@classytic/mongokit 3.23.0 → 3.25.0

package/README.md

@@ -212,12 +212,21 @@ const parser = new QueryParser({
   searchMode: 'auto',
 });
 
-const parsed = parser.parse(req.query);
+const parsed = parser.parse(req.query); // throws HttpError(400) on invalid/blocked input
 const result = await invoiceRepo.getAll(parsed);
 ```
 
 Supports common URL operators such as `_gt`, `_gte`, `_lt`, `_lte`, `_in`, `_nin`, `_regex`, geo filters, populate, and schema-aware coercion.
 
+The parser is **fail-closed by default** (`invalidInput: 'throw'`): blocked
+operators, disallowed fields, malformed values, and pathological regex input
+raise HTTP 400 (`code: 'INVALID_QUERY_INPUT'`) instead of being silently
+dropped — dropping a request's *only* filter would broaden the query to every
+record in tenant scope. Literal-semantics input (`search`, `like`/`contains`)
+always escapes rather than rejects, so `?search=c++` never 400s. Trusted
+migration/compat tooling can opt into the legacy warn-and-drop behavior with
+`invalidInput: 'drop'`.
+
 ## Built-In Plugins
 
 | Plugin | Purpose |
@@ -228,7 +237,7 @@ Supports common URL operators such as `_gt`, `_gte`, `_lt`, `_lte`, `_in`, `_nin
 | `timestampPlugin` | `createdAt` / `updatedAt` management |
 | `batchOperationsPlugin` | `bulkWrite` and batch helpers |
 | `cachePlugin` | Pluggable read-through cache |
-| `auditLogPlugin` / `auditTrailPlugin` | Operational and compliance audit trails |
+| `auditLogPlugin` / `auditTrailPlugin` | Audit trails — `auditTrailPlugin({ mode: 'transactional' })` gives session-joined entries that are atomic inside `withTransaction` (compliance-grade); the default `'best-effort'` mode is fire-and-forget observability. Call `ensureAuditTrailReady()` at boot so collection/index creation doesn't happen inside the first transaction |
 | `observabilityPlugin` | Metrics hook points |
 | `cascadePlugin` | Hook-routed cascade delete |
 | `customIdPlugin` | Prefixed or sequential public IDs |

package/dist/{PaginationEngine-BnZ24ehC.d.mts → PaginationEngine-CBS1XGzp.d.mts}

@@ -1,4 +1,5 @@
-import { A as KeysetPaginationOptions, U as PaginationConfig, V as OffsetPaginationOptions, i as AnyDocument, n as AggregatePaginationOptions } from "./types-BtMuhoX5.mjs";
+import { t as AnyDocument } from "./core-62oo3N1C.mjs";
+import { c as PaginationConfig, o as KeysetPaginationOptions, s as OffsetPaginationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
 import { Model } from "mongoose";
 import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult } from "@classytic/repo-core/pagination";
 //#region src/pagination/PaginationEngine.d.ts

package/dist/{PaginationEngine-BT1ywu9k.mjs → PaginationEngine-CczbvCAq.mjs}

@@ -255,6 +255,59 @@ function resolveCursorFilter(after, sort, cursorVersion, baseFilters = {}, minCu
 //#endregion
 //#region src/pagination/utils/index-hint.ts
 /**
+* The only operators that give the query planner a *bounded equality* it can
+* lead an index with. Everything else (`$ne`, `$nin`, `$gt(e)`, `$lt(e)`,
+* `$all`, `$elemMatch`, `$regex`, `$exists`, …) is a range predicate and, per ESR,
+* must come AFTER the sort keys — never in the leading prefix.
+*
+* `$all` is intentionally excluded: although it combines equality matches,
+* it targets multikey data, whose bounded index prefix cannot generally
+* provide a subsequent index sort. Treating it as residual avoids claiming
+* that a multikey-prefix compound index satisfies the sort.
+*/
+const EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["$eq", "$in"]);
+/**
+* Is a top-level filter value a RANGE predicate (as opposed to equality)?
+*
+* Only a plain operator object — one whose own keys start with `$` — can be a
+* range. Scalars, `Date`, `ObjectId`, arrays, and embedded-doc equality
+* matches (`{ nested: { a: 1 } }`) are all equality for index-leading
+* purposes. An operator object is equality iff every `$`-operator it uses is
+* in {@link EQUALITY_OPERATORS}.
+*/
+function isRangePredicate(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const operatorKeys = Object.keys(value).filter((k) => k.startsWith("$"));
+	if (operatorKeys.length === 0) return false;
+	return operatorKeys.some((k) => !EQUALITY_OPERATORS.has(k));
+}
+/**
+* Split top-level filter fields into ESR equality vs range predicates.
+*
+* The keyset index check follows MongoDB's ESR rule (Equality → Sort →
+* Range). Only equality predicates belong in an index's leading prefix; a
+* range predicate placed there stops the planner from using any later key for
+* bounds OR for satisfying the sort. So the compatibility check and the
+* recommended-index shape must treat the two classes differently — a field
+* filtered by a range should TRAIL the sort keys, not lead them.
+*
+* `$`-prefixed top-level keys (`$and`/`$or`/…) are ignored (the caller decides
+* how to handle logical combinators).
+*/
+function classifyFilterFields(filters) {
+	const equality = [];
+	const range = [];
+	for (const [key, value] of Object.entries(filters)) {
+		if (key.startsWith("$")) continue;
+		if (isRangePredicate(value)) range.push(key);
+		else equality.push(key);
+	}
+	return {
+		equality,
+		range
+	};
+}
+/**
 * Read a Mongoose schema's declared indexes, defensively.
 * Returns an empty array on any introspection failure.
 */
@@ -626,9 +679,17 @@ var PaginationEngine = class {
 		const sortWithoutIdTail = stripTrailingIdTiebreaker(normalizedSort);
 		const filterKeys = Object.keys(filters).filter((k) => !k.startsWith("$"));
 		const effectiveSortFields = Object.keys(sortWithoutIdTail);
-		if (process.env.NODE_ENV !== "test" && filterKeys.length > 0 && effectiveSortFields.length > 0 && !hasCompatibleKeysetIndex(this._getSchemaIndexes(), filterKeys, sortWithoutIdTail)) {
-			const indexFields = [...filterKeys.map((f) => `${f}: 1`), ...effectiveSortFields.map((f) => `${f}: ${sortWithoutIdTail[f]}`)];
-			warn(`[mongokit] Keyset pagination with filters [${filterKeys.join(", ")}] and sort [${effectiveSortFields.join(", ")}] has no matching schema-declared compound index. For O(1) performance, declare: { ${indexFields.join(", ")} }. (Collection-level indexes created outside the schema are not visible here.)`);
+		if (process.env.NODE_ENV !== "test" && filterKeys.length > 0 && effectiveSortFields.length > 0) {
+			const indexes = this._getSchemaIndexes();
+			const { equality, range } = classifyFilterFields(filters);
+			if (!(hasCompatibleKeysetIndex(indexes, filterKeys, sortWithoutIdTail) || equality.length !== filterKeys.length && hasCompatibleKeysetIndex(indexes, equality, sortWithoutIdTail))) {
+				const indexFields = [
+					...equality.map((f) => `${f}: 1`),
+					...effectiveSortFields.map((f) => `${f}: ${sortWithoutIdTail[f]}`),
+					...range.map((f) => `${f}: 1`)
+				];
+				warn(`[mongokit] Keyset pagination with filters [${filterKeys.join(", ")}] and sort [${effectiveSortFields.join(", ")}] has no matching schema-declared compound index. For O(1) performance, declare: { ${indexFields.join(", ")} }. (Collection-level indexes created outside the schema are not visible here.)`);
+			}
 		}
 		let query = { ...filters };
 		if (after) query = resolveCursorFilter(after, normalizedSort, this.config.cursorVersion, query, this.config.minCursorVersion);

package/dist/{Repository-CLQA3sEz.mjs → Repository-KKR8jxfD.mjs}

@@ -1,8 +1,8 @@
-import { i as isValidIdForType, t as getSchemaIdType } from "./id-resolution-P2OzcyRl.mjs";
+import { i as isValidIdForType, t as getSchemaIdType } from "./id-resolution-BqDrk0S2.mjs";
 import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-1Lq9OMD2.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
-import { t as PaginationEngine } from "./PaginationEngine-BT1ywu9k.mjs";
+import { t as PaginationEngine } from "./PaginationEngine-CczbvCAq.mjs";
 import { hasNearOperator, rewriteNearForCount } from "./query/primitives/geo.mjs";
 import { RepositoryBase, runChunkedArchive, runChunkedPurge, throwIfAborted, validatePluginOrder, withRetry } from "@classytic/repo-core/repository";
 import mongoose from "mongoose";
@@ -543,7 +543,7 @@ function buildAggPipeline(req) {
 		const match = compileFilterToMongo(baseFilter);
 		if (Object.keys(match).length > 0) stages.push({ $match: match });
 	}
-	if (req.lookups && req.lookups.length > 0) appendLookupStages(stages, req.lookups);
+	if (req.lookups && req.lookups.length > 0) appendLookupStages$1(stages, req.lookups);
 	if (joinedFilter !== void 0) {
 		const match = compileFilterToMongo(joinedFilter);
 		if (Object.keys(match).length > 0) stages.push({ $match: match });
@@ -698,7 +698,7 @@ function validateBucketAliases(bucketAliases, groupCols, measures) {
 function safeIdKey(field) {
 	return field.includes(".") ? field.replace(/\./g, "__") : field;
 }
-function appendLookupStages(stages, lookups) {
+function appendLookupStages$1(stages, lookups) {
 	const asLookupOptions = lookups;
 	stages.push(...LookupBuilder.multiple(asLookupOptions));
 	for (const lookup of lookups) if (lookup.single) {
@@ -1470,6 +1470,59 @@ var AggregationBuilder = class AggregationBuilder {
 *    ```
 */
 //#endregion
+//#region src/repository/lookup-populate.ts
+/**
+* Inclusion projections must carry the keyset sort fields (plus `_id`) or
+* cursor encoding has no values to serialize. No-op for exclusion
+* projections and cursor-less calls.
+*/
+function ensureLookupProjectionIncludesCursorFields(projection, sort) {
+	if (!projection || !sort) return projection;
+	if (!Object.values(projection).some((value) => value === 1)) return projection;
+	const nextProjection = { ...projection };
+	for (const field of [...Object.keys(sort), "_id"]) nextProjection[field] = 1;
+	return nextProjection;
+}
+/**
+* Build the `$project` map from a caller's select spec (string / array /
+* inclusion-exclusion record). For inclusion projections, every lookup's
+* `as` field is auto-included so `$project` doesn't strip the joined data.
+* Returns a fresh object (callers may add fields for cursor encoding).
+*/
+function buildLookupProjection(selectSpec, lookups) {
+	if (!selectSpec) return void 0;
+	let projection;
+	if (typeof selectSpec === "string") {
+		projection = {};
+		for (const field of selectSpec.split(",").map((f) => f.trim())) if (field.startsWith("-")) projection[field.substring(1)] = 0;
+		else projection[field] = 1;
+	} else if (Array.isArray(selectSpec)) {
+		projection = {};
+		for (const field of selectSpec) if (field.startsWith("-")) projection[field.substring(1)] = 0;
+		else projection[field] = 1;
+	} else projection = { ...selectSpec };
+	if (Object.values(projection).some((v) => v === 1)) for (const lookup of lookups) {
+		const asField = lookup.as || lookup.from;
+		if (!(asField in projection)) projection[asField] = 1;
+	}
+	return projection;
+}
+/**
+* Append the shared pipeline tail: `$lookup` stages, `$ifNull` coalescing
+* for `single` lookups, and the final `$project` (with cursor fields kept
+* when a keyset sort is active). Mutates `pipeline` in place — it is the
+* tail-builder both the keyset and offset modes share.
+*/
+function appendLookupStages(pipeline, lookups, projection, keysetSort) {
+	pipeline.push(...LookupBuilder.multiple(lookups));
+	for (const lookup of lookups) if (lookup.single) {
+		const asField = lookup.as || lookup.from;
+		pipeline.push({ $addFields: { [asField]: { $ifNull: [`$${asField}`, null] } } });
+	}
+	const finalProjection = ensureLookupProjectionIncludesCursorFields(projection, keysetSort);
+	if (finalProjection) pipeline.push({ $project: finalProjection });
+}
+//#endregion
 //#region src/tx-bound.ts
 /**
 * Map of session-aware method name → positional index of the `{ session }`
@@ -1680,13 +1733,6 @@ function isTransactionUnsupported(error) {
 }
 //#endregion
 //#region src/Repository.ts
-function ensureLookupProjectionIncludesCursorFields(projection, sort) {
-	if (!projection || !sort) return projection;
-	if (!Object.values(projection).some((value) => value === 1)) return projection;
-	const nextProjection = { ...projection };
-	for (const field of [...Object.keys(sort), "_id"]) nextProjection[field] = 1;
-	return nextProjection;
-}
 /**
 * Validates that an update patch is homogeneous — either all top-level
 * keys are `$`-prefixed Mongo operators OR none are. Mixed shapes (e.g.
@@ -3423,6 +3469,15 @@ var Repository = class extends RepositoryBase {
 	* Routes through the hook system for policy enforcement
 	* (multi-tenant, soft-delete).
 	*
+	* The pipeline parameter also accepts `readonly unknown[]` (3.25.0):
+	* real-world stage arrays are assembled from exported fragment builders
+	* and spreads whose element type degrades to `unknown` — mongoose's
+	* `PipelineStage` union can't be satisfied without an `as` at every
+	* such call site. Runtime validation is MongoDB's job either way; the
+	* single documented widening lives HERE instead of N host-side casts
+	* (spine PACKAGE_RULES §7.1). Literal arrays still get full
+	* `PipelineStage` contextual checking via the first union member.
+	*
 	* @param pipeline - MongoDB aggregation stage array
 	* @param options  - Aggregation options including governance controls
 	*/
@@ -3748,39 +3803,13 @@ var Repository = class extends RepositoryBase {
 				const pageFromContext = context.page ?? options.page;
 				const isKeyset = !!after || !pageFromContext && !!sort;
 				const countStrategy = context.countStrategy ?? options.countStrategy ?? "exact";
-				const selectSpec = context.select ?? options.select;
-				let projection;
-				if (selectSpec) {
-					if (typeof selectSpec === "string") {
-						projection = {};
-						for (const field of selectSpec.split(",").map((f) => f.trim())) if (field.startsWith("-")) projection[field.substring(1)] = 0;
-						else projection[field] = 1;
-					} else if (Array.isArray(selectSpec)) {
-						projection = {};
-						for (const field of selectSpec) if (field.startsWith("-")) projection[field.substring(1)] = 0;
-						else projection[field] = 1;
-					} else projection = { ...selectSpec };
-					if (projection) {
-						if (Object.values(projection).some((v) => v === 1)) for (const lookup of lookups) {
-							const asField = lookup.as || lookup.from;
-							if (!(asField in projection)) projection[asField] = 1;
-						}
-					}
-				}
-				const appendLookupStages = (pipeline) => {
-					pipeline.push(...LookupBuilder.multiple(lookups));
-					for (const lookup of lookups) if (lookup.single) {
-						const asField = lookup.as || lookup.from;
-						pipeline.push({ $addFields: { [asField]: { $ifNull: [`$${asField}`, null] } } });
-					}
-					const finalProjection = ensureLookupProjectionIncludesCursorFields(projection, isKeyset && sort ? this._parseSort(sort) : void 0);
-					if (finalProjection) pipeline.push({ $project: finalProjection });
-				};
+				const projection = buildLookupProjection(context.select ?? options.select, lookups);
+				const appendLookupStages$2 = (pipeline) => appendLookupStages(pipeline, lookups, projection, isKeyset && sort ? this._parseSort(sort) : void 0);
 				if (isKeyset && sort) {
 					const parsedSort = this._parseSort(sort);
-					const { validateKeysetSort } = await import("./PaginationEngine-BT1ywu9k.mjs").then((n) => n.n);
-					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-BT1ywu9k.mjs").then((n) => n.r);
-					const { getPrimaryField } = await import("./PaginationEngine-BT1ywu9k.mjs").then((n) => n.n);
+					const { validateKeysetSort } = await import("./PaginationEngine-CczbvCAq.mjs").then((n) => n.n);
+					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-CczbvCAq.mjs").then((n) => n.r);
+					const { getPrimaryField } = await import("./PaginationEngine-CczbvCAq.mjs").then((n) => n.n);
 					const normalizedSort = validateKeysetSort(parsedSort, this._pagination.config.strictKeysetSortFields);
 					const cursorVersion = this._pagination.config.cursorVersion ?? 1;
 					const minCursorVersion = this._pagination.config.minCursorVersion ?? 1;
@@ -3794,7 +3823,7 @@ var Repository = class extends RepositoryBase {
 					if (Object.keys(matchFilters).length > 0) pipeline.push({ $match: matchFilters });
 					pipeline.push({ $sort: normalizedSort });
 					pipeline.push({ $limit: limit + 1 });
-					appendLookupStages(pipeline);
+					appendLookupStages$2(pipeline);
 					const aggregation = this.Model.aggregate(pipeline).session(session || null);
 					if (collation) aggregation.collation(collation);
 					if (readPref) aggregation.read(readPref);
@@ -3823,7 +3852,7 @@ var Repository = class extends RepositoryBase {
 				if (sort) dataPipeline.push({ $sort: this._parseSort(sort) });
 				if (countStrategy === "none") {
 					dataPipeline.push({ $skip: skip }, { $limit: limit + 1 });
-					appendLookupStages(dataPipeline);
+					appendLookupStages$2(dataPipeline);
 					const aggregation = this.Model.aggregate(dataPipeline).session(session || null);
 					if (collation) aggregation.collation(collation);
 					if (readPref) aggregation.read(readPref);
@@ -3847,7 +3876,7 @@ var Repository = class extends RepositoryBase {
 					return result;
 				}
 				dataPipeline.push({ $skip: skip }, { $limit: limit });
-				appendLookupStages(dataPipeline);
+				appendLookupStages$2(dataPipeline);
 				const countPipeline = [];
 				if (filters && Object.keys(filters).length > 0) countPipeline.push({ $match: filters });
 				countPipeline.push({ $count: "total" });

package/dist/actions/index.d.mts

@@ -1,2 +1,2 @@
-import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-DLQ6pjal.mjs";
+import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-DceInCTX.mjs";
 export { aggregate_d_exports as aggregate, create_d_exports as create, delete_d_exports as deleteActions, read_d_exports as read, update_d_exports as update };

package/dist/adapter/index.d.mts

@@ -59,7 +59,7 @@ interface MongooseAdapterOptions<TDoc = unknown> {
  * `@classytic/repo-core/adapter`.
  */
 declare class MongooseAdapter<TDoc = unknown> implements DataAdapter<TDoc> {
-  readonly type: 'mongoose';
+  readonly type: "mongoose";
   readonly name: string;
   readonly model: Model<TDoc>;
   readonly repository: RepositoryLike<TDoc>;

package/dist/adapter/index.mjs

@@ -1,2 +1,2 @@
-import { n as createMongooseAdapter, r as isMongooseModel, t as MongooseAdapter } from "../adapter-BWgJ_Jdc.mjs";
+import { n as createMongooseAdapter, r as isMongooseModel, t as MongooseAdapter } from "../adapter-CLvUHiTW.mjs";
 export { MongooseAdapter, createMongooseAdapter, isMongooseModel };

package/dist/{adapter-BWgJ_Jdc.mjs → adapter-CLvUHiTW.mjs}

@@ -1,5 +1,5 @@
 import { n as warn } from "./logger-K7dPmu2U.mjs";
-import { t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-CVnrKFDq.mjs";
+import { t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-CByt1VhQ.mjs";
 import { matchesRecordFilter } from "@classytic/repo-core/filter";
 import { mergeFieldRuleConstraints } from "@classytic/repo-core/schema";
 import { asRepositoryLike, isRepository } from "@classytic/repo-core/adapter";

package/dist/ai/index.d.mts

@@ -1,4 +1,4 @@
-import { G as Plugin } from "../types-BtMuhoX5.mjs";
+import { l as Plugin } from "../repository-DCHRWRXw.mjs";
 import { PipelineStage } from "mongoose";
 //#region src/ai/types.d.ts
 /** Supported similarity metrics for vector search */

package/dist/better-auth/index.mjs

@@ -1,5 +1,5 @@
-import { n as Repository } from "../Repository-CLQA3sEz.mjs";
-import { n as createMongooseAdapter } from "../adapter-BWgJ_Jdc.mjs";
+import { n as Repository } from "../Repository-KKR8jxfD.mjs";
+import { n as createMongooseAdapter } from "../adapter-CLvUHiTW.mjs";
 import { pluralizeBetterAuthCollection, resolveBetterAuthCollections } from "@classytic/repo-core/better-auth";
 //#region src/better-auth/index.ts
 /**

package/dist/core-62oo3N1C.d.mts

@@ -0,0 +1,50 @@
+import { Document, Model, PopulateOptions, Types } from "mongoose";
+//#region src/types/core.d.ts
+/**
+ * Core query/document primitives shared across every mongokit module —
+ * sort/select/populate/filter specs and the mongoose-facing aliases.
+ *
+ * Also the home of the `softRequired` Mongoose declaration merge (this file
+ * is loaded by every module, so the augmentation is always in the program).
+ */
+/**
+ * Global declaration merge: adds `softRequired` to Mongoose's SchemaTypeOptions
+ * so consumers can annotate paths type-safely without importing anything.
+ *
+ * A path with `softRequired: true` keeps its DB-level `required: true`
+ * invariant but is excluded from the auto-generated CRUD body `required[]`
+ * array (see buildCrudSchemasFromModel).
+ */
+declare module 'mongoose' {
+  interface SchemaTypeOptions<T, EnforcedDocType = any, THydratedDocumentType = HydratedDocument<EnforcedDocType>> {
+    /** mongokit: omit from auto-generated CRUD body `required` array. */
+    softRequired?: boolean;
+  }
+}
+/** Read Preference Type for replica sets */
+type ReadPreferenceType = 'primary' | 'primaryPreferred' | 'secondary' | 'secondaryPreferred' | 'nearest' | (string & {});
+/** Re-export mongoose ObjectId */
+type ObjectId = Types.ObjectId;
+/** Generic document type */
+type AnyDocument = Document & Record<string, unknown>;
+/** Generic model type */
+type AnyModel = Model<AnyDocument>;
+/** Sort direction */
+type SortDirection = 1 | -1;
+/** Sort specification for MongoDB queries */
+type SortSpec = Record<string, SortDirection>;
+/** Populate specification */
+type PopulateSpec = string | string[] | PopulateOptions | PopulateOptions[];
+/**
+ * Select specification. `readonly string[]` widens the legacy `string[]`
+ * form to also accept the immutable variant repo-core's contract uses
+ * (`LookupPopulateOptions.select: readonly string[] | Record<string, 0
+ * | 1>`), so `Repository<TDoc>` assigns to `StandardRepo<TDoc>` without
+ * TS2322 on the `select` field. Any existing mutable-array caller stays
+ * compatible — `string[]` is assignable to `readonly string[]`.
+ */
+type SelectSpec = string | readonly string[] | Record<string, 0 | 1>;
+/** Filter query type for MongoDB queries (compatible with Mongoose 8 & 9) */
+type FilterQuery<_T = unknown> = Record<string, unknown>;
+//#endregion
+export { PopulateSpec as a, SortDirection as c, ObjectId as i, SortSpec as l, AnyModel as n, ReadPreferenceType as o, FilterQuery as r, SelectSpec as s, AnyDocument as t };

package/dist/{create-repository-Bx1PpcdF.mjs → create-repository-DA5VJh-3.mjs}

@@ -1,5 +1,5 @@
-import { n as Repository } from "./Repository-CLQA3sEz.mjs";
-import { a as methodRegistryPlugin, d as cachePlugin, f as batchOperationsPlugin, h as auditLogPlugin, i as multiTenantPlugin, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, t as timestampPlugin } from "./timestamp.plugin-BnuuIDqJ.mjs";
+import { n as Repository } from "./Repository-KKR8jxfD.mjs";
+import { a as methodRegistryPlugin, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, i as multiTenantPlugin, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, t as timestampPlugin } from "./timestamp.plugin-B8252GuQ.mjs";
 //#region src/create-repository.ts
 function isLoggerAudit(value) {
 	const v = value;

package/dist/{create-repository-Cn1LkvL7.d.mts → create-repository-HjMD9h9_.d.mts}

@@ -1,12 +1,16 @@
-import { At as LookupOptions, B as ObjectId, H as OperationOptions, J as PopulateSpec, M as LookupPopulateOptions, N as LookupPopulateResult, P as Middleware, Q as RepositoryContext, U as PaginationConfig, X as ReadOptions, Y as PrioritizedHook, Z as ReadPreferenceType, _ as DeleteManyResult, at as SessionOptions, c as CacheableOptions, d as CollationOptions, ft as UpdateManyResult, it as SelectSpec, j as Logger, kt as LookupBuilder, n as AggregatePaginationOptions, nt as RepositoryOptions, p as CreateOptions, pt as UpdateOptions, q as PluginType, st as SoftDeleteOptions, t as AggregateOptions, ut as SortSpec$1, v as DeleteResult, w as FindOneAndUpdateOptions, xt as WithTransactionOptions } from "./types-BtMuhoX5.mjs";
-import { _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions, w as AuditTrailOptions } from "./multi-tenant.plugin-BjXXuc_g.mjs";
-import { t as PaginationEngine } from "./PaginationEngine-BnZ24ehC.mjs";
+import { _ as WithTransactionOptions, a as DeleteManyResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, l as LookupPopulateOptions, m as SessionOptions, o as DeleteResult, p as ReadOptions, r as CacheableOptions, s as FindOneAndUpdateOptions, t as AggregateOptions, u as LookupPopulateResult, v as LookupBuilder, y as LookupOptions } from "./operations-C8IcCHF9.mjs";
+import { a as PopulateSpec, i as ObjectId, l as SortSpec$1, o as ReadPreferenceType, s as SelectSpec } from "./core-62oo3N1C.mjs";
+import { c as PaginationConfig, r as CollationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
+import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-DCHRWRXw.mjs";
+import { T as AuditTrailOptions, _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions } from "./multi-tenant.plugin-DVyVGREb.mjs";
+import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
+import { i as Logger, o as SoftDeleteOptions } from "./plugin-options-vFufQZMZ.mjs";
 import { AggPaginationRequest, AggRequest, AggResult, ArchiveOptions, ArchiveResult, ArchiveSink, ChangeEvent, FilterInput, KeysetAggPaginationResult, QueryOptions, RepoCapabilities, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy, WatchOptions } from "@classytic/repo-core/repository";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
 import { UpdateInput } from "@classytic/repo-core/update";
-import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
 import { HttpError } from "@classytic/repo-core/errors";
+import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
 //#region src/query/AggregationBuilder.d.ts
 /** Options for $vectorSearch stage (Atlas only) */
 interface VectorSearchOptions {
@@ -1486,10 +1490,19 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * Routes through the hook system for policy enforcement
    * (multi-tenant, soft-delete).
    *
+   * The pipeline parameter also accepts `readonly unknown[]` (3.25.0):
+   * real-world stage arrays are assembled from exported fragment builders
+   * and spreads whose element type degrades to `unknown` — mongoose's
+   * `PipelineStage` union can't be satisfied without an `as` at every
+   * such call site. Runtime validation is MongoDB's job either way; the
+   * single documented widening lives HERE instead of N host-side casts
+   * (spine PACKAGE_RULES §7.1). Literal arrays still get full
+   * `PipelineStage` contextual checking via the first union member.
+   *
    * @param pipeline - MongoDB aggregation stage array
    * @param options  - Aggregation options including governance controls
    */
-  aggregatePipeline<TResult = unknown>(pipeline: PipelineStage[], options?: AggregateOptions): Promise<TResult[]>;
+  aggregatePipeline<TResult = unknown>(pipeline: PipelineStage[] | readonly unknown[], options?: AggregateOptions): Promise<TResult[]>;
   /**
    * Paginated kit-native aggregation pipeline. Same mongo-specific
    * scope as `aggregatePipeline` — reach for this when you need

package/dist/{id-resolution-P2OzcyRl.mjs → id-resolution-BqDrk0S2.mjs}

@@ -15,6 +15,17 @@ import mongoose from "mongoose";
 * Design: no `this`, no Model, no DB calls. Only reads `schema.paths._id.instance`.
 */
 /**
+* Null-tolerant `id → ObjectId` coercion — the single seam for optional
+* reference/audit-stamp fields (`approvedBy`, `submittedBy`, …) where an
+* absent actor is a legitimate `null`, not an error. Invalid non-empty
+* strings still throw (mongoose's own constructor validation) — this helper
+* only absorbs the absent case, never bad input. Hosts were hand-rolling
+* this identically at every approval-hook write; import it instead.
+*/
+function toObjectId(id) {
+	return id ? new mongoose.Types.ObjectId(id) : null;
+}
+/**
 * Check if a Mongoose SchemaType `instance` string is an ObjectId variant.
 * Mongoose 9.x uses `'ObjectId'`, older versions use `'ObjectID'`. This
 * is the single source of truth — use it instead of inline
@@ -103,4 +114,4 @@ function idVariants(id) {
 	return [id];
 }
 //#endregion
-export { isValidIdForType as i, idVariants as n, isObjectIdInstance as r, getSchemaIdType as t };
+export { toObjectId as a, isValidIdForType as i, idVariants as n, isObjectIdInstance as r, getSchemaIdType as t };

package/dist/{index-DLQ6pjal.d.mts → index-DceInCTX.d.mts}

@@ -1,4 +1,6 @@
-import { At as LookupOptions, B as ObjectId, H as OperationOptions, I as MinMaxResult, J as PopulateSpec, T as GroupResult, Z as ReadPreferenceType, ft as UpdateManyResult, ht as UpdateWithValidationResult, i as AnyDocument, it as SelectSpec, p as CreateOptions, pt as UpdateOptions, ut as SortSpec, v as DeleteResult, w as FindOneAndUpdateOptions } from "./types-BtMuhoX5.mjs";
+import { c as GroupResult, d as MinMaxResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, o as DeleteResult, s as FindOneAndUpdateOptions, y as LookupOptions } from "./operations-C8IcCHF9.mjs";
+import { a as PopulateSpec, i as ObjectId, l as SortSpec, o as ReadPreferenceType, s as SelectSpec, t as AnyDocument } from "./core-62oo3N1C.mjs";
+import { p as UpdateWithValidationResult } from "./type-utils-CLzRFtIA.mjs";
 import { Model, PipelineStage } from "mongoose";
 declare namespace aggregate_d_exports {
   export { aggregate, aggregatePaginate, average, countBy, distinct, facet, groupBy, lookup, minMax, sum, unwind };