@classytic/mongokit 3.15.0 → 3.16.0

package/dist/index.d.mts

@@ -1,75 +1,19 @@
-import { $ as RepositoryEvent, A as KeysetPaginationOptions, B as ObjectId, C as FieldPreset, Ct as IControllerResponse, D as InferDocument, Dt as LookupOptions, E as HookMode, Et as LookupBuilder, F as MiddlewareContext, G as Plugin, H as OperationOptions, I as MinMaxResult, J as PopulateSpec, K as PluginFunction, L as MinimalRepoView, M as LookupPopulateOptions, N as LookupPopulateResult, O as InferRawDoc, P as Middleware, Q as RepositoryContext, R as MongoOperatorUpdate, S as EventPhase, St as IController, T as GroupResult, Tt as IResponseFormatter, U as PaginationConfig, V as OffsetPaginationOptions, W as PartialBy, X as ReadOptions, Y as PrioritizedHook, Z as ReadPreferenceType, _ as DeleteManyResult, _t as ValidationChainOptions, a as AnyModel, at as SessionOptions, b as EventHandlers, bt as WithPlugins, c as CacheableOptions, ct as SoftDeleteRepository, d as CollationOptions, dt as Strict, et as RepositoryInstance, f as CreateInput, ft as UpdateManyResult, g as DeepPartial, gt as UserContext, h as DecodedCursor, ht as UpdateWithValidationResult, i as AnyDocument, it as SelectSpec, j as Logger, k as KeysOfType, l as CascadeOptions, lt as SortDirection, m as CursorPayload, mt as UpdatePatch, n as AggregatePaginationOptions, nt as RepositoryOptions, o as BasePaginationOptions, ot as SoftDeleteFilterMode, p as CreateOptions, pt as UpdateOptions, q as PluginType, r as AllPluginMethods, rt as RequiredBy, s as CacheOperationOptions, st as SoftDeleteOptions, t as AggregateOptions, tt as RepositoryOperation, u as CascadeRelation, ut as SortSpec, v as DeleteResult, vt as ValidatorDefinition, w as FindOneAndUpdateOptions, wt as IRequestContext, x as EventPayload, xt as WithTransactionOptions, y as DocField, yt as ValueType, z as NonNullableFields } from "./types-BbaPZleN.mjs";
-import { t as index_d_exports } from "./index-Dccha9dw.mjs";
+import { $ as RepositoryEvent, A as KeysetPaginationOptions, B as ObjectId, C as FieldPreset, Ct as IControllerResponse, D as InferDocument, Dt as LookupOptions, E as HookMode, Et as LookupBuilder, F as MiddlewareContext, G as Plugin, H as OperationOptions, I as MinMaxResult, J as PopulateSpec, K as PluginFunction, L as MinimalRepoView, M as LookupPopulateOptions, N as LookupPopulateResult, O as InferRawDoc, P as Middleware, Q as RepositoryContext, R as MongoOperatorUpdate, S as EventPhase, St as IController, T as GroupResult, Tt as IResponseFormatter, U as PaginationConfig, V as OffsetPaginationOptions, W as PartialBy, X as ReadOptions, Y as PrioritizedHook, Z as ReadPreferenceType, _ as DeleteManyResult, _t as ValidationChainOptions, a as AnyModel, at as SessionOptions, b as EventHandlers, bt as WithPlugins, c as CacheableOptions, ct as SoftDeleteRepository, d as CollationOptions, dt as Strict, et as RepositoryInstance, f as CreateInput, ft as UpdateManyResult, g as DeepPartial, gt as UserContext, h as DecodedCursor, ht as UpdateWithValidationResult, i as AnyDocument, it as SelectSpec, j as Logger, k as KeysOfType, l as CascadeOptions, lt as SortDirection, m as CursorPayload, mt as UpdatePatch, n as AggregatePaginationOptions, nt as RepositoryOptions, o as BasePaginationOptions, ot as SoftDeleteFilterMode, p as CreateOptions, pt as UpdateOptions, q as PluginType, r as AllPluginMethods, rt as RequiredBy, s as CacheOperationOptions, st as SoftDeleteOptions, t as AggregateOptions, tt as RepositoryOperation, u as CascadeRelation, ut as SortSpec, v as DeleteResult, vt as ValidatorDefinition, w as FindOneAndUpdateOptions, wt as IRequestContext, x as EventPayload, xt as WithTransactionOptions, y as DocField, yt as ValueType, z as NonNullableFields } from "./types-BWZILovv.mjs";
+import { t as index_d_exports } from "./index-CV5vv-8E.mjs";
+import { $ as AuditEntry, A as BulkWriteResult, B as IdGenerator, C as LeasePluginOptions, D as elasticSearchPlugin, E as ElasticSearchOptions, F as MultiTenantOptions, G as getNextSequence, H as SequentialIdOptions, I as adminBypass, J as CacheAdapter, K as prefixedId, L as multiTenantPlugin, M as auditLogPlugin, N as AggregateHelpersMethods, O as cascadePlugin, P as aggregateHelpersPlugin, Q as cachePlugin, R as CustomIdOptions, S as LeaseMethods, T as fieldFilterPlugin, U as customIdPlugin, V as PrefixedIdOptions, W as dateSequentialId, X as RepositoryCacheHandle, Y as CacheOptions, Z as RepositoryCachePluginOptions, _ as observabilityPlugin, a as uniqueField, at as AuditTrailQuery, c as TenantContext, d as SubdocumentMethods, et as AuditOperation, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, it as AuditTrailOptions, j as batchOperationsPlugin, k as BatchOperationsMethods, l as TenantStore, m as softDeletePlugin, n as blockIf, nt as AuditQueryResult, o as validationChainPlugin, ot as auditTrailPlugin, p as SoftDeleteMethods, q as sequentialId, r as immutableField, rt as AuditTrailMethods, s as timestampPlugin, t as autoInject, tt as AuditQueryOptions, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as DateSequentialIdOptions } from "./validation-chain.plugin-Iee2_puD.mjs";
 import { PaginationEngine } from "./pagination/PaginationEngine.mjs";
-import { $ as AuditQueryResult, A as elasticSearchPlugin, B as sequentialId, D as leasePlugin, E as LeasePluginOptions, F as SequentialIdOptions, G as RepositoryCachePluginOptions, H as CacheAdapter, I as customIdPlugin, J as BulkWriteResult, K as cachePlugin, L as dateSequentialId, M as DateSequentialIdOptions, N as IdGenerator, O as fieldFilterPlugin, P as PrefixedIdOptions, Q as AuditQueryOptions, R as getNextSequence, S as mongoOperationsPlugin, T as LeaseMethods, U as CacheOptions, V as cascadePlugin, W as RepositoryCacheHandle, X as AuditEntry, Y as batchOperationsPlugin, Z as AuditOperation, _ as observabilityPlugin, a as uniqueField, at as AggregateHelpersMethods, b as multiTenantPlugin, c as TenantContext, d as SubdocumentMethods, et as AuditTrailMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, it as auditLogPlugin, j as CustomIdOptions, k as ElasticSearchOptions, l as TenantStore, m as softDeletePlugin, n as blockIf, nt as AuditTrailQuery, o as validationChainPlugin, ot as aggregateHelpersPlugin, p as SoftDeleteMethods, q as BatchOperationsMethods, r as immutableField, rt as auditTrailPlugin, s as timestampPlugin, t as autoInject, tt as AuditTrailOptions, u as createTenantContext, v as MultiTenantOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as adminBypass, z as prefixedId } from "./validation-chain.plugin-CAPYCj_T.mjs";
 import { n as SchemaPathsLike, t as FieldType$1 } from "./coercion-TRMmR49h.mjs";
 import { n as SchemaIndexes } from "./indexes-CgOF7Wjd.mjs";
-import { a as createFieldPreset, c as getMongooseProjection, d as parseDuplicateKeyError, i as configureLogger, l as createError, n as buildCrudSchemasFromMongooseSchema, o as filterResponseData, r as createMemoryCache, s as getFieldsForUser, t as buildCrudSchemasFromModel, u as isDuplicateKeyError } from "./mongooseToJsonSchema-BgRAaXX-.mjs";
+import { a as createFieldPreset, c as getMongooseProjection, d as parseDuplicateKeyError, i as configureLogger, l as createError, n as buildCrudSchemasFromMongooseSchema, o as filterResponseData, r as createMemoryCache, s as getFieldsForUser, t as buildCrudSchemasFromModel, u as isDuplicateKeyError } from "./mongooseToJsonSchema-GhvZUjRO.mjs";
 import * as _$mongoose from "mongoose";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
-import { AggPaginationRequest, AggRequest, AggResult, KeysetAggPaginationResult, QueryOptions, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy } from "@classytic/repo-core/repository";
+import { AggPaginationRequest, AggRequest, AggResult, ChangeEvent, FilterInput, KeysetAggPaginationResult, QueryOptions, RepoCapabilities, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy, WatchOptions } from "@classytic/repo-core/repository";
 import { UpdateInput } from "@classytic/repo-core/update";
 import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
 import { HttpError } from "@classytic/repo-core/errors";
 
-//#region src/filter/compile.d.ts
-/**
- * Filter IR → MongoDB query compiler.
- *
- * Mirrors sqlitekit's `compileFilterToDrizzle`: takes a repo-core
- * `Filter` tree and emits a MongoDB query object. Used by `groupBy` /
- * `groupByPaginate` to translate the portable AggRequest's `filter`
- * + `having` into `$match` stages.
- *
- * Scope: the same operator set sqlitekit supports (`eq`, `ne`, `gt`,
- * `gte`, `lt`, `lte`, `in`, `nin`, `exists`, `like`, `regex`, `and`,
- * `or`, `not`, `raw`). Anything else throws so we fail loud instead
- * of silently dropping predicates.
- *
- * Why only this op set here and not everywhere in mongokit? Historic
- * reason: mongokit pre-dates repo-core's Filter IR, so its existing
- * policy plugins (multi-tenant, soft-delete) speak MongoDB query
- * language directly. Converting mongokit's entire filter pipeline
- * to Filter IR is out-of-scope for this change — we introduce the
- * compiler only where the new portable `groupBy` IR needs it.
- */
-declare function compileFilterToMongo(input: unknown): Record<string, unknown>;
-//#endregion
-//#region src/operations.d.ts
-/**
- * Where a plugin should inject its scoping filter (multi-tenant scope,
- * soft-delete filter, etc.) on the RepositoryContext.
- *
- * - `data`        — single-doc create payload (`context.data`)
- * - `dataArray`   — multi-doc create payload (`context.dataArray`)
- * - `query`       — raw filter (`context.query`); the dominant convention
- * - `filters`     — paginated list options' filter sub-bag (`context.filters`)
- * - `operations`  — bulkWrite per-sub-op (special — plugins walk each entry)
- * - `none`        — no scoping target (op accepts no filter input)
- */
-type PolicyKey = 'data' | 'dataArray' | 'query' | 'filters' | 'operations' | 'none';
-interface OperationDescriptor {
-  /** Where multi-tenant / soft-delete plugins inject their scoping filter. */
-  policyKey: PolicyKey;
-  /** Whether this op writes to the database. Drives audit + cache invalidation. */
-  mutates: boolean;
-  /** True when `context.id` is populated by the time before/after hooks fire. */
-  hasIdContext: boolean;
-}
-/**
- * The registry. Order intentionally groups by category for readability.
- * Adding a new RepositoryOperation requires exactly one entry here, after
- * which every bundled plugin auto-classifies it correctly.
- */
-declare const OP_REGISTRY: Readonly<Record<RepositoryOperation, OperationDescriptor>>;
-/** All known repository operations, in registry order. */
-declare const ALL_OPERATIONS: RepositoryOperation[];
-/** Operations that mutate the database. Drives audit + cache invalidation lists. */
-declare const MUTATING_OPERATIONS: readonly RepositoryOperation[];
-/** Operations that don't mutate. Drives default cacheable ops. */
-declare const READ_OPERATIONS: readonly RepositoryOperation[];
-/** Filter ops by their policy injection key. */
-declare function operationsByPolicyKey(key: PolicyKey): RepositoryOperation[];
+//#region src/capabilities.d.ts
+declare const MONGOKIT_CAPABILITIES: RepoCapabilities;
 //#endregion
 //#region src/query/AggregationBuilder.d.ts
 /** Options for $vectorSearch stage (Atlas only) */
@@ -492,745 +436,407 @@ declare class AggregationBuilder {
   static startWith(query: Record<string, unknown>): AggregationBuilder;
 }
 //#endregion
-//#region src/query/QueryParser.d.ts
-type SortSpec$1 = Record<string, 1 | -1>;
-type FilterQuery = Record<string, unknown>;
+//#region src/Repository.d.ts
 /**
- * Mongoose-compatible populate option
- * Supports advanced populate with select, match, limit, sort, and nested populate
+ * Plugin phase priorities (lower = runs first).
  *
- * @example
- * ```typescript
- * // URL: ?populate[author][select]=name,email&populate[author][match][active]=true
- * // Generates: { path: 'author', select: 'name email', match: { active: true } }
- * ```
- */
-interface PopulateOption {
-  /** Field path to populate */
-  path: string;
-  /** Fields to select (space-separated) */
-  select?: string;
-  /** Filter conditions for populated documents */
-  match?: Record<string, unknown>;
-  /** Query options (limit, sort, skip) */
-  options?: {
-    limit?: number;
-    sort?: SortSpec$1;
-    skip?: number;
-  };
-  /** Nested populate configuration */
-  populate?: PopulateOption;
-}
-/** Parsed query result with optional lookup configuration */
-interface ParsedQuery {
-  /** MongoDB filter query */
-  filters: FilterQuery;
-  /** Sort specification */
-  sort?: SortSpec$1;
-  /** Fields to populate (simple comma-separated string) */
-  populate?: string;
-  /**
-   * Advanced populate options (Mongoose-compatible)
-   * When this is set, `populate` will be undefined
-   * @example [{ path: 'author', select: 'name email' }]
-   */
-  populateOptions?: PopulateOption[];
-  /** Page number for offset pagination */
-  page?: number;
-  /** Cursor for keyset pagination */
-  after?: string;
-  /** Limit */
-  limit: number;
-  /** Full-text search query */
-  search?: string;
-  /** Lookup configurations for custom field joins */
-  lookups?: LookupOptions[];
-  /** Aggregation pipeline stages (advanced) */
-  aggregation?: PipelineStage[];
-  /** Select/project fields */
-  select?: Record<string, 0 | 1>;
-}
-/** Search mode for query parser */
-type SearchMode = 'text' | 'regex';
-/**
- * Normalized field type used for schema-aware value coercion. Re-exported
- * from `primitives/coercion` so the public QueryParser API stays unchanged
- * while the actual logic lives in a single, unit-tested primitive module.
+ * Re-exported from `@classytic/repo-core/hooks` so mongokit 3.10 callers see
+ * the same constant whether they import from mongokit or directly from
+ * repo-core — priorities are identical (POLICY=100, CACHE=200,
+ * OBSERVABILITY=300, DEFAULT=500) and the two refs are reference-equal.
  */
-type FieldType = FieldType$1;
+declare const HOOK_PRIORITY: {
+  readonly POLICY: 100;
+  readonly VALIDATION: 150;
+  readonly CACHE: 200;
+  readonly OBSERVABILITY: 300;
+  readonly DEFAULT: 500;
+};
 /**
- * Minimal structural type for a Mongoose schema. We only read `.paths` and
- * (optionally) `.indexes()`, so the parser stays decoupled from a specific
- * Mongoose major version and is easy to mock in tests. Re-exported from the
- * primitives module — the canonical definition lives there.
+ * Production-grade repository for MongoDB.
+ *
+ * Extends `@classytic/repo-core/repository`'s `RepositoryBase` for the
+ * driver-agnostic hook + plugin plumbing (context builder, priority-sorted
+ * event engine, plugin-order validator) while layering every Mongo-specific
+ * concern — populate, aggregate, lookup, keyset + cursor pagination, $near
+ * rewriting — on top.
+ *
+ * Public surface is byte-stable with mongokit 3.9 (the `_hooks` property is
+ * preserved as a live read-through getter; all CRUD, event, and plugin method
+ * signatures unchanged). 3.10 is an internal re-plumbing release; consumers
+ * upgrading from 3.9 need no code changes.
  */
-interface SchemaLike extends SchemaPathsLike {
-  /** Optional — when present, schema indexes are introspected for geo/text fields */
-  indexes?: () => Array<[Record<string, unknown>, Record<string, unknown>?]>;
-}
-interface QueryParserOptions {
-  /** Maximum allowed regex pattern length (default: 500) */
-  maxRegexLength?: number;
-  /** Maximum allowed text search query length (default: 200) */
-  maxSearchLength?: number;
-  /** Maximum allowed filter depth (default: 10) */
-  maxFilterDepth?: number;
-  /** Maximum allowed limit value (default: 1000) */
-  maxLimit?: number;
-  /** Additional operators to block */
-  additionalDangerousOperators?: string[];
-  /** Enable lookup parsing (default: true) */
-  enableLookups?: boolean;
-  /** Enable aggregation parsing (default: false - requires explicit opt-in) */
-  enableAggregations?: boolean;
+declare class Repository<TDoc = unknown> extends RepositoryBase {
   /**
-   * Search mode (default: 'text')
-   * - 'text': Uses MongoDB $text search (requires text index)
-   * - 'regex': Uses $or with $regex across searchFields (no index required)
+   * Runtime capability descriptor required by `StandardRepo<TDoc>`
+   * (repo-core 0.6.0). Hosts feature-detect once at boot instead of
+   * try/catching `UnsupportedOperationError` per call.
    */
-  searchMode?: SearchMode;
+  readonly capabilities: RepoCapabilities;
+  readonly Model: Model<TDoc>;
   /**
-   * Fields to search when searchMode is 'regex'
-   * Required when searchMode is 'regex'
-   * @example ['name', 'description', 'sku', 'tags']
+   * Mongoose model name. Duplicated on the instance for BC — arc / catalog /
+   * user code read `repo.model`. `RepositoryBase.modelName` points to the
+   * same string; prefer `modelName` in new code.
    */
-  searchFields?: string[];
+  readonly model: string;
+  readonly _pagination: PaginationEngine<TDoc>;
+  readonly idField: string;
+  readonly searchMode: 'text' | 'regex' | 'auto';
+  readonly searchFields: string[] | undefined;
+  [key: string]: unknown;
+  private _hasTextIndex;
   /**
-   * Whitelist of collection names allowed in lookups.
-   * When set, only these collections can be used in $lookup stages.
-   * When undefined, all collection names are allowed.
-   * @example ['departments', 'categories', 'users']
+   * Wrap-style middleware chain. Composed around every `_runOp`
+   * invocation in registration order — earlier-registered middlewares
+   * are outer (run first / unwind last). See `useMiddleware()` and
+   * the `Middleware<TDoc>` type for the protocol.
    */
-  allowedLookupCollections?: string[];
-  /** Allowed fields for filtering. If set, ignores unknown fields. */
-  allowedFilterFields?: string[];
-  /** Allowed fields for sorting. If set, ignores unknown fields. */
-  allowedSortFields?: string[];
+  private readonly _middlewares;
+  constructor(Model: Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions);
   /**
-   * Whitelist of allowed filter operators.
-   * When set, only these operators can be used in filters.
-   * When undefined, all built-in operators are allowed.
-   * Values are human-readable keys: 'eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in', 'nin',
-   * 'like', 'contains', 'regex', 'exists', 'size', 'type'
-   * @example ['eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in']
+   * Live read-through view of the hook engine's listener registry.
+   *
+   * Preserved as a public field on the Repository for back-compat with
+   * mongokit ≤3.9 — existing tests and observability code pattern-match
+   * `repo._hooks.get('before:getAll')` / `repo._hooks.size`. Each access
+   * returns a fresh snapshot of the underlying HookEngine state.
+   *
+   * Read-only. To register listeners use `repo.on(event, listener, { priority })`.
    */
-  allowedOperators?: string[];
+  get _hooks(): Map<string, PrioritizedHook[]>;
   /**
-   * Mongoose schema (or schema-like object exposing `.paths`) used for
-   * authoritative, schema-aware value coercion. When provided, filter values
-   * are coerced to the declared field type instead of guessed from the
-   * string shape — `?stock=50` becomes a number against a `Number` field but
-   * `?name=12345` stays a string against a `String` field. Nested paths like
-   * `address.zip` are looked up via dot-notation, matching Mongoose's
-   * `schema.paths` reflection. Unknown fields fall through to the heuristic.
+   * Fire-and-forget emit aliased through RepositoryBase's async path so
+   * error hooks converted to/from sync mode still route uniformly. Mongokit
+   * ≤3.9 made this a private method on its subclass; the base class exposes
+   * it publicly and wraps it in `_emitHook` below for internal use.
    */
-  schema?: SchemaLike;
+  private _emitHook;
+  private _emitErrorHook;
   /**
-   * Plain field-type map used for authoritative coercion when no Mongoose
-   * schema is available (raw MongoDB, Prisma, computed fields, upstream
-   * models you don't own). Takes precedence over `schema` for paths declared
-   * in both — useful for runtime overrides. Use dot-notation for nested
-   * paths (`'address.zip': 'string'`).
-   * @example { stock: 'number', active: 'boolean', releasedAt: 'date' }
+   * Wire the `warnOnStrictQueryStrip` diagnostic. When enabled, every
+   * filter-shaped op (`getById`, `getByQuery`, `getOne`, `findAll`,
+   * `count`, `exists`, `update`, `delete`, `findOneAndUpdate`,
+   * `updateMany`, `deleteMany`, `claim`, `claimVersion`, `cursor`)
+   * checks its `context.query` keys against the cached set of schema
+   * paths. Top-level keys not on the schema get logged once per
+   * `(model, key)` pair — so a single bad caller surfaces in dev /
+   * staging instead of returning the wrong row in prod.
+   *
+   * Only runs when `strictQuery !== false` is in effect — if mongoose's
+   * strictQuery is off, unknown keys flow through to the driver and
+   * the trap doesn't apply.
    */
-  fieldTypes?: Record<string, FieldType>;
-}
-/**
- * Modern Query Parser
- * Converts URL parameters to MongoDB queries with $lookup support
- */
-declare class QueryParser {
-  private readonly options;
-  private readonly operators;
-  private readonly dangerousOperators;
-  /**
-   * Normalized dot-notation field-type map. Built once at construction from
-   * `options.schema` (Mongoose) and `options.fieldTypes` (override map), with
-   * `fieldTypes` taking precedence. An empty map means schema-aware coercion
-   * is disabled and the heuristic in `_convertValue` runs unchanged — this
-   * preserves backwards compatibility for callers that don't opt in.
-   */
-  private readonly _fieldTypes;
-  /**
-   * Structured schema-index info (geo / text / other), built once from
-   * `options.schema?.indexes()`. Used by the operator router to validate
-   * geo operators against actual geo-indexed fields, and exposed publicly
-   * via `parser.schemaIndexes` for downstream tools (Arc MCP, query planners).
-   */
-  private readonly _schemaIndexes;
+  private _wireStrictQueryStripDiagnostic;
   /**
-   * Regex patterns that can cause catastrophic backtracking (ReDoS attacks).
-   * Detects common footguns:
-   * - Quantifiers: {n,m}
-   * - Possessive quantifiers: *+, ++, ?+
-   * - Nested quantifiers: (a+)+, (a*)*
-   * - Backreferences: \1, \2, etc.
-   * - Complex character classes: [...]...[...]
+   * Register a wrap-style middleware. Middleware composes AROUND every
+   * `_runOp` invocation — it sees the operation name, the live
+   * `RepositoryContext`, and a `next()` continuation that runs the
+   * remaining chain + the actual op + after/error hooks.
    *
-   * This pattern detector is FAIL-SAFE (on match, the input is escaped), but
-   * it is not exhaustive. {@link _regexComplexityExceedsBudget} complements
-   * it with a deterministic static complexity budget so patterns that happen
-   * to evade the detector still fail over when their unbounded-quantifier
-   * density is pathological.
-   */
-  private readonly dangerousRegexPatterns;
-  /**
-   * Static complexity budget for user-supplied regex patterns.
-   * Returns `true` if the pattern crosses a budget that empirically correlates
-   * with ReDoS risk — independent of the heuristic regex detector.
+   * **Composes with `repo.on()` and plugins, doesn't replace them.**
+   * Middleware is for ergonomics (timing, short-circuit, input/output
+   * mutation in a single closure) — NOT for security policy. Use the
+   * `before:*` hook engine for tenant scope, soft-delete filtering,
+   * cache invalidation, and audit; those plugins MUST run before
+   * middleware sees the op.
    *
-   * Budget components (any single threshold crossed → over budget):
-   *   - unbounded quantifiers (`*`, `+`, `?`) — hard cap 20
-   *   - nested groups `(` — hard cap 8
-   *   - alternations `|` — hard cap 10
-   *   - combined: (quantifiers * groups) — hard cap 40
+   * **Execution order on every call** (build/before hooks fire BEFORE
+   * the middleware chain dispatches, so middleware cannot wrap a
+   * before-hook failure):
    *
-   * These thresholds are intentionally permissive for legitimate queries and
-   * tight enough to refuse known-pathological patterns like `(a+)+b` with
-   * heavy repetition.
-   */
-  private _regexComplexityExceedsBudget;
-  constructor(options?: QueryParserOptions);
-  /**
-   * Structured view of the configured schema's indexes — geo fields, text
-   * fields, and other compound indexes. Empty arrays when no schema was
-   * provided. Stable across the parser's lifetime; mutating the returned
-   * object does not affect parser behavior.
+   * ```text
+   *   _buildContext + before:<op>   ← repo.on('before:*') hooks
+   *     [outer middleware pre]      ← repo.useMiddleware() registrations
+   *       [...inner middleware pre]
+   *         fn (driver call)
+   *         after:<op> | error:<op> ← repo.on('after:*' / 'error:*')
+   *       [...inner middleware post]
+   *     [outer middleware post]
+   * ```
    *
-   * Useful for downstream tooling (Arc MCP, query planners, doc generators)
-   * that needs to know which fields support which query types.
-   */
-  get schemaIndexes(): SchemaIndexes;
-  /**
-   * Get the configured allowed filter fields.
-   * Returns `undefined` if no whitelist is set (all fields allowed).
+   * Why this order matters: a `before:create` hook that injects a
+   * tenant filter into `context.query` runs BEFORE the middleware chain
+   * is composed. Middleware sees a context that was already scoped by
+   * the policy plugins — it never has the authority to short-circuit a
+   * tenant check, because the throw from a `before:*` policy hook
+   * unwinds before middleware ever fires. That's by design — middleware
+   * as a security boundary would be impossible to audit, since
+   * registration order would determine whether scope wins.
    *
-   * Used by Arc's MCP integration to auto-derive `filterableFields`
-   * from the QueryParser when `schemaOptions.filterableFields` is not set.
-   */
-  get allowedFilterFields(): string[] | undefined;
-  /**
-   * Get the configured allowed sort fields.
-   * Returns `undefined` if no whitelist is set (all fields allowed).
-   */
-  get allowedSortFields(): string[] | undefined;
-  /**
-   * Get the configured allowed operators.
-   * Returns `undefined` if no whitelist is set (all built-in operators allowed).
-   */
-  get allowedOperators(): string[] | undefined;
-  /**
-   * Parse URL query parameters into MongoDB query format
+   * Practical consequence: if you want middleware to observe a policy
+   * failure (e.g. metric a tenant-scope rejection), use `repo.on('error:
+   * <op>', ...)` instead — that fires from inside the middleware chain
+   * and is reachable.
    *
-   * @example
-   * ```typescript
-   * // URL: ?status=active&lookup[department][foreignField]=slug&sort=-createdAt&page=1
-   * const query = parser.parse(req.query);
-   * // Returns: { filters: {...}, lookups: [...], sort: {...}, page: 1 }
+   * Registration order = composition order: the first middleware
+   * registered runs outermost (wraps everything else).
+   *
+   * @example Time every op
+   * ```ts
+   * repo.useMiddleware(async ({ operation, next }) => {
+   *   const start = performance.now();
+   *   try { return await next(); }
+   *   finally { metrics.record(operation, performance.now() - start); }
+   * });
+   * ```
+   *
+   * @example Inject `tenantId` on every create
+   * ```ts
+   * repo.useMiddleware(async ({ operation, context, next }) => {
+   *   if (operation === 'create' && context.data) {
+   *     context.data.tenantId = currentTenant();
+   *   }
+   *   return next();
+   * });
+   * ```
+   *
+   * @example Short-circuit (return without `next()` to skip the actual op)
+   * ```ts
+   * repo.useMiddleware(async ({ operation, context, next }) => {
+   *   if (operation === 'getById' && readOnlyMaintenance) {
+   *     return cachedReadOnlyResponse(context.id);
+   *   }
+   *   return next();
+   * });
    * ```
    */
-  parse(query: Record<string, unknown> | null | undefined): ParsedQuery;
+  useMiddleware(middleware: Middleware<TDoc>): this;
   /**
-   * Generate OpenAPI-compatible JSON Schema for query parameters.
-   * Arc's defineResource() auto-detects this method and uses it
-   * to document list endpoint query parameters in OpenAPI/Swagger.
+   * Compose the registered middleware chain around `exec`. Outermost
+   * middleware (first registered) wraps innermost. Each middleware sees
+   * the live `RepositoryContext` (already populated + run through
+   * `before:*` hooks at the call site — see `useMiddleware` JSDoc for
+   * the exact order). `after:` / `error:` hooks fire from inside
+   * `exec`, so middleware composes WITH plugins, not instead of them.
    *
-   * The schema respects parser configuration:
-   * - `allowedOperators`: only documents allowed operators
-   * - `allowedFilterFields`: generates explicit field[op] entries
-   * - `enableLookups` / `enableAggregations`: includes/excludes lookup/aggregate params
-   * - `maxLimit` / `maxSearchLength`: reflected in schema constraints
+   * `_runOp` calls this with its standard try/catch envelope; inline-try
+   * methods (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
+   * `lookupPopulate`, plus `getOne`/`getAll` cache-hit branches) call it
+   * directly so middleware sees every op — including cached reads — not
+   * just the ones routed through `_runOp`.
    */
-  getQuerySchema(): {
-    type: 'object';
-    properties: Record<string, unknown>;
-    required?: string[];
-  };
+  private _composeMiddleware;
   /**
-   * Get the query schema with OpenAPI extensions (x-internal metadata).
-   * Use this when generating OpenAPI/Swagger docs — it includes a documentary
-   * `_filterOperators` property describing available filter operators.
-   * For validation-only schemas, use `getQuerySchema()` instead.
+   * Standard operation envelope: compose middleware around an exec that
+   * runs `fn`, emits `after:<op>` on success or `error:<op>` on failure.
+   * Methods with branched in-try logic that emit `after:*` from multiple
+   * paths (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
+   * `lookupPopulate`) keep their inline try/catch and call
+   * `_composeMiddleware` directly instead of being forced through this
+   * single-result helper.
    */
-  getOpenAPIQuerySchema(): {
-    type: 'object';
-    properties: Record<string, unknown>;
-  };
+  private _runOp;
   /**
-   * Get the JSON Schema type for a filter operator
+   * Resilience envelope around the DRIVER round-trip only — the repo-core
+   * 0.6.0 `QueryOptions.signal` / `QueryOptions.retryPolicy` contract.
+   *
+   * `throwIfAborted` stops a cancelled request before the next driver call;
+   * `withRetry` retries transient failures with exponential backoff (and is
+   * a zero-cost passthrough when no policy was passed, so we wrap
+   * unconditionally). Crucially this wraps `fn` AFTER `_buildContext` ran —
+   * before-hooks (validation, tenant scope, audit, events) execute exactly
+   * once per logical call and are NEVER re-run on retry; only the driver
+   * call repeats.
+   *
+   * Both knobs are read from the context (the options bag is spread into
+   * `_buildContext` inputs), so every op routed through `_runOp` — and the
+   * inline-try methods that call this directly — honors them uniformly.
    */
-  private _getOperatorSchemaType;
+  private _withResilience;
   /**
-   * Get a human-readable description for a filter operator
+   * Create single document
    */
-  private _getOperatorDescription;
+  create(data: Record<string, unknown>, options?: CreateOptions): Promise<TDoc>;
   /**
-   * Build a summary description of all available filter operators
+   * Create multiple documents
    */
-  private _buildOperatorDescription;
+  createMany(dataArray: Record<string, unknown>[], options?: CreateOptions): Promise<TDoc[]>;
   /**
-   * Parse lookup configurations from URL parameters
-   *
-   * Supported formats:
-   * 1. Simple: ?lookup[department]=slug
-   *    → Join with 'departments' collection on slug field
-   *
-   * 2. Detailed: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug
-   *    → Full control over join configuration
-   *
-   * 3. Multiple: ?lookup[department]=slug&lookup[category]=categorySlug
-   *    → Multiple lookups
-   *
-   * @example
-   * ```typescript
-   * // URL: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug&lookup[department][single]=true
-   * const lookups = parser._parseLookups({
-   *   department: { localField: 'deptSlug', foreignField: 'slug', single: 'true' }
-   * });
-   * // Returns: [{ from: 'departments', localField: 'deptSlug', foreignField: 'slug', single: true }]
-   * ```
+   * Get document by ID
    */
-  private _parseLookups;
+  getById(id: string | ObjectId, options?: CacheableOptions): Promise<TDoc | null>;
   /**
-   * Parse a single lookup configuration
+   * Get single document by query
    */
-  private _parseSingleLookup;
+  getByQuery(query: Record<string, unknown>, options?: CacheableOptions & {
+    sort?: SortSpec;
+  }): Promise<TDoc | null>;
   /**
-   * Parse aggregation pipeline from URL (advanced feature)
+   * Get single document by arbitrary filter.
+   * Unlike getByQuery, this method is designed for Arc/controller use where
+   * compound filters (org scope + policy + id) are pre-built.
    *
    * @example
-   * ```typescript
-   * // URL: ?aggregate[group][_id]=$status&aggregate[group][count]=$sum:1
-   * const pipeline = parser._parseAggregation({
-   *   group: { _id: '$status', count: '$sum:1' }
-   * });
-   * ```
+   * const product = await repo.getOne({ slug: 'laptop', organizationId: 'org_1' });
    */
-  private _parseAggregation;
+  getOne(query: Record<string, unknown>, options?: CacheableOptions & {
+    sort?: SortSpec;
+  }): Promise<TDoc | null>;
   /**
-   * Parse select/project fields
+   * Fetch ALL documents matching filters without pagination.
+   * Use for background jobs, exports, batch processing where you need every doc.
    *
    * @example
-   * ```typescript
-   * // URL: ?select=name,email,-password
-   * // Returns: { name: 1, email: 1, password: 0 }
-   * ```
+   * const all = await repo.findAll({ status: 'active' });
+   * const allLean = await repo.findAll({}, { select: 'name email', lean: true });
    */
-  private _parseSelect;
+  findAll(filters?: Record<string, unknown>, options?: OperationOptions & {
+    sort?: SortSpec | string;
+    limit?: number;
+  }): Promise<TDoc[]>;
   /**
-   * Parse populate parameter - handles both simple string and advanced object format
+   * Streaming reads — async iterator over data, suitable for migrations,
+   * backfills, schema audits, and any once-a-quarter "touch every row"
+   * job. Goes through the standard `before:cursor` hook pipeline so
+   * multi-tenant scope, soft-delete filter, and access-control plugins
+   * inject scope BEFORE the underlying mongoose cursor is built.
    *
-   * @example
-   * ```typescript
-   * // Simple: ?populate=author,category
-   * // Returns: { simplePopulate: 'author,category', populateOptions: undefined }
+   * Replaces direct `Model.find().cursor()` usage which bypasses every
+   * plugin — that's how cross-tenant data ends up in migrations.
    *
-   * // Advanced: ?populate[author][select]=name,email
-   * // Returns: { simplePopulate: undefined, populateOptions: [{ path: 'author', select: 'name email' }] }
+   * Returns an `AsyncIterableIterator<TDoc>` — drive it with `for await`.
+   * The mongoose cursor is closed when iteration completes or breaks.
+   *
+   * @example Backfill a missing field across the whole tenant scope
+   * ```ts
+   * for await (const doc of repo.cursor({ filter: { migrated: { $ne: true }}}, { batchSize: 1000 })) {
+   *   await transformer(doc);
+   *   await repo.update(doc._id, { migrated: true });
+   * }
    * ```
-   */
-  private _parsePopulate;
-  /**
-   * Parse a single populate configuration
-   */
-  private _parseSinglePopulate;
-  /**
-   * Convert populate match values (handles boolean strings, etc.)
-   */
-  private _convertPopulateMatch;
-  /**
-   * Parse filter parameters
-   */
-  private _parseFilters;
-  /**
-   * Handle operator syntax: field[operator]=value
-   */
-  private _handleOperatorSyntax;
-  /**
-   * Handle bracket syntax with object value
-   */
-  private _handleBracketSyntax;
-  private _parseSort;
-  private _toMongoOperator;
-  private _createSafeRegex;
-  private _escapeRegex;
-  /**
-   * Sanitize $match configuration to prevent dangerous operators
-   * Recursively filters out operators like $where, $function, $accumulator
-   */
-  private _sanitizeMatchConfig;
-  /**
-   * Sanitize pipeline stages for use in $lookup.
-   * Blocks dangerous stages ($out, $merge, etc.) and recursively sanitizes
-   * operator expressions within $match, $addFields, and $set stages.
-   */
-  private _sanitizePipeline;
-  /**
-   * Recursively sanitize expression objects, blocking dangerous operators
-   * like $where, $function, $accumulator inside $addFields/$set stages.
    *
-   * Depth-guarded — same protection `_sanitizeMatchConfig` ships, since
-   * a hostile `$cond`/`$switch` chain can recurse arbitrarily deep and
-   * exhaust JS stack. Without the guard, this is a one-liner DoS against
-   * any host that exposes pipeline parsing to untrusted callers.
+   * @example Audit unscoped — opt out of multi-tenant for global sweeps
+   * ```ts
+   * for await (const doc of repo.cursor({}, { batchSize: 500, organizationId: undefined })) {
+   *   audit(doc);
+   * }
+   * ```
    */
-  private _sanitizeExpressions;
-  private _sanitizeSearch;
+  cursor(filter?: Record<string, unknown>, options?: ReadOptions & {
+    sort?: SortSpec | string;
+    batchSize?: number;
+    select?: SelectSpec;
+    lean?: boolean;
+  }): AsyncIterableIterator<TDoc>;
   /**
-   * Build regex-based multi-field search filters
-   * Creates an $or query with case-insensitive regex across all searchFields
+   * Portable change feed — `StandardRepo.watch()` over Mongo change
+   * streams (`Model.watch`). Requires a replica set (or mongos); a
+   * standalone mongod rejects change streams at open time — gate on
+   * `repo.capabilities.changeStreams` plus your deployment topology.
+   *
+   * Semantics:
+   *   - **Plugin-routed like every other read.** The filter goes through
+   *     the standard `before:watch` hook pipeline (`OP_REGISTRY.watch`,
+   *     policyKey `'query'`) BEFORE the change-stream pipeline is built —
+   *     `multiTenantPlugin` injects the tenant scope (and throws under
+   *     `required: true` exactly like other reads), `softDeletePlugin`
+   *     injects the deletion-state predicate. A tenant-scoped repo never
+   *     streams cross-tenant changes.
+   *   - `fullDocument: 'updateLookup'` — update events carry the post-
+   *     image document when it still exists at lookup time.
+   *   - `filter` (record or Filter IR) is compiled with the standard
+   *     filter compiler and applied against `fullDocument.*` paths, so
+   *     `watch({ status: 'pending' })` matches the post-image. Delete
+   *     events have no `fullDocument` and therefore don't match a
+   *     non-empty post-policy filter — use `bypassTenant` / an unscoped
+   *     repo without a filter to observe deletes.
+   *   - `options.signal` ends the iterator (closes the stream). A
+   *     pre-aborted signal rejects at the op boundary like every other op.
+   *   - `options.resumeAfter` forwards a previously captured Mongo
+   *     resume token for at-least-once consumption across restarts.
+   *
+   * Context keys for policy plugins (`organizationId`, `bypassTenant`,
+   * `includeDeleted`, ...) ride the options bag at runtime — same as every
+   * other op. The contract's `WatchOptions` type doesn't declare an index
+   * signature, so typed callers widen at the call site (or rely on an
+   * ALS `resolveContext` so no per-call tenant key is needed).
    *
    * @example
-   * // searchFields: ['name', 'description', 'sku']
-   * // search: 'azure'
-   * // Returns: [
-   * //   { name: { $regex: /azure/i } },
-   * //   { description: { $regex: /azure/i } },
-   * //   { sku: { $regex: /azure/i } }
-   * // ]
-   */
-  private _buildRegexSearch;
-  private _parseOr;
-  private _enhanceWithBetween;
-  private _pluralize;
-  private _capitalize;
-}
-//#endregion
-//#region src/Repository.d.ts
-/**
- * Plugin phase priorities (lower = runs first).
- *
- * Re-exported from `@classytic/repo-core/hooks` so mongokit 3.10 callers see
- * the same constant whether they import from mongokit or directly from
- * repo-core — priorities are identical (POLICY=100, CACHE=200,
- * OBSERVABILITY=300, DEFAULT=500) and the two refs are reference-equal.
- */
-declare const HOOK_PRIORITY: {
-  readonly POLICY: 100;
-  readonly CACHE: 200;
-  readonly OBSERVABILITY: 300;
-  readonly DEFAULT: 500;
-};
-/**
- * Production-grade repository for MongoDB.
- *
- * Extends `@classytic/repo-core/repository`'s `RepositoryBase` for the
- * driver-agnostic hook + plugin plumbing (context builder, priority-sorted
- * event engine, plugin-order validator) while layering every Mongo-specific
- * concern — populate, aggregate, lookup, keyset + cursor pagination, $near
- * rewriting — on top.
- *
- * Public surface is byte-stable with mongokit 3.9 (the `_hooks` property is
- * preserved as a live read-through getter; all CRUD, event, and plugin method
- * signatures unchanged). 3.10 is an internal re-plumbing release; consumers
- * upgrading from 3.9 need no code changes.
- */
-declare class Repository<TDoc = unknown> extends RepositoryBase {
-  readonly Model: Model<TDoc>;
-  /**
-   * Mongoose model name. Duplicated on the instance for BC — arc / catalog /
-   * user code read `repo.model`. `RepositoryBase.modelName` points to the
-   * same string; prefer `modelName` in new code.
+   * ```ts
+   * const ac = new AbortController();
+   * for await (const change of repo.watch({ status: 'pending' }, { signal: ac.signal })) {
+   *   if (change.operation === 'create') enqueue(change.doc!);
+   * }
+   * ```
    */
-  readonly model: string;
-  readonly _pagination: PaginationEngine<TDoc>;
-  readonly idField: string;
-  readonly searchMode: 'text' | 'regex' | 'auto';
-  readonly searchFields: string[] | undefined;
-  [key: string]: unknown;
-  private _hasTextIndex;
+  watch(filter?: FilterInput, options?: WatchOptions): AsyncIterable<ChangeEvent<TDoc>>;
   /**
-   * Wrap-style middleware chain. Composed around every `_runOp`
-   * invocation in registration order — earlier-registered middlewares
-   * are outer (run first / unwind last). See `useMiddleware()` and
-   * the `Middleware<TDoc>` type for the protocol.
+   * Unified pagination - auto-detects offset vs keyset based on params
+   *
+   * Auto-detection logic:
+   * - If params has 'cursor' or 'after' → uses keyset pagination (stream)
+   * - If params has 'pagination' or 'page' → uses offset pagination (paginate)
+   * - Else → defaults to offset pagination with page=1
+   *
+   * @example
+   * // Offset pagination (page-based)
+   * await repo.getAll({ page: 1, limit: 50, filters: { status: 'active' } });
+   * await repo.getAll({ pagination: { page: 2, limit: 20 } });
+   *
+   * // Keyset pagination (cursor-based)
+   * await repo.getAll({ cursor: 'eyJ2Ij...', limit: 50 });
+   * await repo.getAll({ after: 'eyJ2Ij...', sort: { createdAt: -1 } });
+   *
+   * // Simple query (defaults to page 1)
+   * await repo.getAll({ filters: { status: 'active' } });
+   *
+   * // Skip cache for fresh data
+   * await repo.getAll({ filters: { status: 'active' } }, { skipCache: true });
    */
-  private readonly _middlewares;
-  constructor(Model: Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions);
+  getAll(params?: {
+    filters?: Record<string, unknown>;
+    sort?: SortSpec | string;
+    cursor?: string;
+    after?: string;
+    page?: number;
+    pagination?: {
+      page?: number;
+      limit?: number;
+    };
+    limit?: number;
+    search?: string;
+    mode?: 'offset' | 'keyset';
+    hint?: string | Record<string, 1 | -1>;
+    maxTimeMS?: number;
+    countStrategy?: 'exact' | 'estimated' | 'none';
+    readPreference?: ReadPreferenceType; /** Advanced populate options (from QueryParser or Arc's BaseController) */
+    populateOptions?: PopulateOptions[]; /** Collation for locale-aware string comparison */
+    collation?: CollationOptions; /** Lookup configurations for $lookup joins (from QueryParser or manual) */
+    lookups?: LookupOptions[]; /** Skip pagination entirely — returns raw TDoc[] (same as findAll) */
+    noPagination?: boolean;
+  }, options?: CacheableOptions): Promise<OffsetPaginationResult<TDoc> | KeysetPaginationResult<TDoc> | TDoc[]>;
   /**
-   * Live read-through view of the hook engine's listener registry.
+   * Atomic "look up by filter, insert `data` if missing, return the doc."
    *
-   * Preserved as a public field on the Repository for back-compat with
-   * mongokit ≤3.9 — existing tests and observability code pattern-match
-   * `repo._hooks.get('before:getAll')` / `repo._hooks.size`. Each access
-   * returns a fresh snapshot of the underlying HookEngine state.
+   * Returns `{ doc, created }` so callers can tell whether *this* call
+   * inserted (race-win) or matched an existing row. Implements
+   * `StandardRepo.getOrCreate()` from `@classytic/repo-core/repository`
+   * — see that interface's JSDoc for the cross-kit contract.
    *
-   * Read-only. To register listeners use `repo.on(event, listener, { priority })`.
+   * Routes through the hook system for policy enforcement (multi-tenant,
+   * soft-delete, audit). The hook context carries the resolved query +
+   * data; the action layer adds the `created` discriminator from the
+   * driver's `lastErrorObject.upserted`.
    */
-  get _hooks(): Map<string, PrioritizedHook[]>;
+  getOrCreate(query: Record<string, unknown>, createData: Record<string, unknown>, options?: SessionOptions): Promise<{
+    doc: TDoc;
+    created: boolean;
+  }>;
   /**
-   * Fire-and-forget emit aliased through RepositoryBase's async path so
-   * error hooks converted to/from sync mode still route uniformly. Mongokit
-   * ≤3.9 made this a private method on its subclass; the base class exposes
-   * it publicly and wraps it in `_emitHook` below for internal use.
+   * Count documents
+   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
    */
-  private _emitHook;
-  private _emitErrorHook;
+  count(query?: Record<string, unknown>, options?: ReadOptions): Promise<number>;
   /**
-   * Wire the `warnOnStrictQueryStrip` diagnostic. When enabled, every
-   * filter-shaped op (`getById`, `getByQuery`, `getOne`, `findAll`,
-   * `count`, `exists`, `update`, `delete`, `findOneAndUpdate`,
-   * `updateMany`, `deleteMany`, `claim`, `claimVersion`, `cursor`)
-   * checks its `context.query` keys against the cached set of schema
-   * paths. Top-level keys not on the schema get logged once per
-   * `(model, key)` pair — so a single bad caller surfaces in dev /
-   * staging instead of returning the wrong row in prod.
-   *
-   * Only runs when `strictQuery !== false` is in effect — if mongoose's
-   * strictQuery is off, unknown keys flow through to the driver and
-   * the trap doesn't apply.
+   * Check if document exists
+   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
    */
-  private _wireStrictQueryStripDiagnostic;
+  exists(query: Record<string, unknown>, options?: ReadOptions): Promise<{
+    _id: unknown;
+  } | null>;
   /**
-   * Register a wrap-style middleware. Middleware composes AROUND every
-   * `_runOp` invocation — it sees the operation name, the live
-   * `RepositoryContext`, and a `next()` continuation that runs the
-   * remaining chain + the actual op + after/error hooks.
-   *
-   * **Composes with `repo.on()` and plugins, doesn't replace them.**
-   * Middleware is for ergonomics (timing, short-circuit, input/output
-   * mutation in a single closure) — NOT for security policy. Use the
-   * `before:*` hook engine for tenant scope, soft-delete filtering,
-   * cache invalidation, and audit; those plugins MUST run before
-   * middleware sees the op.
-   *
-   * **Execution order on every call** (build/before hooks fire BEFORE
-   * the middleware chain dispatches, so middleware cannot wrap a
-   * before-hook failure):
-   *
-   * ```text
-   *   _buildContext + before:<op>   ← repo.on('before:*') hooks
-   *     [outer middleware pre]      ← repo.useMiddleware() registrations
-   *       [...inner middleware pre]
-   *         fn (driver call)
-   *         after:<op> | error:<op> ← repo.on('after:*' / 'error:*')
-   *       [...inner middleware post]
-   *     [outer middleware post]
-   * ```
-   *
-   * Why this order matters: a `before:create` hook that injects a
-   * tenant filter into `context.query` runs BEFORE the middleware chain
-   * is composed. Middleware sees a context that was already scoped by
-   * the policy plugins — it never has the authority to short-circuit a
-   * tenant check, because the throw from a `before:*` policy hook
-   * unwinds before middleware ever fires. That's by design — middleware
-   * as a security boundary would be impossible to audit, since
-   * registration order would determine whether scope wins.
-   *
-   * Practical consequence: if you want middleware to observe a policy
-   * failure (e.g. metric a tenant-scope rejection), use `repo.on('error:
-   * <op>', ...)` instead — that fires from inside the middleware chain
-   * and is reachable.
-   *
-   * Registration order = composition order: the first middleware
-   * registered runs outermost (wraps everything else).
-   *
-   * @example Time every op
-   * ```ts
-   * repo.useMiddleware(async ({ operation, next }) => {
-   *   const start = performance.now();
-   *   try { return await next(); }
-   *   finally { metrics.record(operation, performance.now() - start); }
-   * });
-   * ```
-   *
-   * @example Inject `tenantId` on every create
-   * ```ts
-   * repo.useMiddleware(async ({ operation, context, next }) => {
-   *   if (operation === 'create' && context.data) {
-   *     context.data.tenantId = currentTenant();
-   *   }
-   *   return next();
-   * });
-   * ```
-   *
-   * @example Short-circuit (return without `next()` to skip the actual op)
-   * ```ts
-   * repo.useMiddleware(async ({ operation, context, next }) => {
-   *   if (operation === 'getById' && readOnlyMaintenance) {
-   *     return cachedReadOnlyResponse(context.id);
-   *   }
-   *   return next();
-   * });
-   * ```
-   */
-  useMiddleware(middleware: Middleware<TDoc>): this;
-  /**
-   * Compose the registered middleware chain around `exec`. Outermost
-   * middleware (first registered) wraps innermost. Each middleware sees
-   * the live `RepositoryContext` (already populated + run through
-   * `before:*` hooks at the call site — see `useMiddleware` JSDoc for
-   * the exact order). `after:` / `error:` hooks fire from inside
-   * `exec`, so middleware composes WITH plugins, not instead of them.
-   *
-   * `_runOp` calls this with its standard try/catch envelope; inline-try
-   * methods (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
-   * `lookupPopulate`, plus `getOne`/`getAll` cache-hit branches) call it
-   * directly so middleware sees every op — including cached reads — not
-   * just the ones routed through `_runOp`.
-   */
-  private _composeMiddleware;
-  /**
-   * Standard operation envelope: compose middleware around an exec that
-   * runs `fn`, emits `after:<op>` on success or `error:<op>` on failure.
-   * Methods with branched in-try logic that emit `after:*` from multiple
-   * paths (`getById`, `update`, `delete`, `deleteMany`, `aggregatePaginate`,
-   * `lookupPopulate`) keep their inline try/catch and call
-   * `_composeMiddleware` directly instead of being forced through this
-   * single-result helper.
-   */
-  private _runOp;
-  /**
-   * Create single document
-   */
-  create(data: Record<string, unknown>, options?: CreateOptions): Promise<TDoc>;
-  /**
-   * Create multiple documents
-   */
-  createMany(dataArray: Record<string, unknown>[], options?: CreateOptions): Promise<TDoc[]>;
-  /**
-   * Get document by ID
-   */
-  getById(id: string | ObjectId, options?: CacheableOptions): Promise<TDoc | null>;
-  /**
-   * Get single document by query
-   */
-  getByQuery(query: Record<string, unknown>, options?: CacheableOptions & {
-    sort?: SortSpec;
-  }): Promise<TDoc | null>;
-  /**
-   * Get single document by arbitrary filter.
-   * Unlike getByQuery, this method is designed for Arc/controller use where
-   * compound filters (org scope + policy + id) are pre-built.
-   *
-   * @example
-   * const product = await repo.getOne({ slug: 'laptop', organizationId: 'org_1' });
-   */
-  getOne(query: Record<string, unknown>, options?: CacheableOptions & {
-    sort?: SortSpec;
-  }): Promise<TDoc | null>;
-  /**
-   * Fetch ALL documents matching filters without pagination.
-   * Use for background jobs, exports, batch processing where you need every doc.
-   *
-   * @example
-   * const all = await repo.findAll({ status: 'active' });
-   * const allLean = await repo.findAll({}, { select: 'name email', lean: true });
-   */
-  findAll(filters?: Record<string, unknown>, options?: OperationOptions & {
-    sort?: SortSpec | string;
-    limit?: number;
-  }): Promise<TDoc[]>;
-  /**
-   * Streaming reads — async iterator over data, suitable for migrations,
-   * backfills, schema audits, and any once-a-quarter "touch every row"
-   * job. Goes through the standard `before:cursor` hook pipeline so
-   * multi-tenant scope, soft-delete filter, and access-control plugins
-   * inject scope BEFORE the underlying mongoose cursor is built.
-   *
-   * Replaces direct `Model.find().cursor()` usage which bypasses every
-   * plugin — that's how cross-tenant data ends up in migrations.
-   *
-   * Returns an `AsyncIterableIterator<TDoc>` — drive it with `for await`.
-   * The mongoose cursor is closed when iteration completes or breaks.
-   *
-   * @example Backfill a missing field across the whole tenant scope
-   * ```ts
-   * for await (const doc of repo.cursor({ filter: { migrated: { $ne: true }}}, { batchSize: 1000 })) {
-   *   await transformer(doc);
-   *   await repo.update(doc._id, { migrated: true });
-   * }
-   * ```
-   *
-   * @example Audit unscoped — opt out of multi-tenant for global sweeps
-   * ```ts
-   * for await (const doc of repo.cursor({}, { batchSize: 500, organizationId: undefined })) {
-   *   audit(doc);
-   * }
-   * ```
-   */
-  cursor(filter?: Record<string, unknown>, options?: ReadOptions & {
-    sort?: SortSpec | string;
-    batchSize?: number;
-    select?: SelectSpec;
-    lean?: boolean;
-  }): AsyncIterableIterator<TDoc>;
-  /**
-   * Unified pagination - auto-detects offset vs keyset based on params
-   *
-   * Auto-detection logic:
-   * - If params has 'cursor' or 'after' → uses keyset pagination (stream)
-   * - If params has 'pagination' or 'page' → uses offset pagination (paginate)
-   * - Else → defaults to offset pagination with page=1
-   *
-   * @example
-   * // Offset pagination (page-based)
-   * await repo.getAll({ page: 1, limit: 50, filters: { status: 'active' } });
-   * await repo.getAll({ pagination: { page: 2, limit: 20 } });
-   *
-   * // Keyset pagination (cursor-based)
-   * await repo.getAll({ cursor: 'eyJ2Ij...', limit: 50 });
-   * await repo.getAll({ after: 'eyJ2Ij...', sort: { createdAt: -1 } });
-   *
-   * // Simple query (defaults to page 1)
-   * await repo.getAll({ filters: { status: 'active' } });
-   *
-   * // Skip cache for fresh data
-   * await repo.getAll({ filters: { status: 'active' } }, { skipCache: true });
-   */
-  getAll(params?: {
-    filters?: Record<string, unknown>;
-    sort?: SortSpec | string;
-    cursor?: string;
-    after?: string;
-    page?: number;
-    pagination?: {
-      page?: number;
-      limit?: number;
-    };
-    limit?: number;
-    search?: string;
-    mode?: 'offset' | 'keyset';
-    hint?: string | Record<string, 1 | -1>;
-    maxTimeMS?: number;
-    countStrategy?: 'exact' | 'estimated' | 'none';
-    readPreference?: ReadPreferenceType; /** Advanced populate options (from QueryParser or Arc's BaseController) */
-    populateOptions?: PopulateOptions[]; /** Collation for locale-aware string comparison */
-    collation?: CollationOptions; /** Lookup configurations for $lookup joins (from QueryParser or manual) */
-    lookups?: LookupOptions[]; /** Skip pagination entirely — returns raw TDoc[] (same as findAll) */
-    noPagination?: boolean;
-  }, options?: CacheableOptions): Promise<OffsetPaginationResult<TDoc> | KeysetPaginationResult<TDoc> | TDoc[]>;
-  /**
-   * Atomic "look up by filter, insert `data` if missing, return the doc."
-   *
-   * Returns `{ doc, created }` so callers can tell whether *this* call
-   * inserted (race-win) or matched an existing row. Implements
-   * `StandardRepo.getOrCreate()` from `@classytic/repo-core/repository`
-   * — see that interface's JSDoc for the cross-kit contract.
-   *
-   * Routes through the hook system for policy enforcement (multi-tenant,
-   * soft-delete, audit). The hook context carries the resolved query +
-   * data; the action layer adds the `created` discriminator from the
-   * driver's `lastErrorObject.upserted`.
-   */
-  getOrCreate(query: Record<string, unknown>, createData: Record<string, unknown>, options?: SessionOptions): Promise<{
-    doc: TDoc;
-    created: boolean;
-  }>;
-  /**
-   * Count documents
-   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
-   */
-  count(query?: Record<string, unknown>, options?: ReadOptions): Promise<number>;
-  /**
-   * Check if document exists
-   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
-   */
-  exists(query: Record<string, unknown>, options?: ReadOptions): Promise<{
-    _id: unknown;
-  } | null>;
-  /**
-   * Update a document by id and return the post-update doc.
+   * Update a document by id and return the post-update doc.
    *
    * Compiles to `Model.findOneAndUpdate(filter, { $set: data }, { new:
    * true, runValidators: true })` under the hood and routes through the
@@ -1603,415 +1209,925 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * );
    * ```
    */
-  claimVersion(id: string | ObjectId, transition: {
-    field?: string;
-    from: number | undefined;
-    by?: number;
-    where?: Record<string, unknown>;
-  }, update: Record<string, unknown>, options?: SessionOptions & {
-    idField?: string;
-  }): Promise<TDoc | null>;
+  claimVersion(id: string | ObjectId, transition: {
+    field?: string;
+    from: number | undefined;
+    by?: number;
+    where?: Record<string, unknown>;
+  }, update: Record<string, unknown>, options?: SessionOptions & {
+    idField?: string;
+  }): Promise<TDoc | null>;
+  /**
+   * Delete a document by ID.
+   *
+   * By default the behavior is decided by the plugin stack:
+   *   - With `softDeletePlugin` wired → soft delete (sets `deletedAt`)
+   *   - Without the plugin → physical delete
+   *
+   * Pass `mode: 'hard'` to force physical deletion regardless of plugins.
+   * All policy hooks (multi-tenant scope, audit trails, cache invalidation,
+   * cascade) still fire — only the soft-delete interception is skipped. This
+   * is the GDPR / admin-cleanup path.
+   *
+   * @example
+   * ```ts
+   * // Respects softDeletePlugin — soft if wired
+   * await userRepo.delete(userId);
+   *
+   * // GDPR erasure — physical delete, audit hooks still fire
+   * await userRepo.delete(userId, { mode: 'hard', organizationId: 'org_123' });
+   * ```
+   */
+  delete(id: string | ObjectId, options?: SessionOptions & {
+    idField?: string;
+    mode?: 'hard' | 'soft'; /** Legacy opt-in: throw a 404 error on miss instead of returning `null`. */
+    throwOnNotFound?: boolean;
+  }): Promise<DeleteResult | null>;
+  /**
+   * Update every document matching the filter.
+   *
+   * Promoted from `batchOperationsPlugin` to a class primitive in 3.11.0 so
+   * the surface matches sqlitekit's always-available `updateMany`. Consumers
+   * who forget to wire `batchOperationsPlugin` no longer get a runtime
+   * `TypeError: repo.updateMany is not a function` — the method is always
+   * here.
+   *
+   * Accepts three `update` forms via `UpdateInput`:
+   *   - Portable `UpdateSpec` from `@classytic/repo-core/update` (compiled to
+   *     `$set`/`$unset`/`$inc`/`$setOnInsert` before hooks run).
+   *   - Raw Mongo operator record (`{ $set, $inc, ... }`) — passed through.
+   *   - Mongo aggregation pipeline (`[...]`) — requires `updatePipeline: true`
+   *     to guard against accidental pipeline updates.
+   *
+   * Refuses empty filters (defense-in-depth against mass-update accidents)
+   * both before and after policy hooks inject tenant scope.
+   */
+  updateMany(filter: Record<string, unknown>, update: UpdateInput, options?: SessionOptions & {
+    updatePipeline?: boolean;
+    [key: string]: unknown;
+  }): Promise<UpdateManyResult>;
+  /**
+   * Delete every document matching the filter.
+   *
+   * Promoted from `batchOperationsPlugin` to a class primitive in 3.11.0 for
+   * the same reason as `updateMany` — sqlitekit parity and no silent "method
+   * is undefined" footgun when the batch plugin isn't wired.
+   *
+   * Behavior mirrors `delete()`: defaults to soft delete when
+   * `softDeletePlugin` is wired, physical delete otherwise. Pass
+   * `{ mode: 'hard' }` to bypass soft-delete — multi-tenant scoping, audit,
+   * and cache hooks still fire.
+   *
+   * Rejects empty filters up front AND after policy hooks, so a policy-plugin
+   * bug that zeroes out the query can't be exploited to wipe a collection.
+   */
+  deleteMany(filter: Record<string, unknown>, options?: SessionOptions & {
+    mode?: 'hard' | 'soft';
+    [key: string]: unknown;
+  }): Promise<DeleteManyResult>;
+  /**
+   * Compliance-grade cleanup primitive — see `StandardRepo.purgeByField`
+   * for the cross-kit contract. Mongokit composes the kit-agnostic
+   * `runChunkedPurge` orchestrator (loop, signal, progress, result
+   * envelope) with `createMongoPurgePort` (driver-specific id selection
+   * + strategy writes). See [actions/purge.ts](./actions/purge.ts) for
+   * the port implementation.
+   */
+  purgeByField(field: string, value: unknown, strategy: TenantPurgeStrategy, options?: TenantPurgeOptions): Promise<TenantPurgeResult>;
+  /**
+   * Kit-native aggregation pipeline — takes a MongoDB stage array and
+   * returns the raw pipeline output. Use this for `$lookup`, `$unwind`,
+   * `$facet`, `$graphLookup`, and any other mongo-specific power
+   * features that don't translate to SQL.
+   *
+   * For backend-portable aggregations (filter + group + measures +
+   * sort + limit) use `aggregate(req: AggRequest)` instead — it
+   * compiles the repo-core IR to the equivalent pipeline internally
+   * and produces the same row shape sqlitekit emits.
+   *
+   * Routes through the hook system for policy enforcement
+   * (multi-tenant, soft-delete).
+   *
+   * @param pipeline - MongoDB aggregation stage array
+   * @param options  - Aggregation options including governance controls
+   */
+  aggregatePipeline<TResult = unknown>(pipeline: PipelineStage[], options?: AggregateOptions): Promise<TResult[]>;
+  /**
+   * Paginated kit-native aggregation pipeline. Same mongo-specific
+   * scope as `aggregatePipeline` — reach for this when you need
+   * `$lookup` / `$unwind` / `$facet` alongside pagination.
+   *
+   * Prefer `aggregatePaginate(req: AggPaginationRequest)` for
+   * cross-backend dashboard code; that method compiles the portable
+   * IR to an equivalent pipeline.
+   *
+   * Policy hooks (multi-tenant, soft-delete) inject context.filters
+   * which are prepended as a `$match` stage.
+   */
+  aggregatePipelinePaginate(options?: AggregatePaginationOptions): Promise<AggregatePaginationResult<TDoc>>;
+  /**
+   * Portable aggregation. Compiles the repo-core `AggRequest` IR to
+   * `[{$match}, {$group}, {$addFields}, {$project}, {$match}, {$sort},
+   * {$skip}, {$limit}]` against this repo's collection. Output rows
+   * carry one key per `groupBy` column plus one key per measure alias
+   * — identical shape to sqlitekit's `aggregate(req)`, so dashboards
+   * work unchanged across backends.
+   *
+   * Without `groupBy`: returns a single-row result with just the
+   * measures (scalar aggregation). Pass
+   * `{ measures: { total: { op: 'sum', field: 'amount' } } }` for a
+   * simple summary.
+   *
+   * For mongo-specific power features (`$lookup`, `$unwind`, `$facet`,
+   * `$graphLookup`, window operators) reach for `aggregatePipeline`
+   * — that's the kit-native escape hatch.
+   *
+   * Routes through the hook system for policy enforcement
+   * (multi-tenant, soft-delete) — plugins inject their scope into
+   * `context.filter`, which is merged into the pre-aggregate `$match`
+   * before compilation.
+   */
+  aggregate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggRequest, options?: QueryOptions): Promise<AggResult<TRow>>;
+  /**
+   * Invalidate every aggregate-cache entry tagged with ANY of the
+   * given tags. Delegates to the unified cache plugin's handle
+   * (`repo.cache.invalidateByTags`) — wired by `cachePlugin({ adapter })`.
+   *
+   * Pass no tags to wipe the entire cache namespace (requires the
+   * adapter to implement `clear`).
+   *
+   * Returns the count of distinct entries cleared (`-1` when the call
+   * routed through `adapter.clear()` and the adapter doesn't report a
+   * count). No-op (returns `0`) when no cache plugin is wired.
+   */
+  invalidateAggregateCache(tags?: readonly string[]): Promise<number>;
+  /**
+   * Paginated portable aggregation. Two pagination modes, picked by
+   * the request shape:
+   *
+   * - **Offset (default)** — `page` + `limit`. Returns the standard
+   *   `{ method: 'offset', data, total, pages, hasNext, hasPrev, ... }`
+   *   envelope. `countStrategy: 'none'` skips the second round-trip
+   *   that computes `total`; the envelope reports `total: 0`,
+   *   `pages: 0`, and derives `hasNext` from a `LIMIT N+1` peek on
+   *   the data pipeline.
+   * - **Keyset** — `pagination: 'keyset'` (or `after` set). Returns
+   *   `{ method: 'keyset', data, hasMore, next, limit }`. `sort` is
+   *   required — the cursor encodes the sort-key tuple of the last
+   *   row. Each subsequent page passes the previous `next` back as
+   *   `after`. Scales to arbitrary group counts because the planner
+   *   uses `(sort_keys) > (cursor)` instead of `OFFSET N`.
+   */
+  aggregatePaginate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggPaginationRequest, options?: QueryOptions): Promise<OffsetPaginationResultCore<TRow> | KeysetAggPaginationResult<TRow>>;
+  /**
+   * Internal: the actual aggregate-paginate execution body. Extracted
+   * so `aggregatePaginate` can wrap it in the cache layer without
+   * duplicating the keyset / offset branch logic.
+   *
+   * Receives `finalReq` (already policy-scoped) so the cache key
+   * built by the outer wrapper matches the request the executor
+   * sees — no cross-tenant cache poisoning.
+   */
+  private _executeAggregatePaginate;
+  /**
+   * Merge policy-hook-injected filters (multi-tenant scope,
+   * soft-delete) into the pre-aggregate `filter` slot of the request.
+   * Plugins speak mongo-query shape (`context.query` / `context.filters`);
+   * the caller's `req.filter` may be either Filter IR or a mongo query.
+   *
+   * Each part is compiled through `compileFilterToMongo` BEFORE the
+   * `$and` merge — otherwise an IR node like `eq('status', 'paid')`
+   * (`{ op, field, value }`) gets nested inside `$and` as a literal,
+   * `compileFilterToMongo` of the merged value finds no top-level `op`
+   * (so `isFilter` is false), and Mongo receives the IR object as a
+   * raw query clause that matches no real document. Symptom: aggregates
+   * silently return 0 rows whenever a callerpasses IR + a policy
+   * plugin is installed.
+   */
+  private _injectPolicyScopeIntoAgg;
+  /**
+   * Get distinct values
+   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
+   */
+  distinct<T = unknown>(field: string, query?: Record<string, unknown>, options?: ReadOptions): Promise<T[]>;
+  /**
+   * Query with custom field lookups ($lookup)
+   * Best for: Joins on slugs, SKUs, codes, or other indexed custom fields
+   *
+   * @example
+   * ```typescript
+   * // Join employees with departments using slug instead of ObjectId
+   * const employees = await employeeRepo.lookupPopulate({
+   *   filters: { status: 'active' },
+   *   lookups: [
+   *     {
+   *       from: 'departments',
+   *       localField: 'departmentSlug',
+   *       foreignField: 'slug',
+   *       as: 'department',
+   *       single: true
+   *     }
+   *   ],
+   *   sort: '-createdAt',
+   *   page: 1,
+   *   limit: 50
+   * });
+   * ```
+   */
+  lookupPopulate<TExtra extends Record<string, unknown> = Record<string, unknown>>(options: LookupPopulateOptions<TDoc>): Promise<LookupPopulateResult<TDoc, TExtra>>;
+  /**
+   * Create an aggregation builder for this model
+   * Useful for building complex custom aggregations
+   *
+   * @example
+   * ```typescript
+   * const pipeline = repo.buildAggregation()
+   *   .match({ status: 'active' })
+   *   .lookup('departments', 'deptSlug', 'slug', 'department', true)
+   *   .group({ _id: '$department', count: { $sum: 1 } })
+   *   .sort({ count: -1 })
+   *   .build();
+   *
+   * const results = await repo.Model.aggregate(pipeline);
+   * ```
+   */
+  buildAggregation(): AggregationBuilder;
+  /**
+   * Create a lookup builder
+   * Useful for building $lookup stages independently
+   *
+   * @example
+   * ```typescript
+   * const lookupStages = repo.buildLookup('departments')
+   *   .localField('deptSlug')
+   *   .foreignField('slug')
+   *   .as('department')
+   *   .single()
+   *   .build();
+   *
+   * const pipeline = [
+   *   { $match: { status: 'active' } },
+   *   ...lookupStages
+   * ];
+   * ```
+   */
+  buildLookup(from?: string): LookupBuilder;
+  /**
+   * Execute callback within a MongoDB transaction with automatic retry on
+   * transient failures.
+   *
+   * **BREAKING (3.10):** the callback now receives a **tx-bound repository**,
+   * not a raw `ClientSession`. This matches repo-core's `StandardRepo.withTransaction`
+   * contract that every kit (sqlitekit, pgkit, prismakit) already implements
+   * — so cross-kit plugins and apps are portable. Session threading happens
+   * transparently: every CRUD call on `txRepo` auto-injects the session into
+   * its options bag, including plugin-added methods (`upsert`, `increment`,
+   * `updateMany`, `restore`, ...). Nested `txRepo.withTransaction(...)` throws.
+   *
+   * For raw-session cross-repo workflows — multiple repositories coordinating
+   * writes — use the standalone `withTransaction(connection, fn)` export
+   * from `@classytic/mongokit`. That helper remains session-based by design.
+   *
+   * @param callback - Receives a tx-bound `Repository<TDoc>` — call its
+   *                   methods directly, no need to pass `{ session }` manually
+   * @param options.allowFallback - Run without transaction on standalone MongoDB (default: false)
+   * @param options.onFallback - Called when falling back to non-transactional execution
+   * @param options.transactionOptions - MongoDB driver transaction options (readConcern, writeConcern, etc.)
+   *
+   * @example
+   * ```typescript
+   * const order = await repo.withTransaction(async (txRepo) => {
+   *   const created = await txRepo.create({ total: 100 });
+   *   await txRepo.update(created._id, { confirmed: true });
+   *   return created;
+   * });
+   *
+   * // With fallback for standalone/dev environments
+   * await repo.withTransaction(
+   *   async (txRepo) => {
+   *     await txRepo.create(doc);
+   *   },
+   *   {
+   *     allowFallback: true,
+   *     onFallback: (err) => logger.warn('Running without transaction', err),
+   *   },
+   * );
+   *
+   * // Cross-repo with explicit session:
+   * import { withTransaction } from '@classytic/mongokit';
+   * await withTransaction(mongoose.connection, async (session) => {
+   *   const order = await orderRepo.create(data, { session });
+   *   await inventoryRepo.decrement(..., { session });
+   * });
+   * ```
+   */
+  withTransaction<T>(callback: (txRepo: this) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
+  /**
+   * Execute custom query with event emission
+   */
+  _executeQuery<T>(buildQuery: (Model: Model<TDoc>) => Promise<T>): Promise<T>;
+  /**
+   * Build operation context and run before-hooks (sorted by priority).
+   *
+   * Narrows `RepositoryBase._buildContext`'s return type to mongokit's
+   * richer `RepositoryContext` (which carries `softDeleted`, `_cacheHit`,
+   * populate / readPreference / session, etc.). Runtime is inherited from
+   * the base class — this override is purely a type-narrowing shim.
+   *
+   * Hook execution order is deterministic:
+   * 1. POLICY (100) — tenant isolation, soft-delete filtering, validation
+   * 2. CACHE  (200) — cache lookup (after policy filters are injected)
+   * 3. OBSERVABILITY (300) — audit logging, metrics
+   * 4. DEFAULT (500) — user-registered hooks
+   */
+  _buildContext(operation: string, options: Record<string, unknown> | object): Promise<RepositoryContext>;
+  /**
+   * Walk the well-known filter-carrying keys (`query`, `filters`,
+   * `having`) and route any Filter IR through `compileFilterToMongo`.
+   * Plain Mongo queries pass through untouched — `isFilter` is the
+   * discriminator. Returns a shallow clone; never mutates input.
+   */
+  private _normalizeFilterSlots;
+  /**
+   * Resolve the effective sort for getAll. Handles $near conflict detection
+   * (warns + drops explicit sort when $near is in filters).
+   */
+  private _resolveSort;
+  /**
+   * Detect whether to use keyset (cursor) or offset (page) pagination.
+   */
+  private _detectPaginationMode;
+  /**
+   * Build the MongoDB query filter with search merged in. Handles text
+   * search ($text), regex search ($or of $regex), and the search-resolver
+   * plugin contract (search already cleared by a before:getAll hook).
+   */
+  private _buildSearchQuery;
+  /**
+   * Parse sort string or object
+   */
+  _parseSort(sort: SortSpec | string | undefined): SortSpec;
+  /**
+   * Parse populate specification
+   */
+  _parsePopulate(populate: PopulateSpec | undefined): string[] | PopulateOptions[];
+  /**
+   * Classify a driver error as an authoritative duplicate-key conflict.
+   *
+   * Used by arc's outbox / idempotency adapters to distinguish
+   * "write already landed (idempotent no-op)" from "transient DB error
+   * (must retry)". Every backend signals duplicate keys differently —
+   * MongoDB `code: 11000`, Prisma `P2002`, Postgres `23505` — so this
+   * predicate lives on the kit that knows its driver. Cross-driver
+   * adapters then depend only on the boolean outcome, not the shape of
+   * the underlying error.
+   *
+   * Deliberately narrow: matches ONLY `code === 11000` and
+   * `codeName === 'DuplicateKey'`. Does NOT match
+   * `err.name === 'MongoServerError'`, which is also true for
+   * WriteConflict, NotWritablePrimary, ExceededTimeLimit, and every
+   * other server-side error — treating those as duplicate keys would
+   * silently swallow transactional retries.
+   *
+   * @example
+   * try {
+   *   await outboxRepo.create(event);
+   * } catch (err) {
+   *   if (outboxRepo.isDuplicateKeyError(err)) {
+   *     // Idempotent no-op — event was already written by a prior attempt.
+   *     return;
+   *   }
+   *   throw err; // transient DB error — upstream retries
+   * }
+   */
+  isDuplicateKeyError(err: unknown): boolean;
+  /**
+   * Handle errors with proper HTTP status codes.
+   *
+   * **Transactional retry signal preservation.** MongoDB driver errors
+   * carry `errorLabels` (e.g. `'TransientTransactionError'`,
+   * `'UnknownTransactionCommitResult'`) that `mongoose.Connection.
+   * withTransaction()` reads via `error.hasErrorLabel(label)` to decide
+   * whether to auto-retry the transaction. Wrapping such an error in a
+   * fresh `Error` via `createError(...)` strips both the labels and the
+   * `hasErrorLabel` method — the retry signal vanishes and concurrent
+   * writers see WriteConflicts surface to userland instead of being
+   * retried by the driver. To keep the standard MongoDB transaction-
+   * retry mechanism intact, we re-throw any error that carries
+   * `errorLabels` exactly as we received it. The caller still sees a
+   * thrown error — only the wrapping layer is skipped.
+   */
+  _handleError(error: Error): HttpError;
+}
+//#endregion
+//#region src/create-repository.d.ts
+/**
+ * Audit config — either a `Logger` (routes to `auditLogPlugin`, which
+ * writes structured log lines through your logger) or an
+ * `AuditTrailOptions` object (routes to `auditTrailPlugin`, which
+ * persists a queryable compliance ledger in its own collection).
+ *
+ * Discrimination: a value carrying any of the `Logger` function members
+ * (`info` / `warn` / `error` / `debug`) is treated as a logger; anything
+ * else is treated as `AuditTrailOptions` (all of whose members are
+ * data-shaped except `metadata` / `onError`, which don't overlap with
+ * the logger member names).
+ */
+type AuditConfig = Logger | AuditTrailOptions;
+/**
+ * Declarative repository config. Every key is optional; a feature's
+ * plugin is installed only when its key is present. The remaining
+ * `RepositoryOptions` keys (`idField`, `hooks`, `schema`, `updateSchema`,
+ * `events`, `requirePlugins`, ...) pass through to the `Repository`
+ * constructor unchanged.
+ */
+interface CreateRepositoryConfig extends RepositoryOptions {
+  /** Multi-tenant scoping — forwarded to `multiTenantPlugin`. */
+  tenant?: MultiTenantOptions;
+  /** Soft-delete — `true` for defaults, or `SoftDeleteOptions`. */
+  softDelete?: boolean | SoftDeleteOptions;
+  /** createdAt/updatedAt stamping — `timestampPlugin` takes no options. */
+  timestamps?: boolean;
+  /** Batch ops (`updateMany`/`deleteMany`/`bulkWrite`) via `batchOperationsPlugin`. */
+  batch?: boolean;
+  /** Read-through cache — forwarded to `cachePlugin`. */
+  cache?: RepositoryCachePluginOptions;
+  /** Audit — `Logger` → `auditLogPlugin`; `AuditTrailOptions` → `auditTrailPlugin`. */
+  audit?: AuditConfig;
+  /** Custom ID generation — forwarded to `customIdPlugin`. */
+  customId?: CustomIdOptions;
+  /** Extra plugins appended AFTER the canonical stack. */
+  plugins?: PluginType[];
+  /** Pagination engine config (defaultLimit, maxLimit, ...). */
+  pagination?: PaginationConfig;
+}
+/**
+ * Build a `Repository` from a declarative config. See module JSDoc for
+ * ordering guarantees and an example.
+ */
+declare function createRepository<TDoc>(model: Model<TDoc, any, any, any>, config?: CreateRepositoryConfig): Repository<TDoc>;
+//#endregion
+//#region src/filter/compile.d.ts
+/**
+ * Filter IR → MongoDB query compiler.
+ *
+ * Mirrors sqlitekit's `compileFilterToDrizzle`: takes a repo-core
+ * `Filter` tree and emits a MongoDB query object. Used by `groupBy` /
+ * `groupByPaginate` to translate the portable AggRequest's `filter`
+ * + `having` into `$match` stages.
+ *
+ * Scope: the same operator set sqlitekit supports (`eq`, `ne`, `gt`,
+ * `gte`, `lt`, `lte`, `in`, `nin`, `exists`, `like`, `regex`, `and`,
+ * `or`, `not`, `raw`). Anything else throws so we fail loud instead
+ * of silently dropping predicates.
+ *
+ * Why only this op set here and not everywhere in mongokit? Historic
+ * reason: mongokit pre-dates repo-core's Filter IR, so its existing
+ * policy plugins (multi-tenant, soft-delete) speak MongoDB query
+ * language directly. Converting mongokit's entire filter pipeline
+ * to Filter IR is out-of-scope for this change — we introduce the
+ * compiler only where the new portable `groupBy` IR needs it.
+ */
+declare function compileFilterToMongo(input: unknown): Record<string, unknown>;
+//#endregion
+//#region src/operations.d.ts
+/**
+ * Where a plugin should inject its scoping filter (multi-tenant scope,
+ * soft-delete filter, etc.) on the RepositoryContext.
+ *
+ * - `data`        — single-doc create payload (`context.data`)
+ * - `dataArray`   — multi-doc create payload (`context.dataArray`)
+ * - `query`       — raw filter (`context.query`); the dominant convention
+ * - `filters`     — paginated list options' filter sub-bag (`context.filters`)
+ * - `operations`  — bulkWrite per-sub-op (special — plugins walk each entry)
+ * - `none`        — no scoping target (op accepts no filter input)
+ */
+type PolicyKey = 'data' | 'dataArray' | 'query' | 'filters' | 'operations' | 'none';
+interface OperationDescriptor {
+  /** Where multi-tenant / soft-delete plugins inject their scoping filter. */
+  policyKey: PolicyKey;
+  /** Whether this op writes to the database. Drives audit + cache invalidation. */
+  mutates: boolean;
+  /** True when `context.id` is populated by the time before/after hooks fire. */
+  hasIdContext: boolean;
+}
+/**
+ * The registry. Order intentionally groups by category for readability.
+ * Adding a new RepositoryOperation requires exactly one entry here, after
+ * which every bundled plugin auto-classifies it correctly.
+ */
+declare const OP_REGISTRY: Readonly<Record<RepositoryOperation, OperationDescriptor>>;
+/** All known repository operations, in registry order. */
+declare const ALL_OPERATIONS: RepositoryOperation[];
+/** Operations that mutate the database. Drives audit + cache invalidation lists. */
+declare const MUTATING_OPERATIONS: readonly RepositoryOperation[];
+/** Operations that don't mutate. Drives default cacheable ops. */
+declare const READ_OPERATIONS: readonly RepositoryOperation[];
+/** Filter ops by their policy injection key. */
+declare function operationsByPolicyKey(key: PolicyKey): RepositoryOperation[];
+//#endregion
+//#region src/query/QueryParser.d.ts
+type SortSpec$1 = Record<string, 1 | -1>;
+type FilterQuery = Record<string, unknown>;
+/**
+ * Mongoose-compatible populate option
+ * Supports advanced populate with select, match, limit, sort, and nested populate
+ *
+ * @example
+ * ```typescript
+ * // URL: ?populate[author][select]=name,email&populate[author][match][active]=true
+ * // Generates: { path: 'author', select: 'name email', match: { active: true } }
+ * ```
+ */
+interface PopulateOption {
+  /** Field path to populate */
+  path: string;
+  /** Fields to select (space-separated) */
+  select?: string;
+  /** Filter conditions for populated documents */
+  match?: Record<string, unknown>;
+  /** Query options (limit, sort, skip) */
+  options?: {
+    limit?: number;
+    sort?: SortSpec$1;
+    skip?: number;
+  };
+  /** Nested populate configuration */
+  populate?: PopulateOption;
+}
+/** Parsed query result with optional lookup configuration */
+interface ParsedQuery {
+  /** MongoDB filter query */
+  filters: FilterQuery;
+  /** Sort specification */
+  sort?: SortSpec$1;
+  /** Fields to populate (simple comma-separated string) */
+  populate?: string;
+  /**
+   * Advanced populate options (Mongoose-compatible)
+   * When this is set, `populate` will be undefined
+   * @example [{ path: 'author', select: 'name email' }]
+   */
+  populateOptions?: PopulateOption[];
+  /** Page number for offset pagination */
+  page?: number;
+  /** Cursor for keyset pagination */
+  after?: string;
+  /** Limit */
+  limit: number;
+  /** Full-text search query */
+  search?: string;
+  /** Lookup configurations for custom field joins */
+  lookups?: LookupOptions[];
+  /** Aggregation pipeline stages (advanced) */
+  aggregation?: PipelineStage[];
+  /** Select/project fields */
+  select?: Record<string, 0 | 1>;
+}
+/** Search mode for query parser */
+type SearchMode = 'text' | 'regex';
+/**
+ * Normalized field type used for schema-aware value coercion. Re-exported
+ * from `primitives/coercion` so the public QueryParser API stays unchanged
+ * while the actual logic lives in a single, unit-tested primitive module.
+ */
+type FieldType = FieldType$1;
+/**
+ * Minimal structural type for a Mongoose schema. We only read `.paths` and
+ * (optionally) `.indexes()`, so the parser stays decoupled from a specific
+ * Mongoose major version and is easy to mock in tests. Re-exported from the
+ * primitives module — the canonical definition lives there.
+ */
+interface SchemaLike extends SchemaPathsLike {
+  /** Optional — when present, schema indexes are introspected for geo/text fields */
+  indexes?: () => Array<[Record<string, unknown>, Record<string, unknown>?]>;
+}
+interface QueryParserOptions {
+  /** Maximum allowed regex pattern length (default: 500) */
+  maxRegexLength?: number;
+  /** Maximum allowed text search query length (default: 200) */
+  maxSearchLength?: number;
+  /** Maximum allowed filter depth (default: 10) */
+  maxFilterDepth?: number;
+  /** Maximum allowed limit value (default: 1000) */
+  maxLimit?: number;
+  /** Additional operators to block */
+  additionalDangerousOperators?: string[];
+  /** Enable lookup parsing (default: true) */
+  enableLookups?: boolean;
+  /** Enable aggregation parsing (default: false - requires explicit opt-in) */
+  enableAggregations?: boolean;
+  /**
+   * Search mode (default: 'text')
+   * - 'text': Uses MongoDB $text search (requires text index)
+   * - 'regex': Uses $or with $regex across searchFields (no index required)
+   */
+  searchMode?: SearchMode;
+  /**
+   * Fields to search when searchMode is 'regex'
+   * Required when searchMode is 'regex'
+   * @example ['name', 'description', 'sku', 'tags']
+   */
+  searchFields?: string[];
+  /**
+   * Whitelist of collection names allowed in lookups.
+   * When set, only these collections can be used in $lookup stages.
+   * When undefined, all collection names are allowed.
+   * @example ['departments', 'categories', 'users']
+   */
+  allowedLookupCollections?: string[];
+  /** Allowed fields for filtering. If set, ignores unknown fields. */
+  allowedFilterFields?: string[];
+  /** Allowed fields for sorting. If set, ignores unknown fields. */
+  allowedSortFields?: string[];
+  /**
+   * Whitelist of allowed filter operators.
+   * When set, only these operators can be used in filters.
+   * When undefined, all built-in operators are allowed.
+   * Values are human-readable keys: 'eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in', 'nin',
+   * 'like', 'contains', 'regex', 'exists', 'size', 'type'
+   * @example ['eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in']
+   */
+  allowedOperators?: string[];
+  /**
+   * Mongoose schema (or schema-like object exposing `.paths`) used for
+   * authoritative, schema-aware value coercion. When provided, filter values
+   * are coerced to the declared field type instead of guessed from the
+   * string shape — `?stock=50` becomes a number against a `Number` field but
+   * `?name=12345` stays a string against a `String` field. Nested paths like
+   * `address.zip` are looked up via dot-notation, matching Mongoose's
+   * `schema.paths` reflection. Unknown fields fall through to the heuristic.
+   */
+  schema?: SchemaLike;
+  /**
+   * Plain field-type map used for authoritative coercion when no Mongoose
+   * schema is available (raw MongoDB, Prisma, computed fields, upstream
+   * models you don't own). Takes precedence over `schema` for paths declared
+   * in both — useful for runtime overrides. Use dot-notation for nested
+   * paths (`'address.zip': 'string'`).
+   * @example { stock: 'number', active: 'boolean', releasedAt: 'date' }
+   */
+  fieldTypes?: Record<string, FieldType>;
+}
+/**
+ * Modern Query Parser
+ * Converts URL parameters to MongoDB queries with $lookup support
+ */
+declare class QueryParser {
+  private readonly options;
+  private readonly operators;
+  private readonly dangerousOperators;
+  /**
+   * Normalized dot-notation field-type map. Built once at construction from
+   * `options.schema` (Mongoose) and `options.fieldTypes` (override map), with
+   * `fieldTypes` taking precedence. An empty map means schema-aware coercion
+   * is disabled and the heuristic in `_convertValue` runs unchanged — this
+   * preserves backwards compatibility for callers that don't opt in.
+   */
+  private readonly _fieldTypes;
   /**
-   * Delete a document by ID.
-   *
-   * By default the behavior is decided by the plugin stack:
-   *   - With `softDeletePlugin` wired → soft delete (sets `deletedAt`)
-   *   - Without the plugin → physical delete
-   *
-   * Pass `mode: 'hard'` to force physical deletion regardless of plugins.
-   * All policy hooks (multi-tenant scope, audit trails, cache invalidation,
-   * cascade) still fire — only the soft-delete interception is skipped. This
-   * is the GDPR / admin-cleanup path.
-   *
-   * @example
-   * ```ts
-   * // Respects softDeletePlugin — soft if wired
-   * await userRepo.delete(userId);
-   *
-   * // GDPR erasure — physical delete, audit hooks still fire
-   * await userRepo.delete(userId, { mode: 'hard', organizationId: 'org_123' });
-   * ```
+   * Structured schema-index info (geo / text / other), built once from
+   * `options.schema?.indexes()`. Used by the operator router to validate
+   * geo operators against actual geo-indexed fields, and exposed publicly
+   * via `parser.schemaIndexes` for downstream tools (Arc MCP, query planners).
    */
-  delete(id: string | ObjectId, options?: SessionOptions & {
-    idField?: string;
-    mode?: 'hard' | 'soft'; /** Legacy opt-in: throw a 404 error on miss instead of returning `null`. */
-    throwOnNotFound?: boolean;
-  }): Promise<DeleteResult | null>;
+  private readonly _schemaIndexes;
   /**
-   * Update every document matching the filter.
-   *
-   * Promoted from `batchOperationsPlugin` to a class primitive in 3.11.0 so
-   * the surface matches sqlitekit's always-available `updateMany`. Consumers
-   * who forget to wire `batchOperationsPlugin` no longer get a runtime
-   * `TypeError: repo.updateMany is not a function` — the method is always
-   * here.
-   *
-   * Accepts three `update` forms via `UpdateInput`:
-   *   - Portable `UpdateSpec` from `@classytic/repo-core/update` (compiled to
-   *     `$set`/`$unset`/`$inc`/`$setOnInsert` before hooks run).
-   *   - Raw Mongo operator record (`{ $set, $inc, ... }`) — passed through.
-   *   - Mongo aggregation pipeline (`[...]`) — requires `updatePipeline: true`
-   *     to guard against accidental pipeline updates.
+   * Regex patterns that can cause catastrophic backtracking (ReDoS attacks).
+   * Detects common footguns:
+   * - Quantifiers: {n,m}
+   * - Possessive quantifiers: *+, ++, ?+
+   * - Nested quantifiers: (a+)+, (a*)*
+   * - Backreferences: \1, \2, etc.
+   * - Complex character classes: [...]...[...]
    *
-   * Refuses empty filters (defense-in-depth against mass-update accidents)
-   * both before and after policy hooks inject tenant scope.
+   * This pattern detector is FAIL-SAFE (on match, the input is escaped), but
+   * it is not exhaustive. {@link _regexComplexityExceedsBudget} complements
+   * it with a deterministic static complexity budget so patterns that happen
+   * to evade the detector still fail over when their unbounded-quantifier
+   * density is pathological.
    */
-  updateMany(filter: Record<string, unknown>, update: UpdateInput, options?: SessionOptions & {
-    updatePipeline?: boolean;
-    [key: string]: unknown;
-  }): Promise<UpdateManyResult>;
+  private readonly dangerousRegexPatterns;
   /**
-   * Delete every document matching the filter.
-   *
-   * Promoted from `batchOperationsPlugin` to a class primitive in 3.11.0 for
-   * the same reason as `updateMany` — sqlitekit parity and no silent "method
-   * is undefined" footgun when the batch plugin isn't wired.
+   * Static complexity budget for user-supplied regex patterns.
+   * Returns `true` if the pattern crosses a budget that empirically correlates
+   * with ReDoS risk — independent of the heuristic regex detector.
    *
-   * Behavior mirrors `delete()`: defaults to soft delete when
-   * `softDeletePlugin` is wired, physical delete otherwise. Pass
-   * `{ mode: 'hard' }` to bypass soft-delete — multi-tenant scoping, audit,
-   * and cache hooks still fire.
+   * Budget components (any single threshold crossed → over budget):
+   *   - unbounded quantifiers (`*`, `+`, `?`) — hard cap 20
+   *   - nested groups `(` — hard cap 8
+   *   - alternations `|` — hard cap 10
+   *   - combined: (quantifiers * groups) — hard cap 40
    *
-   * Rejects empty filters up front AND after policy hooks, so a policy-plugin
-   * bug that zeroes out the query can't be exploited to wipe a collection.
+   * These thresholds are intentionally permissive for legitimate queries and
+   * tight enough to refuse known-pathological patterns like `(a+)+b` with
+   * heavy repetition.
    */
-  deleteMany(filter: Record<string, unknown>, options?: SessionOptions & {
-    mode?: 'hard' | 'soft';
-    [key: string]: unknown;
-  }): Promise<DeleteManyResult>;
+  private _regexComplexityExceedsBudget;
+  constructor(options?: QueryParserOptions);
   /**
-   * Compliance-grade cleanup primitive — see `StandardRepo.purgeByField`
-   * for the cross-kit contract. Mongokit composes the kit-agnostic
-   * `runChunkedPurge` orchestrator (loop, signal, progress, result
-   * envelope) with `createMongoPurgePort` (driver-specific id selection
-   * + strategy writes). See [actions/purge.ts](./actions/purge.ts) for
-   * the port implementation.
+   * Structured view of the configured schema's indexes — geo fields, text
+   * fields, and other compound indexes. Empty arrays when no schema was
+   * provided. Stable across the parser's lifetime; mutating the returned
+   * object does not affect parser behavior.
+   *
+   * Useful for downstream tooling (Arc MCP, query planners, doc generators)
+   * that needs to know which fields support which query types.
    */
-  purgeByField(field: string, value: unknown, strategy: TenantPurgeStrategy, options?: TenantPurgeOptions): Promise<TenantPurgeResult>;
+  get schemaIndexes(): SchemaIndexes;
   /**
-   * Kit-native aggregation pipeline — takes a MongoDB stage array and
-   * returns the raw pipeline output. Use this for `$lookup`, `$unwind`,
-   * `$facet`, `$graphLookup`, and any other mongo-specific power
-   * features that don't translate to SQL.
-   *
-   * For backend-portable aggregations (filter + group + measures +
-   * sort + limit) use `aggregate(req: AggRequest)` instead — it
-   * compiles the repo-core IR to the equivalent pipeline internally
-   * and produces the same row shape sqlitekit emits.
-   *
-   * Routes through the hook system for policy enforcement
-   * (multi-tenant, soft-delete).
+   * Get the configured allowed filter fields.
+   * Returns `undefined` if no whitelist is set (all fields allowed).
    *
-   * @param pipeline - MongoDB aggregation stage array
-   * @param options  - Aggregation options including governance controls
+   * Used by Arc's MCP integration to auto-derive `filterableFields`
+   * from the QueryParser when `schemaOptions.filterableFields` is not set.
    */
-  aggregatePipeline<TResult = unknown>(pipeline: PipelineStage[], options?: AggregateOptions): Promise<TResult[]>;
+  get allowedFilterFields(): string[] | undefined;
   /**
-   * Paginated kit-native aggregation pipeline. Same mongo-specific
-   * scope as `aggregatePipeline` — reach for this when you need
-   * `$lookup` / `$unwind` / `$facet` alongside pagination.
-   *
-   * Prefer `aggregatePaginate(req: AggPaginationRequest)` for
-   * cross-backend dashboard code; that method compiles the portable
-   * IR to an equivalent pipeline.
-   *
-   * Policy hooks (multi-tenant, soft-delete) inject context.filters
-   * which are prepended as a `$match` stage.
+   * Get the configured allowed sort fields.
+   * Returns `undefined` if no whitelist is set (all fields allowed).
    */
-  aggregatePipelinePaginate(options?: AggregatePaginationOptions): Promise<AggregatePaginationResult<TDoc>>;
+  get allowedSortFields(): string[] | undefined;
   /**
-   * Portable aggregation. Compiles the repo-core `AggRequest` IR to
-   * `[{$match}, {$group}, {$addFields}, {$project}, {$match}, {$sort},
-   * {$skip}, {$limit}]` against this repo's collection. Output rows
-   * carry one key per `groupBy` column plus one key per measure alias
-   * — identical shape to sqlitekit's `aggregate(req)`, so dashboards
-   * work unchanged across backends.
-   *
-   * Without `groupBy`: returns a single-row result with just the
-   * measures (scalar aggregation). Pass
-   * `{ measures: { total: { op: 'sum', field: 'amount' } } }` for a
-   * simple summary.
-   *
-   * For mongo-specific power features (`$lookup`, `$unwind`, `$facet`,
-   * `$graphLookup`, window operators) reach for `aggregatePipeline`
-   * — that's the kit-native escape hatch.
-   *
-   * Routes through the hook system for policy enforcement
-   * (multi-tenant, soft-delete) — plugins inject their scope into
-   * `context.filter`, which is merged into the pre-aggregate `$match`
-   * before compilation.
+   * Get the configured allowed operators.
+   * Returns `undefined` if no whitelist is set (all built-in operators allowed).
    */
-  aggregate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggRequest, options?: QueryOptions): Promise<AggResult<TRow>>;
+  get allowedOperators(): string[] | undefined;
   /**
-   * Invalidate every aggregate-cache entry tagged with ANY of the
-   * given tags. Delegates to the unified cache plugin's handle
-   * (`repo.cache.invalidateByTags`) — wired by `cachePlugin({ adapter })`.
-   *
-   * Pass no tags to wipe the entire cache namespace (requires the
-   * adapter to implement `clear`).
+   * Parse URL query parameters into MongoDB query format
    *
-   * Returns the count of distinct entries cleared (`-1` when the call
-   * routed through `adapter.clear()` and the adapter doesn't report a
-   * count). No-op (returns `0`) when no cache plugin is wired.
+   * @example
+   * ```typescript
+   * // URL: ?status=active&lookup[department][foreignField]=slug&sort=-createdAt&page=1
+   * const query = parser.parse(req.query);
+   * // Returns: { filters: {...}, lookups: [...], sort: {...}, page: 1 }
+   * ```
    */
-  invalidateAggregateCache(tags?: readonly string[]): Promise<number>;
+  parse(query: Record<string, unknown> | null | undefined): ParsedQuery;
   /**
-   * Paginated portable aggregation. Two pagination modes, picked by
-   * the request shape:
+   * Generate OpenAPI-compatible JSON Schema for query parameters.
+   * Arc's defineResource() auto-detects this method and uses it
+   * to document list endpoint query parameters in OpenAPI/Swagger.
    *
-   * - **Offset (default)** — `page` + `limit`. Returns the standard
-   *   `{ method: 'offset', data, total, pages, hasNext, hasPrev, ... }`
-   *   envelope. `countStrategy: 'none'` skips the second round-trip
-   *   that computes `total`; the envelope reports `total: 0`,
-   *   `pages: 0`, and derives `hasNext` from a `LIMIT N+1` peek on
-   *   the data pipeline.
-   * - **Keyset** — `pagination: 'keyset'` (or `after` set). Returns
-   *   `{ method: 'keyset', data, hasMore, next, limit }`. `sort` is
-   *   required — the cursor encodes the sort-key tuple of the last
-   *   row. Each subsequent page passes the previous `next` back as
-   *   `after`. Scales to arbitrary group counts because the planner
-   *   uses `(sort_keys) > (cursor)` instead of `OFFSET N`.
+   * The schema respects parser configuration:
+   * - `allowedOperators`: only documents allowed operators
+   * - `allowedFilterFields`: generates explicit field[op] entries
+   * - `enableLookups` / `enableAggregations`: includes/excludes lookup/aggregate params
+   * - `maxLimit` / `maxSearchLength`: reflected in schema constraints
    */
-  aggregatePaginate<TRow extends Record<string, unknown> = Record<string, unknown>>(req: AggPaginationRequest, options?: QueryOptions): Promise<OffsetPaginationResultCore<TRow> | KeysetAggPaginationResult<TRow>>;
+  getQuerySchema(): {
+    type: 'object';
+    properties: Record<string, unknown>;
+    required?: string[];
+  };
   /**
-   * Internal: the actual aggregate-paginate execution body. Extracted
-   * so `aggregatePaginate` can wrap it in the cache layer without
-   * duplicating the keyset / offset branch logic.
-   *
-   * Receives `finalReq` (already policy-scoped) so the cache key
-   * built by the outer wrapper matches the request the executor
-   * sees — no cross-tenant cache poisoning.
+   * Get the query schema with OpenAPI extensions (x-internal metadata).
+   * Use this when generating OpenAPI/Swagger docs — it includes a documentary
+   * `_filterOperators` property describing available filter operators.
+   * For validation-only schemas, use `getQuerySchema()` instead.
    */
-  private _executeAggregatePaginate;
+  getOpenAPIQuerySchema(): {
+    type: 'object';
+    properties: Record<string, unknown>;
+  };
   /**
-   * Merge policy-hook-injected filters (multi-tenant scope,
-   * soft-delete) into the pre-aggregate `filter` slot of the request.
-   * Plugins speak mongo-query shape (`context.query` / `context.filters`);
-   * the caller's `req.filter` may be either Filter IR or a mongo query.
-   *
-   * Each part is compiled through `compileFilterToMongo` BEFORE the
-   * `$and` merge — otherwise an IR node like `eq('status', 'paid')`
-   * (`{ op, field, value }`) gets nested inside `$and` as a literal,
-   * `compileFilterToMongo` of the merged value finds no top-level `op`
-   * (so `isFilter` is false), and Mongo receives the IR object as a
-   * raw query clause that matches no real document. Symptom: aggregates
-   * silently return 0 rows whenever a callerpasses IR + a policy
-   * plugin is installed.
+   * Get the JSON Schema type for a filter operator
+   */
+  private _getOperatorSchemaType;
+  /**
+   * Get a human-readable description for a filter operator
    */
-  private _injectPolicyScopeIntoAgg;
+  private _getOperatorDescription;
   /**
-   * Get distinct values
-   * Routes through hook system for policy enforcement (multi-tenant, soft-delete)
+   * Build a summary description of all available filter operators
    */
-  distinct<T = unknown>(field: string, query?: Record<string, unknown>, options?: ReadOptions): Promise<T[]>;
+  private _buildOperatorDescription;
   /**
-   * Query with custom field lookups ($lookup)
-   * Best for: Joins on slugs, SKUs, codes, or other indexed custom fields
+   * Parse lookup configurations from URL parameters
+   *
+   * Supported formats:
+   * 1. Simple: ?lookup[department]=slug
+   *    → Join with 'departments' collection on slug field
+   *
+   * 2. Detailed: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug
+   *    → Full control over join configuration
+   *
+   * 3. Multiple: ?lookup[department]=slug&lookup[category]=categorySlug
+   *    → Multiple lookups
    *
    * @example
    * ```typescript
-   * // Join employees with departments using slug instead of ObjectId
-   * const employees = await employeeRepo.lookupPopulate({
-   *   filters: { status: 'active' },
-   *   lookups: [
-   *     {
-   *       from: 'departments',
-   *       localField: 'departmentSlug',
-   *       foreignField: 'slug',
-   *       as: 'department',
-   *       single: true
-   *     }
-   *   ],
-   *   sort: '-createdAt',
-   *   page: 1,
-   *   limit: 50
+   * // URL: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug&lookup[department][single]=true
+   * const lookups = parser._parseLookups({
+   *   department: { localField: 'deptSlug', foreignField: 'slug', single: 'true' }
    * });
+   * // Returns: [{ from: 'departments', localField: 'deptSlug', foreignField: 'slug', single: true }]
    * ```
    */
-  lookupPopulate<TExtra extends Record<string, unknown> = Record<string, unknown>>(options: LookupPopulateOptions<TDoc>): Promise<LookupPopulateResult<TDoc, TExtra>>;
+  private _parseLookups;
   /**
-   * Create an aggregation builder for this model
-   * Useful for building complex custom aggregations
+   * Parse a single lookup configuration
+   */
+  private _parseSingleLookup;
+  /**
+   * Parse aggregation pipeline from URL (advanced feature)
    *
    * @example
    * ```typescript
-   * const pipeline = repo.buildAggregation()
-   *   .match({ status: 'active' })
-   *   .lookup('departments', 'deptSlug', 'slug', 'department', true)
-   *   .group({ _id: '$department', count: { $sum: 1 } })
-   *   .sort({ count: -1 })
-   *   .build();
-   *
-   * const results = await repo.Model.aggregate(pipeline);
+   * // URL: ?aggregate[group][_id]=$status&aggregate[group][count]=$sum:1
+   * const pipeline = parser._parseAggregation({
+   *   group: { _id: '$status', count: '$sum:1' }
+   * });
    * ```
    */
-  buildAggregation(): AggregationBuilder;
+  private _parseAggregation;
   /**
-   * Create a lookup builder
-   * Useful for building $lookup stages independently
+   * Parse select/project fields
    *
    * @example
    * ```typescript
-   * const lookupStages = repo.buildLookup('departments')
-   *   .localField('deptSlug')
-   *   .foreignField('slug')
-   *   .as('department')
-   *   .single()
-   *   .build();
-   *
-   * const pipeline = [
-   *   { $match: { status: 'active' } },
-   *   ...lookupStages
-   * ];
+   * // URL: ?select=name,email,-password
+   * // Returns: { name: 1, email: 1, password: 0 }
    * ```
    */
-  buildLookup(from?: string): LookupBuilder;
+  private _parseSelect;
   /**
-   * Execute callback within a MongoDB transaction with automatic retry on
-   * transient failures.
-   *
-   * **BREAKING (3.10):** the callback now receives a **tx-bound repository**,
-   * not a raw `ClientSession`. This matches repo-core's `StandardRepo.withTransaction`
-   * contract that every kit (sqlitekit, pgkit, prismakit) already implements
-   * — so cross-kit plugins and apps are portable. Session threading happens
-   * transparently: every CRUD call on `txRepo` auto-injects the session into
-   * its options bag, including plugin-added methods (`upsert`, `increment`,
-   * `updateMany`, `restore`, ...). Nested `txRepo.withTransaction(...)` throws.
-   *
-   * For raw-session cross-repo workflows — multiple repositories coordinating
-   * writes — use the standalone `withTransaction(connection, fn)` export
-   * from `@classytic/mongokit`. That helper remains session-based by design.
-   *
-   * @param callback - Receives a tx-bound `Repository<TDoc>` — call its
-   *                   methods directly, no need to pass `{ session }` manually
-   * @param options.allowFallback - Run without transaction on standalone MongoDB (default: false)
-   * @param options.onFallback - Called when falling back to non-transactional execution
-   * @param options.transactionOptions - MongoDB driver transaction options (readConcern, writeConcern, etc.)
+   * Parse populate parameter - handles both simple string and advanced object format
    *
    * @example
    * ```typescript
-   * const order = await repo.withTransaction(async (txRepo) => {
-   *   const created = await txRepo.create({ total: 100 });
-   *   await txRepo.update(created._id, { confirmed: true });
-   *   return created;
-   * });
-   *
-   * // With fallback for standalone/dev environments
-   * await repo.withTransaction(
-   *   async (txRepo) => {
-   *     await txRepo.create(doc);
-   *   },
-   *   {
-   *     allowFallback: true,
-   *     onFallback: (err) => logger.warn('Running without transaction', err),
-   *   },
-   * );
+   * // Simple: ?populate=author,category
+   * // Returns: { simplePopulate: 'author,category', populateOptions: undefined }
    *
-   * // Cross-repo with explicit session:
-   * import { withTransaction } from '@classytic/mongokit';
-   * await withTransaction(mongoose.connection, async (session) => {
-   *   const order = await orderRepo.create(data, { session });
-   *   await inventoryRepo.decrement(..., { session });
-   * });
+   * // Advanced: ?populate[author][select]=name,email
+   * // Returns: { simplePopulate: undefined, populateOptions: [{ path: 'author', select: 'name email' }] }
    * ```
    */
-  withTransaction<T>(callback: (txRepo: this) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
-  /**
-   * Execute custom query with event emission
-   */
-  _executeQuery<T>(buildQuery: (Model: Model<TDoc>) => Promise<T>): Promise<T>;
+  private _parsePopulate;
   /**
-   * Build operation context and run before-hooks (sorted by priority).
-   *
-   * Narrows `RepositoryBase._buildContext`'s return type to mongokit's
-   * richer `RepositoryContext` (which carries `softDeleted`, `_cacheHit`,
-   * populate / readPreference / session, etc.). Runtime is inherited from
-   * the base class — this override is purely a type-narrowing shim.
-   *
-   * Hook execution order is deterministic:
-   * 1. POLICY (100) — tenant isolation, soft-delete filtering, validation
-   * 2. CACHE  (200) — cache lookup (after policy filters are injected)
-   * 3. OBSERVABILITY (300) — audit logging, metrics
-   * 4. DEFAULT (500) — user-registered hooks
+   * Parse a single populate configuration
    */
-  _buildContext(operation: string, options: Record<string, unknown> | object): Promise<RepositoryContext>;
+  private _parseSinglePopulate;
   /**
-   * Walk the well-known filter-carrying keys (`query`, `filters`,
-   * `having`) and route any Filter IR through `compileFilterToMongo`.
-   * Plain Mongo queries pass through untouched — `isFilter` is the
-   * discriminator. Returns a shallow clone; never mutates input.
+   * Convert populate match values (handles boolean strings, etc.)
    */
-  private _normalizeFilterSlots;
+  private _convertPopulateMatch;
   /**
-   * Resolve the effective sort for getAll. Handles $near conflict detection
-   * (warns + drops explicit sort when $near is in filters).
+   * Parse filter parameters
    */
-  private _resolveSort;
+  private _parseFilters;
   /**
-   * Detect whether to use keyset (cursor) or offset (page) pagination.
+   * Handle operator syntax: field[operator]=value
    */
-  private _detectPaginationMode;
+  private _handleOperatorSyntax;
   /**
-   * Build the MongoDB query filter with search merged in. Handles text
-   * search ($text), regex search ($or of $regex), and the search-resolver
-   * plugin contract (search already cleared by a before:getAll hook).
+   * Handle bracket syntax with object value
    */
-  private _buildSearchQuery;
+  private _handleBracketSyntax;
+  private _parseSort;
+  private _toMongoOperator;
+  private _createSafeRegex;
+  private _escapeRegex;
   /**
-   * Parse sort string or object
+   * Sanitize $match configuration to prevent dangerous operators
+   * Recursively filters out operators like $where, $function, $accumulator
    */
-  _parseSort(sort: SortSpec | string | undefined): SortSpec;
+  private _sanitizeMatchConfig;
   /**
-   * Parse populate specification
+   * Sanitize pipeline stages for use in $lookup.
+   * Blocks dangerous stages ($out, $merge, etc.) and recursively sanitizes
+   * operator expressions within $match, $addFields, and $set stages.
    */
-  _parsePopulate(populate: PopulateSpec | undefined): string[] | PopulateOptions[];
+  private _sanitizePipeline;
   /**
-   * Classify a driver error as an authoritative duplicate-key conflict.
-   *
-   * Used by arc's outbox / idempotency adapters to distinguish
-   * "write already landed (idempotent no-op)" from "transient DB error
-   * (must retry)". Every backend signals duplicate keys differently —
-   * MongoDB `code: 11000`, Prisma `P2002`, Postgres `23505` — so this
-   * predicate lives on the kit that knows its driver. Cross-driver
-   * adapters then depend only on the boolean outcome, not the shape of
-   * the underlying error.
-   *
-   * Deliberately narrow: matches ONLY `code === 11000` and
-   * `codeName === 'DuplicateKey'`. Does NOT match
-   * `err.name === 'MongoServerError'`, which is also true for
-   * WriteConflict, NotWritablePrimary, ExceededTimeLimit, and every
-   * other server-side error — treating those as duplicate keys would
-   * silently swallow transactional retries.
+   * Recursively sanitize expression objects, blocking dangerous operators
+   * like $where, $function, $accumulator inside $addFields/$set stages.
    *
-   * @example
-   * try {
-   *   await outboxRepo.create(event);
-   * } catch (err) {
-   *   if (outboxRepo.isDuplicateKeyError(err)) {
-   *     // Idempotent no-op — event was already written by a prior attempt.
-   *     return;
-   *   }
-   *   throw err; // transient DB error — upstream retries
-   * }
+   * Depth-guarded — same protection `_sanitizeMatchConfig` ships, since
+   * a hostile `$cond`/`$switch` chain can recurse arbitrarily deep and
+   * exhaust JS stack. Without the guard, this is a one-liner DoS against
+   * any host that exposes pipeline parsing to untrusted callers.
    */
-  isDuplicateKeyError(err: unknown): boolean;
+  private _sanitizeExpressions;
+  private _sanitizeSearch;
   /**
-   * Handle errors with proper HTTP status codes.
+   * Build regex-based multi-field search filters
+   * Creates an $or query with case-insensitive regex across all searchFields
    *
-   * **Transactional retry signal preservation.** MongoDB driver errors
-   * carry `errorLabels` (e.g. `'TransientTransactionError'`,
-   * `'UnknownTransactionCommitResult'`) that `mongoose.Connection.
-   * withTransaction()` reads via `error.hasErrorLabel(label)` to decide
-   * whether to auto-retry the transaction. Wrapping such an error in a
-   * fresh `Error` via `createError(...)` strips both the labels and the
-   * `hasErrorLabel` method — the retry signal vanishes and concurrent
-   * writers see WriteConflicts surface to userland instead of being
-   * retried by the driver. To keep the standard MongoDB transaction-
-   * retry mechanism intact, we re-throw any error that carries
-   * `errorLabels` exactly as we received it. The caller still sees a
-   * thrown error — only the wrapping layer is skipped.
+   * @example
+   * // searchFields: ['name', 'description', 'sku']
+   * // search: 'azure'
+   * // Returns: [
+   * //   { name: { $regex: /azure/i } },
+   * //   { description: { $regex: /azure/i } },
+   * //   { sku: { $regex: /azure/i } }
+   * // ]
    */
-  _handleError(error: Error): HttpError;
+  private _buildRegexSearch;
+  private _parseOr;
+  private _enhanceWithBetween;
+  private _pluralize;
+  private _capitalize;
 }
 //#endregion
 //#region src/transaction.d.ts
@@ -2313,17 +2429,4 @@ declare function createOptionsExtractor<TCtx extends Record<string, unknown>>(fi
  */
 declare function systemContext(extra?: SessionOptions): SessionOptions;
 //#endregion
-//#region src/index.d.ts
-/**
- * Factory function to create a repository instance
- *
- * @param Model - Mongoose model
- * @param plugins - Array of plugins to apply
- * @returns Repository instance
- *
- * @example
- * const userRepo = createRepository(UserModel, [timestampPlugin()]);
- */
-declare function createRepository<TDoc>(Model: _$mongoose.Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions): Repository<TDoc>;
-//#endregion
-export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BasePaginationOptions, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheOperationOptions, type CacheOptions, type CacheableOptions, type CascadeOptions, type CascadeRelation, type CollationOptions, type CreateInput, type CreateOptions, type CursorPayload, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type IController, type IControllerResponse, type IRequestContext, type IResponseFormatter, type IdGenerator, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type LeaseMethods, type LeasePluginOptions, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MUTATING_OPERATIONS, type Middleware, type MiddlewareContext, type MinMaxResult, type MinimalRepoView, type MongoOperationsMethods, type MongoOperatorUpdate, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, type PrioritizedHook, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, Repository, Repository as default, type RepositoryCacheHandle, type RepositoryCachePluginOptions, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type ValueType, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, adminBypass, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, compileFilterToMongo, configureLogger, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, immutableField, isDuplicateKeyError, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, repoOptionsFromCtx, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, systemContext, timestampPlugin, uniqueField, validationChainPlugin, withTransaction };
+export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AuditConfig, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BasePaginationOptions, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheOperationOptions, type CacheOptions, type CacheableOptions, type CascadeOptions, type CascadeRelation, type CollationOptions, type CreateInput, type CreateOptions, type CreateRepositoryConfig, type CursorPayload, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type IController, type IControllerResponse, type IRequestContext, type IResponseFormatter, type IdGenerator, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type LeaseMethods, type LeasePluginOptions, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MONGOKIT_CAPABILITIES, MUTATING_OPERATIONS, type Middleware, type MiddlewareContext, type MinMaxResult, type MinimalRepoView, type MongoOperationsMethods, type MongoOperatorUpdate, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, type PrioritizedHook, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, Repository, Repository as default, type RepositoryCacheHandle, type RepositoryCachePluginOptions, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type ValueType, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, adminBypass, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, compileFilterToMongo, configureLogger, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, immutableField, isDuplicateKeyError, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, repoOptionsFromCtx, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, systemContext, timestampPlugin, uniqueField, validationChainPlugin, withTransaction };