@classytic/mongokit 3.11.1 → 3.13.0

package/dist/index.d.mts

@@ -1,15 +1,16 @@
-import { $ as ReadPreferenceType, A as InferDocument, B as ObjectId, C as EventPayload, Ct as WithTransactionOptions, D as GroupResult, Dt as IResponseFormatter, E as FindOneAndUpdateOptions, Et as IRequestContext, F as Logger, G as PaginationResult, H as OffsetPaginationResult, I as LookupPopulateOptions, J as PluginFunction, K as PartialBy, L as LookupPopulateResult, M as KeysOfType, N as KeysetPaginationOptions, O as HookMode, Ot as LookupBuilder, P as KeysetPaginationResult, Q as ReadOptions, R as MinMaxResult, S as EventHandlers, St as WithPlugins, T as FieldPreset, Tt as IControllerResponse, U as OperationOptions, V as OffsetPaginationOptions, W as PaginationConfig, X as PopulateSpec, Y as PluginType, Z as PrioritizedHook, _ as DecodedCursor, _t as UpdatePatch, a as AnyDocument, at as RequiredBy, b as DeleteResult, bt as ValidationChainOptions, c as CacheOperationOptions, ct as SoftDeleteFilterMode, d as CacheableOptions, dt as SortDirection, et as RepositoryContext, f as CascadeOptions, ft as SortSpec, g as CreateOptions, gt as UpdateOptions, h as CreateInput, ht as UpdateManyResult, i as AllPluginMethods, it as RepositoryOptions, j as InferRawDoc, k as HttpError, kt as LookupOptions, l as CacheOptions, lt as SoftDeleteOptions, m as CollationOptions, mt as UpdateInput, n as AggregatePaginationOptions, nt as RepositoryInstance, o as AnyModel, ot as SelectSpec, p as CascadeRelation, pt as Strict, q as Plugin, r as AggregatePaginationResult, rt as RepositoryOperation, s as CacheAdapter, st as SessionOptions, t as AggregateOptions, tt as RepositoryEvent, u as CacheStats, ut as SoftDeleteRepository, v as DeepPartial, vt as UpdateWithValidationResult, w as EventPhase, wt as IController, x as DocField, xt as ValidatorDefinition, y as DeleteManyResult, yt as UserContext, z as NonNullableFields } from "./types-Dc2aDVUi.mjs";
-import { t as index_d_exports } from "./index-dNTmpgK8.mjs";
+import { $ as RepositoryEvent, A as KeysetPaginationOptions, B as ObjectId, C as FieldPreset, Ct as IControllerResponse, D as InferDocument, Dt as LookupOptions, E as HookMode, Et as LookupBuilder, F as MiddlewareContext, G as Plugin, H as OperationOptions, I as MinMaxResult, J as PopulateSpec, K as PluginFunction, L as MinimalRepoView, M as LookupPopulateOptions, N as LookupPopulateResult, O as InferRawDoc, P as Middleware, Q as RepositoryContext, R as MongoOperatorUpdate, S as EventPhase, St as IController, T as GroupResult, Tt as IResponseFormatter, U as PaginationConfig, V as OffsetPaginationOptions, W as PartialBy, X as ReadOptions, Y as PrioritizedHook, Z as ReadPreferenceType, _ as DeleteManyResult, _t as ValidationChainOptions, a as AnyModel, at as SessionOptions, b as EventHandlers, bt as WithPlugins, c as CacheableOptions, ct as SoftDeleteRepository, d as CollationOptions, dt as Strict, et as RepositoryInstance, f as CreateInput, ft as UpdateManyResult, g as DeepPartial, gt as UserContext, h as DecodedCursor, ht as UpdateWithValidationResult, i as AnyDocument, it as SelectSpec, j as Logger, k as KeysOfType, l as CascadeOptions, lt as SortDirection, m as CursorPayload, mt as UpdatePatch, n as AggregatePaginationOptions, nt as RepositoryOptions, o as BasePaginationOptions, ot as SoftDeleteFilterMode, p as CreateOptions, pt as UpdateOptions, q as PluginType, r as AllPluginMethods, rt as RequiredBy, s as CacheOperationOptions, st as SoftDeleteOptions, t as AggregateOptions, tt as RepositoryOperation, u as CascadeRelation, ut as SortSpec, v as DeleteResult, vt as ValidatorDefinition, w as FindOneAndUpdateOptions, wt as IRequestContext, x as EventPayload, xt as WithTransactionOptions, y as DocField, yt as ValueType, z as NonNullableFields } from "./types-BbaPZleN.mjs";
+import { t as index_d_exports } from "./index-BbHaKwi5.mjs";
 import { PaginationEngine } from "./pagination/PaginationEngine.mjs";
-import { $ as aggregateHelpersPlugin, A as PrefixedIdOptions, B as BatchOperationsMethods, C as methodRegistryPlugin, D as CustomIdOptions, E as elasticSearchPlugin, F as prefixedId, G as AuditQueryOptions, H as batchOperationsPlugin, I as sequentialId, J as AuditTrailOptions, K as AuditQueryResult, L as cascadePlugin, M as customIdPlugin, N as dateSequentialId, O as DateSequentialIdOptions, P as getNextSequence, Q as AggregateHelpersMethods, R as CacheMethods, T as ElasticSearchOptions, U as AuditEntry, V as BulkWriteResult, W as AuditOperation, X as auditTrailPlugin, Y as AuditTrailQuery, Z as auditLogPlugin, _ as observabilityPlugin, a as uniqueField, b as MongoOperationsMethods, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as SequentialIdOptions, k as IdGenerator, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, q as AuditTrailMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MultiTenantOptions, w as fieldFilterPlugin, x as mongoOperationsPlugin, y as multiTenantPlugin, z as cachePlugin } from "./validation-chain.plugin-B0VSdcwa.mjs";
-import { n as SchemaPathsLike, t as FieldType$1 } from "./coercion-oM8G4b6m.mjs";
-import { n as SchemaIndexes } from "./indexes-C26GNZRU.mjs";
-import { a as createFieldPreset, c as getMongooseProjection, d as parseDuplicateKeyError, i as configureLogger, l as createError, n as buildCrudSchemasFromMongooseSchema, o as filterResponseData, r as createMemoryCache, s as getFieldsForUser, t as buildCrudSchemasFromModel, u as isDuplicateKeyError } from "./mongooseToJsonSchema-DXxjFkLB.mjs";
+import { $ as AuditQueryResult, A as elasticSearchPlugin, B as sequentialId, D as leasePlugin, E as LeasePluginOptions, F as SequentialIdOptions, G as RepositoryCachePluginOptions, H as CacheAdapter, I as customIdPlugin, J as BulkWriteResult, K as cachePlugin, L as dateSequentialId, M as DateSequentialIdOptions, N as IdGenerator, O as fieldFilterPlugin, P as PrefixedIdOptions, Q as AuditQueryOptions, R as getNextSequence, S as mongoOperationsPlugin, T as LeaseMethods, U as CacheOptions, V as cascadePlugin, W as RepositoryCacheHandle, X as AuditEntry, Y as batchOperationsPlugin, Z as AuditOperation, _ as observabilityPlugin, a as uniqueField, at as AggregateHelpersMethods, b as multiTenantPlugin, c as TenantContext, d as SubdocumentMethods, et as AuditTrailMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, it as auditLogPlugin, j as CustomIdOptions, k as ElasticSearchOptions, l as TenantStore, m as softDeletePlugin, n as blockIf, nt as AuditTrailQuery, o as validationChainPlugin, ot as aggregateHelpersPlugin, p as SoftDeleteMethods, q as BatchOperationsMethods, r as immutableField, rt as auditTrailPlugin, s as timestampPlugin, t as autoInject, tt as AuditTrailOptions, u as createTenantContext, v as MultiTenantOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as adminBypass, z as prefixedId } from "./validation-chain.plugin-CAPYCj_T.mjs";
+import { n as SchemaPathsLike, t as FieldType$1 } from "./coercion-TRMmR49h.mjs";
+import { n as SchemaIndexes } from "./indexes-CgOF7Wjd.mjs";
+import { a as createFieldPreset, c as getMongooseProjection, d as parseDuplicateKeyError, i as configureLogger, l as createError, n as buildCrudSchemasFromMongooseSchema, o as filterResponseData, r as createMemoryCache, s as getFieldsForUser, t as buildCrudSchemasFromModel, u as isDuplicateKeyError } from "./mongooseToJsonSchema-BgRAaXX-.mjs";
 import * as _$mongoose from "mongoose";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
-import { AggPaginationRequest, AggRequest, AggResult, RepositoryBase } from "@classytic/repo-core/repository";
-import { UpdateInput as UpdateInput$1 } from "@classytic/repo-core/update";
-import { OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
+import { AggPaginationRequest, AggRequest, AggResult, KeysetAggPaginationResult, RepositoryBase } from "@classytic/repo-core/repository";
+import { UpdateInput } from "@classytic/repo-core/update";
+import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
+import { HttpError } from "@classytic/repo-core/errors";
 
 //#region src/operations.d.ts
 /**
@@ -844,6 +845,11 @@ declare class QueryParser {
   /**
    * Recursively sanitize expression objects, blocking dangerous operators
    * like $where, $function, $accumulator inside $addFields/$set stages.
+   *
+   * Depth-guarded — same protection `_sanitizeMatchConfig` ships, since
+   * a hostile `$cond`/`$switch` chain can recurse arbitrarily deep and
+   * exhaust JS stack. Without the guard, this is a one-liner DoS against
+   * any host that exposes pipeline parsing to untrusted callers.
    */
   private _sanitizeExpressions;
   private _sanitizeSearch;
@@ -910,6 +916,13 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   readonly searchFields: string[] | undefined;
   [key: string]: unknown;
   private _hasTextIndex;
+  /**
+   * Wrap-style middleware chain. Composed around every `_runOp`
+   * invocation in registration order — earlier-registered middlewares
+   * are outer (run first / unwind last). See `useMiddleware()` and
+   * the `Middleware<TDoc>` type for the protocol.
+   */
+  private readonly _middlewares;
   constructor(Model: Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions);
   /**
    * Live read-through view of the hook engine's listener registry.
@@ -931,14 +944,117 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   private _emitHook;
   private _emitErrorHook;
   /**
-   * Run a Repository operation under the standard envelope:
-   *   - invoke `fn`, emit `after:<op>` with `{ context, result }` on success
-   *   - emit `error:<op>` and rethrow via `_handleError` on failure
+   * Wire the `warnOnStrictQueryStrip` diagnostic. When enabled, every
+   * filter-shaped op (`getById`, `getByQuery`, `getOne`, `findAll`,
+   * `count`, `exists`, `update`, `delete`, `findOneAndUpdate`,
+   * `updateMany`, `deleteMany`, `claim`, `claimVersion`, `cursor`)
+   * checks its `context.query` keys against the cached set of schema
+   * paths. Top-level keys not on the schema get logged once per
+   * `(model, key)` pair — so a single bad caller surfaces in dev /
+   * staging instead of returning the wrong row in prod.
+   *
+   * Only runs when `strictQuery !== false` is in effect — if mongoose's
+   * strictQuery is off, unknown keys flow through to the driver and
+   * the trap doesn't apply.
+   */
+  private _wireStrictQueryStripDiagnostic;
+  /**
+   * Register a wrap-style middleware. Middleware composes AROUND every
+   * `_runOp` invocation — it sees the operation name, the live
+   * `RepositoryContext`, and a `next()` continuation that runs the
+   * remaining chain + the actual op + after/error hooks.
+   *
+   * **Composes with `repo.on()` and plugins, doesn't replace them.**
+   * Middleware is for ergonomics (timing, short-circuit, input/output
+   * mutation in a single closure) — NOT for security policy. Use the
+   * `before:*` hook engine for tenant scope, soft-delete filtering,
+   * cache invalidation, and audit; those plugins MUST run before
+   * middleware sees the op.
+   *
+   * **Execution order on every call** (build/before hooks fire BEFORE
+   * the middleware chain dispatches, so middleware cannot wrap a
+   * before-hook failure):
+   *
+   * ```text
+   *   _buildContext + before:<op>   ← repo.on('before:*') hooks
+   *     [outer middleware pre]      ← repo.useMiddleware() registrations
+   *       [...inner middleware pre]
+   *         fn (driver call)
+   *         after:<op> | error:<op> ← repo.on('after:*' / 'error:*')
+   *       [...inner middleware post]
+   *     [outer middleware post]
+   * ```
+   *
+   * Why this order matters: a `before:create` hook that injects a
+   * tenant filter into `context.query` runs BEFORE the middleware chain
+   * is composed. Middleware sees a context that was already scoped by
+   * the policy plugins — it never has the authority to short-circuit a
+   * tenant check, because the throw from a `before:*` policy hook
+   * unwinds before middleware ever fires. That's by design — middleware
+   * as a security boundary would be impossible to audit, since
+   * registration order would determine whether scope wins.
    *
+   * Practical consequence: if you want middleware to observe a policy
+   * failure (e.g. metric a tenant-scope rejection), use `repo.on('error:
+   * <op>', ...)` instead — that fires from inside the middleware chain
+   * and is reachable.
+   *
+   * Registration order = composition order: the first middleware
+   * registered runs outermost (wraps everything else).
+   *
+   * @example Time every op
+   * ```ts
+   * repo.useMiddleware(async ({ operation, next }) => {
+   *   const start = performance.now();
+   *   try { return await next(); }
+   *   finally { metrics.record(operation, performance.now() - start); }
+   * });
+   * ```
+   *
+   * @example Inject `tenantId` on every create
+   * ```ts
+   * repo.useMiddleware(async ({ operation, context, next }) => {
+   *   if (operation === 'create' && context.data) {
+   *     context.data.tenantId = currentTenant();
+   *   }
+   *   return next();
+   * });
+   * ```
+   *
+   * @example Short-circuit (return without `next()` to skip the actual op)
+   * ```ts
+   * repo.useMiddleware(async ({ operation, context, next }) => {
+   *   if (operation === 'getById' && readOnlyMaintenance) {
+   *     return cachedReadOnlyResponse(context.id);
+   *   }
+   *   return next();
+   * });
+   * ```
+   */
+  useMiddleware(middleware: Middleware<TDoc>): this;
+  /**
+   * Compose the registered middleware chain around `exec`. Outermost
+   * middleware (first registered) wraps innermost. Each middleware sees
+   * the live `RepositoryContext` (already populated + run through
+   * `before:*` hooks at the call site — see `useMiddleware` JSDoc for
+   * the exact order). `after:` / `error:` hooks fire from inside
+   * `exec`, so middleware composes WITH plugins, not instead of them.
+   *
+   * `_runOp` calls this with its standard try/catch envelope; inline-try
+   * methods (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
+   * `lookupPopulate`, plus `getOne`/`getAll` cache-hit branches) call it
+   * directly so middleware sees every op — including cached reads — not
+   * just the ones routed through `_runOp`.
+   */
+  private _composeMiddleware;
+  /**
+   * Standard operation envelope: compose middleware around an exec that
+   * runs `fn`, emits `after:<op>` on success or `error:<op>` on failure.
    * Methods with branched in-try logic that emit `after:*` from multiple
    * paths (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
-   * `lookupPopulate`) intentionally keep their inline try/catch rather than
-   * being restructured to return a single result through this helper.
+   * `lookupPopulate`) keep their inline try/catch and call
+   * `_composeMiddleware` directly instead of being forced through this
+   * single-result helper.
    */
   private _runOp;
   /**
@@ -977,6 +1093,40 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   findAll(filters?: Record<string, unknown>, options?: OperationOptions & {
     sort?: SortSpec | string;
   }): Promise<TDoc[]>;
+  /**
+   * Streaming reads — async iterator over data, suitable for migrations,
+   * backfills, schema audits, and any once-a-quarter "touch every row"
+   * job. Goes through the standard `before:cursor` hook pipeline so
+   * multi-tenant scope, soft-delete filter, and access-control plugins
+   * inject scope BEFORE the underlying mongoose cursor is built.
+   *
+   * Replaces direct `Model.find().cursor()` usage which bypasses every
+   * plugin — that's how cross-tenant data ends up in migrations.
+   *
+   * Returns an `AsyncIterableIterator<TDoc>` — drive it with `for await`.
+   * The mongoose cursor is closed when iteration completes or breaks.
+   *
+   * @example Backfill a missing field across the whole tenant scope
+   * ```ts
+   * for await (const doc of repo.cursor({ filter: { migrated: { $ne: true }}}, { batchSize: 1000 })) {
+   *   await transformer(doc);
+   *   await repo.update(doc._id, { migrated: true });
+   * }
+   * ```
+   *
+   * @example Audit unscoped — opt out of multi-tenant for global sweeps
+   * ```ts
+   * for await (const doc of repo.cursor({}, { batchSize: 500, organizationId: undefined })) {
+   *   audit(doc);
+   * }
+   * ```
+   */
+  cursor(filter?: Record<string, unknown>, options?: ReadOptions & {
+    sort?: SortSpec | string;
+    batchSize?: number;
+    select?: SelectSpec;
+    lean?: boolean;
+  }): AsyncIterableIterator<TDoc>;
   /**
    * Unified pagination - auto-detects offset vs keyset based on params
    *
@@ -1023,10 +1173,22 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
     noPagination?: boolean;
   }, options?: CacheableOptions): Promise<OffsetPaginationResult<TDoc> | KeysetPaginationResult<TDoc> | TDoc[]>;
   /**
-   * Get or create document
-   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
+   * Atomic "look up by filter, insert `data` if missing, return the doc."
+   *
+   * Returns `{ doc, created }` so callers can tell whether *this* call
+   * inserted (race-win) or matched an existing row. Implements
+   * `StandardRepo.getOrCreate()` from `@classytic/repo-core/repository`
+   * — see that interface's JSDoc for the cross-kit contract.
+   *
+   * Routes through the hook system for policy enforcement (multi-tenant,
+   * soft-delete, audit). The hook context carries the resolved query +
+   * data; the action layer adds the `created` discriminator from the
+   * driver's `lastErrorObject.upserted`.
    */
-  getOrCreate(query: Record<string, unknown>, createData: Record<string, unknown>, options?: SessionOptions): Promise<TDoc | null>;
+  getOrCreate(query: Record<string, unknown>, createData: Record<string, unknown>, options?: SessionOptions): Promise<{
+    doc: TDoc;
+    created: boolean;
+  }>;
   /**
    * Count documents
    * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
@@ -1072,7 +1234,267 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * );
    * ```
    */
-  findOneAndUpdate<TResult = TDoc>(filter: Record<string, unknown>, update: UpdateInput$1, options?: FindOneAndUpdateOptions): Promise<TResult | null>;
+  findOneAndUpdate<TResult = TDoc>(filter: Record<string, unknown>, update: UpdateInput, options?: FindOneAndUpdateOptions): Promise<TResult | null>;
+  /**
+   * Atomic compare-and-swap state transition. Implements
+   * `StandardRepo.claim()` from `@classytic/repo-core/repository` (0.4+).
+   *
+   * Builds a `findOneAndUpdate({ _id, [field]: from, ...where }, { $set:
+   * { [field]: to, ...patch } })` in a single round-trip — race-free
+   * across concurrent callers. Returns the post-update doc on success,
+   * `null` when:
+   *   - the row exists but its current state isn't `from` (someone
+   *     else won the transition), OR
+   *   - any predicate in `transition.where` fails (paused guard,
+   *     retry-time guard, heartbeat-staleness, sub-document predicate),
+   *     OR
+   *   - no row matches the id at all.
+   *
+   * The caller can't distinguish "lost race" from "guard predicate
+   * failed" — both mean "don't proceed." That's by design: the only
+   * action either way is to back off.
+   *
+   * **Source-state — `from: T | T[]`.** Pass a literal for a single-
+   * source transition (`from: 'pending'`) or an array for the
+   * "transition from any of these states" pattern (`from: ['pending',
+   * 'approved']`). Compiles to `[stateField]: { $in: [...] }`. Real-
+   * world frequency: commission's `voidRecord` / `markClawedBack` /
+   * `endAgreement` / `_transition`, media-kit's error path,
+   * streamline's `cancelAt` — every state machine with more than one
+   * non-terminal source state hits this. Without array support those
+   * sites fall back to raw `findOneAndUpdate` and lose plugin routing.
+   *
+   * **`from` is value-only — no Mongo expressions.** `from` accepts a
+   * literal or an array of literals (`$in`-shaped). It does NOT
+   * accept `{ $ne: ... }`, `{ $lt: ... }`, `{ $exists: ... }`, or
+   * arbitrary expression objects. The CAS contract is "match if the
+   * state field equals one of these specific values" — admitting
+   * arbitrary predicates would collapse the contract into a generic
+   * filter, defeating the point of a state-machine primitive.
+   *
+   * For non-equality / range / existence predicates on the state
+   * field, use `where`:
+   *
+   * ```ts
+   * // ❌ from: { $ne: 'ended' }    — not supported, would silently work-as-filter
+   * // ✅ Use `where` for $ne / $lt / $exists / arbitrary mongo predicates:
+   * await repo.claim(id, {
+   *   from: 'active',                          // exact-match state
+   *   to: 'closed',
+   *   where: { closedAt: { $exists: false } }, // additional predicates
+   * });
+   * ```
+   *
+   * **Dotted-path `field` is supported** — `field: 'scheduling.status'`
+   * for nested state fields works. Mongo's filter and `$set` both
+   * honor dotted paths, and the from===to optimization handles them
+   * correctly (literal comparison on the path string). Use for
+   * domain models that nest the state under a sub-document
+   * (`lpn.state`, `package.condition.state`, `scheduling.status`).
+   *
+   * **`from === to` is allowed — idempotent re-claim.** Yard's
+   * `reviseDeparture` writes `departed → departed` to update the
+   * row's payload while asserting the row hasn't moved on. The CAS
+   * still returns `null` on race-loss (row left the source state),
+   * so the safety property holds. Use the same semantic as a "touch
+   * with state assertion" primitive.
+   *
+   * When `from === to` (and `from` is a literal, not an array), the
+   * implementation **skips the redundant `$set: { [stateField]: to }`
+   * write** — the filter has already pinned the state field to that
+   * exact value, so writing it again is a no-op disk operation.
+   * Workloads doing high-replay dedup (yard's `gate-event.append`,
+   * outbox replay storms, idempotent first-write CAS) save one disk
+   * write + one journal flush + one replication-log entry per replay.
+   * Three observable behaviours follow:
+   *
+   *   - With a non-empty patch: only the patch fields land in `$set`;
+   *     the redundant state-field key is dropped.
+   *   - With an empty patch and `upsert: false`: the call lowers to
+   *     a plain `findOne` round-trip — pure assertion, zero writes.
+   *     Plugin pipeline (before/after `claim` hooks) still fires
+   *     correctly — only the internal driver shape changes.
+   *   - With an empty patch and `upsert: true`: the update becomes
+   *     `{ $setOnInsert: { [stateField]: to } }` — no-op on match,
+   *     populates the inserted row's state field on miss. This is
+   *     the "pure dedup" insert-or-confirm path.
+   *
+   * For pure-dedup recipes (no real state column, just an external
+   * id used as both filter and `from`/`to`), see CLAUDE.md — yard's
+   * `gate-event.append` is the canonical worked example.
+   *
+   * **`upsert: true` — insert-or-claim.** Set `options.upsert: true`
+   * for the upsert-claim pattern: insert when the row doesn't exist,
+   * else CAS-transition the existing row. Yard's `gate-event.append`
+   * uses this for idempotent event landing. With `upsert` on, claim
+   * NEVER returns null on miss — it inserts. Pair with
+   * `$setOnInsert` in the operator patch for insert-only fields.
+   * The default (`upsert: false`) keeps the canonical "match
+   * exactly, else null" semantic.
+   *
+   * **Patch shape** — accepts BOTH flat (`{ field: value }`) and Mongo
+   * operator (`{ $set, $inc, $unset, $setOnInsert, ... }`) forms.
+   * Operator form is load-bearing for versioned docs (`$inc: {
+   * version: 1 }`) and upsert-claim (`$setOnInsert: { createdBy }`);
+   * flat form is the textbook ergonomic case. Mixing flat keys with
+   * `$`-keys throws — Mongo would silently drop the flat keys,
+   * which would mask data-loss bugs.
+   *
+   * Multi-tenant scope, soft-delete filter, cache invalidation, and
+   * audit hooks all flow through automatically — `claim` is registered
+   * in `OP_REGISTRY` (policyKey: 'query', mutates: true), so plugins
+   * that iterate the registry pick it up without changes.
+   *
+   * **Caller responsibility for tenant context.** When
+   * `multiTenantPlugin` is mounted, plugin-injected scoping reads the
+   * tenant key from the **options bag** — `claim(id, transition, patch,
+   * { organizationId: '...' })`. Without it, the plugin throws
+   * `'Missing organizationId'` at runtime. Use
+   * `repoOptionsFromCtx(ctx)` (or your own context helper) to forward
+   * request-scoped tenant fields; do not assume the plugin reads them
+   * from a global.
+   *
+   * @example Textbook transition (flat patch)
+   * ```ts
+   * const claimed = await runRepo.claim(runId, { from: 'waiting', to: 'running' }, {
+   *   lastHeartbeat: new Date(),
+   *   workerId: 'worker-12',
+   * });
+   * if (!claimed) return; // someone else got it (or no match)
+   * ```
+   *
+   * @example Versioned doc — operator patch with `$inc`
+   * ```ts
+   * const claimed = await orderRepo.claim(
+   *   orderId,
+   *   { from: 'pending', to: 'shipped' },
+   *   {
+   *     $set: { shippedAt: new Date() },
+   *     $inc: { version: 1 },
+   *   },
+   * );
+   * ```
+   *
+   * @example Compound-filter claim (paused guard + retry timer)
+   * ```ts
+   * const claimed = await runRepo.claim(
+   *   runId,
+   *   {
+   *     from: 'waiting',
+   *     to: 'running',
+   *     where: {
+   *       paused: { $ne: true },
+   *       'scheduling.retryAfter': { $lte: new Date() },
+   *     },
+   *   },
+   *   { lastHeartbeat: new Date() },
+   *   { organizationId: ctx.orgId }, // tenant fwd — see note above
+   * );
+   * ```
+   *
+   * Pairs with `defineStateMachine()` from
+   * `@classytic/primitives/state-machine`:
+   *   - State machine validates "is from→to legal in the model?"
+   *   - `claim()` performs the atomic "did we win?"
+   */
+  claim(id: string | ObjectId, transition: {
+    field?: string;
+    from: unknown | readonly unknown[];
+    to: unknown;
+    where?: Record<string, unknown>;
+  }, patch?: Record<string, unknown>, options?: SessionOptions & {
+    idField?: string;
+    upsert?: boolean;
+  }): Promise<TDoc | null>;
+  /**
+   * Optimistic-concurrency CAS via a version stamp.
+   *
+   * Sibling to `claim()` — distinct mental model:
+   *   - `claim()` is a state machine: "move from status A to status B, atomically"
+   *   - `claimVersion()` is optimistic locking: "I expect version N; if it
+   *     still is, apply this update and increment the version"
+   *
+   * Builds `findOneAndUpdate({ _id, [versionField]: from, ...where },
+   * { ...update, $inc: { [versionField]: by ?? 1 } })` in one
+   * round-trip. Returns the post-update doc on success, `null` when:
+   *   - the row doesn't exist, OR
+   *   - the row's version isn't `from` (someone else committed first —
+   *     standard race-loss signal), OR
+   *   - any predicate in `transition.where` fails (state guard, tenant
+   *     guard expressed inline, etc.)
+   *
+   * **`from: undefined` is tolerated.** Lean reads return `version:
+   * number | undefined` because the field defaults are absent on
+   * fresh-from-mongo POJOs. Passing `from: undefined` matches docs
+   * whose version field is *missing entirely* — exactly what you want
+   * on a first-write CAS. Callers no longer need `?? 0` at every site.
+   *
+   * The caller's `update` is freeform — pass either a Mongo operator
+   * shape (`{ $set: { status: 'submitted', updatedAt: now } }`) or a
+   * field-shape object (auto-wrapped in `$set`). The version `$inc` is
+   * MERGED into the update, so callers don't have to remember to bump
+   * the counter.
+   *
+   * **Compound CAS via `where`.** State machines that key on both
+   * version AND status (yard's `transition()`, every package whose
+   * "ready to commit" gate is more than a version stamp) need to
+   * AND-merge additional predicates. Pass them via
+   * `transition.where` — same shape and semantics as `claim`'s
+   * `where` field. Without this, claimVersion was forced back to raw
+   * `findOneAndUpdate` for every state-AND-version site.
+   *
+   * Multi-tenant scope, soft-delete filter, cache invalidation, and
+   * audit hooks all fire — `claimVersion` is in `OP_REGISTRY`
+   * (policyKey: 'query', mutates: true) so plugins iterate the registry
+   * and pick it up automatically.
+   *
+   * **Caller responsibility for tenant context.** When
+   * `multiTenantPlugin` is mounted, the plugin reads the tenant key
+   * from the **options bag** (`{ organizationId: '...' }`). Without it,
+   * the plugin throws `'Missing organizationId'` at runtime. Use
+   * `repoOptionsFromCtx(ctx)` to forward — same as `claim()` and every
+   * other repo op.
+   *
+   * @example Order submission with version check
+   * ```ts
+   * const submitted = await orderRepo.claimVersion(
+   *   orderId,
+   *   { from: order.version },
+   *   { $set: { status: 'submitted', submittedAt: new Date() } },
+   * );
+   * if (!submitted) throw new ConcurrentEditError();
+   * ```
+   *
+   * @example Compound CAS — version + status
+   * ```ts
+   * const transitioned = await yardRepo.claimVersion(
+   *   loadId,
+   *   {
+   *     from: load.version, // number | undefined OK
+   *     where: { status: 'queued' },
+   *   },
+   *   { $set: { status: 'in-progress', startedAt: new Date() } },
+   * );
+   * if (!transitioned) throw new ConcurrentEditError();
+   * ```
+   *
+   * @example Custom version field name + step
+   * ```ts
+   * await runRepo.claimVersion(
+   *   runId,
+   *   { field: 'rev', from: 12, by: 1 },
+   *   { lastHeartbeat: new Date() },  // field-shape auto-wraps in $set
+   * );
+   * ```
+   */
+  claimVersion(id: string | ObjectId, transition: {
+    field?: string;
+    from: number | undefined;
+    by?: number;
+    where?: Record<string, unknown>;
+  }, update: Record<string, unknown>, options?: SessionOptions & {
+    idField?: string;
+  }): Promise<TDoc | null>;
   /**
    * Delete a document by ID.
    *
@@ -1096,9 +1518,9 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    */
   delete(id: string | ObjectId, options?: SessionOptions & {
     idField?: string;
-    mode?: 'hard' | 'soft'; /** Legacy opt-in: throw a 404 error on miss instead of returning `{ success: false }`. */
+    mode?: 'hard' | 'soft'; /** Legacy opt-in: throw a 404 error on miss instead of returning `null`. */
     throwOnNotFound?: boolean;
-  }): Promise<DeleteResult>;
+  }): Promise<DeleteResult | null>;
   /**
    * Update every document matching the filter.
    *
@@ -1118,7 +1540,7 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * Refuses empty filters (defense-in-depth against mass-update accidents)
    * both before and after policy hooks inject tenant scope.
    */
-  updateMany(filter: Record<string, unknown>, update: UpdateInput$1, options?: SessionOptions & {
+  updateMany(filter: Record<string, unknown>, update: UpdateInput, options?: SessionOptions & {
     updatePipeline?: boolean;
     [key: string]: unknown;
   }): Promise<UpdateManyResult>;
@@ -1196,26 +1618,60 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    */
   aggregate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggRequest): Promise<AggResult<TRow>>;
   /**
-   * Offset-paginated portable aggregation. Same IR as `aggregate`,
-   * wrapped in the standard `OffsetPaginationResultCore` envelope so
-   * UI code paginates aggregated dashboards with the same primitives
-   * as raw document lists.
+   * Invalidate every aggregate-cache entry tagged with ANY of the
+   * given tags. Delegates to the unified cache plugin's handle
+   * (`repo.cache.invalidateByTags`) — wired by `cachePlugin({ adapter })`.
+   *
+   * Pass no tags to wipe the entire cache namespace (requires the
+   * adapter to implement `clear`).
+   *
+   * Returns the count of distinct entries cleared (`-1` when the call
+   * routed through `adapter.clear()` and the adapter doesn't report a
+   * count). No-op (returns `0`) when no cache plugin is wired.
+   */
+  invalidateAggregateCache(tags?: readonly string[]): Promise<number>;
+  /**
+   * Paginated portable aggregation. Two pagination modes, picked by
+   * the request shape:
+   *
+   * - **Offset (default)** — `page` + `limit`. Returns the standard
+   *   `{ method: 'offset', data, total, pages, hasNext, hasPrev, ... }`
+   *   envelope. `countStrategy: 'none'` skips the second round-trip
+   *   that computes `total`; the envelope reports `total: 0`,
+   *   `pages: 0`, and derives `hasNext` from a `LIMIT N+1` peek on
+   *   the data pipeline.
+   * - **Keyset** — `pagination: 'keyset'` (or `after` set). Returns
+   *   `{ method: 'keyset', data, hasMore, next, limit }`. `sort` is
+   *   required — the cursor encodes the sort-key tuple of the last
+   *   row. Each subsequent page passes the previous `next` back as
+   *   `after`. Scales to arbitrary group counts because the planner
+   *   uses `(sort_keys) > (cursor)` instead of `OFFSET N`.
+   */
+  aggregatePaginate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggPaginationRequest): Promise<OffsetPaginationResultCore<TRow> | KeysetAggPaginationResult<TRow>>;
+  /**
+   * Internal: the actual aggregate-paginate execution body. Extracted
+   * so `aggregatePaginate` can wrap it in the cache layer without
+   * duplicating the keyset / offset branch logic.
    *
-   * `countStrategy: 'none'` skips the second round-trip that computes
-   * `total`; the envelope reports `total: 0`, `pages: 0`, and derives
-   * `hasNext` from a `LIMIT N+1` peek on the data pipeline.
+   * Receives `finalReq` (already policy-scoped) so the cache key
+   * built by the outer wrapper matches the request the executor
+   * sees — no cross-tenant cache poisoning.
    */
-  aggregatePaginate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggPaginationRequest): Promise<OffsetPaginationResultCore<TRow>>;
+  private _executeAggregatePaginate;
   /**
    * Merge policy-hook-injected filters (multi-tenant scope,
    * soft-delete) into the pre-aggregate `filter` slot of the request.
    * Plugins speak mongo-query shape (`context.query` / `context.filters`);
-   * we merge those with the portable `req.filter` using `$and`.
+   * the caller's `req.filter` may be either Filter IR or a mongo query.
    *
-   * When the caller's filter is a Filter IR node we don't unwrap it —
-   * the pipeline compiler does Filter→mongo translation. Merging here
-   * as a mongo-shaped `$and` is safe because `compileFilterToMongo`
-   * passes through already-mongo queries unchanged.
+   * Each part is compiled through `compileFilterToMongo` BEFORE the
+   * `$and` merge — otherwise an IR node like `eq('status', 'paid')`
+   * (`{ op, field, value }`) gets nested inside `$and` as a literal,
+   * `compileFilterToMongo` of the merged value finds no top-level `op`
+   * (so `isFilter` is false), and Mongo receives the IR object as a
+   * raw query clause that matches no real document. Symptom: aggregates
+   * silently return 0 rows whenever a callerpasses IR + a policy
+   * plugin is installed.
    */
   private _injectPolicyScopeIntoAgg;
   /**
@@ -1449,16 +1905,202 @@ interface SessionStarter {
  * ```
  */
 declare function withTransaction<T>(connection: SessionStarter, callback: (session: ClientSession) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
+/**
+ * Multi-repo transactional batch — every repo in `repos` becomes a
+ * session-bound proxy inside the callback. Eliminates the per-call
+ * `{ session }` threading that was repeated across ~20 call sites
+ * (be-prod outbox writes, order placement, transfer source/dest pairs,
+ * payrun saga steps).
+ *
+ * Same retry + fallback semantics as `withTransaction`: the
+ * `transactionOptions` / `allowFallback` / `onFallback` knobs apply.
+ *
+ * Each property of the input `repos` map is rebound via the
+ * `createTxBoundRepo` proxy — every CRUD method on the bound repo
+ * auto-injects `session` into its options bag, including
+ * `claim` / `claimVersion` / `findOneAndUpdate` and plugin-contributed
+ * methods. Non-CRUD properties (Model, modelName, hook engine,
+ * idField) pass through to the underlying repo. Nested
+ * `boundRepo.withTransaction(...)` throws — reuse the outer bound
+ * repos.
+ *
+ * @example Order placement across three repos in one transaction
+ * ```ts
+ * import { batchTransaction } from '@classytic/mongokit';
+ *
+ * const order = await batchTransaction(
+ *   mongoose.connection,
+ *   { orders: orderRepo, events: eventRepo, inventory: inventoryRepo },
+ *   async ({ orders, events, inventory }) => {
+ *     const created = await orders.create(orderData);          // session auto-injected
+ *     await events.create({ type: 'order.placed', orderId: created._id });
+ *     await inventory.claim(skuId, { from: 'available', to: 'reserved' });
+ *     return created;
+ *   },
+ * );
+ * ```
+ *
+ * @example With fallback for standalone-mongo dev environments
+ * ```ts
+ * await batchTransaction(
+ *   mongoose.connection,
+ *   { orders, events },
+ *   async ({ orders, events }) => { ... },
+ *   { allowFallback: true, onFallback: (err) => log.warn(err) },
+ * );
+ * ```
+ *
+ * @param connection - Mongoose connection (or anything with
+ *   `startSession()`). Single source of session truth — every bound
+ *   repo shares this session.
+ * @param repos - Map of repo instances to rebind. Keys become the
+ *   property names on the callback's argument.
+ * @param callback - Receives the bound repo map. Return value flows
+ *   through to the outer `Promise`.
+ */
+declare function batchTransaction<TRepos extends Record<string, object>, TResult>(connection: SessionStarter, repos: TRepos, callback: (bound: TRepos) => Promise<TResult>, options?: WithTransactionOptions): Promise<TResult>;
 /**
  * Detect whether an error indicates the MongoDB deployment does not support
  * multi-document transactions (standalone server, older topology, etc.).
  *
  * Checks MongoDB error codes first — 263 (standalone) and 20 (unsupported
  * topology) — with a message-matching fallback for edge cases surfaced by
- * older driver versions.
+ * driver versions that throw before the proper code lands.
+ *
+ * **Driver-version drift:** modern mongoose / mongodb-driver versions hit
+ * the standalone case via the retryable-writes precondition rather than
+ * the transaction precondition (`retryWrites=true` is on by default,
+ * standalone Mongo rejects it before the transaction is even attempted).
+ * So we accept that message as equivalent — the underlying topology
+ * problem is the same, and the fallback semantics are correct either way.
  */
 declare function isTransactionUnsupported(error: Error): boolean;
 //#endregion
+//#region src/utils/repo-options.d.ts
+/**
+ * Forward request-scoped context fields into a mongokit options bag.
+ *
+ * Multi-tenant scoping, audit attribution, and transaction threading
+ * all read their inputs from the **options** argument of every repo
+ * method — `multiTenantPlugin` looks for `organizationId`, the audit
+ * plugins read `userId` / `user`, and `withTransaction` honors
+ * `session`. Consumers were repeatedly hand-rolling:
+ *
+ *   ```ts
+ *   await repo.update(id, data, {
+ *     organizationId: ctx.organizationId,
+ *     userId: ctx.userId,
+ *     session: ctx.session,
+ *   });
+ *   ```
+ *
+ * — sometimes correctly forwarding all three, sometimes only one,
+ * sometimes constructing `Types.ObjectId(orgId)` manually because the
+ * caller didn't trust `multiTenantPlugin` to handle the cast (it does).
+ * The result was inconsistent forwarding across repos, with several
+ * silent tenant-leak shapes traced back to a forgotten field.
+ *
+ * `repoOptionsFromCtx(ctx)` is the canonical extractor. Pass it the
+ * request context (whatever shape your framework hands you) and it
+ * returns the subset of fields mongokit's plugins read. Unknown ctx
+ * keys are NOT forwarded — the options bag stays narrow and explicit.
+ *
+ * @example
+ * ```ts
+ * import { repoOptionsFromCtx } from '@classytic/mongokit';
+ *
+ * await orderRepo.update(id, data, repoOptionsFromCtx(ctx));
+ * await orderRepo.claim(id, { from: 'pending', to: 'shipped' }, {}, repoOptionsFromCtx(ctx));
+ * ```
+ *
+ * @example Spreading + adding kit-specific options
+ * ```ts
+ * await orderRepo.findOneAndUpdate(filter, update, {
+ *   ...repoOptionsFromCtx(ctx),
+ *   returnDocument: 'after',
+ *   upsert: true,
+ * });
+ * ```
+ *
+ * The fields read (all optional — extracted only when present and not
+ * `undefined`):
+ *
+ * - `organizationId` — multi-tenant scope key. The
+ *   `multiTenantPlugin` casts to `ObjectId` automatically when
+ *   configured with `fieldType: 'objectId'`; do NOT pre-cast.
+ * - `userId` / `user` — audit attribution (audit-log + audit-trail
+ *   plugins read these for the `who` column).
+ * - `session` — mongoose `ClientSession` for transaction threading.
+ * - `requestId` — observability correlation id.
+ *
+ * Fields beyond this set should be added inline at the call site —
+ * `repoOptionsFromCtx` deliberately stays narrow so adding a new
+ * convention to the canonical set is a deliberate API decision, not
+ * a quiet drift.
+ */
+declare function repoOptionsFromCtx<TCtx extends Record<string, unknown>>(ctx: TCtx | undefined | null): Record<string, unknown>;
+/**
+ * Build a typed extractor for **consumer-defined** ctx → options
+ * forwarding. Same conceptual shape as `repoOptionsFromCtx`, but the
+ * caller declares the field set so domain-package fields beyond
+ * mongokit's bundled-plugin keys land too.
+ *
+ * Across the classytic codebase, ~6 packages (commission, supplier-
+ * performance, pos, yard, order, plus implicit in leave/payrun/
+ * muster/people) ship a hand-rolled 15-line `repo-options.ts` doing
+ * the same shape — drift is inevitable, "I forgot to forward
+ * `correlationId`" is a recurring bug class. This builder eliminates
+ * the boilerplate and pins the field list at the type level so
+ * adding a new canonical field is a single-line edit.
+ *
+ * **Type-safe field declaration.** The `fields` array is constrained
+ * to `keyof TCtx & string`, so a typo in a field name is a compile
+ * error rather than a silent absent-key. The returned extractor's
+ * output keys are inferred from the input field tuple — you can
+ * destructure with full autocomplete.
+ *
+ * **Difference from `repoOptionsFromCtx`.** That helper hardcodes the
+ * fields **mongokit's bundled plugins** read (`organizationId`,
+ * `userId`, `user`, `session`, `requestId`). Use it when those are
+ * sufficient. Reach for `createOptionsExtractor` when your domain has
+ * its own canonical fields (`actorRef`, `actorKind`, `correlationId`,
+ * `idempotencyKey`, `sagaRunId`, ...) that should also forward.
+ *
+ * @example Per-package canonical extractor
+ * ```ts
+ * import { createOptionsExtractor } from '@classytic/mongokit';
+ *
+ * type CommissionCtx = {
+ *   organizationId: string;
+ *   actorRef: string;
+ *   actorKind: 'user' | 'system';
+ *   correlationId: string;
+ *   session?: ClientSession;
+ *   idempotencyKey?: string;
+ * };
+ *
+ * export const repoOptionsFromCtx = createOptionsExtractor<CommissionCtx>([
+ *   'organizationId',
+ *   'actorRef',
+ *   'actorKind',
+ *   'correlationId',
+ *   'session',
+ *   'idempotencyKey',
+ * ]);
+ *
+ * // Use:
+ * await commissionRepo.update(id, data, repoOptionsFromCtx(ctx));
+ * ```
+ *
+ * @param fields - The canonical option keys to extract from ctx.
+ *   Must be `(keyof TCtx & string)[]` — TypeScript prevents typos at
+ *   the declaration site.
+ * @returns An extractor function `(ctx: TCtx | null | undefined) → Record<string, unknown>`
+ *   that omits absent/undefined keys (so spreading into a parent
+ *   options bag never erases inherited values).
+ */
+declare function createOptionsExtractor<TCtx extends Record<string, unknown>>(fields: readonly (keyof TCtx & string)[]): (ctx: TCtx | undefined | null) => Record<string, unknown>;
+//#endregion
 //#region src/index.d.ts
 /**
  * Factory function to create a repository instance
@@ -1472,4 +2114,4 @@ declare function isTransactionUnsupported(error: Error): boolean;
  */
 declare function createRepository<TDoc>(Model: _$mongoose.Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions): Repository<TDoc>;
 //#endregion
-export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, type AggregatePaginationResult, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheMethods, type CacheOperationOptions, type CacheOptions, type CacheStats, type CacheableOptions, type CascadeOptions, type CascadeRelation, type CollationOptions, type CreateInput, type CreateOptions, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type HttpError, type IController, type IControllerResponse, type IRequestContext, type IResponseFormatter, type IdGenerator, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type KeysetPaginationResult, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MUTATING_OPERATIONS, type MinMaxResult, type MongoOperationsMethods, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OffsetPaginationResult, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type PaginationResult, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, Repository, Repository as default, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type UpdateInput, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, configureLogger, createError, createFieldPreset, createMemoryCache, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, immutableField, isDuplicateKeyError, isTransactionUnsupported, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin, withTransaction };
+export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BasePaginationOptions, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheOperationOptions, type CacheOptions, type CacheableOptions, type CascadeOptions, type CascadeRelation, type CollationOptions, type CreateInput, type CreateOptions, type CursorPayload, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type IController, type IControllerResponse, type IRequestContext, type IResponseFormatter, type IdGenerator, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type LeaseMethods, type LeasePluginOptions, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MUTATING_OPERATIONS, type Middleware, type MiddlewareContext, type MinMaxResult, type MinimalRepoView, type MongoOperationsMethods, type MongoOperatorUpdate, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, type PrioritizedHook, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, Repository, Repository as default, type RepositoryCacheHandle, type RepositoryCachePluginOptions, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type ValueType, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, adminBypass, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, configureLogger, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, immutableField, isDuplicateKeyError, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, repoOptionsFromCtx, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin, withTransaction };