs safety guards,
-* compiles the AggRequest, dispatches to the materialized hook or
-* `repo.aggregate()`, and applies the post-execution `maxGroups` cap.
-*
-* Returns an envelope describing the response — Fastify wrappers
-* apply it to a reply, MCP wrappers convert it to a tool-call result.
-*
-* **Does NOT run the per-aggregation permission check.** Auth runs
-* upstream (Fastify preHandler chain or MCP `evaluatePermission`)
-* because the permission shape differs by surface (FastifyRequest vs
-* MCP session). Both surfaces fail-closed BEFORE reaching this
-* function; this is purely the runtime executor.
-*/
-async function executeAggregation(normalized, deps, ctx) {
-	const { repo } = deps;
-	const config = normalized.base;
-	const aggregationName = normalized.name;
-	const { query, tenantOptions } = ctx;
-	const guardError = checkRequestGuards(query, config);
-	if (guardError) return {
-		status: 400,
-		body: guardError
-	};
-	const aggReq = compileAggRequest(normalized, extractCallerFilter(query), tenantOptions);
-	if (config.materialized) {
-		const matCtx = {
-			filter: aggReq.filter,
-			orgId: pickString(tenantOptions.organizationId),
-			userId: pickString(tenantOptions.userId),
-			requestId: pickString(tenantOptions.requestId),
-			query
-		};
-		return {
-			status: 200,
-			headers: { "x-aggregation-source": "materialized" },
-			body: { rows: (await config.materialized(matCtx)).rows }
-		};
-	}
-	if (!adapterSupportsAggregate(repo)) return {
-		status: 501,
-		body: {
-			code: "arc.adapter.capability_required",
-			message: `Aggregation "${aggregationName}" is not supported: the resource's storage adapter does not implement repo.aggregate(). Use a kit that ships StandardRepo.aggregate (mongokit / sqlitekit), or remove the aggregations entry.`,
-			status: 501,
-			meta: {
-				capability: "aggregate",
-				aggregation: aggregationName
-			}
-		}
-	};
-	let result;
-	try {
-		result = await repo.aggregate(aggReq, tenantOptions);
-	} catch (err) {
-		return mapAggregateError(err, aggregationName);
-	}
-	if (config.maxGroups !== void 0 && result.rows.length > config.maxGroups) return {
-		status: 422,
-		body: {
-			code: "arc.aggregation.max_groups_exceeded",
-			message: `Aggregation "${aggregationName}" produced ${result.rows.length} groups, exceeding maxGroups (${config.maxGroups}). Narrow the filter or raise the cap.`,
-			status: 422,
-			meta: {
-				aggregation: aggregationName,
-				produced: result.rows.length,
-				maxGroups: config.maxGroups
-			}
-		}
-	};
-	return {
-		status: 200,
-		body: { rows: result.rows }
-	};
-}
-/**
-* Build the Fastify handler for a single aggregation.
-*
-* The returned function calls the repo (or materialized hook), shapes
-* the response envelope, and writes status/headers via Fastify's
-* `reply` API. Errors throw — the router's error handler converts to
-* the standard arc response shape.
-*/
-/**
-* Build the Fastify handler for a single aggregation.
-*
-* Caching lives in the kit's repo-core `cachePlugin` — when the host
-* declares `cache:` on the aggregation, `compileAggRequest` translates
-* to `aggReq.cache: CacheOptions` and the kit handles SWR + tag
-* invalidation + version-bump on writes. Arc passes the request
-* through; no duplicate cache layer at the HTTP handler.
-*/
-function buildAggregationHandler(normalized, deps) {
-	const { buildOptions } = deps;
-	return async (request, reply) => {
-		const result = await executeAggregation(normalized, deps, {
-			query: request.query ?? {},
-			tenantOptions: buildOptions(request)
-		});
-		reply.status(result.status);
-		if (result.headers) for (const [k, v] of Object.entries(result.headers)) reply.header(k, v);
-		return result.body;
-	};
-}
-function pickString(value) {
-	return typeof value === "string" ? value : void 0;
-}
-function checkRequestGuards(query, config) {
-	if (config.requireFilters) {
-		for (const field of config.requireFilters) if (!hasFilterOnField(query, field)) return {
-			code: "arc.aggregation.required_filter_missing",
-			message: `Aggregation requires filter on "${field}" — supply ?${field}=... or ?${field}[op]=... in the query string.`,
-			status: 400,
-			meta: { field }
-		};
-	}
-	if (config.requireDateRange) {
-		const { field, maxRangeDays } = config.requireDateRange;
-		const range = parseDateRange(query, field);
-		if (!range) return {
-			code: "arc.aggregation.required_date_range_missing",
-			message: `Aggregation requires a bounded date range on "${field}" — supply ?${field}[gte]=... and ?${field}[lt]=... (or ?${field}[lte]=...).`,
-			status: 400,
-			meta: { field }
-		};
-		if (maxRangeDays !== void 0) {
-			const days = (range.upper.getTime() - range.lower.getTime()) / 864e5;
-			if (days > maxRangeDays) return {
-				code: "arc.aggregation.date_range_exceeded",
-				message: `Aggregation date range on "${field}" exceeds the cap (${maxRangeDays} days). Requested range: ${days.toFixed(1)} days. Narrow the range and retry.`,
-				status: 400,
-				meta: {
-					field,
-					maxRangeDays,
-					requestedDays: days
-				}
-			};
-		}
-	}
-	return null;
-}
-function hasFilterOnField(query, field) {
-	const direct = query[field];
-	if (direct !== void 0 && direct !== "") return true;
-	for (const key of Object.keys(query)) if (key.startsWith(`${field}[`)) return true;
-	return false;
-}
-function parseDateRange(query, field) {
-	let gte;
-	let lte;
-	const nested = query[field];
-	if (nested && typeof nested === "object" && !Array.isArray(nested)) {
-		const ops = nested;
-		gte = pickString(ops.gte) ?? pickString(ops.gt);
-		lte = pickString(ops.lte) ?? pickString(ops.lt);
-	}
-	if (!gte) gte = pickString(query[`${field}[gte]`]) ?? pickString(query[`${field}[gt]`]);
-	if (!lte) lte = pickString(query[`${field}[lte]`]) ?? pickString(query[`${field}[lt]`]);
-	if (!gte || !lte) return null;
-	const lower = new Date(gte);
-	const upper = new Date(lte);
-	if (Number.isNaN(lower.getTime()) || Number.isNaN(upper.getTime())) return null;
-	if (upper <= lower) return null;
-	return {
-		lower,
-		upper
-	};
-}
-/**
-* Bracket-syntax operator shorthand → canonical Mongo operator. Mirrors
-* the `operators` map in `ArcQueryParser` so the aggregation route emits
-* the same shape the CRUD list route produces. Aggregations don't run
-* through the resource-level QueryParser (they have their own URL→IR
-* compile path), so this translation has to happen in arc itself —
-* downstream kits' filter compilers expect canonical `$gte/$lte/$in/...`
-* keys, not bare `gte/lte/in/...` shorthand.
-*/
-const OPERATOR_SHORTHAND = {
-	eq: "$eq",
-	ne: "$ne",
-	gt: "$gt",
-	gte: "$gte",
-	lt: "$lt",
-	lte: "$lte",
-	in: "$in",
-	nin: "$nin",
-	like: "$regex",
-	contains: "$regex",
-	regex: "$regex",
-	exists: "$exists",
-	size: "$size",
-	type: "$type"
-};
-const SHORTHAND_RANGE_OPS = new Set([
-	"gt",
-	"gte",
-	"lt",
-	"lte"
-]);
-const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
-function tryCoerceDate(v) {
-	if (typeof v !== "string" || !ISO_DATE_RE.test(v)) return v;
-	const d = new Date(v);
-	return Number.isNaN(d.getTime()) ? v : d;
-}
-/**
-* Translate a qs-parsed nested-operator object (`{ field: { gte, lte } }`)
-* into Mongo-shape (`{ field: { $gte: Date, $lte: Date } }`). Only fires
-* when EVERY key is a known shorthand operator — leaves user-data
-* objects untouched so callers can still equality-match on a stored
-* sub-document.
-*/
-function expandShorthandOperators(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return value;
-	const nested = value;
-	const keys = Object.keys(nested);
-	if (keys.length === 0) return value;
-	if (!keys.every((k) => !k.startsWith("$") && OPERATOR_SHORTHAND[k] !== void 0)) return value;
-	const expanded = {};
-	for (const [op, opVal] of Object.entries(nested)) {
-		const mongoOp = OPERATOR_SHORTHAND[op];
-		if (!mongoOp) continue;
-		expanded[mongoOp] = SHORTHAND_RANGE_OPS.has(op) ? tryCoerceDate(opVal) : opVal;
-	}
-	return expanded;
-}
-/**
-* Strip control params (page/limit/sort/select/...) and the resource-
-* dispatch verbs from the query, leaving only filter predicates the
-* caller used to narrow the aggregation. Bracket-syntax operator
-* shorthand (`createdAt[gte]=...`) gets translated to canonical Mongo-
-* shape here so kits don't have to reimplement the URL grammar — same
-* contract `ArcQueryParser` enforces for the CRUD list route.
-*
-* The resulting record is shallow-merged into the AggRequest filter
-* via `compileAggRequest`.
-*/
-function extractCallerFilter(query) {
-	const out = {};
-	const reserved = new Set([
-		"page",
-		"limit",
-		"after",
-		"sort",
-		"select",
-		"populate",
-		"search",
-		"_count",
-		"_distinct",
-		"_exists"
-	]);
-	for (const [key, value] of Object.entries(query)) {
-		if (reserved.has(key)) continue;
-		if (value === void 0 || value === "") continue;
-		out[key] = expandShorthandOperators(value);
-	}
-	return out;
-}
-/**
-* Map a kit-thrown error to the framework-agnostic execute response.
-* Detects two well-known signals:
-*   - "unsupported" / "not implemented" → 501 with upgrade hint
-*   - timeout markers → 504
-*   - everything else → 500
-*/
-function mapAggregateError(err, aggregationName) {
-	const message = err instanceof Error ? err.message : String(err);
-	const lower = message.toLowerCase();
-	if (lower.includes("unsupported") || lower.includes("not implemented")) return {
-		status: 501,
-		body: {
-			code: "arc.adapter.capability_required",
-			message: `Aggregation "${aggregationName}" failed: ${message}. The kit may not yet support this feature (e.g. lookups in aggregate). Upgrade the kit or remove the unsupported field.`,
-			status: 501,
-			meta: { aggregation: aggregationName }
-		}
-	};
-	if (lower.includes("maxtimems") || lower.includes("timeout") || lower.includes("timed out")) return {
-		status: 504,
-		body: {
-			code: "arc.gateway_timeout",
-			message: `Aggregation "${aggregationName}" timed out: ${message}. Narrow the filter or raise the timeout.`,
-			status: 504,
-			meta: { aggregation: aggregationName }
-		}
-	};
-	return {
-		status: 500,
-		body: {
-			code: "arc.internal_error",
-			message: `Aggregation "${aggregationName}" failed: ${message}`,
-			status: 500,
-			meta: { aggregation: aggregationName }
-		}
-	};
-}
-//#endregion
-export { executeAggregation as n, validateAggregations as r, buildAggregationHandler as t };
+export { validate_exports as i, compileAggRequest as n, validateAggregations as r, adapterSupportsAggregate as t };

package/dist/{versioning-hmkPcDlX.d.mts → versioning-ZwX9tmbS.d.mts}

@@ -1,4 +1,4 @@
-import { n as DomainEvent } from "./EventTransport-CT_52aWU.mjs";
+import { n as DomainEvent } from "./EventTransport-C-2oAHtw.mjs";
 import { FastifyPluginAsync, FastifyRequest } from "fastify";
 
 //#region src/plugins/health.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.15.4",
+  "version": "2.16.0",
   "description": "Resource-oriented backend framework for Fastify - clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -48,14 +48,6 @@
       "types": "./dist/auth/index.d.mts",
       "default": "./dist/auth/index.mjs"
     },
-    "./org": {
-      "types": "./dist/org/index.d.mts",
-      "default": "./dist/org/index.mjs"
-    },
-    "./org/types": {
-      "types": "./dist/org/types.d.mts",
-      "default": "./dist/org/types.mjs"
-    },
     "./hooks": {
       "types": "./dist/hooks/index.d.mts",
       "default": "./dist/hooks/index.mjs"
@@ -227,8 +219,8 @@
     "lint:fix": "biome check --fix src/",
     "lint:all": "biome check src/ tests/",
     "test": "vitest run",
-    "test:main": "vitest run",
-    "test:perf": "node --expose-gc ./node_modules/vitest/vitest.mjs run --config vitest.perf.config.ts",
+    "test:main": "vitest run --no-file-parallelism",
+    "test:perf": "node --expose-gc ./node_modules/vitest/vitest.mjs run --config vitest.perf.config.ts --no-file-parallelism",
     "test:ci": "npm run test:main && npm run test:perf",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
@@ -245,8 +237,8 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@classytic/primitives": ">=0.5.0",
-    "@classytic/repo-core": ">=0.4.1",
+    "@classytic/primitives": ">=0.6.0",
+    "@classytic/repo-core": ">=0.5.0",
     "@classytic/streamline": ">=2.3.3",
     "@fastify/cors": ">=11.0.0",
     "@fastify/helmet": ">=13.0.0",
@@ -349,18 +341,18 @@
   },
   "dependencies": {
     "fastify-plugin": "^5.0.1",
-    "qs": "^6.15.1",
+    "qs": "^6.15.2",
     "secure-json-parse": "^4.1.0"
   },
   "devDependencies": {
     "@better-auth/drizzle-adapter": "^1.6.9",
     "@better-auth/mongo-adapter": "^1.6.9",
-    "@biomejs/biome": "^2.4.11",
+    "@biomejs/biome": "^2.4.15",
     "@classytic/dev-tools": "^0.2.0",
-    "@classytic/mongokit": "^3.13.2",
-    "@classytic/primitives": "^0.4.0",
-    "@classytic/repo-core": "^0.4.1",
-    "@classytic/sqlitekit": "^0.3.1",
+    "@classytic/mongokit": "^3.14.0",
+    "@classytic/primitives": "^0.6.0",
+    "@classytic/repo-core": "^0.5.0",
+    "@classytic/sqlitekit": "^0.4.0",
     "@classytic/streamline": "^2.3.3",
     "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",
@@ -374,27 +366,28 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.1",
     "@sinclair/typebox": "^0.34.0",
-    "@types/node": "^22.10.0",
-    "@types/qs": "^6.14.0",
+    "@types/node": "^22.19.19",
+    "@types/qs": "^6.15.1",
     "@vitest/coverage-v8": "^3.2.4",
     "ajv": "^8.18.0",
     "better-auth": "^1.6.9",
-    "better-sqlite3": "^12.9.0",
-    "bullmq": "^5.73.5",
+    "better-sqlite3": "^12.10.0",
+    "bullmq": "^5.76.9",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
-    "fast-check": "^4.6.0",
+    "fast-check": "^4.8.0",
+    "fastify": "^5.8.5",
     "fastify-raw-body": "^5.0.0",
     "ioredis": "^5.10.1",
     "jsonwebtoken": "^9.0.0",
-    "knip": "^6.4.1",
+    "knip": "^6.14.1",
     "mongodb": "^7.1.0",
     "mongodb-memory-server": "^11.0.1",
-    "mongoose": ">=9.4.1",
+    "mongoose": "^9.6.2",
     "tsdown": "^0.21.7",
     "typescript": "^6.0.2",
     "vitest": "^3.0.0",
-    "ws": "^8.0.0",
+    "ws": "^8.20.1",
     "zod": "^4.3.6"
   },
   "keywords": [
@@ -420,4 +413,4 @@
     "type": "git",
     "url": "https://github.com/classytic/arc.git"
   }
-}
+}