@classytic/arc 2.23.0 → 2.28.0

package/dist/cli/commands/describe.d.mts

@@ -1,4 +1,4 @@
-import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-BBsvQt7U.mjs";
+import { Nt as RateLimitConfig, V as ResourceDefinition, et as RouteSchemaOptions } from "../../index-DPRH0Cme.mjs";
 //#region src/cli/commands/describe.d.ts
 interface DescribedResource {
   name: string;

package/dist/cli/commands/docs.mjs

@@ -1,4 +1,4 @@
-import { t as buildOpenApiSpec } from "../../openapi-jSDx-VDv.mjs";
+import { t as buildOpenApiSpec } from "../../openapi-BLV4OMXb.mjs";
 import { t as loadResourcesFromEntry } from "../../loadResourcesFromEntry-kvGT6EcO.mjs";
 import { dirname, resolve } from "node:path";
 import { mkdirSync, writeFileSync } from "node:fs";

package/dist/cli/commands/generate.mjs

@@ -1,2 +1,2 @@
-import { t as generate } from "../../generate-usRSdQmP.mjs";
+import { t as generate } from "../../generate-D0wZupBg.mjs";
 export { generate };

package/dist/cli/commands/init.mjs

@@ -1,2 +1,2 @@
-import { t as init } from "../../init-CjO4p_q1.mjs";
+import { t as init } from "../../init-tlRSt667.mjs";
 export { init };

package/dist/cli/index.mjs

@@ -1,7 +1,7 @@
 import { describe } from "./commands/describe.mjs";
 import { exportDocs } from "./commands/docs.mjs";
 import { doctor } from "./commands/doctor.mjs";
-import { t as generate } from "../generate-usRSdQmP.mjs";
-import { t as init } from "../init-CjO4p_q1.mjs";
+import { t as generate } from "../generate-D0wZupBg.mjs";
+import { t as init } from "../init-tlRSt667.mjs";
 import { introspect } from "./commands/introspect.mjs";
 export { describe, doctor, exportDocs, generate, init, introspect };

package/dist/context/index.mjs

@@ -1,65 +1,3 @@
-import { n as requestContext, t as getTraceHeaders } from "../requestContext-BZKOr13H.mjs";
-import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/context/transactionContext.ts
-/**
-* Transaction Context via AsyncLocalStorage
-*
-* Provides a Unit-of-Work (UoW) hook so any code in the call stack can
-* retrieve the active database session/transaction without it being threaded
-* through every function parameter.
-*
-* Arc is DB-agnostic — the session type is `unknown` so any backend
-* (Mongoose session, Prisma transaction, pg client, Drizzle client) can
-* participate. Kit adapters call `runInTransaction(session, fn)` to install
-* the active context; the outbox's `store()` reads it automatically when no
-* explicit `options.session` is passed.
-*
-* @example
-* ```typescript
-* // In a Mongoose-backed service (mongokit adapter)
-* import { transactionContext } from '@classytic/arc/context';
-*
-* await mongoose.connection.withSession(async (session) => {
-*   await session.withTransaction(async () => {
-*     await transactionContext.run(session, async () => {
-*       await orders.insertOne(order, { session });
-*       // outbox.store() auto-picks up `session` — no manual threading
-*       await outbox.store(orderCreatedEvent);
-*     });
-*   });
-* });
-* ```
-*
-* @example
-* ```typescript
-* // Opt-out: explicit session always wins over the ALS context
-* await outbox.store(event, { session: explicitSession });
-* ```
-*/
-const storage = new AsyncLocalStorage();
-/**
-* Transaction context API.
-*
-* - `run(session, fn)` — install an active DB session for the duration of `fn`
-* - `get()` — read the current session (undefined if outside a transaction scope)
-*/
-const transactionContext = {
-	/**
-	* Run `fn` with `session` as the active DB transaction context.
-	* Any call to `get()` within `fn`'s async call stack returns `session`.
-	*/
-	run(session, fn) {
-		return storage.run(session, fn);
-	},
-	/**
-	* Get the current DB session, or `undefined` if not inside a
-	* `transactionContext.run(...)` scope.
-	*/
-	get() {
-		return storage.getStore();
-	},
-	/** The underlying AsyncLocalStorage instance. Exposed for advanced integrations. */
-	storage
-};
-//#endregion
+import { n as requestContext, t as getTraceHeaders } from "../requestContext-MrlJwECf.mjs";
+import { t as transactionContext } from "../transactionContext-PNdoyLLm.mjs";
 export { getTraceHeaders, requestContext, transactionContext };

package/dist/core/index.d.mts

@@ -1,3 +1,3 @@
-import { B as defineResource, Bn as BodySanitizer, In as BaseControllerOptions, Ln as ControllerConfigurableOptions, Rn as ControllerConstructionOptions, V as ResourceDefinition, Vn as BodySanitizerConfig, an as TreeMixin, cn as BulkExt, ct as AggMeasureShorthand, dn as QueryResolver, dt as AggregationDateRangeRequirement, fn as QueryResolverConfig, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as TreeExt, ln as BulkMixin, lt as AggregationCacheConfig, mn as AccessControlConfig, mt as AggregationMaterializedResult, nn as SoftDeleteExt, on as SlugExt, pn as AccessControl, pt as AggregationMaterializedContext, rn as SoftDeleteMixin, sn as SlugMixin, st as AggMeasureInput, tn as BaseController, un as BaseCrudController, ut as AggregationConfig, zn as ListResult } from "../index-BBsvQt7U.mjs";
-import { A as HOOK_OPERATIONS, B as SYSTEM_FIELDS, C as CrudOperation, D as DEFAULT_SORT, E as DEFAULT_MAX_LIMIT, F as MAX_REGEX_LENGTH, I as MAX_SEARCH_LENGTH, L as MUTATION_OPERATIONS, M as HookOperation, N as HookPhase, O as DEFAULT_TENANT_FIELD, P as MAX_FILTER_DEPTH, R as MutationOperation, S as CRUD_OPERATIONS, T as DEFAULT_LIMIT, _ as DefineActionConfig, a as createRequestContext, b as createPermissionMiddleware, c as sendControllerResponse, d as getEntityQuery, f as defineResourceVariants, g as mergeResourceConfig, h as SeamedResourceConfig, i as createFastifyHandler, j as HOOK_PHASES, k as DEFAULT_UPDATE_METHOD, l as getEntityId, m as ResourceSeams, n as isFieldReadable, o as getControllerContext, p as AdapterLike, r as createCrudHandlers, s as getControllerScope, t as collectReadBlockedFields, u as getEntityIdField, v as defineAction, w as DEFAULT_ID_FIELD, x as defineAggregation, y as createCrudRouter, z as RESERVED_QUERY_PARAMS } from "../index-CC5ruDGh.mjs";
-export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };
+import { $t as SlugExt, An as ControllerConfigurableOptions, B as defineResource, Jt as BaseController, Mn as ListResult, Nn as BodySanitizer, Pn as BodySanitizerConfig, Qt as TreeMixin, V as ResourceDefinition, Xt as SoftDeleteMixin, Yt as SoftDeleteExt, Zt as TreeExt, an as QueryResolverConfig, ct as AggMeasureShorthand, dt as AggregationDateRangeRequirement, en as SlugMixin, ft as AggregationIndexHint, gt as AggregationsMap, ht as AggregationRateLimit, in as QueryResolver, jn as ControllerConstructionOptions, kn as BaseControllerOptions, lt as AggregationCacheConfig, mt as AggregationMaterializedResult, nn as BulkMixin, on as AccessControl, pt as AggregationMaterializedContext, rn as BaseCrudController, sn as AccessControlConfig, st as AggMeasureInput, tn as BulkExt, ut as AggregationConfig } from "../index-DPRH0Cme.mjs";
+import { A as DEFAULT_ID_FIELD, B as MAX_FILTER_DEPTH, C as DefineActionConfig, D as defineAggregation, E as createPermissionMiddleware, F as DEFAULT_UPDATE_METHOD, G as RESERVED_QUERY_PARAMS, H as MAX_SEARCH_LENGTH, I as HOOK_OPERATIONS, K as SYSTEM_FIELDS, L as HOOK_PHASES, M as DEFAULT_MAX_LIMIT, N as DEFAULT_SORT, O as CRUD_OPERATIONS, P as DEFAULT_TENANT_FIELD, R as HookOperation, S as mergeResourceConfig, T as createCrudRouter, U as MUTATION_OPERATIONS, V as MAX_REGEX_LENGTH, W as MutationOperation, _ as getEntityQuery, a as formatValidationErrors, b as ResourceSeams, c as isFieldReadable, d as createRequestContext, f as getControllerContext, g as getEntityIdField, h as getEntityId, i as assertValidConfig, j as DEFAULT_LIMIT, k as CrudOperation, l as createCrudHandlers, m as sendControllerResponse, n as ValidateOptions, o as validateResourceConfig, p as getControllerScope, r as ValidationResult, s as collectReadBlockedFields, t as ConfigError, u as createFastifyHandler, v as defineResourceVariants, w as defineAction, x as SeamedResourceConfig, y as AdapterLike, z as HookPhase } from "../index-CjVg-Epg.mjs";
+export { AccessControl, type AccessControlConfig, type AdapterLike, type AggMeasureInput, type AggMeasureShorthand, type AggregationCacheConfig, type AggregationConfig, type AggregationDateRangeRequirement, type AggregationIndexHint, type AggregationMaterializedContext, type AggregationMaterializedResult, type AggregationRateLimit, type AggregationsMap, BaseController, type BaseControllerOptions, BaseCrudController, BodySanitizer, type BodySanitizerConfig, type BulkExt, BulkMixin, CRUD_OPERATIONS, type ConfigError, type ControllerConfigurableOptions, type ControllerConstructionOptions, CrudOperation, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, type DefineActionConfig, HOOK_OPERATIONS, HOOK_PHASES, HookOperation, HookPhase, type ListResult, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, MutationOperation, QueryResolver, type QueryResolverConfig, RESERVED_QUERY_PARAMS, ResourceDefinition, type ResourceSeams, SYSTEM_FIELDS, type SeamedResourceConfig, type SlugExt, SlugMixin, type SoftDeleteExt, SoftDeleteMixin, type TreeExt, TreeMixin, type ValidateOptions, type ValidationResult, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/core/index.mjs

@@ -1,5 +1,6 @@
 import { a as DEFAULT_SORT, c as HOOK_OPERATIONS, d as MAX_REGEX_LENGTH, f as MAX_SEARCH_LENGTH, h as SYSTEM_FIELDS, i as DEFAULT_MAX_LIMIT, l as HOOK_PHASES, m as RESERVED_QUERY_PARAMS, n as DEFAULT_ID_FIELD, o as DEFAULT_TENANT_FIELD, p as MUTATION_OPERATIONS, r as DEFAULT_LIMIT, s as DEFAULT_UPDATE_METHOD, t as CRUD_OPERATIONS, u as MAX_FILTER_DEPTH } from "../constants-DNre0wRg.mjs";
-import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-BQ8KNvWC.mjs";
-import { a as defineResource, c as defineAction, d as defineAggregation, i as defineResourceVariants, l as createCrudRouter, n as getEntityIdField, o as ResourceDefinition, r as getEntityQuery, s as mergeResourceConfig, t as getEntityId, u as createPermissionMiddleware } from "../core-DQ6rDTyH.mjs";
-import { a as createCrudHandlers, c as getControllerContext, l as getControllerScope, o as createFastifyHandler, s as createRequestContext, u as sendControllerResponse } from "../actionPermissions-lszoJle1.mjs";
-export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse };
+import { a as BulkMixin, c as collectReadBlockedFields, f as AccessControl, i as SlugMixin, l as isFieldReadable, n as TreeMixin, o as BaseCrudController, r as SoftDeleteMixin, s as QueryResolver, t as BaseController, u as BodySanitizer } from "../BaseController-B65zbz9m.mjs";
+import { a as ResourceDefinition, i as validateResourceConfig, n as assertValidConfig, o as createCrudRouter, r as formatValidationErrors, s as createPermissionMiddleware, t as defineResource } from "../defineResource-2zvVVpxg.mjs";
+import { a as createFastifyHandler, c as getControllerScope, i as createCrudHandlers, l as sendControllerResponse, o as createRequestContext, s as getControllerContext } from "../pipeline-BGRnV-To.mjs";
+import { a as mergeResourceConfig, i as defineResourceVariants, n as getEntityIdField, o as defineAction, r as getEntityQuery, s as defineAggregation, t as getEntityId } from "../core-BGa8TXJR.mjs";
+export { AccessControl, BaseController, BaseCrudController, BodySanitizer, BulkMixin, CRUD_OPERATIONS, DEFAULT_ID_FIELD, DEFAULT_LIMIT, DEFAULT_MAX_LIMIT, DEFAULT_SORT, DEFAULT_TENANT_FIELD, DEFAULT_UPDATE_METHOD, HOOK_OPERATIONS, HOOK_PHASES, MAX_FILTER_DEPTH, MAX_REGEX_LENGTH, MAX_SEARCH_LENGTH, MUTATION_OPERATIONS, QueryResolver, RESERVED_QUERY_PARAMS, ResourceDefinition, SYSTEM_FIELDS, SlugMixin, SoftDeleteMixin, TreeMixin, assertValidConfig, collectReadBlockedFields, createCrudHandlers, createCrudRouter, createFastifyHandler, createPermissionMiddleware, createRequestContext, defineAction, defineAggregation, defineResource, defineResourceVariants, formatValidationErrors, getControllerContext, getControllerScope, getEntityId, getEntityIdField, getEntityQuery, isFieldReadable, mergeResourceConfig, sendControllerResponse, validateResourceConfig };

package/dist/core-BGa8TXJR.mjs

@@ -0,0 +1,221 @@
+import "./constants-DNre0wRg.mjs";
+import { t as defineResource } from "./defineResource-2zvVVpxg.mjs";
+//#region src/core/aggregation/defineAggregation.ts
+/**
+* Declare a single resource aggregation. Exported configs flow into
+* `defineResource({ aggregations: { ... } })` either as named keys or
+* via auto-discovery patterns (loadAggregations — future).
+*
+* @example Inline
+* ```ts
+* defineResource({
+*   name: 'order',
+*   aggregations: {
+*     revenueByStatus: defineAggregation({
+*       groupBy: 'status',
+*       measures: { count: 'count', revenue: 'sum:totalPrice' },
+*       permissions: requireRoles(['admin']),
+*     }),
+*   },
+* });
+* ```
+*
+* @example Multi-file
+* ```ts
+* // orders/aggregations/revenue-by-status.ts
+* import { defineAggregation } from '@classytic/arc';
+*
+* export const revenueByStatus = defineAggregation({
+*   groupBy: 'status',
+*   measures: { count: 'count', revenue: 'sum:totalPrice' },
+*   permissions: requireRoles(['admin']),
+*   timeout: 5000,
+*   cache: { staleTime: 60 },
+* });
+*
+* // orders/order.resource.ts
+* import * as aggregations from './aggregations/index.js';
+*
+* defineResource({
+*   name: 'order',
+*   aggregations,                                  // 30+ entries flow in
+* });
+* ```
+*/
+function defineAggregation(config) {
+	return config;
+}
+//#endregion
+//#region src/core/defineAction.ts
+/**
+* Build an `ActionDefinition` with a typed handler. The literal schema
+* type captured here flows into `data`, so `defineAction({ schema:
+* z.object({...}), handler })` produces fully-typed code with no
+* `as MyShape` cast.
+*
+* Behaviorally identical to a bare `ActionDefinition` object — same
+* validation path (AJV), same permission resolution, same MCP wiring.
+* The runtime shape is unchanged; only the type-level inference is new.
+*/
+function defineAction(config) {
+	return {
+		handler: config.handler,
+		permissions: config.permissions,
+		schema: config.schema,
+		description: config.description,
+		id: config.id,
+		mcp: config.mcp
+	};
+}
+//#endregion
+//#region src/core/defineResource/seams.ts
+/** Plain object test — literals only; class instances must replace, not merge. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** Recursive plain-object merge; nested arrays REPLACE (they're value lists). */
+function mergePlain(base, next) {
+	const out = { ...base };
+	for (const [key, value] of Object.entries(next)) {
+		if (value === void 0) continue;
+		const existing = out[key];
+		out[key] = isPlainObject(existing) && isPlainObject(value) ? mergePlain(existing, value) : value;
+	}
+	return out;
+}
+/**
+* Canonical slot-aware merge of a base resource config with host seams.
+* Later seams win over earlier ones; `undefined` values never clobber.
+*
+* Merge semantics (value-driven — no per-slot registry to drift):
+*
+*   - **Top-level arrays CONCAT** — `routes`, `middlewares`, `presets`,
+*     `routeGuards`, `disabledRoutes`: additive collections, base first.
+*   - **Plain objects merge recursively** — `permissions`, `actions`,
+*     `schemaOptions` (incl. `fieldRules`), `aggregations`, `customSchemas`,
+*     `fields`, `cache`, `events`: per-key composition. Arrays NESTED inside
+*     them replace (they're value lists — enums, sort specs), not concat.
+*   - **Everything else last-wins** — class instances (`adapter`,
+*     `controller`, `queryParser`), functions, scalars.
+*
+* The single `as` at the return is the one documented erasure for the
+* {@link AdapterLike}-widened seam slots — inside the helper so no module
+* author ever writes one (mirrors mongokit's one-cast-at-the-boundary rule).
+*/
+function mergeResourceConfig(base, ...seams) {
+	const out = { ...base };
+	for (const seam of seams) {
+		if (!seam) continue;
+		for (const [key, value] of Object.entries(seam)) {
+			if (value === void 0) continue;
+			const existing = out[key];
+			if (Array.isArray(existing) && Array.isArray(value)) out[key] = [...existing, ...value];
+			else if (isPlainObject(existing) && isPlainObject(value)) out[key] = mergePlain(existing, value);
+			else if (Array.isArray(value)) out[key] = [...value];
+			else out[key] = value;
+		}
+	}
+	return out;
+}
+//#endregion
+//#region src/core/defineResourceVariants.ts
+/**
+* Define multiple resources from a shared base config and per-variant overrides.
+*
+* Each variant is independently passed through `defineResource()` — the
+* returned `ResourceDefinition`s are real, fully-registered resources.
+* Register each one's plugin in your app:
+*
+* ```typescript
+* await app.register(articlePublic.toPlugin());
+* await app.register(articleAdmin.toPlugin());
+* ```
+*
+* @param base    Shared config — adapter, queryParser, schemaOptions, hooks, etc.
+*                Must NOT include `name` or `prefix` (those are per-variant).
+* @param variants  Map of variant key → override. Each variant must declare
+*                  its own `name` and `prefix`. Other fields override the base.
+* @returns A record where each key from `variants` maps to a real
+*          `ResourceDefinition` ready for `.toPlugin()` registration.
+*/
+function defineResourceVariants(base, variants) {
+	const out = {};
+	for (const key of Object.keys(variants)) {
+		const override = variants[key];
+		out[key] = defineResource({
+			...base,
+			...override
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/core/entityHelpers.ts
+/**
+* Per-request entity helpers — read the resource binding (idField + the
+* URL `:id` value) off `req.arc`.
+*
+* Action handlers receive their `id` argument as the raw URL `:id` value.
+* When the resource declares a custom `idField` (`slug`, `reportId`, …)
+* that's NOT the document `_id`, a naive `Model.findById(id)` silently
+* returns null. The historical footgun was a `findById(id)` typo where
+* the handler author hadn't realised that `:id` resolves to the friendly
+* handle.
+*
+* `getEntityQuery(req)` produces the canonical filter shape so handlers
+* compose lookups with no resource-config recall:
+*
+* ```ts
+* actions: {
+*   archive: {
+*     handler: async (id, data, req) => {
+*       const doc = await Model.findOne(getEntityQuery(req));
+*       if (!doc) throw new NotFoundError("Order");
+*       // ...
+*     },
+*   },
+* }
+* ```
+*
+* The router populates `req.arc.idField` and `req.arc.entityId` before
+* invoking the handler — these helpers are zero-cost reads.
+*/
+/**
+* Read the resource's configured `idField` for the current request.
+* Falls back to the framework default (`_id`) when the route hasn't
+* bound an idField — keeps handlers safe to author without checking
+* the resource config.
+*/
+function getEntityIdField(req) {
+	return req.arc?.idField ?? "_id";
+}
+/**
+* Read the URL `:id` path param value as the resource handle.
+* Returns `undefined` when the route has no `:id` segment (collection
+* routes) — handlers that need the entity must be on row routes.
+*/
+function getEntityId(req) {
+	if (req.arc?.entityId !== void 0) return req.arc.entityId;
+	return req.params?.id;
+}
+/**
+* Compose a `findOne` filter that resolves the current request's
+* entity, regardless of whether the resource binds `_id` or a custom
+* field. Idiomatic shape for arc action handlers.
+*
+* ```ts
+* const doc = await Model.findOne(getEntityQuery(req));
+* ```
+*
+* Returns `{}` when the route has no entity context (collection routes
+* or tests bypassing the router) — caller decides what that means.
+*/
+function getEntityQuery(req) {
+	const id = getEntityId(req);
+	if (id === void 0) return {};
+	return { [getEntityIdField(req)]: id };
+}
+//#endregion
+export { mergeResourceConfig as a, defineResourceVariants as i, getEntityIdField as n, defineAction as o, getEntityQuery as r, defineAggregation as s, getEntityId as t };

package/dist/{createActionRouter-BuOv-m4Y.mjs → createActionRouter-C-N7z2EL.mjs}

@@ -1,8 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
 import "./constants-DNre0wRg.mjs";
 import { f as createError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, f as buildAuthMiddlewareForPermissions, i as resolveRouterPluginMw, n as buildRateLimitConfig, o as buildActionPermissionMw, p as buildArcDecorator, r as buildRouteConfig, t as tryRegisterRoute, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
-import { i as resolvePipelineSteps, n as buildActionPipelineHandler, u as sendControllerResponse } from "./actionPermissions-lszoJle1.mjs";
+import { a as buildRouteHooks, i as selectPluginMw, l as buildAuthMiddlewareForPermissions, n as buildRouteConfig, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
+import { n as buildActionPermissionMw, t as tryRegisterRoute } from "./registerRoute-DTp18Ah_.mjs";
+import { l as sendControllerResponse, r as resolvePipelineSteps, t as buildActionPipelineHandler } from "./pipeline-BGRnV-To.mjs";
 import { n as schemaIRToJsonSchemaBranch, t as normalizeSchemaIR } from "./schemaIR-Ca7ySNPx.mjs";
 //#region src/core/createActionRouter.ts
 var createActionRouter_exports = /* @__PURE__ */ __exportAll({

package/dist/{createAggregationRouter-CgJv_BU_.mjs → createAggregationRouter-wzwFa_dW.mjs}

@@ -1,7 +1,7 @@
 import { f as createError, l as UnauthorizedError, r as ForbiddenError } from "./errors-DkO8Nk6-.mjs";
-import { a as selectPluginMw, c as buildRouteHooks, d as buildAuthMiddleware, i as resolveRouterPluginMw, n as buildRateLimitConfig, p as buildArcDecorator, u as routeHookOptions } from "./registerRoute-CWO6mdYe.mjs";
-import { n as validateAggregations } from "./validate-C2mGgSXg.mjs";
-import { t as buildAggregationHandler } from "./buildHandler-D_2ULWxZ.mjs";
+import { a as buildRouteHooks, c as buildAuthMiddleware, i as selectPluginMw, r as resolveRouterPluginMw, s as routeHookOptions, t as buildRateLimitConfig, u as buildArcDecorator } from "./rateLimit-DrED-C4v.mjs";
+import { n as validateAggregations } from "./validate-Bk44F2yT.mjs";
+import { t as buildAggregationHandler } from "./buildHandler-Dtwd8fdz.mjs";
 //#region src/core/aggregation/createAggregationRouter.ts
 /**
 * Register one Fastify route per aggregation. No-op when the map is